@node9/policy-engine 2.14.1 → 2.14.3

package/dist/index.d.mts

@@ -571,6 +571,19 @@ interface PolicyVerdict {
     matchedField?: string;
     matchedWord?: string;
     tier?: 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    /**
+     * False when NO human may override this verdict: the SSRF tier-1 floors,
+     * whose own reason string already tells the user "This address cannot be
+     * allowlisted". Absent means an override is a legitimate product decision,
+     * which is every other verdict.
+     *
+     * It exists because the host downgrades a hard block into a review whenever a
+     * human approver is reachable (orchestrator.ts, `mayDowngrade`). That is right
+     * for a smart-rule block and wrong for a floor, and the host could not tell
+     * the two apart: `overridable` was computed in egress/ssrf.ts, rendered into
+     * the reason sentence, and then dropped here.
+     */
+    overridable?: boolean;
     ruleName?: string;
     /** State predicates from the matched smart rule (only when decision is 'block'). */
     dependsOnStatePredicates?: string[];
@@ -647,6 +660,27 @@ declare function validateRegex(pattern: string): string | null;
  */
 declare function getCompiledRegex(pattern: string, flags?: string): RegExp | null;
 
+/** See TERMINAL_ESCAPE_RE. Keeps tab, newline and carriage return. */
+declare function stripTerminalEscapes(s: string): string;
+/** See CONTROL_CHAR_RE. Removes every C0 control and DEL, whitespace included. */
+declare function stripControlChars(s: string): string;
+/**
+ * One safe line, for any string that came from outside this process before it
+ * reaches a terminal or a log file.
+ *
+ * node9's terminal output IS the user's trust signal: a "connected and
+ * governed" line is what tells someone the machine is protected. A response
+ * field carrying CR plus SGR codes can paint a line that looks exactly like
+ * one of ours, and a newline in a value written to hook-debug.log forges a
+ * second journal entry. So: escape sequences removed, all whitespace collapsed
+ * to single spaces (one value can never become two lines), and a length cap so
+ * a hostile or broken peer cannot flood the log.
+ *
+ * Accepts unknown because most call sites hold a caught `error` or an optional
+ * response field.
+ */
+declare function safeMessage(value: unknown, max?: number): string;
+
 interface ShieldDefinition {
     name: string;
     description: string;
@@ -1058,6 +1092,11 @@ interface BlastSummary {
     /** Number of env vars flagged as credentials. No keys included. */
     envExposureCount: number;
 }
+/**
+ * Longest path `truncateBlastPath` will look at, tail-anchored. PATH_MAX is
+ * 4096 on Linux, so anything past this is not a path we could have read.
+ */
+declare const MAX_BLAST_PATH = 4096;
 /**
  * Sanitise a sensitive path for transmission. Keeps only the trailing 2
  * segments — enough to identify the kind of file ("~/.aws/credentials"
@@ -1306,7 +1345,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v15";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "5dad4c8f07121f6c";
+declare const CANONICAL_EXTRACTOR_HASH = "2823cd6a54a1fca7";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -1426,4 +1465,4 @@ declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, NET_BINARIES, PATTERN_VERB_NAMES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, fileOperandFlagsOf, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, patternShapeOf, positionedArgs, previewArgs, redactText, resolvePinned, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, MAX_BLAST_PATH, NET_BINARIES, PATTERN_VERB_NAMES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, fileOperandFlagsOf, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, patternShapeOf, positionedArgs, previewArgs, redactText, resolvePinned, safeMessage, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, stripControlChars, stripTerminalEscapes, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -571,6 +571,19 @@ interface PolicyVerdict {
     matchedField?: string;
     matchedWord?: string;
     tier?: 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    /**
+     * False when NO human may override this verdict: the SSRF tier-1 floors,
+     * whose own reason string already tells the user "This address cannot be
+     * allowlisted". Absent means an override is a legitimate product decision,
+     * which is every other verdict.
+     *
+     * It exists because the host downgrades a hard block into a review whenever a
+     * human approver is reachable (orchestrator.ts, `mayDowngrade`). That is right
+     * for a smart-rule block and wrong for a floor, and the host could not tell
+     * the two apart: `overridable` was computed in egress/ssrf.ts, rendered into
+     * the reason sentence, and then dropped here.
+     */
+    overridable?: boolean;
     ruleName?: string;
     /** State predicates from the matched smart rule (only when decision is 'block'). */
     dependsOnStatePredicates?: string[];
@@ -647,6 +660,27 @@ declare function validateRegex(pattern: string): string | null;
  */
 declare function getCompiledRegex(pattern: string, flags?: string): RegExp | null;
 
+/** See TERMINAL_ESCAPE_RE. Keeps tab, newline and carriage return. */
+declare function stripTerminalEscapes(s: string): string;
+/** See CONTROL_CHAR_RE. Removes every C0 control and DEL, whitespace included. */
+declare function stripControlChars(s: string): string;
+/**
+ * One safe line, for any string that came from outside this process before it
+ * reaches a terminal or a log file.
+ *
+ * node9's terminal output IS the user's trust signal: a "connected and
+ * governed" line is what tells someone the machine is protected. A response
+ * field carrying CR plus SGR codes can paint a line that looks exactly like
+ * one of ours, and a newline in a value written to hook-debug.log forges a
+ * second journal entry. So: escape sequences removed, all whitespace collapsed
+ * to single spaces (one value can never become two lines), and a length cap so
+ * a hostile or broken peer cannot flood the log.
+ *
+ * Accepts unknown because most call sites hold a caught `error` or an optional
+ * response field.
+ */
+declare function safeMessage(value: unknown, max?: number): string;
+
 interface ShieldDefinition {
     name: string;
     description: string;
@@ -1058,6 +1092,11 @@ interface BlastSummary {
     /** Number of env vars flagged as credentials. No keys included. */
     envExposureCount: number;
 }
+/**
+ * Longest path `truncateBlastPath` will look at, tail-anchored. PATH_MAX is
+ * 4096 on Linux, so anything past this is not a path we could have read.
+ */
+declare const MAX_BLAST_PATH = 4096;
 /**
  * Sanitise a sensitive path for transmission. Keeps only the trailing 2
  * segments — enough to identify the kind of file ("~/.aws/credentials"
@@ -1306,7 +1345,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v15";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "5dad4c8f07121f6c";
+declare const CANONICAL_EXTRACTOR_HASH = "2823cd6a54a1fca7";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -1426,4 +1465,4 @@ declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, NET_BINARIES, PATTERN_VERB_NAMES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, fileOperandFlagsOf, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, patternShapeOf, positionedArgs, previewArgs, redactText, resolvePinned, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, MAX_BLAST_PATH, NET_BINARIES, PATTERN_VERB_NAMES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, fileOperandFlagsOf, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, patternShapeOf, positionedArgs, previewArgs, redactText, resolvePinned, safeMessage, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, stripControlChars, stripTerminalEscapes, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.js

@@ -51,6 +51,7 @@ __export(src_exports, {
   LONG_OUTPUT_THRESHOLD_BYTES: () => LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS: () => LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE: () => LOOP_THRESHOLD_FOR_WASTE,
+  MAX_BLAST_PATH: () => MAX_BLAST_PATH,
   NET_BINARIES: () => NET_BINARIES,
   PATTERN_VERB_NAMES: () => PATTERN_VERB_NAMES,
   PRIVILEGE_ESCALATION_RE: () => PRIVILEGE_ESCALATION_RE,
@@ -114,6 +115,7 @@ __export(src_exports, {
   previewArgs: () => previewArgs,
   redactText: () => redactText,
   resolvePinned: () => resolvePinned,
+  safeMessage: () => safeMessage,
   sampleCopyCommand: () => sampleCopyCommand,
   scanArgs: () => scanArgs,
   scanInjection: () => scanInjection,
@@ -122,6 +124,8 @@ __export(src_exports, {
   ssrfDestinationFloor: () => ssrfDestinationFloor,
   ssrfFloor: () => ssrfFloor,
   ssrfReason: () => ssrfReason,
+  stripControlChars: () => stripControlChars,
+  stripTerminalEscapes: () => stripTerminalEscapes,
   summarizeBlast: () => summarizeBlast,
   summarizeScan: () => summarizeScan,
   toScanFinding: () => toScanFinding,
@@ -4005,7 +4009,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         reason: dest.reason,
         ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
         ruleDescription: dest.reason,
-        tier: 3
+        tier: 3,
+        overridable: dest.overridable
       };
     }
   }
@@ -4154,7 +4159,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
           reason: ssrf.reason,
           ruleName: `ssrf:${ssrf.tier}:${ssrf.binary}:${ssrf.host}`,
           ruleDescription: ssrf.reason,
-          tier: 3
+          tier: 3,
+          overridable: ssrf.overridable
         };
       }
     }
@@ -4279,6 +4285,21 @@ function isIgnoredTool(toolName, config) {
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
 
+// src/utils/safe-text.ts
+var TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+var CONTROL_CHAR_RE = /[\x00-\x1F\x7F]/g;
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
+function stripControlChars(s) {
+  return s.replace(CONTROL_CHAR_RE, "");
+}
+function safeMessage(value, max = 300) {
+  const raw = typeof value === "string" ? value : value instanceof Error ? value.message : String(value ?? "");
+  const s = stripTerminalEscapes(raw).replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+
 // src/shields/index.ts
 var import_safe_regex23 = __toESM(require("safe-regex2"));
 
@@ -5360,9 +5381,13 @@ function computeAgentDeviceScore(opts) {
 }
 
 // src/blast/index.ts
+var MAX_BLAST_PATH = 4096;
 function truncateBlastPath(full) {
   if (!full) return "";
-  const cleaned = full.replace(/[/\\]+$/, "");
+  if (full.length > MAX_BLAST_PATH) full = full.slice(-MAX_BLAST_PATH);
+  let end = full.length;
+  while (end > 0 && (full[end - 1] === "/" || full[end - 1] === "\\")) end--;
+  const cleaned = full.slice(0, end);
   const parts = cleaned.split(/[/\\]+/).filter((p) => p.length > 0);
   if (parts.length <= 2) {
     return cleaned.startsWith("~") && !cleaned.startsWith("~/") ? cleaned : cleaned.startsWith("~/") ? cleaned : parts.join("/");
@@ -5650,7 +5675,7 @@ function matchCanaryArgs(args, values) {
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 var CANONICAL_EXTRACTOR_VERSION = "canonical-v15";
-var CANONICAL_EXTRACTOR_HASH = "5dad4c8f07121f6c";
+var CANONICAL_EXTRACTOR_HASH = "2823cd6a54a1fca7";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -5969,13 +5994,9 @@ function toScanFinding(c) {
     lineIndex: c.lineIndex
   };
 }
-var TERMINAL_ESCAPE_RE = (
-  // eslint-disable-next-line no-control-regex
-  /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g
-);
 function previewArgs(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
-  const s = String(cmd).replace(TERMINAL_ESCAPE_RE, "").replace(/\s+/g, " ").trim();
+  const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
   return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
 }
 function makeFinding(args) {
@@ -6041,6 +6062,7 @@ var ENGINE_VERSION = "1.4.0";
   LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,
+  MAX_BLAST_PATH,
   NET_BINARIES,
   PATTERN_VERB_NAMES,
   PRIVILEGE_ESCALATION_RE,
@@ -6104,6 +6126,7 @@ var ENGINE_VERSION = "1.4.0";
   previewArgs,
   redactText,
   resolvePinned,
+  safeMessage,
   sampleCopyCommand,
   scanArgs,
   scanInjection,
@@ -6112,6 +6135,8 @@ var ENGINE_VERSION = "1.4.0";
   ssrfDestinationFloor,
   ssrfFloor,
   ssrfReason,
+  stripControlChars,
+  stripTerminalEscapes,
   summarizeBlast,
   summarizeScan,
   toScanFinding,

package/dist/index.mjs

@@ -3869,7 +3869,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         reason: dest.reason,
         ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
         ruleDescription: dest.reason,
-        tier: 3
+        tier: 3,
+        overridable: dest.overridable
       };
     }
   }
@@ -4018,7 +4019,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
           reason: ssrf.reason,
           ruleName: `ssrf:${ssrf.tier}:${ssrf.binary}:${ssrf.host}`,
           ruleDescription: ssrf.reason,
-          tier: 3
+          tier: 3,
+          overridable: ssrf.overridable
         };
       }
     }
@@ -4143,6 +4145,21 @@ function isIgnoredTool(toolName, config) {
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
 
+// src/utils/safe-text.ts
+var TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+var CONTROL_CHAR_RE = /[\x00-\x1F\x7F]/g;
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
+function stripControlChars(s) {
+  return s.replace(CONTROL_CHAR_RE, "");
+}
+function safeMessage(value, max = 300) {
+  const raw = typeof value === "string" ? value : value instanceof Error ? value.message : String(value ?? "");
+  const s = stripTerminalEscapes(raw).replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+
 // src/shields/index.ts
 import safeRegex3 from "safe-regex2";
 
@@ -5224,9 +5241,13 @@ function computeAgentDeviceScore(opts) {
 }
 
 // src/blast/index.ts
+var MAX_BLAST_PATH = 4096;
 function truncateBlastPath(full) {
   if (!full) return "";
-  const cleaned = full.replace(/[/\\]+$/, "");
+  if (full.length > MAX_BLAST_PATH) full = full.slice(-MAX_BLAST_PATH);
+  let end = full.length;
+  while (end > 0 && (full[end - 1] === "/" || full[end - 1] === "\\")) end--;
+  const cleaned = full.slice(0, end);
   const parts = cleaned.split(/[/\\]+/).filter((p) => p.length > 0);
   if (parts.length <= 2) {
     return cleaned.startsWith("~") && !cleaned.startsWith("~/") ? cleaned : cleaned.startsWith("~/") ? cleaned : parts.join("/");
@@ -5514,7 +5535,7 @@ function matchCanaryArgs(args, values) {
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 var CANONICAL_EXTRACTOR_VERSION = "canonical-v15";
-var CANONICAL_EXTRACTOR_HASH = "5dad4c8f07121f6c";
+var CANONICAL_EXTRACTOR_HASH = "2823cd6a54a1fca7";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -5833,13 +5854,9 @@ function toScanFinding(c) {
     lineIndex: c.lineIndex
   };
 }
-var TERMINAL_ESCAPE_RE = (
-  // eslint-disable-next-line no-control-regex
-  /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g
-);
 function previewArgs(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
-  const s = String(cmd).replace(TERMINAL_ESCAPE_RE, "").replace(/\s+/g, " ").trim();
+  const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
   return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
 }
 function makeFinding(args) {
@@ -5904,6 +5921,7 @@ export {
   LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,
+  MAX_BLAST_PATH,
   NET_BINARIES,
   PATTERN_VERB_NAMES,
   PRIVILEGE_ESCALATION_RE,
@@ -5967,6 +5985,7 @@ export {
   previewArgs,
   redactText,
   resolvePinned,
+  safeMessage,
   sampleCopyCommand,
   scanArgs,
   scanInjection,
@@ -5975,6 +5994,8 @@ export {
   ssrfDestinationFloor,
   ssrfFloor,
   ssrfReason,
+  stripControlChars,
+  stripTerminalEscapes,
   summarizeBlast,
   summarizeScan,
   toScanFinding,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "2.14.1",
+  "version": "2.14.3",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",