@node9/policy-engine 1.30.0 → 1.31.0

package/dist/index.d.mts

@@ -165,6 +165,27 @@ declare const AST_FS_REGEX_RULES: Set<string>;
  * the tool-managed cache allow-list. Used to gate `rm -rf` on home paths.
  */
 declare function isProtectedHomePath(rawPath: string): boolean;
+interface ShellDestination {
+    /** Extracted hostname, lowercased (e.g. "evil.com", "10.0.0.5"). */
+    host: string;
+    /** The network binary it belongs to (e.g. "curl"). */
+    binary: string;
+    /** The raw argument token the host came from (for UI / audit). */
+    raw: string;
+}
+/**
+ * Parse a destination host out of a single token. Handles scheme URLs
+ * (`https://h/p`), scheme-less curl targets (`evil.com/p`), `user@host:path`
+ * (scp/ssh), and `host:port`. Returns the lowercased hostname, or null if the
+ * token doesn't resolve to a plausible host. IPv6 literals are out of scope v1.
+ */
+declare function parseDestHost(token: string): string | null;
+/**
+ * AST-extract every network destination host in a shell command. Walks each
+ * CallExpr; for curl/wget/scp/ssh/nc it resolves the destination argument(s)
+ * and parses the host. Deduplicated by host. Pure — no I/O, no DNS.
+ */
+declare function extractShellDestinations(command: string): ShellDestination[];
 declare function analyzeFsOperation(command: string): FsOpVerdict | null;
 interface ShellCommandAnalysis {
     /** First word of every CallExpr — the command names invoked. */
@@ -181,6 +202,39 @@ interface ShellCommandAnalysis {
  */
 declare function analyzeShellCommand(command: string): ShellCommandAnalysis;
 
+interface EgressPolicy {
+    /** Master switch. Default false — opt-in, like dlp.pii. */
+    enabled: boolean;
+    /** Verdict for an UNKNOWN host (not in allow, not in deny, not private). */
+    mode: 'off' | 'review' | 'block';
+    /** Host globs always allowed (e.g. "*.github.com", "api.openai.com"). */
+    allow: string[];
+    /** Host globs always blocked — wins over allow/private. */
+    deny: string[];
+    /** Auto-allow localhost / RFC1918 / *.local. Default true. */
+    allowPrivate: boolean;
+}
+interface EgressVerdict {
+    verdict: 'block' | 'review';
+    host: string;
+    binary: string;
+    reason: string;
+}
+declare const DEFAULT_EGRESS_ALLOWLIST: readonly string[];
+/** Glob host match: "*" = any, "*.x" = apex x + any subdomain, else exact. */
+declare function hostMatches(host: string, pattern: string): boolean;
+/** localhost / loopback / RFC1918 / link-local-ish — never a real exfil target. */
+declare function isPrivateHost(host: string): boolean;
+/**
+ * Evaluate extracted destinations against the egress policy. Precedence per
+ * host: deny (block) > private-allow > allow/default-allow (skip) > unknown
+ * (policy.mode). Returns the most severe actionable verdict across all
+ * destinations — a deny or block-mode-unknown short-circuits; otherwise the
+ * first review; null if everything is allowed (or policy disabled / mode off).
+ * Pure.
+ */
+declare function evaluateEgress(dests: readonly ShellDestination[], policy: EgressPolicy): EgressVerdict | null;
+
 interface PipeChainAnalysis {
     isPipeline: boolean;
     hasSensitiveSource: boolean;
@@ -243,6 +297,9 @@ interface PolicyConfig {
             enabled: boolean;
             scanIgnoredTools: boolean;
         };
+        /** Egress / destination control (GAP-5). Optional for back-compat with
+         *  callers/tests that build a PolicyConfig without it. */
+        egress?: EgressPolicy;
     };
     settings: {
         mode: string;
@@ -777,6 +834,13 @@ type PiiPattern = 'Email' | 'SSN' | 'Phone' | 'Credit Card';
  * per distinct pattern type, never multiple "Email" findings from one input.
  */
 declare function detectPii(text: string): PiiPattern[];
+declare const REALTIME_PII_PATTERNS: readonly PiiPattern[];
+/**
+ * Realtime adapter for detectPii: walks a tool-args value (stringifying
+ * objects/arrays) and returns only the high-signal PII patterns found. Used by
+ * the authorize path to gate SSN / Credit Card in tool arguments. Pure.
+ */
+declare function detectArgsPii(args: unknown): PiiPattern[];
 
 type CanonicalFindingType = 'smart-rule' | 'ast-fs-op' | 'dlp' | 'pii' | 'sensitive-file-read' | 'privilege-escalation' | 'destructive-op' | 'pipe-to-shell' | 'eval-of-remote' | 'loop' | 'long-output-redacted';
 type CanonicalAgent = 'claude' | 'gemini' | 'codex' | 'shell';
@@ -918,7 +982,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "64a6a63a27f4646f";
+declare const CANONICAL_EXTRACTOR_HASH = "dbe0199dae0f29f6";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -945,4 +1009,4 @@ declare function previewArgs(input: Record<string, unknown>, max: number): strin
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, getCompiledRegex, getNestedValue, isBashTool, isIgnoredTool, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, previewArgs, redactText, scanArgs, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, scanArgs, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -165,6 +165,27 @@ declare const AST_FS_REGEX_RULES: Set<string>;
  * the tool-managed cache allow-list. Used to gate `rm -rf` on home paths.
  */
 declare function isProtectedHomePath(rawPath: string): boolean;
+interface ShellDestination {
+    /** Extracted hostname, lowercased (e.g. "evil.com", "10.0.0.5"). */
+    host: string;
+    /** The network binary it belongs to (e.g. "curl"). */
+    binary: string;
+    /** The raw argument token the host came from (for UI / audit). */
+    raw: string;
+}
+/**
+ * Parse a destination host out of a single token. Handles scheme URLs
+ * (`https://h/p`), scheme-less curl targets (`evil.com/p`), `user@host:path`
+ * (scp/ssh), and `host:port`. Returns the lowercased hostname, or null if the
+ * token doesn't resolve to a plausible host. IPv6 literals are out of scope v1.
+ */
+declare function parseDestHost(token: string): string | null;
+/**
+ * AST-extract every network destination host in a shell command. Walks each
+ * CallExpr; for curl/wget/scp/ssh/nc it resolves the destination argument(s)
+ * and parses the host. Deduplicated by host. Pure — no I/O, no DNS.
+ */
+declare function extractShellDestinations(command: string): ShellDestination[];
 declare function analyzeFsOperation(command: string): FsOpVerdict | null;
 interface ShellCommandAnalysis {
     /** First word of every CallExpr — the command names invoked. */
@@ -181,6 +202,39 @@ interface ShellCommandAnalysis {
  */
 declare function analyzeShellCommand(command: string): ShellCommandAnalysis;
 
+interface EgressPolicy {
+    /** Master switch. Default false — opt-in, like dlp.pii. */
+    enabled: boolean;
+    /** Verdict for an UNKNOWN host (not in allow, not in deny, not private). */
+    mode: 'off' | 'review' | 'block';
+    /** Host globs always allowed (e.g. "*.github.com", "api.openai.com"). */
+    allow: string[];
+    /** Host globs always blocked — wins over allow/private. */
+    deny: string[];
+    /** Auto-allow localhost / RFC1918 / *.local. Default true. */
+    allowPrivate: boolean;
+}
+interface EgressVerdict {
+    verdict: 'block' | 'review';
+    host: string;
+    binary: string;
+    reason: string;
+}
+declare const DEFAULT_EGRESS_ALLOWLIST: readonly string[];
+/** Glob host match: "*" = any, "*.x" = apex x + any subdomain, else exact. */
+declare function hostMatches(host: string, pattern: string): boolean;
+/** localhost / loopback / RFC1918 / link-local-ish — never a real exfil target. */
+declare function isPrivateHost(host: string): boolean;
+/**
+ * Evaluate extracted destinations against the egress policy. Precedence per
+ * host: deny (block) > private-allow > allow/default-allow (skip) > unknown
+ * (policy.mode). Returns the most severe actionable verdict across all
+ * destinations — a deny or block-mode-unknown short-circuits; otherwise the
+ * first review; null if everything is allowed (or policy disabled / mode off).
+ * Pure.
+ */
+declare function evaluateEgress(dests: readonly ShellDestination[], policy: EgressPolicy): EgressVerdict | null;
+
 interface PipeChainAnalysis {
     isPipeline: boolean;
     hasSensitiveSource: boolean;
@@ -243,6 +297,9 @@ interface PolicyConfig {
             enabled: boolean;
             scanIgnoredTools: boolean;
         };
+        /** Egress / destination control (GAP-5). Optional for back-compat with
+         *  callers/tests that build a PolicyConfig without it. */
+        egress?: EgressPolicy;
     };
     settings: {
         mode: string;
@@ -777,6 +834,13 @@ type PiiPattern = 'Email' | 'SSN' | 'Phone' | 'Credit Card';
  * per distinct pattern type, never multiple "Email" findings from one input.
  */
 declare function detectPii(text: string): PiiPattern[];
+declare const REALTIME_PII_PATTERNS: readonly PiiPattern[];
+/**
+ * Realtime adapter for detectPii: walks a tool-args value (stringifying
+ * objects/arrays) and returns only the high-signal PII patterns found. Used by
+ * the authorize path to gate SSN / Credit Card in tool arguments. Pure.
+ */
+declare function detectArgsPii(args: unknown): PiiPattern[];
 
 type CanonicalFindingType = 'smart-rule' | 'ast-fs-op' | 'dlp' | 'pii' | 'sensitive-file-read' | 'privilege-escalation' | 'destructive-op' | 'pipe-to-shell' | 'eval-of-remote' | 'loop' | 'long-output-redacted';
 type CanonicalAgent = 'claude' | 'gemini' | 'codex' | 'shell';
@@ -918,7 +982,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "64a6a63a27f4646f";
+declare const CANONICAL_EXTRACTOR_HASH = "dbe0199dae0f29f6";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -945,4 +1009,4 @@ declare function previewArgs(input: Record<string, unknown>, max: number): strin
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, getCompiledRegex, getNestedValue, isBashTool, isIgnoredTool, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, previewArgs, redactText, scanArgs, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, scanArgs, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.js

@@ -36,6 +36,7 @@ __export(src_exports, {
   CANONICAL_EXTRACTOR_HASH: () => CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION: () => CANONICAL_EXTRACTOR_VERSION,
   COST_PER_LOOP_ITER_USD: () => COST_PER_LOOP_ITER_USD,
+  DEFAULT_EGRESS_ALLOWLIST: () => DEFAULT_EGRESS_ALLOWLIST,
   DESTRUCTIVE_OP_RE: () => DESTRUCTIVE_OP_RE,
   DLP_PATTERNS: () => DLP_PATTERNS,
   ENGINE_VERSION: () => ENGINE_VERSION,
@@ -45,6 +46,7 @@ __export(src_exports, {
   LOOP_MAX_RECORDS: () => LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE: () => LOOP_THRESHOLD_FOR_WASTE,
   PRIVILEGE_ESCALATION_RE: () => PRIVILEGE_ESCALATION_RE,
+  REALTIME_PII_PATTERNS: () => REALTIME_PII_PATTERNS,
   SCAN_SIGNAL_WEIGHTS: () => SCAN_SIGNAL_WEIGHTS,
   SENSITIVE_PATH_RE: () => SENSITIVE_PATH_RE,
   SENSITIVE_PATH_REGEXES: () => SENSITIVE_PATH_REGEXES,
@@ -60,9 +62,11 @@ __export(src_exports, {
   computeScanScore: () => computeScanScore,
   computeSecurityScore: () => computeSecurityScore,
   dedupeCanonicalFindings: () => dedupeCanonicalFindings,
+  detectArgsPii: () => detectArgsPii,
   detectDangerousEval: () => detectDangerousEval,
   detectDangerousShellExec: () => detectDangerousShellExec,
   detectPii: () => detectPii,
+  evaluateEgress: () => evaluateEgress,
   evaluateLoopWindow: () => evaluateLoopWindow,
   evaluatePolicy: () => evaluatePolicy,
   evaluateSmartConditions: () => evaluateSmartConditions,
@@ -71,10 +75,13 @@ __export(src_exports, {
   extractNetworkTargets: () => extractNetworkTargets,
   extractPositionalArgs: () => extractPositionalArgs,
   extractSessionLevelFindings: () => extractSessionLevelFindings,
+  extractShellDestinations: () => extractShellDestinations,
   getCompiledRegex: () => getCompiledRegex,
   getNestedValue: () => getNestedValue,
+  hostMatches: () => hostMatches,
   isBashTool: () => isBashTool,
   isIgnoredTool: () => isIgnoredTool,
+  isPrivateHost: () => isPrivateHost,
   isProtectedHomePath: () => isProtectedHomePath,
   isShieldVerdict: () => isShieldVerdict,
   matchSensitivePath: () => matchSensitivePath,
@@ -82,6 +89,7 @@ __export(src_exports, {
   narrativeRuleLabel: () => narrativeRuleLabel,
   normalizeCommandForPolicy: () => normalizeCommandForPolicy,
   parseAllSshHostsFromCommand: () => parseAllSshHostsFromCommand,
+  parseDestHost: () => parseDestHost,
   previewArgs: () => previewArgs,
   redactText: () => redactText,
   scanArgs: () => scanArgs,
@@ -1072,6 +1080,201 @@ function extractLiteralArgs(callExpr) {
   }
   return { name, flags, paths };
 }
+var NET_BINARIES = /* @__PURE__ */ new Set(["curl", "wget", "scp", "ssh", "nc", "ncat", "netcat"]);
+var VALUE_FLAGS = {
+  curl: /* @__PURE__ */ new Set([
+    "-d",
+    "--data",
+    "--data-ascii",
+    "--data-binary",
+    "--data-raw",
+    "--data-urlencode",
+    "-F",
+    "--form",
+    "-H",
+    "--header",
+    "-X",
+    "--request",
+    "-o",
+    "--output",
+    "-T",
+    "--upload-file",
+    "-u",
+    "--user",
+    "-e",
+    "--referer",
+    "-A",
+    "--user-agent",
+    "-b",
+    "--cookie",
+    "-c",
+    "--cookie-jar",
+    "--connect-to",
+    "--resolve",
+    "--cacert",
+    "--cert",
+    "--key",
+    "-x",
+    "--proxy",
+    "-m",
+    "--max-time",
+    "--retry"
+  ]),
+  wget: /* @__PURE__ */ new Set([
+    "-O",
+    "--output-document",
+    "--post-data",
+    "--post-file",
+    "--header",
+    "-U",
+    "--user-agent",
+    "--user",
+    "--password",
+    "-o",
+    "--output-file",
+    "-P",
+    "--directory-prefix",
+    "-t",
+    "--tries",
+    "-T",
+    "--timeout"
+  ]),
+  scp: /* @__PURE__ */ new Set(["-i", "-F", "-l", "-o", "-c", "-S", "-P", "-J", "-D", "-W"]),
+  ssh: /* @__PURE__ */ new Set([
+    "-i",
+    "-p",
+    "-o",
+    "-l",
+    "-F",
+    "-c",
+    "-L",
+    "-R",
+    "-D",
+    "-W",
+    "-b",
+    "-e",
+    "-m",
+    "-O",
+    "-Q",
+    "-S",
+    "-J",
+    "-w",
+    "-B",
+    "-I",
+    "-E"
+  ]),
+  nc: /* @__PURE__ */ new Set(["-p", "-s", "-w", "-X", "-x", "-e", "-g", "-G", "-i", "-O", "-T", "-q", "-m"])
+};
+function resolveWordLiteral(w) {
+  const parts = w?.Parts || [];
+  let s = "";
+  for (const p of parts) {
+    const t = syntax.NodeType(p);
+    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
+    else if (t === "SglQuoted") s += p.Value ?? "";
+    else if (t === "DblQuoted") {
+      const inner = p.Parts || [];
+      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
+      s += inner.map((ip) => ip.Value ?? "").join("");
+    } else {
+      return null;
+    }
+  }
+  return s;
+}
+function parseDestHost(token) {
+  if (!token) return null;
+  let t = token.trim();
+  if (!t || t.startsWith("-")) return null;
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(t)) {
+    try {
+      const h = new URL(t).hostname.toLowerCase();
+      return h || null;
+    } catch {
+      return null;
+    }
+  }
+  const at = t.lastIndexOf("@");
+  if (at >= 0) t = t.slice(at + 1);
+  t = t.split("/")[0];
+  t = t.replace(/:\d+$/, "");
+  t = t.split(":")[0];
+  t = t.toLowerCase();
+  if (t.length > 253) return null;
+  if (t === "localhost") return t;
+  if (/^[a-z0-9.-]+\.[a-z0-9.-]+$/.test(t)) return t;
+  return null;
+}
+function destTokensForBinary(binary, args) {
+  const valueFlags = VALUE_FLAGS[binary] ?? /* @__PURE__ */ new Set();
+  const positionals = [];
+  const urlFlagValues = [];
+  for (let i = 0; i < args.length; i++) {
+    const tok = args[i];
+    if (tok === null) continue;
+    if (tok.startsWith("-")) {
+      if (tok.startsWith("--url=")) {
+        urlFlagValues.push(tok.slice("--url=".length));
+        continue;
+      }
+      if (tok === "--url") {
+        const next = args[i + 1];
+        if (typeof next === "string") urlFlagValues.push(next);
+        i++;
+        continue;
+      }
+      if (tok.includes("=")) continue;
+      if (valueFlags.has(tok)) i++;
+      continue;
+    }
+    positionals.push(tok);
+  }
+  switch (binary) {
+    case "curl":
+    case "wget":
+      return [...urlFlagValues, ...positionals];
+    case "ssh":
+      return positionals.slice(0, 1);
+    case "scp":
+      return positionals.filter((p) => p.includes(":") || p.includes("@"));
+    case "nc":
+    case "ncat":
+    case "netcat":
+      return positionals.slice(0, 1);
+    default:
+      return [];
+  }
+}
+function extractShellDestinations(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const callArgs = n.Args || [];
+      if (callArgs.length === 0) return true;
+      const name = (resolveWordLiteral(callArgs[0]) || "").toLowerCase();
+      if (!NET_BINARIES.has(name)) return true;
+      const rest = callArgs.slice(1).map((a) => resolveWordLiteral(a));
+      for (const raw of destTokensForBinary(name, rest)) {
+        const host = parseDestHost(raw);
+        if (!host) continue;
+        const key = `${name}:${host}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ host, binary: name, raw });
+      }
+      return true;
+    });
+  } catch {
+    return out;
+  }
+  return out;
+}
 var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
@@ -1202,6 +1405,85 @@ function analyzeShellCommand(command) {
   return { actions, paths, allTokens };
 }
 
+// src/egress/index.ts
+var DEFAULT_EGRESS_ALLOWLIST = [
+  "*.github.com",
+  "*.githubusercontent.com",
+  "*.npmjs.org",
+  "pypi.org",
+  "*.pythonhosted.org",
+  "crates.io",
+  "*.crates.io",
+  "rubygems.org",
+  "proxy.golang.org",
+  "sum.golang.org",
+  "*.anthropic.com",
+  "*.openai.com",
+  "*.googleapis.com",
+  "*.docker.io",
+  "*.docker.com",
+  "deb.debian.org",
+  "*.ubuntu.com"
+];
+function hostMatches(host, pattern) {
+  const h = host.toLowerCase();
+  const p = pattern.toLowerCase().trim();
+  if (!p) return false;
+  if (p === "*") return true;
+  if (p.startsWith("*.")) {
+    const suffix = p.slice(2);
+    return h === suffix || h.endsWith("." + suffix);
+  }
+  return h === p;
+}
+function matchesAny(host, patterns) {
+  for (const p of patterns) if (hostMatches(host, p)) return true;
+  return false;
+}
+function isPrivateHost(host) {
+  const h = host.toLowerCase();
+  if (h === "localhost" || h === "0.0.0.0") return true;
+  if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".localhost")) return true;
+  if (/^127\./.test(h)) return true;
+  if (/^10\./.test(h)) return true;
+  if (/^192\.168\./.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
+  return false;
+}
+function evaluateEgress(dests, policy) {
+  if (!policy.enabled) return null;
+  let review = null;
+  for (const d of dests) {
+    if (matchesAny(d.host, policy.deny)) {
+      return {
+        verdict: "block",
+        host: d.host,
+        binary: d.binary,
+        reason: `Egress to ${d.host} is on the deny list.`
+      };
+    }
+    if (policy.allowPrivate && isPrivateHost(d.host)) continue;
+    if (matchesAny(d.host, policy.allow) || matchesAny(d.host, DEFAULT_EGRESS_ALLOWLIST)) continue;
+    if (policy.mode === "block") {
+      return {
+        verdict: "block",
+        host: d.host,
+        binary: d.binary,
+        reason: `Egress to unknown host ${d.host} is blocked (egress policy: block).`
+      };
+    }
+    if (policy.mode === "review" && !review) {
+      review = {
+        verdict: "review",
+        host: d.host,
+        binary: d.binary,
+        reason: `${d.binary} is sending data to an unrecognized host (${d.host}). Approve this destination?`
+      };
+    }
+  }
+  return review;
+}
+
 // src/policy/pipe-chain.ts
 var SOURCE_COMMANDS = /* @__PURE__ */ new Set([
   "cat",
@@ -1795,6 +2077,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost);
     if (ptVerdict) return ptVerdict;
+    if (config.policy.egress?.enabled) {
+      const dests = extractShellDestinations(shellCommand);
+      if (dests.length > 0) {
+        const eg = evaluateEgress(dests, config.policy.egress);
+        if (eg) {
+          return {
+            decision: eg.verdict,
+            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+            reason: eg.reason,
+            ruleName: `egress:${eg.binary}:${eg.host}`,
+            ruleDescription: eg.reason,
+            tier: eg.verdict === "block" ? 3 : 4
+          };
+        }
+      }
+    }
     const firstToken = analyzed.actions[0] ?? "";
     if (["ssh", "scp", "rsync"].includes(firstToken)) {
       const rawTokens = shellCommand.trim().split(/\s+/);
@@ -3014,11 +3312,25 @@ function detectPii(text) {
   if (PII_CC_RE.test(text)) found.add("Credit Card");
   return [...found];
 }
+var REALTIME_PII_PATTERNS = ["SSN", "Credit Card"];
+var MAX_PII_SCAN_BYTES = 1e5;
+function detectArgsPii(args) {
+  if (args === null || args === void 0) return [];
+  let text;
+  try {
+    text = typeof args === "string" ? args : JSON.stringify(args);
+  } catch {
+    return [];
+  }
+  if (typeof text !== "string") return [];
+  if (text.length > MAX_PII_SCAN_BYTES) text = text.slice(0, MAX_PII_SCAN_BYTES);
+  return detectPii(text).filter((p) => REALTIME_PII_PATTERNS.includes(p));
+}
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 var CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
-var CANONICAL_EXTRACTOR_HASH = "64a6a63a27f4646f";
+var CANONICAL_EXTRACTOR_HASH = "dbe0199dae0f29f6";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -3373,6 +3685,7 @@ var ENGINE_VERSION = "1.4.0";
   CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION,
   COST_PER_LOOP_ITER_USD,
+  DEFAULT_EGRESS_ALLOWLIST,
   DESTRUCTIVE_OP_RE,
   DLP_PATTERNS,
   ENGINE_VERSION,
@@ -3382,6 +3695,7 @@ var ENGINE_VERSION = "1.4.0";
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,
   PRIVILEGE_ESCALATION_RE,
+  REALTIME_PII_PATTERNS,
   SCAN_SIGNAL_WEIGHTS,
   SENSITIVE_PATH_RE,
   SENSITIVE_PATH_REGEXES,
@@ -3397,9 +3711,11 @@ var ENGINE_VERSION = "1.4.0";
   computeScanScore,
   computeSecurityScore,
   dedupeCanonicalFindings,
+  detectArgsPii,
   detectDangerousEval,
   detectDangerousShellExec,
   detectPii,
+  evaluateEgress,
   evaluateLoopWindow,
   evaluatePolicy,
   evaluateSmartConditions,
@@ -3408,10 +3724,13 @@ var ENGINE_VERSION = "1.4.0";
   extractNetworkTargets,
   extractPositionalArgs,
   extractSessionLevelFindings,
+  extractShellDestinations,
   getCompiledRegex,
   getNestedValue,
+  hostMatches,
   isBashTool,
   isIgnoredTool,
+  isPrivateHost,
   isProtectedHomePath,
   isShieldVerdict,
   matchSensitivePath,
@@ -3419,6 +3738,7 @@ var ENGINE_VERSION = "1.4.0";
   narrativeRuleLabel,
   normalizeCommandForPolicy,
   parseAllSshHostsFromCommand,
+  parseDestHost,
   previewArgs,
   redactText,
   scanArgs,

package/dist/index.mjs

@@ -973,6 +973,201 @@ function extractLiteralArgs(callExpr) {
   }
   return { name, flags, paths };
 }
+var NET_BINARIES = /* @__PURE__ */ new Set(["curl", "wget", "scp", "ssh", "nc", "ncat", "netcat"]);
+var VALUE_FLAGS = {
+  curl: /* @__PURE__ */ new Set([
+    "-d",
+    "--data",
+    "--data-ascii",
+    "--data-binary",
+    "--data-raw",
+    "--data-urlencode",
+    "-F",
+    "--form",
+    "-H",
+    "--header",
+    "-X",
+    "--request",
+    "-o",
+    "--output",
+    "-T",
+    "--upload-file",
+    "-u",
+    "--user",
+    "-e",
+    "--referer",
+    "-A",
+    "--user-agent",
+    "-b",
+    "--cookie",
+    "-c",
+    "--cookie-jar",
+    "--connect-to",
+    "--resolve",
+    "--cacert",
+    "--cert",
+    "--key",
+    "-x",
+    "--proxy",
+    "-m",
+    "--max-time",
+    "--retry"
+  ]),
+  wget: /* @__PURE__ */ new Set([
+    "-O",
+    "--output-document",
+    "--post-data",
+    "--post-file",
+    "--header",
+    "-U",
+    "--user-agent",
+    "--user",
+    "--password",
+    "-o",
+    "--output-file",
+    "-P",
+    "--directory-prefix",
+    "-t",
+    "--tries",
+    "-T",
+    "--timeout"
+  ]),
+  scp: /* @__PURE__ */ new Set(["-i", "-F", "-l", "-o", "-c", "-S", "-P", "-J", "-D", "-W"]),
+  ssh: /* @__PURE__ */ new Set([
+    "-i",
+    "-p",
+    "-o",
+    "-l",
+    "-F",
+    "-c",
+    "-L",
+    "-R",
+    "-D",
+    "-W",
+    "-b",
+    "-e",
+    "-m",
+    "-O",
+    "-Q",
+    "-S",
+    "-J",
+    "-w",
+    "-B",
+    "-I",
+    "-E"
+  ]),
+  nc: /* @__PURE__ */ new Set(["-p", "-s", "-w", "-X", "-x", "-e", "-g", "-G", "-i", "-O", "-T", "-q", "-m"])
+};
+function resolveWordLiteral(w) {
+  const parts = w?.Parts || [];
+  let s = "";
+  for (const p of parts) {
+    const t = syntax.NodeType(p);
+    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
+    else if (t === "SglQuoted") s += p.Value ?? "";
+    else if (t === "DblQuoted") {
+      const inner = p.Parts || [];
+      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
+      s += inner.map((ip) => ip.Value ?? "").join("");
+    } else {
+      return null;
+    }
+  }
+  return s;
+}
+function parseDestHost(token) {
+  if (!token) return null;
+  let t = token.trim();
+  if (!t || t.startsWith("-")) return null;
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(t)) {
+    try {
+      const h = new URL(t).hostname.toLowerCase();
+      return h || null;
+    } catch {
+      return null;
+    }
+  }
+  const at = t.lastIndexOf("@");
+  if (at >= 0) t = t.slice(at + 1);
+  t = t.split("/")[0];
+  t = t.replace(/:\d+$/, "");
+  t = t.split(":")[0];
+  t = t.toLowerCase();
+  if (t.length > 253) return null;
+  if (t === "localhost") return t;
+  if (/^[a-z0-9.-]+\.[a-z0-9.-]+$/.test(t)) return t;
+  return null;
+}
+function destTokensForBinary(binary, args) {
+  const valueFlags = VALUE_FLAGS[binary] ?? /* @__PURE__ */ new Set();
+  const positionals = [];
+  const urlFlagValues = [];
+  for (let i = 0; i < args.length; i++) {
+    const tok = args[i];
+    if (tok === null) continue;
+    if (tok.startsWith("-")) {
+      if (tok.startsWith("--url=")) {
+        urlFlagValues.push(tok.slice("--url=".length));
+        continue;
+      }
+      if (tok === "--url") {
+        const next = args[i + 1];
+        if (typeof next === "string") urlFlagValues.push(next);
+        i++;
+        continue;
+      }
+      if (tok.includes("=")) continue;
+      if (valueFlags.has(tok)) i++;
+      continue;
+    }
+    positionals.push(tok);
+  }
+  switch (binary) {
+    case "curl":
+    case "wget":
+      return [...urlFlagValues, ...positionals];
+    case "ssh":
+      return positionals.slice(0, 1);
+    case "scp":
+      return positionals.filter((p) => p.includes(":") || p.includes("@"));
+    case "nc":
+    case "ncat":
+    case "netcat":
+      return positionals.slice(0, 1);
+    default:
+      return [];
+  }
+}
+function extractShellDestinations(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const callArgs = n.Args || [];
+      if (callArgs.length === 0) return true;
+      const name = (resolveWordLiteral(callArgs[0]) || "").toLowerCase();
+      if (!NET_BINARIES.has(name)) return true;
+      const rest = callArgs.slice(1).map((a) => resolveWordLiteral(a));
+      for (const raw of destTokensForBinary(name, rest)) {
+        const host = parseDestHost(raw);
+        if (!host) continue;
+        const key = `${name}:${host}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ host, binary: name, raw });
+      }
+      return true;
+    });
+  } catch {
+    return out;
+  }
+  return out;
+}
 var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
@@ -1103,6 +1298,85 @@ function analyzeShellCommand(command) {
   return { actions, paths, allTokens };
 }
 
+// src/egress/index.ts
+var DEFAULT_EGRESS_ALLOWLIST = [
+  "*.github.com",
+  "*.githubusercontent.com",
+  "*.npmjs.org",
+  "pypi.org",
+  "*.pythonhosted.org",
+  "crates.io",
+  "*.crates.io",
+  "rubygems.org",
+  "proxy.golang.org",
+  "sum.golang.org",
+  "*.anthropic.com",
+  "*.openai.com",
+  "*.googleapis.com",
+  "*.docker.io",
+  "*.docker.com",
+  "deb.debian.org",
+  "*.ubuntu.com"
+];
+function hostMatches(host, pattern) {
+  const h = host.toLowerCase();
+  const p = pattern.toLowerCase().trim();
+  if (!p) return false;
+  if (p === "*") return true;
+  if (p.startsWith("*.")) {
+    const suffix = p.slice(2);
+    return h === suffix || h.endsWith("." + suffix);
+  }
+  return h === p;
+}
+function matchesAny(host, patterns) {
+  for (const p of patterns) if (hostMatches(host, p)) return true;
+  return false;
+}
+function isPrivateHost(host) {
+  const h = host.toLowerCase();
+  if (h === "localhost" || h === "0.0.0.0") return true;
+  if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".localhost")) return true;
+  if (/^127\./.test(h)) return true;
+  if (/^10\./.test(h)) return true;
+  if (/^192\.168\./.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
+  return false;
+}
+function evaluateEgress(dests, policy) {
+  if (!policy.enabled) return null;
+  let review = null;
+  for (const d of dests) {
+    if (matchesAny(d.host, policy.deny)) {
+      return {
+        verdict: "block",
+        host: d.host,
+        binary: d.binary,
+        reason: `Egress to ${d.host} is on the deny list.`
+      };
+    }
+    if (policy.allowPrivate && isPrivateHost(d.host)) continue;
+    if (matchesAny(d.host, policy.allow) || matchesAny(d.host, DEFAULT_EGRESS_ALLOWLIST)) continue;
+    if (policy.mode === "block") {
+      return {
+        verdict: "block",
+        host: d.host,
+        binary: d.binary,
+        reason: `Egress to unknown host ${d.host} is blocked (egress policy: block).`
+      };
+    }
+    if (policy.mode === "review" && !review) {
+      review = {
+        verdict: "review",
+        host: d.host,
+        binary: d.binary,
+        reason: `${d.binary} is sending data to an unrecognized host (${d.host}). Approve this destination?`
+      };
+    }
+  }
+  return review;
+}
+
 // src/policy/pipe-chain.ts
 var SOURCE_COMMANDS = /* @__PURE__ */ new Set([
   "cat",
@@ -1696,6 +1970,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost);
     if (ptVerdict) return ptVerdict;
+    if (config.policy.egress?.enabled) {
+      const dests = extractShellDestinations(shellCommand);
+      if (dests.length > 0) {
+        const eg = evaluateEgress(dests, config.policy.egress);
+        if (eg) {
+          return {
+            decision: eg.verdict,
+            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+            reason: eg.reason,
+            ruleName: `egress:${eg.binary}:${eg.host}`,
+            ruleDescription: eg.reason,
+            tier: eg.verdict === "block" ? 3 : 4
+          };
+        }
+      }
+    }
     const firstToken = analyzed.actions[0] ?? "";
     if (["ssh", "scp", "rsync"].includes(firstToken)) {
       const rawTokens = shellCommand.trim().split(/\s+/);
@@ -2915,11 +3205,25 @@ function detectPii(text) {
   if (PII_CC_RE.test(text)) found.add("Credit Card");
   return [...found];
 }
+var REALTIME_PII_PATTERNS = ["SSN", "Credit Card"];
+var MAX_PII_SCAN_BYTES = 1e5;
+function detectArgsPii(args) {
+  if (args === null || args === void 0) return [];
+  let text;
+  try {
+    text = typeof args === "string" ? args : JSON.stringify(args);
+  } catch {
+    return [];
+  }
+  if (typeof text !== "string") return [];
+  if (text.length > MAX_PII_SCAN_BYTES) text = text.slice(0, MAX_PII_SCAN_BYTES);
+  return detectPii(text).filter((p) => REALTIME_PII_PATTERNS.includes(p));
+}
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 var CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
-var CANONICAL_EXTRACTOR_HASH = "64a6a63a27f4646f";
+var CANONICAL_EXTRACTOR_HASH = "dbe0199dae0f29f6";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -3273,6 +3577,7 @@ export {
   CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION,
   COST_PER_LOOP_ITER_USD,
+  DEFAULT_EGRESS_ALLOWLIST,
   DESTRUCTIVE_OP_RE,
   DLP_PATTERNS,
   ENGINE_VERSION,
@@ -3282,6 +3587,7 @@ export {
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,
   PRIVILEGE_ESCALATION_RE,
+  REALTIME_PII_PATTERNS,
   SCAN_SIGNAL_WEIGHTS,
   SENSITIVE_PATH_RE,
   SENSITIVE_PATH_REGEXES,
@@ -3297,9 +3603,11 @@ export {
   computeScanScore,
   computeSecurityScore,
   dedupeCanonicalFindings,
+  detectArgsPii,
   detectDangerousEval,
   detectDangerousShellExec,
   detectPii,
+  evaluateEgress,
   evaluateLoopWindow,
   evaluatePolicy,
   evaluateSmartConditions,
@@ -3308,10 +3616,13 @@ export {
   extractNetworkTargets,
   extractPositionalArgs,
   extractSessionLevelFindings,
+  extractShellDestinations,
   getCompiledRegex,
   getNestedValue,
+  hostMatches,
   isBashTool,
   isIgnoredTool,
+  isPrivateHost,
   isProtectedHomePath,
   isShieldVerdict,
   matchSensitivePath,
@@ -3319,6 +3630,7 @@ export {
   narrativeRuleLabel,
   normalizeCommandForPolicy,
   parseAllSshHostsFromCommand,
+  parseDestHost,
   previewArgs,
   redactText,
   scanArgs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",