@node9/proxy 1.55.1 → 1.56.0

package/dist/index.js

@@ -233,9 +233,9 @@ module.exports = __toCommonJS(src_exports);
 init_audit();
 
 // src/config/index.ts
-var import_fs3 = __toESM(require("fs"));
-var import_path3 = __toESM(require("path"));
-var import_os3 = __toESM(require("os"));
+var import_fs4 = __toESM(require("fs"));
+var import_path4 = __toESM(require("path"));
+var import_os4 = __toESM(require("os"));
 
 // src/config-schema.ts
 var import_zod = require("zod");
@@ -321,6 +321,10 @@ var ConfigFileSchema = import_zod.z.object({
     // approver_set). Default (unset/false): those tools refuse over MCP — a human
     // must run them from the CLI. node9's threat model is the agent itself.
     mcpAllowWeakening: import_zod.z.boolean().optional(),
+    // Auto-wire reconciler (P3 2.6): auto-wrap new ungoverned MCP servers vs
+    // nudge-only (default), and the scan cadence in minutes.
+    mcpAutoWrap: import_zod.z.boolean().optional(),
+    mcpReconcileIntervalMinutes: import_zod.z.number().positive().optional(),
     cloudSyncIntervalHours: import_zod.z.number().positive().optional(),
     // Seconds-granular override for the cloud policy sync cadence. Wins over
     // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
@@ -3555,6 +3559,109 @@ function applyManagedDlp(local, managed, locked) {
   }
   return next;
 }
+function applyManagedApprovers(local, managed) {
+  return {
+    ...local,
+    native: typeof managed.native === "boolean" ? managed.native : local.native,
+    browser: typeof managed.browser === "boolean" ? managed.browser : local.browser,
+    cloud: typeof managed.cloud === "boolean" ? managed.cloud : local.cloud,
+    terminal: typeof managed.terminal === "boolean" ? managed.terminal : local.terminal
+  };
+}
+
+// src/shields/build.ts
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function slug(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "rule";
+}
+var B = "[\\s/\\\\]";
+var SEP = "[/\\\\]";
+function pathToRegexFragment(rawPath) {
+  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
+  const segments = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
+  if (segments.length === 0) return "";
+  return `(^|${B})${segments.join(SEP)}(${B}|$)`;
+}
+function pathRules(rawPath, verdict, reason) {
+  const value = pathToRegexFragment(rawPath);
+  if (!value) return [];
+  const why = reason ?? `Accessing ${rawPath} is restricted by this shield`;
+  const s = slug(rawPath);
+  return [
+    {
+      name: `${verdict}-path-${s}-bash`,
+      tool: "bash",
+      conditions: [{ field: "command", op: "matches", value }],
+      verdict,
+      reason: why
+    },
+    {
+      name: `${verdict}-path-${s}-anytool`,
+      tool: "*",
+      conditions: [{ field: "file_path", op: "matches", value }],
+      verdict,
+      reason: why
+    }
+  ];
+}
+
+// src/auth/trusted-hosts.ts
+var import_fs3 = __toESM(require("fs"));
+var import_path3 = __toESM(require("path"));
+var import_os3 = __toESM(require("os"));
+function getTrustedHostsPath() {
+  return import_path3.default.join(import_os3.default.homedir(), ".node9", "trusted-hosts.json");
+}
+function readTrustedHosts() {
+  try {
+    const raw = import_fs3.default.readFileSync(getTrustedHostsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed.hosts) ? parsed.hosts : [];
+  } catch {
+    return [];
+  }
+}
+var _cache = null;
+var CACHE_TTL_MS = 5e3;
+function getFileMtime() {
+  try {
+    return import_fs3.default.statSync(getTrustedHostsPath()).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function getCachedHosts() {
+  const now = Date.now();
+  if (_cache && now < _cache.expiry) {
+    const mtime = getFileMtime();
+    if (mtime === _cache.mtime) return _cache.hosts;
+  }
+  const hosts = readTrustedHosts();
+  _cache = { hosts, expiry: now + CACHE_TTL_MS, mtime: getFileMtime() };
+  return hosts;
+}
+function normalizeHost(raw) {
+  return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
+}
+function matchesTrustedHost(host, list) {
+  const normalized = normalizeHost(host);
+  return list.some((raw) => {
+    const entryHost = raw.toLowerCase();
+    if (entryHost.startsWith("*.")) {
+      const domain = entryHost.slice(2);
+      return normalized.endsWith("." + domain);
+    }
+    return normalized === entryHost;
+  });
+}
+function isTrustedHost(host) {
+  return matchesTrustedHost(
+    host,
+    getCachedHosts().map((entry) => entry.host)
+  );
+}
 
 // src/config/index.ts
 var DANGEROUS_WORDS = [
@@ -3765,7 +3872,10 @@ var DEFAULT_CONFIG = {
     egress: { enabled: false, mode: "review", allow: [], deny: [], allowPrivate: true },
     loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
     injectionScan: { enabled: false, minConfidence: "medium", allow: [] },
-    skillPinning: { enabled: false, mode: "warn", roots: [] }
+    skillPinning: { enabled: false, mode: "warn", roots: [] },
+    trustedHosts: [],
+    trustedHostsManaged: false,
+    appPermissions: {}
   },
   environments: {}
 };
@@ -3840,9 +3950,9 @@ function getCredentials() {
     };
   }
   try {
-    const credPath = import_path3.default.join(import_os3.default.homedir(), ".node9", "credentials.json");
-    if (import_fs3.default.existsSync(credPath)) {
-      const creds = JSON.parse(import_fs3.default.readFileSync(credPath, "utf-8"));
+    const credPath = import_path4.default.join(import_os4.default.homedir(), ".node9", "credentials.json");
+    if (import_fs4.default.existsSync(credPath)) {
+      const creds = JSON.parse(import_fs4.default.readFileSync(credPath, "utf-8"));
       const profileName = process.env.NODE9_PROFILE || "default";
       const profile = creds[profileName];
       if (profile?.apiKey) {
@@ -3868,8 +3978,8 @@ function getActiveEnvironment(config) {
 }
 function getConfig(cwd) {
   if (!cwd && cachedConfig) return cachedConfig;
-  const globalPath = import_path3.default.join(import_os3.default.homedir(), ".node9", "config.json");
-  const projectPath = import_path3.default.join(cwd ?? process.cwd(), "node9.config.json");
+  const globalPath = import_path4.default.join(import_os4.default.homedir(), ".node9", "config.json");
+  const projectPath = import_path4.default.join(cwd ?? process.cwd(), "node9.config.json");
   const globalConfig = tryLoadConfig(globalPath);
   const projectConfig = tryLoadConfig(projectPath);
   const mergedSettings = {
@@ -3902,7 +4012,13 @@ function getConfig(cwd) {
     skillPinning: {
       ...DEFAULT_CONFIG.policy.skillPinning,
       roots: [...DEFAULT_CONFIG.policy.skillPinning.roots]
-    }
+    },
+    // Left empty on purpose: the local file is read fresh at policy-eval time
+    // (getCachedHosts via isTrustedHost), NOT snapshotted into the frozen config
+    // here. A managed list fills this below and flips trustedHostsManaged.
+    trustedHosts: [],
+    trustedHostsManaged: false,
+    appPermissions: {}
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
@@ -3924,6 +4040,9 @@ function getConfig(cwd) {
     if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
+    if (s.mcpAutoWrap !== void 0) mergedSettings.mcpAutoWrap = s.mcpAutoWrap === true;
+    if (s.mcpReconcileIntervalMinutes !== void 0)
+      mergedSettings.mcpReconcileIntervalMinutes = s.mcpReconcileIntervalMinutes;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
@@ -4004,9 +4123,9 @@ function getConfig(cwd) {
   applyLayer(projectConfig);
   let cloudManagedShields = [];
   {
-    const cacheFile = import_path3.default.join(import_os3.default.homedir(), ".node9", "rules-cache.json");
+    const cacheFile = import_path4.default.join(import_os4.default.homedir(), ".node9", "rules-cache.json");
     try {
-      const raw = JSON.parse(import_fs3.default.readFileSync(cacheFile, "utf-8"));
+      const raw = JSON.parse(import_fs4.default.readFileSync(cacheFile, "utf-8"));
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
@@ -4047,6 +4166,74 @@ function getConfig(cwd) {
             locked
           );
         }
+        if (mc.approvers && typeof mc.approvers === "object") {
+          const bool = (v) => typeof v === "boolean" ? v : void 0;
+          mergedSettings.approvers = applyManagedApprovers(mergedSettings.approvers, {
+            native: bool(mc.approvers.native),
+            browser: bool(mc.approvers.browser),
+            cloud: bool(mc.approvers.cloud),
+            terminal: bool(mc.approvers.terminal)
+          });
+        }
+        if (mc.reviewChannel === "ask" || mc.reviewChannel === "approver") {
+          mergedSettings.reviewChannel = mc.reviewChannel;
+        }
+        if (typeof mc.approvalTimeoutMs === "number" && mc.approvalTimeoutMs > 0) {
+          mergedSettings.approvalTimeoutMs = mc.approvalTimeoutMs;
+        }
+        if (mc.injectionScan && typeof mc.injectionScan === "object") {
+          const i = mc.injectionScan;
+          const cur = mergedPolicy.injectionScan;
+          mergedPolicy.injectionScan = {
+            enabled: typeof i.enabled === "boolean" ? i.enabled : cur.enabled,
+            minConfidence: i.minConfidence === "high" || i.minConfidence === "medium" ? i.minConfidence : cur.minConfidence,
+            allow: Array.isArray(i.allow) ? i.allow.filter((x) => typeof x === "string") : cur.allow
+          };
+        }
+        if (mc.loopDetection && typeof mc.loopDetection === "object") {
+          const l = mc.loopDetection;
+          const cur = mergedPolicy.loopDetection;
+          mergedPolicy.loopDetection = {
+            enabled: typeof l.enabled === "boolean" ? l.enabled : cur.enabled,
+            threshold: typeof l.threshold === "number" && Number.isFinite(l.threshold) ? l.threshold : cur.threshold,
+            windowSeconds: typeof l.windowSeconds === "number" && Number.isFinite(l.windowSeconds) ? l.windowSeconds : cur.windowSeconds
+          };
+        }
+        if (mc.skillPinning && typeof mc.skillPinning === "object") {
+          const sk = mc.skillPinning;
+          const cur = mergedPolicy.skillPinning;
+          mergedPolicy.skillPinning = {
+            enabled: typeof sk.enabled === "boolean" ? sk.enabled : cur.enabled,
+            mode: sk.mode === "block" || sk.mode === "warn" ? sk.mode : cur.mode,
+            roots: Array.isArray(sk.roots) ? sk.roots.filter((x) => typeof x === "string") : cur.roots
+          };
+        }
+        if (Array.isArray(mc.jailPaths)) {
+          for (const jp of mc.jailPaths) {
+            const path13 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path13) continue;
+            const verdict = jp?.verdict === "review" ? "review" : "block";
+            for (const r of pathRules(path13, verdict, "org-managed jail")) {
+              mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
+            }
+          }
+        }
+        if (Array.isArray(mc.trustedHosts)) {
+          mergedPolicy.trustedHostsManaged = true;
+          mergedPolicy.trustedHosts = mc.trustedHosts.filter((h) => typeof h === "string").map((h) => normalizeHost(h));
+        }
+        if (mc.appPermissions && typeof mc.appPermissions === "object" && !Array.isArray(mc.appPermissions)) {
+          const coerced = {};
+          for (const [srv, tools] of Object.entries(mc.appPermissions)) {
+            if (!tools || typeof tools !== "object" || Array.isArray(tools)) continue;
+            const m = {};
+            for (const [tool, d] of Object.entries(tools)) {
+              if (d === "allow" || d === "review" || d === "block") m[tool] = d;
+            }
+            if (Object.keys(m).length) coerced[srv] = m;
+          }
+          mergedPolicy.appPermissions = coerced;
+        }
       }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
@@ -4098,10 +4285,10 @@ function getConfig(cwd) {
   return result;
 }
 function tryLoadConfig(filePath) {
-  if (!import_fs3.default.existsSync(filePath)) return null;
+  if (!import_fs4.default.existsSync(filePath)) return null;
   let raw;
   try {
-    raw = JSON.parse(import_fs3.default.readFileSync(filePath, "utf-8"));
+    raw = JSON.parse(import_fs4.default.readFileSync(filePath, "utf-8"));
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(
@@ -4155,18 +4342,18 @@ ${error.replace("Invalid config:\n", "")}
 var import_picomatch2 = __toESM(require("picomatch"));
 
 // src/dlp.ts
-var import_fs4 = __toESM(require("fs"));
-var import_path4 = __toESM(require("path"));
+var import_fs5 = __toESM(require("fs"));
+var import_path5 = __toESM(require("path"));
 function scanFilePath(filePath, cwd = process.cwd()) {
   if (!filePath) return null;
   let resolved;
   try {
-    const absolute = import_path4.default.resolve(cwd, filePath);
-    resolved = import_fs4.default.realpathSync.native(absolute);
+    const absolute = import_path5.default.resolve(cwd, filePath);
+    resolved = import_fs5.default.realpathSync.native(absolute);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR") {
-      resolved = import_path4.default.resolve(cwd, filePath);
+      resolved = import_path5.default.resolve(cwd, filePath);
     } else {
       return sensitivePathMatch(filePath);
     }
@@ -4175,27 +4362,27 @@ function scanFilePath(filePath, cwd = process.cwd()) {
 }
 
 // src/utils/provenance.ts
-var import_fs5 = __toESM(require("fs"));
-var import_path5 = __toESM(require("path"));
-var import_os4 = __toESM(require("os"));
+var import_fs6 = __toESM(require("fs"));
+var import_path6 = __toESM(require("path"));
+var import_os5 = __toESM(require("os"));
 var SYSTEM_PREFIXES = ["/usr/bin", "/usr/sbin", "/bin", "/sbin"];
 var MANAGED_PREFIXES = ["/usr/local/bin", "/opt/homebrew", "/home/linuxbrew", "/nix/store"];
 var USER_PREFIXES = [
-  import_path5.default.join(import_os4.default.homedir(), "bin"),
-  import_path5.default.join(import_os4.default.homedir(), ".local", "bin"),
-  import_path5.default.join(import_os4.default.homedir(), ".cargo", "bin"),
-  import_path5.default.join(import_os4.default.homedir(), ".npm-global", "bin"),
-  import_path5.default.join(import_os4.default.homedir(), ".volta", "bin")
+  import_path6.default.join(import_os5.default.homedir(), "bin"),
+  import_path6.default.join(import_os5.default.homedir(), ".local", "bin"),
+  import_path6.default.join(import_os5.default.homedir(), ".cargo", "bin"),
+  import_path6.default.join(import_os5.default.homedir(), ".npm-global", "bin"),
+  import_path6.default.join(import_os5.default.homedir(), ".volta", "bin")
 ];
 var SUSPECT_PREFIXES = ["/tmp", "/var/tmp", "/dev/shm"];
 function findInPath(cmd) {
-  if (import_path5.default.posix.isAbsolute(cmd)) return cmd;
+  if (import_path6.default.posix.isAbsolute(cmd)) return cmd;
   const pathEnv = process.env.PATH ?? "";
-  for (const dir of pathEnv.split(import_path5.default.delimiter)) {
+  for (const dir of pathEnv.split(import_path6.default.delimiter)) {
     if (!dir) continue;
-    const full = import_path5.default.join(dir, cmd);
+    const full = import_path6.default.join(dir, cmd);
     try {
-      import_fs5.default.accessSync(full, import_fs5.default.constants.X_OK);
+      import_fs6.default.accessSync(full, import_fs6.default.constants.X_OK);
       return full;
     } catch {
     }
@@ -4206,7 +4393,7 @@ function _classifyPath(resolved, cwd) {
   if (cwd && resolved.startsWith(cwd + "/")) {
     return { trustLevel: "user", reason: "binary in project directory" };
   }
-  const osTmp = import_os4.default.tmpdir();
+  const osTmp = import_os5.default.tmpdir();
   const allSuspect = osTmp ? [...SUSPECT_PREFIXES, osTmp] : SUSPECT_PREFIXES;
   if (allSuspect.some((p) => resolved === p || resolved.startsWith(p + "/"))) {
     return { trustLevel: "suspect", reason: `binary in temp directory: ${resolved}` };
@@ -4224,7 +4411,7 @@ function _classifyPath(resolved, cwd) {
 }
 function checkProvenance(cmd, cwd) {
   const bare = cmd.startsWith("./") ? cmd.slice(2) : cmd;
-  if (import_path5.default.posix.isAbsolute(bare)) {
+  if (import_path6.default.posix.isAbsolute(bare)) {
     const early = _classifyPath(bare, cwd);
     if (early.trustLevel === "suspect") {
       return { resolvedPath: bare, ...early };
@@ -4240,7 +4427,7 @@ function checkProvenance(cmd, cwd) {
         reason: "binary not found in PATH"
       };
     }
-    resolved = import_fs5.default.realpathSync(found);
+    resolved = import_fs6.default.realpathSync(found);
   } catch {
     return {
       resolvedPath: cmd,
@@ -4249,7 +4436,7 @@ function checkProvenance(cmd, cwd) {
     };
   }
   try {
-    const stat = import_fs5.default.statSync(resolved);
+    const stat = import_fs6.default.statSync(resolved);
     if (stat.mode & 2) {
       return {
         resolvedPath: resolved,
@@ -4268,56 +4455,6 @@ function checkProvenance(cmd, cwd) {
   return { resolvedPath: resolved, ...classify };
 }
 
-// src/auth/trusted-hosts.ts
-var import_fs6 = __toESM(require("fs"));
-var import_path6 = __toESM(require("path"));
-var import_os5 = __toESM(require("os"));
-function getTrustedHostsPath() {
-  return import_path6.default.join(import_os5.default.homedir(), ".node9", "trusted-hosts.json");
-}
-function readTrustedHosts() {
-  try {
-    const raw = import_fs6.default.readFileSync(getTrustedHostsPath(), "utf8");
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed.hosts) ? parsed.hosts : [];
-  } catch {
-    return [];
-  }
-}
-var _cache = null;
-var CACHE_TTL_MS = 5e3;
-function getFileMtime() {
-  try {
-    return import_fs6.default.statSync(getTrustedHostsPath()).mtimeMs;
-  } catch {
-    return 0;
-  }
-}
-function getCachedHosts() {
-  const now = Date.now();
-  if (_cache && now < _cache.expiry) {
-    const mtime = getFileMtime();
-    if (mtime === _cache.mtime) return _cache.hosts;
-  }
-  const hosts = readTrustedHosts();
-  _cache = { hosts, expiry: now + CACHE_TTL_MS, mtime: getFileMtime() };
-  return hosts;
-}
-function normalizeHost(raw) {
-  return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
-}
-function isTrustedHost(host) {
-  const normalized = normalizeHost(host);
-  return getCachedHosts().some((entry) => {
-    const entryHost = entry.host.toLowerCase();
-    if (entryHost.startsWith("*.")) {
-      const domain = entryHost.slice(2);
-      return normalized.endsWith("." + domain);
-    }
-    return normalized === entryHost;
-  });
-}
-
 // src/policy/index.ts
 async function evaluatePolicy2(toolName, args, agent, cwd) {
   const config = getConfig();
@@ -4327,7 +4464,14 @@ async function evaluatePolicy2(toolName, args, agent, cwd) {
     toolName,
     args,
     { agent, cwd, activeEnvironment },
-    { checkProvenance, isTrustedHost }
+    {
+      checkProvenance,
+      // Managed → match against the org list (frozen with the rest of managed
+      // config; changes arrive via cloud sync). Unmanaged → the local file via
+      // getCachedHosts (5s TTL + mtime), so a `node9 trust add/remove` still
+      // reaches a long-lived in-process authorizer (the gateway) within seconds.
+      isTrustedHost: config.policy.trustedHostsManaged ? (host) => matchesTrustedHost(host, config.policy.trustedHosts) : isTrustedHost
+    }
   );
 }
 function isIgnoredTool2(toolName) {
@@ -5274,6 +5418,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   const isManual = meta?.agent === "Terminal";
   const isObserveMode = config.settings.mode === "observe";
   let explainableLabel = "Local Config";
+  let dlpReviewFlagged = false;
   let policyMatchedField;
   let policyMatchedWord;
   let policyRuleDescription;
@@ -5378,6 +5523,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       if (!isManual)
         appendLocalAudit(toolName, args, "allow", "dlp-review-flagged", meta, hashAuditArgs);
       explainableLabel = "\u{1F6A8} Node9 DLP (Credential Review)";
+      dlpReviewFlagged = true;
     }
   }
   if (config.policy.dlp.pii === "block" && (!isIgnoredTool2(toolName) || config.policy.dlp.scanIgnoredTools)) {
@@ -5443,9 +5589,40 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     }
     return { approved: true, checkedBy: "audit" };
   }
+  let appPermReview = null;
+  let appPermReviewTool = null;
+  if (meta?.serverKey) {
+    const prefix = meta.mcpServer ? `mcp__${meta.mcpServer}__` : "";
+    const bareTool = prefix && toolName.startsWith(prefix) ? toolName.slice(prefix.length) : toolName;
+    const decision = config.policy.appPermissions?.[meta.serverKey]?.[bareTool];
+    const hardBlock = decision === "block" || decision === "review" && config.settings.panicMode === true;
+    if (hardBlock) {
+      if (!isManual)
+        appendLocalAudit(
+          toolName,
+          args,
+          "deny",
+          "app-permission-block",
+          // ruleName gives the dashboard row its "why" (rule attribution), the
+          // same channel shield fires use; mcpServer (in meta) gives the app chip.
+          { ...meta, ruleName: `app-permission:${bareTool}` },
+          hashAuditArgs
+        );
+      return {
+        approved: false,
+        blockedBy: "local-config",
+        reason: decision === "block" ? `App permission: "${bareTool}" is set to block by your workspace.` : `App permission: "${bareTool}" requires review, and the workspace is in panic mode \u2014 all review actions are blocked.`,
+        blockedByLabel: decision === "block" ? "\u{1F512} Node9 App Permission (Blocked)" : "\u{1F6A8} Panic mode (org policy)"
+      };
+    }
+    if (decision === "review") {
+      appPermReview = `App permission: "${bareTool}" requires human approval (workspace policy).`;
+      appPermReviewTool = bareTool;
+    }
+  }
   if (!taintWarning && !isIgnoredTool2(toolName)) {
     const ld = config.policy.loopDetection;
-    if (ld.enabled) {
+    if (ld.enabled && !appPermReview) {
       const loopResult = recordAndCheck(toolName, args, ld.threshold, ld.windowSeconds * 1e3);
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;
@@ -5476,7 +5653,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         reason: "Workspace is in panic mode \u2014 all review-verdict actions are blocked. Contact your admin to disable panic mode in the Node9 dashboard."
       };
     }
-    if (policyResult.decision === "allow") {
+    if (policyResult.decision === "allow" && !appPermReview) {
       if (!isManual)
         appendLocalAudit(
           toolName,
@@ -5569,7 +5746,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     );
     if (policyRuleDescription) riskMetadata.ruleDescription = policyRuleDescription.slice(0, 200);
     const persistent = policyResult.ruleName ? null : getPersistentDecision(toolName);
-    if (persistent === "allow") {
+    if (persistent === "allow" && !appPermReview) {
       if (!isManual) appendLocalAudit(toolName, args, "allow", "persistent", meta, hashAuditArgs);
       return { approved: true, checkedBy: "persistent" };
     }
@@ -5583,7 +5760,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         blockedByLabel: "Persistent User Rule"
       };
     }
-  } else if (!taintWarning) {
+  } else if (!taintWarning && !appPermReview) {
     const toolLower = toolName.toLowerCase();
     const isFileTool = toolLower === "read" || toolLower === "grep" || toolLower === "glob" || toolLower === "read_file" || toolLower === "grep_search" || toolLower === "list_files";
     if (isFileTool && readActiveShields().includes("project-jail")) {
@@ -5601,7 +5778,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       return { approved: true };
     }
   }
-  if (!taintWarning && getActiveTrustSession(toolName, args)) {
+  if (!taintWarning && !appPermReview && getActiveTrustSession(toolName, args)) {
     if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
     return { approved: true, checkedBy: "trust" };
   }
@@ -5613,11 +5790,35 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       explainableLabel,
       void 0,
       void 0,
-      taintWarning
+      appPermReview ? `${taintWarning}
+${appPermReview}` : taintWarning
     );
+  } else if (appPermReview) {
+    if (dlpReviewFlagged) {
+      explainableLabel = "\u{1F6A8} Node9 DLP (Credential Review) + \u{1F512} App Permission (Review)";
+      riskMetadata = computeRiskMetadata(
+        args,
+        6,
+        explainableLabel,
+        void 0,
+        void 0,
+        `A credential was detected in this call (DLP review).
+${appPermReview}`
+      );
+    } else {
+      explainableLabel = "\u{1F512} Node9 App Permission (Review)";
+      riskMetadata = computeRiskMetadata(
+        args,
+        5,
+        explainableLabel,
+        void 0,
+        void 0,
+        appPermReview
+      );
+    }
   }
   const cloudEnforcedForDefer = approvers.cloud && !!creds?.apiKey;
-  if (options?.deferReview && !taintWarning && !cloudEnforcedForDefer) {
+  if (options?.deferReview && !taintWarning && !appPermReview && !cloudEnforcedForDefer) {
     return {
       approved: false,
       review: true,
@@ -5628,7 +5829,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   }
   let cloudRequestId = null;
   const cloudEnforced = approvers.cloud && !!creds?.apiKey;
-  const forceReview = localSmartRuleMatched === true || options?.localSmartRuleMatched === true || void 0;
+  const forceReview = localSmartRuleMatched === true || options?.localSmartRuleMatched === true || !!appPermReview || void 0;
   if (cloudEnforced) {
     try {
       const initResult = await initNode9SaaS(
@@ -5641,10 +5842,10 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         forceReview
       );
       if (!initResult.pending) {
-        if (initResult.shadowMode) {
+        if (initResult.shadowMode && !appPermReview) {
           return { approved: true, checkedBy: "cloud" };
         }
-        if (!localSmartRuleMatched && !options?.localSmartRuleMatched) {
+        if (!localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview) {
           return {
             approved: !!initResult.approved,
             reason: initResult.reason || (initResult.approved ? void 0 : "Action rejected by organization policy."),
@@ -5655,7 +5856,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         }
       }
       if (initResult.pending) cloudRequestId = initResult.requestId || null;
-      if (!taintWarning) explainableLabel = "Organization Policy (SaaS)";
+      if (!taintWarning && !appPermReview) explainableLabel = "Organization Policy (SaaS)";
     } catch {
     }
   }
@@ -5708,7 +5909,13 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           options?.activityId,
           options?.cwd,
           statefulRecoveryCommand,
-          void 0,
+          // fix #1: for an app-perm review, tell the daemon NOT to run its own
+          // background authorizeHeadless — it re-auths WITHOUT serverKey (meta
+          // carries no serverKey), skips the app-perm gate, and silently
+          // auto-allows. This process (the long-running gateway — appPermReview
+          // only ever happens here) stays alive to run its own racers, so the
+          // daemon just holds the card and waits for the human decision.
+          appPermReview ? true : void 0,
           void 0,
           localSmartRuleMatched || options?.localSmartRuleMatched,
           options?.socketActivitySent
@@ -5755,8 +5962,11 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           riskMetadata?.ruleDescription
         );
         if (decision === "always_allow") {
-          writeTrustSession(toolName, 36e5, args);
-          return { approved: true, checkedBy: "trust" };
+          if (!appPermReview) {
+            writeTrustSession(toolName, 36e5, args);
+            return { approved: true, checkedBy: "trust" };
+          }
+          return { approved: true, checkedBy: "daemon", decisionSource: "native" };
         }
         const isApproved = decision === "allow";
         return {
@@ -5794,6 +6004,15 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     );
   }
   if (racePromises.length === 0) {
+    if (!isManual && appPermReview)
+      appendLocalAudit(
+        toolName,
+        args,
+        "deny",
+        "app-permission-review",
+        { ...meta, ruleName: `app-permission:${appPermReviewTool}` },
+        hashAuditArgs
+      );
     return {
       approved: false,
       noApprovalMechanism: true,
@@ -5861,7 +6080,13 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
       // the BE enriches that row instead of inserting a duplicate. Matters
       // for EVERY racer outcome, not just cloud wins: a native-popup
       // decision on a cloud-pending request would otherwise count twice.
-      cloudRequestId ? { ...meta, cloudRequestId } : meta,
+      // fix #6: carry app-perm attribution so a race-resolved approve/deny isn't
+      // anonymous on the dashboard (matches the block row's ruleName).
+      {
+        ...meta,
+        ...cloudRequestId && { cloudRequestId },
+        ...appPermReview && { ruleName: `app-permission:${appPermReviewTool}` }
+      },
       hashAuditArgs
     );
   }