opaque-exec: gate local scripts handed to a script interpreter (C2)

[nicolasesanchez50]

Closes the Lotor C2 confession as delivered: a dangerous command that a gated rule does not catch.

The hole

opaque-exec recognizes a script by its file's extension (SCRIPT_EXT = .ps1|.sh|.bash|.zsh|.bat|.cmd). A local script with any other spelling flows free, though its contents are exactly as unreadable to the gate. Through the unpatched matcher, all of these exit 0 with no receipt:

python /tmp/evil.py python3 script.py node /tmp/evil.js
ruby /tmp/evil.rb perl /tmp/evil.pl php /tmp/evil.php
bash /tmp/deploy sh /tmp/deploy (extensionless shell script)
env python /tmp/evil.py PYTHONPATH=x python3 x.py

This is the deploy-incident class (KNOWN-LIMITS 21): "hands control to a local script the gate cannot read" — one spelling away from source /tmp/deploy.sh, which gates today.

The fix

Recognize the interpreter, not the file suffix. When a segment hands a local file to a known script interpreter (python|python3|node|nodejs|ruby|perl|php|bash|zsh|dash|ksh|sh|pwsh|powershell, after optional inline env assignments and env), opaque-exec fires — a PreToolUse boundary, exactly like ./deploy.sh.

Inline-code flags stay free by design: -c/-e/-m/-r/--code/--eval/--module and their operands are in the command string, visible to every other matcher, so opaque-exec need not own them. The matcher skips ordinary option flags (bash --posix file) then requires a file token.

Failure modes answered (acceptance #3)

• Options before the file: bash --posix /tmp/deploy → gates (flags skipped, file remains)
• Detached/REPL interpreter: bare python → free (no file)
• Flags only: python --version, node -v → free
• Inline code: bash -c "...", python -c "...", node -e "...", python -m http.server → free (code visible in-command)
• which python, echo python /tmp/x.py → free (interpreter not in command position)

Quietness (acceptance #4)

This tightens the gate — it does not quieten it. What it now misses is declared, not hidden: a bare direct execution of an extensionless file (./deploy) could be a compiled binary, and a string matcher cannot tell an ELF from a shebang without reading the file. That class would need a C3-style context resolver (file sniff), which is deliberately out of scope here; the interpreter class is string-distinguishable and is the one this PR closes.

Tests

test/policy-opaque-exec-interpreter.test.js — 24 cases.

• Fail-first proven: against the unpatched matcher, 11 "must gate" cases fail; the 13 "must not gate" cases pass.
• After the fix: 24/24 pass.
• Full policy/selfmod/git-context suites: 235/235 pass (includes egress-query-string, push-implicit-protected, opaque-exec-sep, destructive-dotdot).

[nicolasesanchez50]

Closes the Lotor C2 confession as delivered: a dangerous command that a gated rule does not catch.

The hole

opaque-exec recognizes a script by its file's extension (SCRIPT_EXT = .ps1|.sh|.bash|.zsh|.bat|.cmd). A local script with any other spelling flows free, though its contents are exactly as unreadable to the gate. Through the unpatched matcher, all of these exit 0 with no receipt:

python /tmp/evil.py python3 script.py node /tmp/evil.js
ruby /tmp/evil.rb perl /tmp/evil.pl php /tmp/evil.php
bash /tmp/deploy sh /tmp/deploy (extensionless shell script)
env python /tmp/evil.py PYTHONPATH=x python3 x.py

This is the deploy-incident class (KNOWN-LIMITS 21): "hands control to a local script the gate cannot read" — one spelling away from source /tmp/deploy.sh, which gates today.

The fix

Recognize the interpreter, not the file suffix. When a segment hands a local file to a known script interpreter (python|python3|node|nodejs|ruby|perl|php|bash|zsh|dash|ksh|sh|pwsh|powershell, after optional inline env assignments and env), opaque-exec fires — a PreToolUse boundary, exactly like ./deploy.sh.

Inline-code flags stay free by design: -c/-e/-m/-r/--code/--eval/--module and their operands are in the command string, visible to every other matcher, so opaque-exec need not own them. The matcher skips ordinary option flags (bash --posix file) then requires a file token.

Failure modes answered (acceptance #3)

• Options before the file: bash --posix /tmp/deploy → gates (flags skipped, file remains)
• Detached/REPL interpreter: bare python → free (no file)
• Flags only: python --version, node -v → free
• Inline code: bash -c "...", python -c "...", node -e "...", python -m http.server → free (code visible in-command)
• which python, echo python /tmp/x.py → free (interpreter not in command position)

Quietness (acceptance #4)

This tightens the gate — it does not quieten it. What it now misses is declared, not hidden: a bare direct execution of an extensionless file (./deploy) could be a compiled binary, and a string matcher cannot tell an ELF from a shebang without reading the file. That class would need a C3-style context resolver (file sniff), which is deliberately out of scope here; the interpreter class is string-distinguishable and is the one this PR closes.

Tests

test/policy-opaque-exec-interpreter.test.js — 24 cases.

• Fail-first proven: against the unpatched matcher, 11 "must gate" cases fail; the 13 "must not gate" cases pass.
• After the fix: 24/24 pass.
• Full policy/selfmod/git-context suites: 235/235 pass (includes egress-query-string, push-implicit-protected, opaque-exec-sep, destructive-dotdot).

[nicolasesanchez50]

Closes the Lotor C2 confession as delivered: a dangerous command that a gated rule does not catch.

The hole

opaque-exec recognizes a script by its file's extension (SCRIPT_EXT = .ps1|.sh|.bash|.zsh|.bat|.cmd). A local script with any other spelling flows free, though its contents are exactly as unreadable to the gate. Through the unpatched matcher, all of these exit 0 with no receipt:

python /tmp/evil.py python3 script.py node /tmp/evil.js
ruby /tmp/evil.rb perl /tmp/evil.pl php /tmp/evil.php
bash /tmp/deploy sh /tmp/deploy (extensionless shell script)
env python /tmp/evil.py PYTHONPATH=x python3 x.py

This is the deploy-incident class (KNOWN-LIMITS 21): "hands control to a local script the gate cannot read" — one spelling away from source /tmp/deploy.sh, which gates today.

The fix

Recognize the interpreter, not the file suffix. When a segment hands a local file to a known script interpreter (python|python3|node|nodejs|ruby|perl|php|bash|zsh|dash|ksh|sh|pwsh|powershell, after optional inline env assignments and env), opaque-exec fires — a PreToolUse boundary, exactly like ./deploy.sh.

Inline-code flags stay free by design: -c/-e/-m/-r/--code/--eval/--module and their operands are in the command string, visible to every other matcher, so opaque-exec need not own them. The matcher skips ordinary option flags (bash --posix file) then requires a file token.

Failure modes answered (acceptance #3)

• Options before the file: bash --posix /tmp/deploy → gates (flags skipped, file remains)
• Detached/REPL interpreter: bare python → free (no file)
• Flags only: python --version, node -v → free
• Inline code: bash -c "...", python -c "...", node -e "...", python -m http.server → free (code visible in-command)
• which python, echo python /tmp/x.py → free (interpreter not in command position)

Quietness (acceptance #4)

This tightens the gate — it does not quieten it. What it now misses is declared, not hidden: a bare direct execution of an extensionless file (./deploy) could be a compiled binary, and a string matcher cannot tell an ELF from a shebang without reading the file. That class would need a C3-style context resolver (file sniff), which is deliberately out of scope here; the interpreter class is string-distinguishable and is the one this PR closes.

Tests

test/policy-opaque-exec-interpreter.test.js — 24 cases.

• Fail-first proven: against the unpatched matcher, 11 "must gate" cases fail; the 13 "must not gate" cases pass.
• After the fix: 24/24 pass.
• Full policy/selfmod/git-context suites: 235/235 pass (includes egress-query-string, push-implicit-protected, opaque-exec-sep, destructive-dotdot).

[nicolasesanchez50]

Closes the Lotor C2 confession as delivered: a dangerous command that a gated rule does not catch.

The hole

opaque-exec recognizes a script by its file's extension (SCRIPT_EXT = .ps1|.sh|.bash|.zsh|.bat|.cmd). A local script with any other spelling flows free, though its contents are exactly as unreadable to the gate. Through the unpatched matcher, all of these exit 0 with no receipt:

python /tmp/evil.py python3 script.py node /tmp/evil.js
ruby /tmp/evil.rb perl /tmp/evil.pl php /tmp/evil.php
bash /tmp/deploy sh /tmp/deploy (extensionless shell script)
env python /tmp/evil.py PYTHONPATH=x python3 x.py

This is the deploy-incident class (KNOWN-LIMITS 21): "hands control to a local script the gate cannot read" — one spelling away from source /tmp/deploy.sh, which gates today.

The fix

Recognize the interpreter, not the file suffix. When a segment hands a local file to a known script interpreter (python|python3|node|nodejs|ruby|perl|php|bash|zsh|dash|ksh|sh|pwsh|powershell, after optional inline env assignments and env), opaque-exec fires — a PreToolUse boundary, exactly like ./deploy.sh.

Inline-code flags stay free by design: -c/-e/-m/-r/--code/--eval/--module and their operands are in the command string, visible to every other matcher, so opaque-exec need not own them. The matcher skips ordinary option flags (bash --posix file) then requires a file token.

Failure modes answered (acceptance #3)

• Options before the file: bash --posix /tmp/deploy → gates (flags skipped, file remains)
• Detached/REPL interpreter: bare python → free (no file)
• Flags only: python --version, node -v → free
• Inline code: bash -c "...", python -c "...", node -e "...", python -m http.server → free (code visible in-command)
• which python, echo python /tmp/x.py → free (interpreter not in command position)

Quietness (acceptance #4)

This tightens the gate — it does not quieten it. What it now misses is declared, not hidden: a bare direct execution of an extensionless file (./deploy) could be a compiled binary, and a string matcher cannot tell an ELF from a shebang without reading the file. That class would need a C3-style context resolver (file sniff), which is deliberately out of scope here; the interpreter class is string-distinguishable and is the one this PR closes.

Tests

test/policy-opaque-exec-interpreter.test.js — 24 cases.

• Fail-first proven: against the unpatched matcher, 11 "must gate" cases fail; the 13 "must not gate" cases pass.
• After the fix: 24/24 pass.
• Full policy/selfmod/git-context suites: 235/235 pass (includes egress-query-string, push-implicit-protected, opaque-exec-sep, destructive-dotdot).

[nicolasesanchez50]

Closes the Lotor C2 confession as delivered: a dangerous command that a gated rule does not catch.

The hole

opaque-exec recognizes a script by its file's extension (SCRIPT_EXT = .ps1|.sh|.bash|.zsh|.bat|.cmd). A local script with any other spelling flows free, though its contents are exactly as unreadable to the gate. Through the unpatched matcher, all of these exit 0 with no receipt:

python /tmp/evil.py python3 script.py node /tmp/evil.js
ruby /tmp/evil.rb perl /tmp/evil.pl php /tmp/evil.php
bash /tmp/deploy sh /tmp/deploy (extensionless shell script)
env python /tmp/evil.py PYTHONPATH=x python3 x.py

This is the deploy-incident class (KNOWN-LIMITS 21): "hands control to a local script the gate cannot read" — one spelling away from source /tmp/deploy.sh, which gates today.

The fix

Recognize the interpreter, not the file suffix. When a segment hands a local file to a known script interpreter (python|python3|node|nodejs|ruby|perl|php|bash|zsh|dash|ksh|sh|pwsh|powershell, after optional inline env assignments and env), opaque-exec fires — a PreToolUse boundary, exactly like ./deploy.sh.

Inline-code flags stay free by design: -c/-e/-m/-r/--code/--eval/--module and their operands are in the command string, visible to every other matcher, so opaque-exec need not own them. The matcher skips ordinary option flags (bash --posix file) then requires a file token.

Failure modes answered (acceptance #3)

• Options before the file: bash --posix /tmp/deploy → gates (flags skipped, file remains)
• Detached/REPL interpreter: bare python → free (no file)
• Flags only: python --version, node -v → free
• Inline code: bash -c "...", python -c "...", node -e "...", python -m http.server → free (code visible in-command)
• which python, echo python /tmp/x.py → free (interpreter not in command position)

Quietness (acceptance #4)

This tightens the gate — it does not quieten it. What it now misses is declared, not hidden: a bare direct execution of an extensionless file (./deploy) could be a compiled binary, and a string matcher cannot tell an ELF from a shebang without reading the file. That class would need a C3-style context resolver (file sniff), which is deliberately out of scope here; the interpreter class is string-distinguishable and is the one this PR closes.

Tests

test/policy-opaque-exec-interpreter.test.js — 24 cases.

• Fail-first proven: against the unpatched matcher, 11 "must gate" cases fail; the 13 "must not gate" cases pass.
• After the fix: 24/24 pass.
• Full policy/selfmod/git-context suites: 235/235 pass (includes egress-query-string, push-implicit-protected, opaque-exec-sep, destructive-dotdot).

[nicolasesanchez50]

Closes the Lotor C2 confession as delivered: a dangerous command that a gated rule does not catch.

The hole

opaque-exec recognizes a script by its file's extension (SCRIPT_EXT = .ps1|.sh|.bash|.zsh|.bat|.cmd). A local script with any other spelling flows free, though its contents are exactly as unreadable to the gate. Through the unpatched matcher, all of these exit 0 with no receipt:

python /tmp/evil.py python3 script.py node /tmp/evil.js
ruby /tmp/evil.rb perl /tmp/evil.pl php /tmp/evil.php
bash /tmp/deploy sh /tmp/deploy (extensionless shell script)
env python /tmp/evil.py PYTHONPATH=x python3 x.py

This is the deploy-incident class (KNOWN-LIMITS 21): "hands control to a local script the gate cannot read" — one spelling away from source /tmp/deploy.sh, which gates today.

The fix

Recognize the interpreter, not the file suffix. When a segment hands a local file to a known script interpreter (python|python3|node|nodejs|ruby|perl|php|bash|zsh|dash|ksh|sh|pwsh|powershell, after optional inline env assignments and env), opaque-exec fires — a PreToolUse boundary, exactly like ./deploy.sh.

Inline-code flags stay free by design: -c/-e/-m/-r/--code/--eval/--module and their operands are in the command string, visible to every other matcher, so opaque-exec need not own them. The matcher skips ordinary option flags (bash --posix file) then requires a file token.

Failure modes answered (acceptance #3)

• Options before the file: bash --posix /tmp/deploy → gates (flags skipped, file remains)
• Detached/REPL interpreter: bare python → free (no file)
• Flags only: python --version, node -v → free
• Inline code: bash -c "...", python -c "...", node -e "...", python -m http.server → free (code visible in-command)
• which python, echo python /tmp/x.py → free (interpreter not in command position)

Quietness (acceptance #4)

This tightens the gate — it does not quieten it. What it now misses is declared, not hidden: a bare direct execution of an extensionless file (./deploy) could be a compiled binary, and a string matcher cannot tell an ELF from a shebang without reading the file. That class would need a C3-style context resolver (file sniff), which is deliberately out of scope here; the interpreter class is string-distinguishable and is the one this PR closes.

Tests

test/policy-opaque-exec-interpreter.test.js — 24 cases.

• Fail-first proven: against the unpatched matcher, 11 "must gate" cases fail; the 13 "must not gate" cases pass.
• After the fix: 24/24 pass.
• Full policy/selfmod/git-context suites: 235/235 pass (includes egress-query-string, push-implicit-protected, opaque-exec-sep, destructive-dotdot).

[nicolasesanchez50]

Closes the Lotor C2 confession as delivered: a dangerous command that a gated rule does not catch.

The hole

opaque-exec recognizes a script by its file's extension (SCRIPT_EXT = .ps1|.sh|.bash|.zsh|.bat|.cmd). A local script with any other spelling flows free, though its contents are exactly as unreadable to the gate. Through the unpatched matcher, all of these exit 0 with no receipt:

python /tmp/evil.py python3 script.py node /tmp/evil.js
ruby /tmp/evil.rb perl /tmp/evil.pl php /tmp/evil.php
bash /tmp/deploy sh /tmp/deploy (extensionless shell script)
env python /tmp/evil.py PYTHONPATH=x python3 x.py

This is the deploy-incident class (KNOWN-LIMITS 21): "hands control to a local script the gate cannot read" — one spelling away from source /tmp/deploy.sh, which gates today.

The fix

Recognize the interpreter, not the file suffix. When a segment hands a local file to a known script interpreter (python|python3|node|nodejs|ruby|perl|php|bash|zsh|dash|ksh|sh|pwsh|powershell, after optional inline env assignments and env), opaque-exec fires — a PreToolUse boundary, exactly like ./deploy.sh.

Inline-code flags stay free by design: -c/-e/-m/-r/--code/--eval/--module and their operands are in the command string, visible to every other matcher, so opaque-exec need not own them. The matcher skips ordinary option flags (bash --posix file) then requires a file token.

Failure modes answered (acceptance #3)

• Options before the file: bash --posix /tmp/deploy → gates (flags skipped, file remains)
• Detached/REPL interpreter: bare python → free (no file)
• Flags only: python --version, node -v → free
• Inline code: bash -c "...", python -c "...", node -e "...", python -m http.server → free (code visible in-command)
• which python, echo python /tmp/x.py → free (interpreter not in command position)

Quietness (acceptance #4)

This tightens the gate — it does not quieten it. What it now misses is declared, not hidden: a bare direct execution of an extensionless file (./deploy) could be a compiled binary, and a string matcher cannot tell an ELF from a shebang without reading the file. That class would need a C3-style context resolver (file sniff), which is deliberately out of scope here; the interpreter class is string-distinguishable and is the one this PR closes.

Tests

test/policy-opaque-exec-interpreter.test.js — 24 cases.

• Fail-first proven: against the unpatched matcher, 11 "must gate" cases fail; the 13 "must not gate" cases pass.
• After the fix: 24/24 pass.
• Full policy/selfmod/git-context suites: 235/235 pass (includes egress-query-string, push-implicit-protected, opaque-exec-sep, destructive-dotdot).

[nicolasesanchez50]

Closes the Lotor C2 confession as delivered: a dangerous command that a gated rule does not catch.

The hole

opaque-exec recognizes a script by its file's extension (SCRIPT_EXT = .ps1|.sh|.bash|.zsh|.bat|.cmd). A local script with any other spelling flows free, though its contents are exactly as unreadable to the gate. Through the unpatched matcher, all of these exit 0 with no receipt:

python /tmp/evil.py python3 script.py node /tmp/evil.js
ruby /tmp/evil.rb perl /tmp/evil.pl php /tmp/evil.php
bash /tmp/deploy sh /tmp/deploy (extensionless shell script)
env python /tmp/evil.py PYTHONPATH=x python3 x.py

This is the deploy-incident class (KNOWN-LIMITS 21): "hands control to a local script the gate cannot read" — one spelling away from source /tmp/deploy.sh, which gates today.

The fix

Recognize the interpreter, not the file suffix. When a segment hands a local file to a known script interpreter (python|python3|node|nodejs|ruby|perl|php|bash|zsh|dash|ksh|sh|pwsh|powershell, after optional inline env assignments and env), opaque-exec fires — a PreToolUse boundary, exactly like ./deploy.sh.

Inline-code flags stay free by design: -c/-e/-m/-r/--code/--eval/--module and their operands are in the command string, visible to every other matcher, so opaque-exec need not own them. The matcher skips ordinary option flags (bash --posix file) then requires a file token.

Failure modes answered (acceptance #3)

• Options before the file: bash --posix /tmp/deploy → gates (flags skipped, file remains)
• Detached/REPL interpreter: bare python → free (no file)
• Flags only: python --version, node -v → free
• Inline code: bash -c "...", python -c "...", node -e "...", python -m http.server → free (code visible in-command)
• which python, echo python /tmp/x.py → free (interpreter not in command position)

Quietness (acceptance #4)

This tightens the gate — it does not quieten it. What it now misses is declared, not hidden: a bare direct execution of an extensionless file (./deploy) could be a compiled binary, and a string matcher cannot tell an ELF from a shebang without reading the file. That class would need a C3-style context resolver (file sniff), which is deliberately out of scope here; the interpreter class is string-distinguishable and is the one this PR closes.

Tests

test/policy-opaque-exec-interpreter.test.js — 24 cases.

• Fail-first proven: against the unpatched matcher, 11 "must gate" cases fail; the 13 "must not gate" cases pass.
• After the fix: 24/24 pass.
• Full policy/selfmod/git-context suites: 235/235 pass (includes egress-query-string, push-implicit-protected, opaque-exec-sep, destructive-dotdot).