@node9/policy-engine 2.9.2 → 2.10.0

package/dist/index.d.mts

@@ -1254,6 +1254,13 @@ declare const SSRF_MAX_HOST = 253;
  * id are stripped here: the caller does NOT strip them (measured).
  */
 declare function normalizeIpLiteral(host: string): string | null;
+/** Is this tier reachable by default, waiting on the `ssrfStrict` knob?
+ *  Exported so the non-shell path asks the SAME question rather than
+ *  approximating it with `overridable`, which is a different property. */
+declare function isStrictGatedTier(tier: SsrfTier): boolean;
+/** The sentence a user reads when the floor stops them. One builder, so the
+ *  shell path and the non-shell path cannot word the same block differently. */
+declare function ssrfReason(m: SsrfMatch, asWritten: string): string;
 /**
  * Classify a destination host. Returns null when it is not a protected address,
  * which means the ordinary egress policy decides. Never throws.
@@ -1288,7 +1295,36 @@ declare function ssrfFloor(tokens: ReadonlyArray<{
     binary: string;
 }>, opts?: SsrfFloorOptions): SsrfVerdict | null;
 
+/**
+ * Tools whose named argument really is a destination the agent is about to
+ * reach. Keyed on the BARE tool name (an `mcp__server__` prefix is stripped
+ * before matching), because the browser tools arrive over MCP.
+ *
+ * Derived from real history, not imagination: walking 240,058 audit entries
+ * produced exactly these argument paths. A tool is here because its network
+ * semantics are declared by its name, not because it happens to carry a key
+ * called `url` (founder call, 2026-09-08: ignore those).
+ *
+ * `[]` in a path means "every element of this array".
+ */
+declare const DESTINATION_ARGS: ReadonlyMap<string, readonly string[]>;
+interface DestinationHit extends SsrfMatch {
+    /** The path that carried it, for the message and the audit row. */
+    argPath: string;
+    host: string;
+    reason: string;
+}
+/**
+ * Judge a non-shell tool call. Returns the first protected destination, or
+ * null. Never throws: this runs on the hook path, where an exception would
+ * break every tool call on the machine.
+ */
+declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
+    ssrfStrict?: boolean;
+    ssrfAllow?: readonly string[];
+}): DestinationHit | null;
+
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfFloor, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -1254,6 +1254,13 @@ declare const SSRF_MAX_HOST = 253;
  * id are stripped here: the caller does NOT strip them (measured).
  */
 declare function normalizeIpLiteral(host: string): string | null;
+/** Is this tier reachable by default, waiting on the `ssrfStrict` knob?
+ *  Exported so the non-shell path asks the SAME question rather than
+ *  approximating it with `overridable`, which is a different property. */
+declare function isStrictGatedTier(tier: SsrfTier): boolean;
+/** The sentence a user reads when the floor stops them. One builder, so the
+ *  shell path and the non-shell path cannot word the same block differently. */
+declare function ssrfReason(m: SsrfMatch, asWritten: string): string;
 /**
  * Classify a destination host. Returns null when it is not a protected address,
  * which means the ordinary egress policy decides. Never throws.
@@ -1288,7 +1295,36 @@ declare function ssrfFloor(tokens: ReadonlyArray<{
     binary: string;
 }>, opts?: SsrfFloorOptions): SsrfVerdict | null;
 
+/**
+ * Tools whose named argument really is a destination the agent is about to
+ * reach. Keyed on the BARE tool name (an `mcp__server__` prefix is stripped
+ * before matching), because the browser tools arrive over MCP.
+ *
+ * Derived from real history, not imagination: walking 240,058 audit entries
+ * produced exactly these argument paths. A tool is here because its network
+ * semantics are declared by its name, not because it happens to carry a key
+ * called `url` (founder call, 2026-09-08: ignore those).
+ *
+ * `[]` in a path means "every element of this array".
+ */
+declare const DESTINATION_ARGS: ReadonlyMap<string, readonly string[]>;
+interface DestinationHit extends SsrfMatch {
+    /** The path that carried it, for the message and the audit row. */
+    argPath: string;
+    host: string;
+    reason: string;
+}
+/**
+ * Judge a non-shell tool call. Returns the first protected destination, or
+ * null. Never throws: this runs on the hook path, where an exception would
+ * break every tool call on the machine.
+ */
+declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
+    ssrfStrict?: boolean;
+    ssrfAllow?: readonly string[];
+}): DestinationHit | null;
+
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfFloor, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.js

@@ -38,6 +38,7 @@ __export(src_exports, {
   CANONICAL_EXTRACTOR_VERSION: () => CANONICAL_EXTRACTOR_VERSION,
   COST_PER_LOOP_ITER_USD: () => COST_PER_LOOP_ITER_USD,
   DEFAULT_EGRESS_ALLOWLIST: () => DEFAULT_EGRESS_ALLOWLIST,
+  DESTINATION_ARGS: () => DESTINATION_ARGS,
   DESTRUCTIVE_OP_RE: () => DESTRUCTIVE_OP_RE,
   DLP_PATTERNS: () => DLP_PATTERNS,
   DLP_SCAN_LIMITS: () => DLP_SCAN_LIMITS,
@@ -93,6 +94,7 @@ __export(src_exports, {
   isProtectedHomePath: () => isProtectedHomePath,
   isShellShapedTool: () => isShellShapedTool,
   isShieldVerdict: () => isShieldVerdict,
+  isStrictGatedTier: () => isStrictGatedTier,
   matchCanary: () => matchCanary,
   matchCanaryArgs: () => matchCanaryArgs,
   matchSensitivePath: () => matchSensitivePath,
@@ -109,7 +111,9 @@ __export(src_exports, {
   scanInjection: () => scanInjection,
   scanText: () => scanText,
   sensitivePathMatch: () => sensitivePathMatch,
+  ssrfDestinationFloor: () => ssrfDestinationFloor,
   ssrfFloor: () => ssrfFloor,
+  ssrfReason: () => ssrfReason,
   summarizeBlast: () => summarizeBlast,
   summarizeScan: () => summarizeScan,
   toScanFinding: () => toScanFinding,
@@ -2866,9 +2870,21 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   // AWS ECS task role
   "168.63.129.16",
   // Azure WireServer
-  "fd00:ec2::254"
+  "fd00:ec2::254",
   // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
 ]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -2891,7 +2907,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -2903,7 +2919,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -2916,7 +2932,7 @@ var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
   multicast: "a multicast address",
-  unspecified: "the unspecified address",
+  unspecified: "the unspecified address, which reaches this host",
   cgnat: "a carrier-grade NAT address",
   private: "a loopback or private address"
 };
@@ -2927,18 +2943,76 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-    return {
-      ...m,
-      host: token,
-      binary,
-      reason: `Blocked: ${token} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== token ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.")
-    };
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
 }
 
+// src/egress/destinations.ts
+var DESTINATION_ARGS = /* @__PURE__ */ new Map([
+  ["webfetch", ["url"]],
+  ["fetch", ["url", "uri"]],
+  ["navigate", ["url"]],
+  ["preview_start", ["url"]],
+  ["browser_batch", ["actions[].input.url"]]
+]);
+function bareToolName(toolName) {
+  const parts = toolName.split("__");
+  return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
+}
+function valuesAt(args, path) {
+  let cursors = [args];
+  for (const rawSegment of path.split(".")) {
+    const isArray = rawSegment.endsWith("[]");
+    const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
+    const next = [];
+    for (const cursor of cursors) {
+      if (cursor === null || typeof cursor !== "object") continue;
+      const child = cursor[key];
+      if (isArray) {
+        if (Array.isArray(child)) next.push(...child);
+      } else if (child !== void 0) {
+        next.push(child);
+      }
+    }
+    cursors = next;
+    if (cursors.length === 0) return [];
+  }
+  return cursors.filter((v) => typeof v === "string");
+}
+function hostOf(value) {
+  try {
+    const u = new URL(value);
+    const h = u.hostname;
+    return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+  } catch {
+    return null;
+  }
+}
+function ssrfDestinationFloor(toolName, args, opts = {}) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return null;
+    const exempt = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
+    for (const path of paths) {
+      for (const value of valuesAt(args, path)) {
+        const host = hostOf(value);
+        if (!host) continue;
+        const m = classifySsrf(host);
+        if (!m) continue;
+        if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+        if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+        return { ...m, argPath: path, host, reason: ssrfReason(m, host) };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // src/policy/index.ts
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
@@ -3052,6 +3126,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest) {
+      return {
+        decision: "block",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason,
+        tier: 3
+      };
+    }
+  }
   if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
@@ -5055,6 +5145,7 @@ var ENGINE_VERSION = "1.4.0";
   CANONICAL_EXTRACTOR_VERSION,
   COST_PER_LOOP_ITER_USD,
   DEFAULT_EGRESS_ALLOWLIST,
+  DESTINATION_ARGS,
   DESTRUCTIVE_OP_RE,
   DLP_PATTERNS,
   DLP_SCAN_LIMITS,
@@ -5110,6 +5201,7 @@ var ENGINE_VERSION = "1.4.0";
   isProtectedHomePath,
   isShellShapedTool,
   isShieldVerdict,
+  isStrictGatedTier,
   matchCanary,
   matchCanaryArgs,
   matchSensitivePath,
@@ -5126,7 +5218,9 @@ var ENGINE_VERSION = "1.4.0";
   scanInjection,
   scanText,
   sensitivePathMatch,
+  ssrfDestinationFloor,
   ssrfFloor,
+  ssrfReason,
   summarizeBlast,
   summarizeScan,
   toScanFinding,

package/dist/index.mjs

@@ -2743,9 +2743,21 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   // AWS ECS task role
   "168.63.129.16",
   // Azure WireServer
-  "fd00:ec2::254"
+  "fd00:ec2::254",
   // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
 ]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -2768,7 +2780,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -2780,7 +2792,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -2793,7 +2805,7 @@ var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
   multicast: "a multicast address",
-  unspecified: "the unspecified address",
+  unspecified: "the unspecified address, which reaches this host",
   cgnat: "a carrier-grade NAT address",
   private: "a loopback or private address"
 };
@@ -2804,18 +2816,76 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-    return {
-      ...m,
-      host: token,
-      binary,
-      reason: `Blocked: ${token} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== token ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.")
-    };
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
 }
 
+// src/egress/destinations.ts
+var DESTINATION_ARGS = /* @__PURE__ */ new Map([
+  ["webfetch", ["url"]],
+  ["fetch", ["url", "uri"]],
+  ["navigate", ["url"]],
+  ["preview_start", ["url"]],
+  ["browser_batch", ["actions[].input.url"]]
+]);
+function bareToolName(toolName) {
+  const parts = toolName.split("__");
+  return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
+}
+function valuesAt(args, path) {
+  let cursors = [args];
+  for (const rawSegment of path.split(".")) {
+    const isArray = rawSegment.endsWith("[]");
+    const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
+    const next = [];
+    for (const cursor of cursors) {
+      if (cursor === null || typeof cursor !== "object") continue;
+      const child = cursor[key];
+      if (isArray) {
+        if (Array.isArray(child)) next.push(...child);
+      } else if (child !== void 0) {
+        next.push(child);
+      }
+    }
+    cursors = next;
+    if (cursors.length === 0) return [];
+  }
+  return cursors.filter((v) => typeof v === "string");
+}
+function hostOf(value) {
+  try {
+    const u = new URL(value);
+    const h = u.hostname;
+    return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+  } catch {
+    return null;
+  }
+}
+function ssrfDestinationFloor(toolName, args, opts = {}) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return null;
+    const exempt = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
+    for (const path of paths) {
+      for (const value of valuesAt(args, path)) {
+        const host = hostOf(value);
+        if (!host) continue;
+        const m = classifySsrf(host);
+        if (!m) continue;
+        if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+        if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+        return { ...m, argPath: path, host, reason: ssrfReason(m, host) };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // src/policy/index.ts
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
@@ -2929,6 +2999,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest) {
+      return {
+        decision: "block",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason,
+        tier: 3
+      };
+    }
+  }
   if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
@@ -4931,6 +5017,7 @@ export {
   CANONICAL_EXTRACTOR_VERSION,
   COST_PER_LOOP_ITER_USD,
   DEFAULT_EGRESS_ALLOWLIST,
+  DESTINATION_ARGS,
   DESTRUCTIVE_OP_RE,
   DLP_PATTERNS,
   DLP_SCAN_LIMITS,
@@ -4986,6 +5073,7 @@ export {
   isProtectedHomePath,
   isShellShapedTool,
   isShieldVerdict,
+  isStrictGatedTier,
   matchCanary,
   matchCanaryArgs,
   matchSensitivePath,
@@ -5002,7 +5090,9 @@ export {
   scanInjection,
   scanText,
   sensitivePathMatch,
+  ssrfDestinationFloor,
   ssrfFloor,
+  ssrfReason,
   summarizeBlast,
   summarizeScan,
   toScanFinding,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "2.9.2",
+  "version": "2.10.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",