@node9/proxy 1.63.0 → 1.64.0

package/dist/dashboard.mjs

@@ -1959,6 +1959,7 @@ var init_dist = __esm({
       name: "redis",
       description: "Protects Redis instances from destructive AI operations",
       aliases: [],
+      _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
       smartRules: [
         {
           name: "shield:redis:block-flushall",
@@ -1967,7 +1968,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "\\bFLUSHALL\\b",
+              value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
               flags: "i"
             }
           ],
@@ -1981,7 +1982,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "\\bFLUSHDB\\b",
+              value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
               flags: "i"
             }
           ],
@@ -1995,7 +1996,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "\\bCONFIG\\s+RESETSTAT\\b",
+              value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
               flags: "i"
             }
           ],
@@ -2009,7 +2010,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "\\bCONFIG\\s+SET\\b",
+              value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
               flags: "i"
             }
           ],
@@ -2023,7 +2024,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
+              value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
               flags: "i"
             }
           ],
@@ -2302,6 +2303,7 @@ var init_config_schema = __esm({
         // nudge-only (default), and the scan cadence in minutes.
         mcpAutoWrap: z.boolean().optional(),
         mcpReconcileIntervalMinutes: z.number().positive().optional(),
+        mcpStaleAfterDays: z.number().min(0).optional(),
         cloudSyncIntervalHours: z.number().positive().optional(),
         // Seconds-granular override for the cloud policy sync cadence. Wins over
         // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
@@ -2466,6 +2468,7 @@ var init_config = __esm({
     init_managed();
     init_build();
     init_trusted_hosts();
+    init_dist();
     DANGEROUS_WORDS = [
       "mkfs",
       // formats/wipes a filesystem partition
@@ -2967,6 +2970,50 @@ var init_scan_watermark = __esm({
   }
 });
 
+// src/audit/decision.ts
+function classifyDecision(a, b) {
+  const isRow = !!a && typeof a === "object";
+  const decision = isRow ? a.decision : a;
+  const attribution = isRow ? a.checkedBy ?? a.source : b;
+  const raw = typeof decision === "string" ? decision : String(decision ?? "");
+  const src = typeof attribution === "string" ? attribution.toLowerCase() : "";
+  const d = raw.toLowerCase();
+  if (src && has(src, "observe-mode")) {
+    return { outcome: "observe", label: "Would block", raw };
+  }
+  if (d === "dlp") return { outcome: "info", label: "Finding", raw };
+  if (d === "mcp-discovered") return { outcome: "info", label: "Info", raw };
+  if (d === "allow" || d === "allowed") {
+    if (src === "post-hook") return { outcome: "allow", label: "Ran", raw };
+    if (HUMAN_SOURCES.has(src)) {
+      return { outcome: "allow", label: "Approved", raw };
+    }
+    return { outcome: "allow", label: "Auto-allowed", raw };
+  }
+  if (d === "deny" || d === "auto-deny" || d === "block") {
+    if (TIMEOUT_SOURCES.has(src)) {
+      return { outcome: "deny", label: "Timed out", raw };
+    }
+    if (HUMAN_SOURCES.has(src)) {
+      return { outcome: "deny", label: "Denied", raw };
+    }
+    return { outcome: "deny", label: "Blocked", raw };
+  }
+  if (d === "review" || d === "pending") {
+    return { outcome: "info", label: "Pending", raw };
+  }
+  return { outcome: "unknown", label: raw ? `? ${raw}` : "? (none)", raw };
+}
+var HUMAN_SOURCES, TIMEOUT_SOURCES, has;
+var init_decision = __esm({
+  "src/audit/decision.ts"() {
+    "use strict";
+    HUMAN_SOURCES = /* @__PURE__ */ new Set(["daemon", "cloud", "local-decision", "inline-review-approved"]);
+    TIMEOUT_SOURCES = /* @__PURE__ */ new Set(["timeout"]);
+    has = (s, needle) => s.includes(needle);
+  }
+});
+
 // src/cli/aggregate/report-audit.ts
 import fs5 from "fs";
 import os6 from "os";
@@ -3062,8 +3109,15 @@ function parseAuditLog(logPath) {
     }
   });
 }
-function isAllow(decision) {
-  return decision.startsWith("allow");
+function viewOf(e) {
+  const outcome = classifyDecision(e).outcome;
+  const observed = outcome === "observe";
+  return {
+    observed,
+    ran: outcome === "allow" || observed,
+    blocked: outcome === "deny" || outcome === "unknown",
+    info: outcome === "info"
+  };
 }
 function isDlp(checkedBy) {
   return !!checkedBy?.includes("dlp");
@@ -3520,12 +3574,12 @@ function aggregateReportFromAudit(period, opts = {}) {
   const priorStart = new Date(start.getTime() - periodMs);
   const priorEntries = allEntries.filter((e) => {
     if (e.source === "post-hook") return false;
+    if (e.source === "response-dlp") return false;
+    if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     return ts >= priorStart && ts <= priorEnd;
   });
-  const priorBlocked = priorEntries.filter(
-    (e) => typeof e.decision === "string" && !isAllow(e.decision)
-  ).length;
+  const priorBlocked = priorEntries.filter((e) => viewOf(e).blocked).length;
   const priorBlockRate = priorEntries.length > 0 ? priorBlocked / priorEntries.length : null;
   const excludeTests = opts.excludeTests === true;
   const testTs = excludeTests ? buildTestTimestamps(allEntries) : /* @__PURE__ */ new Set();
@@ -3568,15 +3622,17 @@ function aggregateReportFromAudit(period, opts = {}) {
   let dimInjectionBlocked = 0;
   for (const e of entries) {
     if (superseded.has(supersedeKey(e))) continue;
-    const allow = isAllow(e.decision);
+    const view = viewOf(e);
     const dateKey = e.ts.slice(0, 10);
     const userInteracted = e.source === "daemon";
-    if (userInteracted) {
-      if (allow) userApproved++;
+    if (view.observed) {
+      if (e.checkedBy === "observe-mode-dlp-would-block") observeDlp++;
+    } else if (view.info) {
+    } else if (userInteracted) {
+      if (view.ran) userApproved++;
       else userDenied++;
-    } else if (!allow) {
+    } else if (view.blocked) {
       if (e.checkedBy === "timeout") timedOut++;
-      else if (e.checkedBy === "observe-mode-dlp-would-block") observeDlp++;
       else if (isDlp(e.checkedBy)) dlpBlocked++;
       else if (e.checkedBy === "local-decision") userDenied++;
       else if (e.checkedBy !== "loop-detected") hardBlocked++;
@@ -3588,7 +3644,7 @@ function aggregateReportFromAudit(period, opts = {}) {
     if (cb.includes("would-block") && (cb.includes("pii") || cb.includes("dlp"))) {
       dimDataObserved++;
     }
-    if (!allow && !userInteracted) {
+    if (view.blocked && !userInteracted) {
       switch (dimensionOfBlock(cb, e.ruleName ?? "")) {
         case "network":
           dimNetworkBlocked++;
@@ -3606,15 +3662,15 @@ function aggregateReportFromAudit(period, opts = {}) {
     }
     const t = toolMap.get(e.tool) ?? { calls: 0, blocked: 0 };
     t.calls++;
-    if (!allow) t.blocked++;
+    if (view.blocked) t.blocked++;
     toolMap.set(e.tool, t);
-    if (!allow) {
+    if (view.blocked) {
       const key = e.checkedBy ?? (e.source === "daemon" ? "local-decision" : null);
       if (key) {
         blockMap.set(key, (blockMap.get(key) ?? 0) + 1);
       }
     }
-    if (!allow && e.ruleName) {
+    if ((view.blocked || view.observed) && e.ruleName) {
       ruleMap.set(e.ruleName, (ruleMap.get(e.ruleName) ?? 0) + 1);
     }
     if (e.agent) agentMap.set(e.agent, (agentMap.get(e.agent) ?? 0) + 1);
@@ -3623,7 +3679,7 @@ function aggregateReportFromAudit(period, opts = {}) {
     hourMap.set(hour, (hourMap.get(hour) ?? 0) + 1);
     const d = dailyMap.get(dateKey) ?? { calls: 0, blocked: 0 };
     d.calls++;
-    if (!allow) d.blocked++;
+    if (view.blocked) d.blocked++;
     dailyMap.set(dateKey, d);
   }
   for (const e of allEntries) {
@@ -3699,6 +3755,7 @@ var init_report_audit = __esm({
     init_costSync();
     init_litellm();
     init_cost_codex();
+    init_decision();
     TEST_COMMAND_RE = /(?:^|\s)(npm\s+(?:run\s+)?test|npx\s+(?:vitest|jest|mocha)|yarn\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|vitest|jest|mocha|pytest|py\.test|cargo\s+test|go\s+test|bundle\s+exec\s+rspec|rspec|phpunit|dotnet\s+test)\b/i;
     SUPERSEDE_WINDOW_MS = 6e4;
     GEMINI_FALLBACK_MODELS2 = ["gemini-2.5-flash", "gemini-2.0-flash"];
@@ -4874,20 +4931,20 @@ function aggregateAudit(entries, startMs, endMs = Date.now()) {
   for (const e of inWindow) {
     if (e.sessionId) sessionSet.add(e.sessionId);
     if (e.mcpServer) mcpSet.add(e.mcpServer);
-    const isAllow2 = e.decision === "allow" || e.decision === "observe-allow";
+    const isAllow = e.decision === "allow" || e.decision === "observe-allow";
     const isReview = e.decision === "review";
     const isLoop = e.checkedBy === "loop-detected";
     const isDlp2 = !!(e.checkedBy && e.checkedBy.toLowerCase().includes("dlp"));
-    if (isAllow2) allow++;
+    if (isAllow) allow++;
     else if (isReview) review++;
     else block++;
     if (isLoop) loops++;
     if (isDlp2) dlpHits++;
     const t = toolMap.get(e.tool) ?? { calls: 0, blocked: 0 };
     t.calls++;
-    if (!isAllow2 && !isReview) t.blocked++;
+    if (!isAllow && !isReview) t.blocked++;
     toolMap.set(e.tool, t);
-    if (!isAllow2 && e.checkedBy) {
+    if (!isAllow && e.checkedBy) {
       blockMap.set(e.checkedBy, (blockMap.get(e.checkedBy) ?? 0) + 1);
     }
     if (TEST_TOOLS.has(e.tool) && typeof e.args?.command === "string") {
@@ -4895,7 +4952,7 @@ function aggregateAudit(entries, startMs, endMs = Date.now()) {
       if (head && /^[a-zA-Z0-9._-]+$/.test(head)) {
         const s = shellMap.get(head) ?? { count: 0, blocked: 0 };
         s.count++;
-        if (!isAllow2 && !isReview) s.blocked++;
+        if (!isAllow && !isReview) s.blocked++;
         shellMap.set(head, s);
       }
     }

package/dist/index.js

@@ -325,6 +325,7 @@ var ConfigFileSchema = import_zod.z.object({
     // nudge-only (default), and the scan cadence in minutes.
     mcpAutoWrap: import_zod.z.boolean().optional(),
     mcpReconcileIntervalMinutes: import_zod.z.number().positive().optional(),
+    mcpStaleAfterDays: import_zod.z.number().min(0).optional(),
     cloudSyncIntervalHours: import_zod.z.number().positive().optional(),
     // Seconds-granular override for the cloud policy sync cadence. Wins over
     // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
@@ -3335,6 +3336,7 @@ var redis_default = {
   name: "redis",
   description: "Protects Redis instances from destructive AI operations",
   aliases: [],
+  _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
   smartRules: [
     {
       name: "shield:redis:block-flushall",
@@ -3343,7 +3345,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHALL\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
           flags: "i"
         }
       ],
@@ -3357,7 +3359,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHDB\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
           flags: "i"
         }
       ],
@@ -3371,7 +3373,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+RESETSTAT\\b",
+          value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
           flags: "i"
         }
       ],
@@ -3385,7 +3387,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+SET\\b",
+          value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
           flags: "i"
         }
       ],
@@ -3399,7 +3401,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
+          value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
           flags: "i"
         }
       ],
@@ -4068,6 +4070,49 @@ function getActiveEnvironment(config) {
   const env = config.settings.environment || process.env.NODE_ENV || "development";
   return config.environments[env] ?? null;
 }
+var cacheReadFailureLogged = false;
+function readRulesCacheResilient(cacheFile) {
+  let existed = false;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    let content;
+    try {
+      content = import_fs4.default.readFileSync(cacheFile, "utf-8");
+      existed = true;
+    } catch (err) {
+      if (err.code === "ENOENT") return {};
+      continue;
+    }
+    try {
+      return JSON.parse(content);
+    } catch {
+    }
+  }
+  if (existed) {
+    const backup = import_path4.default.join(import_path4.default.dirname(cacheFile), "rules-cache.last-good.json");
+    if (backup !== cacheFile) {
+      try {
+        const raw = JSON.parse(import_fs4.default.readFileSync(backup, "utf-8"));
+        logCacheReadIssue(cacheFile, "RULES_CACHE_CORRUPT_USED_BACKUP");
+        return raw;
+      } catch {
+      }
+    }
+    logCacheReadIssue(cacheFile, "RULES_CACHE_UNREADABLE");
+  }
+  return {};
+}
+function logCacheReadIssue(cacheFile, kind) {
+  if (cacheReadFailureLogged) return;
+  cacheReadFailureLogged = true;
+  try {
+    import_fs4.default.appendFileSync(
+      import_path4.default.join(import_os4.default.homedir(), ".node9", "hook-debug.log"),
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] ${kind} ${cacheFile}
+`
+    );
+  } catch {
+  }
+}
 function getConfig(cwd) {
   if (!cwd && cachedConfig) return cachedConfig;
   const globalPath = import_path4.default.join(import_os4.default.homedir(), ".node9", "config.json");
@@ -4135,6 +4180,7 @@ function getConfig(cwd) {
     if (s.mcpAutoWrap !== void 0) mergedSettings.mcpAutoWrap = s.mcpAutoWrap === true;
     if (s.mcpReconcileIntervalMinutes !== void 0)
       mergedSettings.mcpReconcileIntervalMinutes = s.mcpReconcileIntervalMinutes;
+    if (s.mcpStaleAfterDays !== void 0) mergedSettings.mcpStaleAfterDays = s.mcpStaleAfterDays;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
@@ -4144,12 +4190,13 @@ function getConfig(cwd) {
     if (p.smartRules) {
       const defaultBlocks = mergedPolicy.smartRules.filter((r) => r.verdict === "block");
       const defaultNonBlocks = mergedPolicy.smartRules.filter((r) => r.verdict !== "block");
-      const userRuleNames = new Set(p.smartRules.filter((r) => r.name).map((r) => r.name));
+      const localRules = p.smartRules.map(({ pinned: _pinned, ...r }) => r);
+      const userRuleNames = new Set(localRules.filter((r) => r.name).map((r) => r.name));
       const filteredBlocks = defaultBlocks.filter((r) => !r.name || !userRuleNames.has(r.name));
       const filteredNonBlocks = defaultNonBlocks.filter(
         (r) => !r.name || !userRuleNames.has(r.name)
       );
-      mergedPolicy.smartRules = [...filteredBlocks, ...p.smartRules, ...filteredNonBlocks];
+      mergedPolicy.smartRules = [...filteredBlocks, ...localRules, ...filteredNonBlocks];
     }
     if (p.snapshot) {
       const s2 = p.snapshot;
@@ -4214,10 +4261,12 @@ function getConfig(cwd) {
   applyLayer(globalConfig);
   applyLayer(projectConfig);
   let cloudManagedShields = [];
+  let modeCloudControlled = false;
+  let modeCloudStaged = false;
   {
     const cacheFile = import_path4.default.join(import_os4.default.homedir(), ".node9", "rules-cache.json");
     try {
-      const raw = JSON.parse(import_fs4.default.readFileSync(cacheFile, "utf-8"));
+      const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
@@ -4234,6 +4283,9 @@ function getConfig(cwd) {
             locked.includes("mode")
           );
         }
+        if (typeof mc.mode === "string" || locked.includes("mode")) {
+          modeCloudControlled = true;
+        }
         if (mc.egress && typeof mc.egress === "object") {
           const hosts = (v) => Array.isArray(v) ? v.filter((h) => typeof h === "string") : void 0;
           mergedPolicy.egress = applyManagedEgress(
@@ -4332,19 +4384,28 @@ function getConfig(cwd) {
       }
       if (raw.shadowMode === true) {
         mergedSettings.mode = "observe";
+        modeCloudStaged = true;
       }
     } catch {
     }
   }
   const shieldOverrides = readShieldOverrides();
   const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  const cloudManagedSet = new Set(cloudManagedShields);
   for (const shieldName of activeShieldNames) {
-    const shield = getShield(shieldName);
+    const isCloudMandated = cloudManagedSet.has(shieldName);
+    const shield = isCloudMandated ? BUILTIN_SHIELDS[shieldName] : getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
-    const ruleOverrides = shieldOverrides[shieldName] ?? {};
+    const ruleOverrides = isCloudMandated ? {} : shieldOverrides[shieldName] ?? {};
     for (const rule of shield.smartRules) {
-      if (!existingRuleNames.has(rule.name)) {
+      const collides = rule.name ? existingRuleNames.has(rule.name) : false;
+      if (isCloudMandated) {
+        if (collides) {
+          mergedPolicy.smartRules = mergedPolicy.smartRules.filter((r) => r.name !== rule.name);
+        }
+        mergedPolicy.smartRules.push({ ...rule, pinned: true });
+      } else if (!collides) {
         const overrideVerdict = rule.name ? ruleOverrides[rule.name] : void 0;
         mergedPolicy.smartRules.push(
           overrideVerdict !== void 0 ? { ...rule, verdict: overrideVerdict } : rule
@@ -4360,7 +4421,27 @@ function getConfig(cwd) {
   for (const rule of ADVISORY_SMART_RULES) {
     if (!existingAdvisoryNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
   }
-  if (process.env.NODE9_MODE) mergedSettings.mode = process.env.NODE9_MODE;
+  const envMode = process.env.NODE9_MODE;
+  if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+    mergedSettings.mode = envMode;
+  }
+  if (cloudManagedShields.length > 0 && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
+    mergedSettings.mode = "standard";
+  }
+  const managedFloorActive = cloudManagedShields.length > 0 || modeCloudControlled && mergedSettings.mode === "strict";
+  if (modeCloudControlled && mergedSettings.mode === "strict") {
+    for (const name of Object.keys(mergedEnvironments)) {
+      if (mergedEnvironments[name]?.requireApproval === false) {
+        const cleaned = { ...mergedEnvironments[name] };
+        delete cleaned.requireApproval;
+        mergedEnvironments[name] = cleaned;
+      }
+    }
+  }
+  if (managedFloorActive) {
+    mergedPolicy.ignoredTools = [...DEFAULT_CONFIG.policy.ignoredTools];
+    mergedPolicy.sandboxPaths = [...DEFAULT_CONFIG.policy.sandboxPaths];
+  }
   mergedPolicy.sandboxPaths = [...new Set(mergedPolicy.sandboxPaths)];
   mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
@@ -4748,6 +4829,18 @@ function isDaemonRunning() {
   }
   return false;
 }
+async function daemonHasInteractiveApprover(timeoutMs = 400) {
+  try {
+    const res = await fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/approver`, {
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) return false;
+    const body = await res.json();
+    return body.interactive === true;
+  } catch {
+    return false;
+  }
+}
 async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd, recoveryCommand, skipBackgroundAuth, viewOnly, localSmartRuleMatched, socketActivitySent) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   const ctrl = new AbortController();
@@ -5444,6 +5537,12 @@ function isNetworkTool(toolName, args) {
 function notifyActivity(data) {
   return notifyActivitySocket(data);
 }
+async function hasReachableHumanApprover(opts) {
+  const hasDisplay = !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+  const nativeReachable = !opts.calledFromDaemon && opts.approvers.native !== false && hasDisplay;
+  if (nativeReachable) return true;
+  return opts.approvers.terminal !== false && await daemonHasInteractiveApprover();
+}
 async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = (0, import_crypto4.randomUUID)();
@@ -5758,6 +5857,35 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       return { approved: true, checkedBy: "local-policy" };
     }
     if (policyResult.decision === "block") {
+      const daemonUp = isDaemonRunning();
+      let humanApproverReachable = false;
+      if (!policyResult.dependsOnStatePredicates?.length && daemonUp && !isTestEnv2) {
+        humanApproverReachable = await hasReachableHumanApprover({
+          approvers,
+          calledFromDaemon: options?.calledFromDaemon
+        });
+      }
+      const mayDowngrade = daemonUp && !isTestEnv2 && humanApproverReachable;
+      const hardBlock = () => {
+        if (!isManual)
+          appendLocalAudit(
+            toolName,
+            args,
+            "deny",
+            "smart-rule-block",
+            { ...meta, ruleName: policyResult.ruleName },
+            hashAuditArgs
+          );
+        return {
+          approved: false,
+          reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
+          blockedBy: "local-config",
+          blockedByLabel: policyResult.blockedByLabel,
+          ruleHit: policyResult.ruleName,
+          ...policyResult.recoveryCommand && { recoveryCommand: policyResult.recoveryCommand },
+          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription }
+        };
+      };
       if (policyResult.dependsOnStatePredicates?.length) {
         const stateResults = await checkStatePredicates(policyResult.dependsOnStatePredicates);
         const predicatesMet = stateResults !== null && policyResult.dependsOnStatePredicates.every((p) => stateResults[p] === true);
@@ -5774,7 +5902,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         if (predicatesMet && policyResult.recoveryCommand) {
           statefulRecoveryCommand = policyResult.recoveryCommand;
         }
-      } else if (isDaemonRunning() && !isTestEnv2) {
+      } else if (mayDowngrade) {
         if (!isManual)
           appendLocalAudit(
             toolName,
@@ -5796,36 +5924,13 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           };
         }
       } else {
-        if (!isManual)
-          appendLocalAudit(
-            toolName,
-            args,
-            "deny",
-            "smart-rule-block",
-            // Include policyResult.ruleName so the [2] Report SHIELDS
-            // panel can attribute this block to its specific shield
-            // (e.g. `shield:project-jail:block-read-ssh`) via the
-            // rule→shield map. checkedBy stays as the generic
-            // `smart-rule-block` for backward compat with existing
-            // log readers.
-            { ...meta, ruleName: policyResult.ruleName },
-            hashAuditArgs
-          );
-        return {
-          approved: false,
-          reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
-          blockedBy: "local-config",
-          blockedByLabel: policyResult.blockedByLabel,
-          ruleHit: policyResult.ruleName,
-          ...policyResult.recoveryCommand && { recoveryCommand: policyResult.recoveryCommand },
-          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription }
-        };
+        return hardBlock();
       }
     }
     explainableLabel = policyResult.blockedByLabel || "Local Config";
     policyMatchedField = policyResult.matchedField;
     policyMatchedWord = policyResult.matchedWord;
-    if (policyResult.ruleName) localSmartRuleMatched = true;
+    if (policyResult.ruleName || policyResult.tier === 7) localSmartRuleMatched = true;
     if (policyResult.ruleDescription) policyRuleDescription = policyResult.ruleDescription;
     else if (policyResult.reason) policyRuleDescription = policyResult.reason;
     riskMetadata = computeRiskMetadata(
@@ -5837,7 +5942,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       policyResult.ruleName
     );
     if (policyRuleDescription) riskMetadata.ruleDescription = policyRuleDescription.slice(0, 200);
-    const persistent = policyResult.ruleName ? null : getPersistentDecision(toolName);
+    const persistent = policyResult.ruleName || policyResult.tier === 7 ? null : getPersistentDecision(toolName);
     if (persistent === "allow" && !appPermReview) {
       if (!isManual) appendLocalAudit(toolName, args, "allow", "persistent", meta, hashAuditArgs);
       return { approved: true, checkedBy: "persistent" };