@node9/policy-engine 2.8.4 → 2.9.0

package/dist/index.js

@@ -33,6 +33,7 @@ __export(src_exports, {
   AST_FS_REGEX_RULES: () => AST_FS_REGEX_RULES,
   BASH_TOOL_NAMES: () => BASH_TOOL_NAMES,
   BUILTIN_SHIELDS: () => BUILTIN_SHIELDS,
+  CANARY_MIN_LENGTH: () => CANARY_MIN_LENGTH,
   CANONICAL_EXTRACTOR_HASH: () => CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION: () => CANONICAL_EXTRACTOR_VERSION,
   COST_PER_LOOP_ITER_USD: () => COST_PER_LOOP_ITER_USD,
@@ -52,6 +53,7 @@ __export(src_exports, {
   SCAN_SIGNAL_WEIGHTS: () => SCAN_SIGNAL_WEIGHTS,
   SENSITIVE_PATH_RE: () => SENSITIVE_PATH_RE,
   SENSITIVE_PATH_REGEXES: () => SENSITIVE_PATH_REGEXES,
+  SSRF_MAX_HOST: () => SSRF_MAX_HOST,
   analyzeFsOperation: () => analyzeFsOperation,
   analyzePipeChain: () => analyzePipeChain,
   analyzeShellCommand: () => analyzeShellCommand,
@@ -59,6 +61,7 @@ __export(src_exports, {
   classifyAuditEntry: () => classifyAuditEntry,
   classifyRuleSeverity: () => classifyRuleSeverity,
   classifyScanSignal: () => classifyScanSignal,
+  classifySsrf: () => classifySsrf,
   computeAgentDeviceScore: () => computeAgentDeviceScore,
   computeArgsHash: () => computeArgsHash,
   computeBlendedSecurityScore: () => computeBlendedSecurityScore,
@@ -79,6 +82,7 @@ __export(src_exports, {
   extractNetworkTargets: () => extractNetworkTargets,
   extractPositionalArgs: () => extractPositionalArgs,
   extractSessionLevelFindings: () => extractSessionLevelFindings,
+  extractShellDestTokens: () => extractShellDestTokens,
   extractShellDestinations: () => extractShellDestinations,
   getCompiledRegex: () => getCompiledRegex,
   getNestedValue: () => getNestedValue,
@@ -89,10 +93,13 @@ __export(src_exports, {
   isProtectedHomePath: () => isProtectedHomePath,
   isShellShapedTool: () => isShellShapedTool,
   isShieldVerdict: () => isShieldVerdict,
+  matchCanary: () => matchCanary,
+  matchCanaryArgs: () => matchCanaryArgs,
   matchSensitivePath: () => matchSensitivePath,
   matchesPattern: () => matchesPattern,
   narrativeRuleLabel: () => narrativeRuleLabel,
   normalizeCommandForPolicy: () => normalizeCommandForPolicy,
+  normalizeIpLiteral: () => normalizeIpLiteral,
   parseAllSshHostsFromCommand: () => parseAllSshHostsFromCommand,
   parseDestHost: () => parseDestHost,
   previewArgs: () => previewArgs,
@@ -102,6 +109,7 @@ __export(src_exports, {
   scanInjection: () => scanInjection,
   scanText: () => scanText,
   sensitivePathMatch: () => sensitivePathMatch,
+  ssrfFloor: () => ssrfFloor,
   summarizeBlast: () => summarizeBlast,
   summarizeScan: () => summarizeScan,
   toScanFinding: () => toScanFinding,
@@ -116,6 +124,175 @@ module.exports = __toCommonJS(src_exports);
 // src/dlp/index.ts
 var import_safe_regex2 = __toESM(require("safe-regex2"));
 
+// src/scan/checksums.ts
+var import_crypto = require("crypto");
+function validateLuhn(digits) {
+  if (!/^\d+$/.test(digits)) return false;
+  if (digits.length < 12) return false;
+  if (!/[1-9]/.test(digits)) return false;
+  let sum = 0;
+  let double = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (double) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var IBAN_LENGTH = {
+  AD: 24,
+  AE: 23,
+  AL: 28,
+  AT: 20,
+  AZ: 28,
+  BA: 20,
+  BE: 16,
+  BG: 22,
+  BH: 22,
+  BI: 27,
+  BR: 29,
+  BY: 28,
+  CH: 21,
+  CR: 22,
+  CY: 28,
+  CZ: 24,
+  DE: 22,
+  DJ: 27,
+  DK: 18,
+  DO: 28,
+  EE: 20,
+  EG: 29,
+  ES: 24,
+  FI: 18,
+  FK: 18,
+  FO: 18,
+  FR: 27,
+  GB: 22,
+  GE: 22,
+  GI: 23,
+  GL: 18,
+  GR: 27,
+  GT: 28,
+  HN: 28,
+  HR: 21,
+  HU: 28,
+  IE: 22,
+  IL: 23,
+  IQ: 23,
+  IS: 26,
+  IT: 27,
+  JO: 30,
+  KW: 30,
+  KZ: 20,
+  LB: 28,
+  LC: 32,
+  LI: 21,
+  LT: 20,
+  LU: 20,
+  LV: 21,
+  LY: 25,
+  MC: 27,
+  MD: 24,
+  ME: 22,
+  MK: 19,
+  MN: 20,
+  MR: 27,
+  MT: 31,
+  MU: 30,
+  NI: 28,
+  NL: 18,
+  NO: 15,
+  OM: 23,
+  PK: 24,
+  PL: 28,
+  PS: 29,
+  PT: 25,
+  QA: 29,
+  RO: 24,
+  RS: 22,
+  RU: 33,
+  SA: 24,
+  SC: 31,
+  SD: 18,
+  SE: 24,
+  SI: 19,
+  SK: 24,
+  SM: 27,
+  SN: 28,
+  SO: 23,
+  ST: 25,
+  SV: 28,
+  TL: 23,
+  TN: 24,
+  TR: 26,
+  UA: 29,
+  VA: 22,
+  VG: 24,
+  XK: 20,
+  YE: 30
+};
+function validateIban(raw) {
+  const s = raw.replace(/[ -]/g, "").toUpperCase();
+  if (!/^[A-Z]{2}\d{2}/.test(s)) return false;
+  const want = IBAN_LENGTH[s.slice(0, 2)];
+  if (want === void 0 || s.length < want) return false;
+  const iban = s.slice(0, want);
+  if (!/^[A-Z0-9]+$/.test(iban)) return false;
+  const rearranged = iban.slice(4) + iban.slice(0, 4);
+  let mod = 0;
+  for (const ch of rearranged) {
+    const code = ch.charCodeAt(0);
+    const digits = code >= 65 ? String(code - 55) : ch;
+    for (const d of digits) mod = (mod * 10 + (d.charCodeAt(0) - 48)) % 97;
+  }
+  return mod === 1;
+}
+var B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var B58_INDEX = Object.fromEntries(
+  [...B58].map((c, i) => [c, i])
+);
+function validateBase58Check(s) {
+  if (!s) return null;
+  let n = 0n;
+  for (const c of s) {
+    const v = B58_INDEX[c];
+    if (v === void 0) return null;
+    n = n * 58n + BigInt(v);
+  }
+  let hex = n.toString(16);
+  if (hex.length % 2) hex = "0" + hex;
+  let zeros = 0;
+  for (const c of s) {
+    if (c !== "1") break;
+    zeros++;
+  }
+  const bytes = Buffer.concat([
+    Buffer.alloc(zeros),
+    n === 0n ? Buffer.alloc(0) : Buffer.from(hex, "hex")
+  ]);
+  if (bytes.length < 5) return null;
+  const body = bytes.subarray(0, bytes.length - 4);
+  const check = bytes.subarray(bytes.length - 4);
+  const h = (0, import_crypto.createHash)("sha256").update((0, import_crypto.createHash)("sha256").update(body).digest()).digest();
+  return h.subarray(0, 4).equals(check) ? body : null;
+}
+function validateWif(s) {
+  const p = validateBase58Check(s);
+  if (!p || p[0] !== 128) return false;
+  return p.length === 33 || p.length === 34 && p[33] === 1;
+}
+var XPRV_VERSIONS = /* @__PURE__ */ new Set([76066276, 77428856, 78791436]);
+function validateXprv(s) {
+  const p = validateBase58Check(s);
+  if (!p || p.length !== 78) return false;
+  const version = p.readUInt32BE(0);
+  return XPRV_VERSIONS.has(version) && p[45] === 0;
+}
+
 // src/dlp/injection.ts
 var MAX = 1e5;
 var UNTRUSTED_TOOLS = /\b(web_?fetch|web_?search|fetch|curl|wget|browser|http_get|read_url|open_url)\b/i;
@@ -360,6 +537,27 @@ var DLP_PATTERNS = [
     severity: "block",
     keywords: ["sg."]
   },
+  // ── Cryptocurrency private keys (base58check-validated) ───────────────────
+  // Both are anchored with \b on each side: unanchored, `[KL][base58]{51}`
+  // matches INSIDE any longer base58 blob (an xprv, a Solana keypair, a
+  // Monero address). Lookbehind fails safe-regex2; \b is the house style
+  // (see the card regexes). Mainnet only, matching validateWif / validateXprv;
+  // testnet (WIF 0xEF, tprv) is deferred. Cost was measured: the WIF regex
+  // runs on every string (first keyword-less pattern) at 0.024 ms per 100 KB
+  // of prose, so no prefilter is warranted.
+  {
+    name: "Bitcoin WIF Private Key",
+    regex: /\b(?:5[1-9A-HJ-NP-Za-km-z]{50}|[KL][1-9A-HJ-NP-Za-km-z]{51})\b/,
+    severity: "block",
+    validate: validateWif
+  },
+  {
+    name: "Extended Private Key",
+    regex: /\b[xyz]prv[1-9A-HJ-NP-Za-km-z]{107}\b/,
+    severity: "block",
+    keywords: ["xprv", "yprv", "zprv"],
+    validate: validateXprv
+  },
   // ── Private keys (PEM) ────────────────────────────────────────────────────
   {
     name: "Private Key (PEM)",
@@ -724,6 +922,33 @@ var DLP_SCAN_LIMITS = {
   /** Max nesting depth walked; anything deeper is NOT scanned. */
   maxDepth: MAX_DEPTH
 };
+function suppressed(pattern, raw) {
+  if (pattern.validate) {
+    let ok;
+    try {
+      ok = pattern.validate(raw);
+    } catch {
+      ok = true;
+    }
+    return !ok;
+  }
+  if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) return true;
+  if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) return true;
+  return false;
+}
+function firstAcceptedMatch(pattern, text) {
+  const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : pattern.regex.flags + "g";
+  const re = new RegExp(pattern.regex.source, flags);
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (m[0].length === 0) {
+      re.lastIndex = m.index + 1;
+      continue;
+    }
+    if (!suppressed(pattern, m[0])) return m[0];
+  }
+  return null;
+}
 function scanArgs(args, depth = 0, fieldPath = "args") {
   if (depth > MAX_DEPTH || args === null || args === void 0) return null;
   if (Array.isArray(args)) {
@@ -748,18 +973,16 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
       if (pattern.keywords && !pattern.keywords.some((kw) => textLower.includes(kw.toLowerCase()))) {
         continue;
       }
-      if (pattern.regex.test(text)) {
-        const raw = text.match(pattern.regex)?.[0] ?? "";
-        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
-        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
-        const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
-        return {
-          patternName: pattern.name,
-          fieldPath,
-          redactedSample: maskSecret(text, pattern.regex),
-          severity
-        };
-      }
+      const raw = firstAcceptedMatch(pattern, text);
+      if (raw === null) continue;
+      const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
+      return {
+        patternName: pattern.name,
+        fieldPath,
+        // Mask the ACCEPTED token, not the first regex hit in the field.
+        redactedSample: maskSecret(raw, pattern.regex),
+        severity
+      };
     }
     if (text.length < MAX_JSON_PARSE_BYTES) {
       const trimmed = text.trim();
@@ -782,17 +1005,14 @@ function scanText(text) {
     if (pattern.keywords && !pattern.keywords.some((kw) => tLower.includes(kw.toLowerCase()))) {
       continue;
     }
-    if (pattern.regex.test(t)) {
-      const raw = t.match(pattern.regex)?.[0] ?? "";
-      if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
-      if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
-      return {
-        patternName: pattern.name,
-        fieldPath: "response-text",
-        redactedSample: maskSecret(t, pattern.regex),
-        severity: pattern.severity
-      };
-    }
+    const raw = firstAcceptedMatch(pattern, t);
+    if (raw === null) continue;
+    return {
+      patternName: pattern.name,
+      fieldPath: "response-text",
+      redactedSample: maskSecret(raw, pattern.regex),
+      severity: pattern.severity
+    };
   }
   return null;
 }
@@ -806,9 +1026,7 @@ function redactText(text) {
       continue;
     }
     result = result.replace(globalRegex, (match) => {
-      if (DLP_STOPWORDS.some((sw) => match.toLowerCase().includes(sw))) return match;
-      if (pattern.minEntropy !== void 0 && shannonEntropy(match) < pattern.minEntropy)
-        return match;
+      if (suppressed(pattern, match)) return match;
       if (!found.includes(pattern.name)) found.push(pattern.name);
       return `[node9-redacted:${pattern.name}]`;
     });
@@ -876,11 +1094,11 @@ function matchesPattern(text, patterns) {
 var FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function getNestedValue(obj, path) {
   if (!obj || typeof obj !== "object") return null;
-  const segments = path.split(".");
-  for (const seg of segments) {
+  const segments2 = path.split(".");
+  for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
-  return segments.reduce((prev, curr) => prev?.[curr], obj);
+  return segments2.reduce((prev, curr) => prev?.[curr], obj);
 }
 function evaluateSmartConditions(args, rule) {
   if (!rule.conditions || rule.conditions.length === 0) return true;
@@ -1851,6 +2069,50 @@ function extractShellDestinations(command) {
   }
   return out;
 }
+function extractShellDestTokens(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const callArgs = n.Args || [];
+      if (callArgs.length === 0) return true;
+      const name = (resolveWordLiteral(callArgs[0]) || "").toLowerCase();
+      if (!NET_BINARIES.has(name)) return true;
+      const rest = callArgs.slice(1).map((a) => resolveWordLiteral(a));
+      for (const raw of destTokensForBinary(name, rest)) {
+        if (!raw) continue;
+        let tok = raw.trim();
+        const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(tok);
+        const hasScheme = scheme !== null;
+        if (hasScheme) tok = tok.slice(scheme[0].length);
+        tok = tok.split(/[/?#]/)[0];
+        const at = tok.lastIndexOf("@");
+        if (at >= 0) tok = tok.slice(at + 1);
+        if (tok.startsWith("[")) {
+          const close = tok.indexOf("]");
+          if (close > 0) tok = tok.slice(0, close + 1);
+        } else {
+          tok = tok.split(":")[0];
+        }
+        if (!tok) continue;
+        if (!hasScheme && /^\d+$/.test(tok) && Number(tok) < 16777216) continue;
+        const key = `${name}:${tok}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ token: tok, binary: name });
+      }
+      return true;
+    });
+  } catch {
+    return out;
+  }
+  return out;
+}
 var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
@@ -2055,8 +2317,8 @@ function analyzeShellCommand(command) {
   if (allTokens.length === 0) {
     const normalized = command.replace(/\\(.)/g, "$1");
     const sanitized = normalized.replace(/["'<>]/g, " ");
-    const segments = sanitized.split(/[|;&]|\$\(|\)|`/);
-    segments.forEach((segment) => {
+    const segments2 = sanitized.split(/[|;&]|\$\(|\)|`/);
+    segments2.forEach((segment) => {
       const tokens = segment.trim().split(/\s+/).filter(Boolean);
       if (tokens.length > 0) {
         const action = tokens[0].toLowerCase();
@@ -2075,6 +2337,10 @@ function analyzeShellCommand(command) {
 
 // src/egress/index.ts
 var DEFAULT_EGRESS_ALLOWLIST = [
+  // node9's own control plane (api, app, dev-api, staging and the apex).
+  // Without it, turning egress on asks the user to approve node9 itself.
+  // A user `deny` entry still wins over this list, see evaluateEgress.
+  "*.node9.ai",
   "*.github.com",
   "*.githubusercontent.com",
   "*.npmjs.org",
@@ -2219,7 +2485,7 @@ function isSensitivePath(p) {
   return SENSITIVE_PATTERNS.some((re) => re.test(p));
 }
 function splitOnPipe(cmd) {
-  const segments = [];
+  const segments2 = [];
   let current = "";
   let inSingle = false;
   let inDouble = false;
@@ -2232,21 +2498,21 @@ function splitOnPipe(cmd) {
       inDouble = !inDouble;
       current += ch;
     } else if (ch === "|" && !inSingle && !inDouble && cmd[i + 1] !== "|" && (i === 0 || cmd[i - 1] !== "|")) {
-      segments.push(current.trim());
+      segments2.push(current.trim());
       current = "";
     } else {
       current += ch;
     }
   }
-  if (current.trim()) segments.push(current.trim());
-  return segments.filter(Boolean);
+  if (current.trim()) segments2.push(current.trim());
+  return segments2.filter(Boolean);
 }
 function positionalTokens(segment) {
   return segment.split(/\s+/).slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
 }
 function analyzePipeChain(command) {
-  const segments = splitOnPipe(command);
-  if (segments.length < 2) {
+  const segments2 = splitOnPipe(command);
+  if (segments2.length < 2) {
     return {
       isPipeline: false,
       hasSensitiveSource: false,
@@ -2262,7 +2528,7 @@ function analyzePipeChain(command) {
   let hasSensitiveSource = false;
   let hasExternalSink = false;
   let hasObfuscation = false;
-  for (const segment of segments) {
+  for (const segment of segments2) {
     const tokens = segment.split(/\s+/).filter(Boolean);
     if (tokens.length === 0) continue;
     const binary = tokens[0].toLowerCase();
@@ -2302,8 +2568,8 @@ function analyzePipeChain(command) {
 
 // src/policy/flag-tables.ts
 function basename(p) {
-  const segments = p.split(/[\\/]/);
-  return segments[segments.length - 1] || "";
+  const segments2 = p.split(/[\\/]/);
+  return segments2[segments2.length - 1] || "";
 }
 var FLAGS_WITH_VALUES = {
   curl: /* @__PURE__ */ new Set([
@@ -2473,6 +2739,206 @@ function parseAllSshHostsFromCommand(command) {
   return extractAllSshHosts(tokens.slice(1));
 }
 
+// src/egress/ssrf.ts
+var SSRF_MAX_HOST = 253;
+function parseComponent(s) {
+  if (!s) return null;
+  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
+  if (s === "0") return 0;
+  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
+  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
+  return null;
+}
+function parseIpv4(input) {
+  let s = input;
+  if (s.endsWith(".")) s = s.slice(0, -1);
+  if (!s) return null;
+  const parts = s.split(".");
+  if (parts.length > 4) return null;
+  const vals = [];
+  for (const p of parts) {
+    const v = parseComponent(p);
+    if (v === null || !Number.isFinite(v) || v < 0) return null;
+    vals.push(v);
+  }
+  const n = vals.length;
+  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
+  const last = vals[n - 1];
+  const remainingBytes = 4 - (n - 1);
+  const limit = Math.pow(256, remainingBytes);
+  if (last >= limit) return null;
+  let value = last;
+  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
+  if (value > 4294967295) return null;
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function expandIpv6(input) {
+  const s = input.toLowerCase();
+  if (!/^[0-9a-f:.]+$/.test(s)) return null;
+  if ((s.match(/::/g) ?? []).length > 1) return null;
+  let head = s;
+  let tailV4 = null;
+  const lastColon = s.lastIndexOf(":");
+  const afterLast = s.slice(lastColon + 1);
+  if (afterLast.includes(".")) {
+    const dotted = parseIpv4(afterLast);
+    if (!dotted) return null;
+    const o = dotted.split(".").map(Number);
+    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
+    head = s.slice(0, lastColon + 1) + "0";
+  }
+  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
+  const toGroups = (part) => {
+    if (!part) return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const left = toGroups(lhs);
+  if (left === null) return null;
+  let right = [];
+  if (rhs !== null) {
+    const r = toGroups(rhs);
+    if (r === null) return null;
+    right = r;
+  }
+  if (tailV4) {
+    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
+    else left.splice(left.length - 1, 1, ...tailV4);
+  }
+  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
+  if (rhs === null && groups.length !== 8) return null;
+  if (rhs !== null && left.length + right.length > 8) return null;
+  if (groups.length !== 8) return null;
+  return groups;
+}
+function compressIpv6(g) {
+  let bestStart = -1;
+  let bestLen = 0;
+  let i = 0;
+  while (i < 8) {
+    if (g[i] !== 0) {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && g[j] === 0) j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  const hex = g.map((x) => x.toString(16));
+  if (bestLen < 2) return hex.join(":");
+  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
+}
+function normalizeIpLiteral(host) {
+  try {
+    if (typeof host !== "string") return null;
+    let s = host.trim();
+    if (!s || s.length > SSRF_MAX_HOST) return null;
+    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+    const zone = s.indexOf("%");
+    if (zone >= 0) s = s.slice(0, zone);
+    if (!s) return null;
+    if (s.includes(":")) {
+      const g = expandIpv6(s);
+      if (!g) return null;
+      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
+      if (mapped) {
+        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
+      }
+      return compressIpv6(g);
+    }
+    return parseIpv4(s);
+  } catch {
+    return null;
+  }
+}
+var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
+  "169.254.169.254",
+  // AWS / Azure / DigitalOcean / OpenStack IMDS
+  "169.254.170.2",
+  // AWS ECS task role
+  "168.63.129.16",
+  // Azure WireServer
+  "fd00:ec2::254"
+  // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+]);
+var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+var v4Octets = (a) => {
+  const p = a.split(".");
+  return p.length === 4 ? p.map(Number) : null;
+};
+function classifySsrf(host) {
+  try {
+    if (typeof host !== "string" || !host) return null;
+    const lower = host.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host);
+    if (ip === null) {
+      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
+    }
+    const hit = (tier, overridable) => ({
+      tier,
+      overridable,
+      kind: "address",
+      normalized: ip
+    });
+    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
+    const o = v4Octets(ip);
+    if (o) {
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
+      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
+      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
+      if (o[0] === 127) return hit("private", true);
+      if (o[0] === 10) return hit("private", true);
+      if (o[0] === 192 && o[1] === 168) return hit("private", true);
+      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
+      return null;
+    }
+    const g = expandIpv6(ip);
+    if (!g) return null;
+    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if ((g[0] & 65472) === 65152) return hit("link-local", false);
+    if ((g[0] & 65280) === 65280) return hit("multicast", false);
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
+    return null;
+  } catch {
+    return null;
+  }
+}
+var TIER_REASON = {
+  metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
+  "link-local": "a link-local address",
+  multicast: "a multicast address",
+  unspecified: "the unspecified address",
+  cgnat: "a carrier-grade NAT address",
+  private: "a loopback or private address"
+};
+function ssrfFloor(tokens, opts = {}) {
+  const exempt = new Set(
+    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
+  );
+  for (const { token, binary } of tokens) {
+    const m = classifySsrf(token);
+    if (!m) continue;
+    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+    return {
+      ...m,
+      host: token,
+      binary,
+      reason: `Blocked: ${token} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== token ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.")
+    };
+  }
+  return null;
+}
+
 // src/policy/index.ts
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
@@ -2715,6 +3181,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     const builtin = strictestVerdict(candidates);
     if (builtin) return builtin;
+    {
+      const ssrf = ssrfFloor(extractShellDestTokens(shellCommand), {
+        ssrfAllow: config.policy.egress?.ssrfAllow,
+        ssrfStrict: config.policy.egress?.ssrfStrict
+      });
+      if (ssrf) {
+        return {
+          decision: "block",
+          blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+          reason: ssrf.reason,
+          ruleName: `ssrf:${ssrf.tier}:${ssrf.binary}:${ssrf.host}`,
+          ruleDescription: ssrf.reason,
+          tier: 3
+        };
+      }
+    }
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
@@ -3666,11 +4148,11 @@ function assertBuiltinShieldRegexesAreSafe() {
 assertBuiltinShieldRegexesAreSafe();
 
 // src/loop/index.ts
-var import_crypto = __toESM(require("crypto"));
+var import_crypto2 = __toESM(require("crypto"));
 var LOOP_MAX_RECORDS = 500;
 function computeArgsHash(args) {
   const str = JSON.stringify(args ?? "");
-  return import_crypto.default.createHash("sha256").update(str).digest("hex").slice(0, 16);
+  return import_crypto2.default.createHash("sha256").update(str).digest("hex").slice(0, 16);
 }
 function evaluateLoopWindow(records, tool, args, threshold, windowMs, now) {
   const hash = computeArgsHash(args);
@@ -3953,34 +4435,249 @@ var FILE_TOOLS = /* @__PURE__ */ new Set([
 var PII_EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/;
 var PII_SSN_RE = /\b\d{3}-\d{2}-\d{4}\b/;
 var PII_PHONE_RE = /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/;
-var PII_CC_RE = /\b(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2}|6\d{3})[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/;
+var PII_CC16_RE = /\b(?:4\d{3}|5[1-5]\d{2}|6\d{3})[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/;
+var PII_CC15_RE = /\b3[47]\d{2}[-\s]?\d{6}[-\s]?\d{5}\b/;
+var PII_IBAN_RE = /\b[A-Z]{2}\d{2}(?:[A-Z0-9]|[ -][A-Z0-9]){11,30}\b/;
+function hasValidCard(text) {
+  for (const base of [PII_CC16_RE, PII_CC15_RE]) {
+    const re = new RegExp(base.source, "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      if (validateLuhn(m[0].replace(/\D/g, ""))) return true;
+      re.lastIndex = m.index + 1;
+    }
+  }
+  return false;
+}
+function hasValidIban(text) {
+  const re = new RegExp(PII_IBAN_RE.source, "g");
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (validateIban(m[0])) return true;
+    re.lastIndex = m.index + 1;
+  }
+  return false;
+}
 function detectPii(text) {
   const found = /* @__PURE__ */ new Set();
   if (/@/.test(text) && PII_EMAIL_RE.test(text)) found.add("Email");
   if (/-/.test(text) && PII_SSN_RE.test(text)) found.add("SSN");
   if (PII_PHONE_RE.test(text)) found.add("Phone");
-  if (PII_CC_RE.test(text)) found.add("Credit Card");
+  if (hasValidCard(text)) found.add("Credit Card");
+  if (hasValidIban(text)) found.add("IBAN");
   return [...found];
 }
-var REALTIME_PII_PATTERNS = ["SSN", "Credit Card"];
+var REALTIME_PII_PATTERNS = ["SSN", "Credit Card", "IBAN"];
 var MAX_PII_SCAN_BYTES = 1e5;
+function* stringLeaves(v, depth = 0) {
+  if (depth > 6) return;
+  if (typeof v === "string") {
+    if (v.length > 0) yield v;
+    return;
+  }
+  if (typeof v === "number") {
+    if (Number.isFinite(v)) yield String(v);
+    return;
+  }
+  if (!v || typeof v !== "object") return;
+  if (Array.isArray(v)) {
+    for (const x of v) yield* stringLeaves(x, depth + 1);
+    return;
+  }
+  for (const x of Object.values(v)) yield* stringLeaves(x, depth + 1);
+}
 function detectArgsPii(args) {
   if (args === null || args === void 0) return [];
-  let text;
+  const found = /* @__PURE__ */ new Set();
+  let budget = MAX_PII_SCAN_BYTES;
   try {
-    text = typeof args === "string" ? args : JSON.stringify(args);
+    for (const leaf of stringLeaves(args)) {
+      if (budget <= 0) break;
+      const t = leaf.length > budget ? leaf.slice(0, budget) : leaf;
+      budget -= t.length;
+      for (const p of detectPii(t)) {
+        if (REALTIME_PII_PATTERNS.includes(p)) found.add(p);
+      }
+    }
   } catch {
     return [];
   }
-  if (typeof text !== "string") return [];
-  if (text.length > MAX_PII_SCAN_BYTES) text = text.slice(0, MAX_PII_SCAN_BYTES);
-  return detectPii(text).filter((p) => REALTIME_PII_PATTERNS.includes(p));
+  return [...found];
+}
+
+// src/dlp/canary.ts
+var CANARY_MIN_LENGTH = 16;
+var MAX_TEXT = 1e5;
+var MAX_DEPTH2 = 6;
+var MAX_JSON_PARSE = 1e4;
+var URL_DEPTH = 4;
+var B64_DEPTH = 3;
+var MIN_SEGMENT = 16;
+var SEPARATORS = /[./\\?&= \t\n\r:;,\-_@%+#]/g;
+var stripSeparators = (s) => s.replace(SEPARATORS, "");
+function percentDecodeOnce(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s.replace(/%([0-9A-Fa-f]{2})/g, (_, h) => String.fromCharCode(parseInt(h, 16)));
+  }
+}
+function segments(s, alphabet) {
+  const out = /* @__PURE__ */ new Set();
+  if (alphabet.test(s)) out.add(s);
+  for (const seg of s.split(/[?&\s"'<>]+/)) {
+    if (seg.length >= MIN_SEGMENT && alphabet.test(seg)) out.add(seg);
+    for (const part of seg.split("=")) {
+      if (part.length >= MIN_SEGMENT && alphabet.test(part)) out.add(part);
+    }
+  }
+  return [...out];
+}
+var looksText = (s) => s.length > 0 && !/[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(s);
+var CANARY_DECODERS = {
+  url: (s) => {
+    const out = [];
+    let cur = s;
+    for (let i = 0; i < URL_DEPTH; i++) {
+      const d = percentDecodeOnce(cur);
+      if (d === cur) break;
+      out.push(d);
+      cur = d;
+    }
+    return out;
+  },
+  base64: (s) => {
+    const out = [];
+    let frontier = segments(s, /^[A-Za-z0-9+/\-_=]+$/);
+    for (let depth = 0; depth < B64_DEPTH && frontier.length; depth++) {
+      const next = [];
+      for (const c of frontier) {
+        const d = Buffer.from(c, "base64").toString("utf8");
+        if (!looksText(d) || d.length < CANARY_MIN_LENGTH) continue;
+        out.push(d);
+        next.push(...segments(d, /^[A-Za-z0-9+/\-_=]+$/));
+      }
+      frontier = next;
+    }
+    return out;
+  },
+  hex: (s) => {
+    const out = [];
+    for (const c of segments(s, /^[0-9A-Fa-f]+$/)) {
+      if (c.length % 2 !== 0 || c.length < CANARY_MIN_LENGTH * 2) continue;
+      const d = Buffer.from(c, "hex").toString("utf8");
+      if (looksText(d)) out.push(d);
+    }
+    return out;
+  },
+  separators: (s) => [stripSeparators(s)]
+};
+function lowestOffset(cands, needles, stripped) {
+  let best = null;
+  for (const c of cands) {
+    for (const n of needles) {
+      const off = c.indexOf(stripped ? n.stripped : n.raw);
+      if (off >= 0 && (best === null || off < best.off)) best = { off, v: n.v };
+    }
+  }
+  return best?.v ?? null;
+}
+var VIEWS = [
+  { view: "url-decoded", decoder: "url", stripped: false },
+  { view: "base64-decoded", decoder: "base64", stripped: false },
+  { view: "hex-decoded", decoder: "hex", stripped: false },
+  { view: "separators-stripped", decoder: "separators", stripped: true }
+];
+function prepare(values) {
+  const out = [];
+  for (const v of values) {
+    if (typeof v.value !== "string" || v.value.length < CANARY_MIN_LENGTH) {
+      console.error(
+        `[node9 engine] canary ${v.id}: value shorter than ${CANARY_MIN_LENGTH}, skipped`
+      );
+      continue;
+    }
+    out.push({ v, raw: v.value, stripped: stripSeparators(v.value) });
+  }
+  return out;
+}
+function matchPrepared(text, needles) {
+  if (!text || needles.length === 0) return null;
+  const t = text.length > MAX_TEXT ? text.slice(0, MAX_TEXT) : text;
+  const raw = lowestOffset([t], needles, false);
+  if (raw) return { v: raw, view: "raw" };
+  for (const { view, decoder, stripped } of VIEWS) {
+    let cands;
+    try {
+      cands = CANARY_DECODERS[decoder](t);
+    } catch (e) {
+      console.error(
+        `[node9 engine] canary view ${view} failed, skipped:`,
+        e instanceof Error ? e.message : String(e)
+      );
+      continue;
+    }
+    const hit = lowestOffset(cands, needles, stripped);
+    if (hit) return { v: hit, view };
+  }
+  return null;
+}
+function matchCanary(text, values) {
+  if (!text || values.length === 0) return null;
+  const hit = matchPrepared(text, prepare(values));
+  return hit ? { id: hit.v.id, view: hit.view, retired: Boolean(hit.v.retired) } : null;
+}
+function matchCanaryArgs(args, values) {
+  if (values.length === 0) return null;
+  const needles = prepare(values);
+  if (needles.length === 0) return null;
+  const walk = (v, depth, fieldPath) => {
+    if (depth > MAX_DEPTH2) return null;
+    if (typeof v === "string") {
+      const hit = matchPrepared(v, needles);
+      if (hit) return { id: hit.v.id, view: hit.view, fieldPath, retired: Boolean(hit.v.retired) };
+      if (v.length < MAX_JSON_PARSE) {
+        const trimmed = v.trim();
+        if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+          try {
+            return walk(JSON.parse(v), depth + 1, fieldPath);
+          } catch {
+          }
+        }
+      }
+      return null;
+    }
+    if (typeof v === "number" && Number.isFinite(v)) return walk(String(v), depth, fieldPath);
+    if (Array.isArray(v)) {
+      for (let i = 0; i < v.length; i++) {
+        const h = walk(v[i], depth + 1, `${fieldPath}[${i}]`);
+        if (h) return h;
+      }
+      return null;
+    }
+    if (v && typeof v === "object") {
+      for (const [k, child] of Object.entries(v)) {
+        const h = walk(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
+        if (h) return h;
+      }
+    }
+    return null;
+  };
+  try {
+    return walk(args, 0, "");
+  } catch (e) {
+    console.error(
+      "[node9 engine] canary args walk failed:",
+      e instanceof Error ? e.message : String(e)
+    );
+    return null;
+  }
 }
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
-var CANONICAL_EXTRACTOR_HASH = "0d6c1ddb9a5af5b7";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
+var CANONICAL_EXTRACTOR_HASH = "5c786cc174281e51";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -4024,6 +4721,28 @@ function extractCanonicalFindings(call, ctx) {
       );
     }
   }
+  if (ctx.canaryValues && ctx.canaryValues.length > 0) {
+    const hit = matchCanaryArgs(call.args, ctx.canaryValues);
+    if (hit) {
+      const v = ctx.canaryValues.find((x) => x.id === hit.id);
+      out.push(
+        makeFinding({
+          type: "canary",
+          ruleName: `canary:${v?.kind ?? "unknown"}`,
+          patternName: "Decoy credential",
+          verdict: "block",
+          severity: "critical",
+          reason: `Decoy credential planted at ${v?.path ?? "a decoy file"} appeared in ${call.toolName} args (${hit.view})`,
+          toolName: call.toolName,
+          ctx,
+          ts,
+          sourceType: "engine"
+          // No `input`: makeFinding stores it verbatim and a finding must never
+          // carry the value (E14). The wire never copies input anyway.
+        })
+      );
+    }
+  }
   for (const value of stringValues(call.args)) {
     const piiHits = detectPii(value);
     for (const pattern of piiHits) {
@@ -4256,6 +4975,9 @@ function toScanFinding(c) {
     "smart-rule": null,
     "ast-fs-op": null,
     dlp: "dlp",
+    // Ships under the dlp rollup with patternName 'Decoy credential' and a
+    // canary:<kind> ruleName until the SaaS wire type gains its own value.
+    canary: "dlp",
     pii: "pii",
     "sensitive-file-read": "sensitive-file-read",
     "privilege-escalation": "privilege-escalation",
@@ -4328,6 +5050,7 @@ var ENGINE_VERSION = "1.4.0";
   AST_FS_REGEX_RULES,
   BASH_TOOL_NAMES,
   BUILTIN_SHIELDS,
+  CANARY_MIN_LENGTH,
   CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION,
   COST_PER_LOOP_ITER_USD,
@@ -4347,6 +5070,7 @@ var ENGINE_VERSION = "1.4.0";
   SCAN_SIGNAL_WEIGHTS,
   SENSITIVE_PATH_RE,
   SENSITIVE_PATH_REGEXES,
+  SSRF_MAX_HOST,
   analyzeFsOperation,
   analyzePipeChain,
   analyzeShellCommand,
@@ -4354,6 +5078,7 @@ var ENGINE_VERSION = "1.4.0";
   classifyAuditEntry,
   classifyRuleSeverity,
   classifyScanSignal,
+  classifySsrf,
   computeAgentDeviceScore,
   computeArgsHash,
   computeBlendedSecurityScore,
@@ -4374,6 +5099,7 @@ var ENGINE_VERSION = "1.4.0";
   extractNetworkTargets,
   extractPositionalArgs,
   extractSessionLevelFindings,
+  extractShellDestTokens,
   extractShellDestinations,
   getCompiledRegex,
   getNestedValue,
@@ -4384,10 +5110,13 @@ var ENGINE_VERSION = "1.4.0";
   isProtectedHomePath,
   isShellShapedTool,
   isShieldVerdict,
+  matchCanary,
+  matchCanaryArgs,
   matchSensitivePath,
   matchesPattern,
   narrativeRuleLabel,
   normalizeCommandForPolicy,
+  normalizeIpLiteral,
   parseAllSshHostsFromCommand,
   parseDestHost,
   previewArgs,
@@ -4397,6 +5126,7 @@ var ENGINE_VERSION = "1.4.0";
   scanInjection,
   scanText,
   sensitivePathMatch,
+  ssrfFloor,
   summarizeBlast,
   summarizeScan,
   toScanFinding,