@node9/proxy 1.65.0 → 1.66.0

package/dist/cli.js

@@ -94,7 +94,7 @@ function redactSecrets(text) {
   if (!text) return text;
   let redacted = text;
   redacted = redacted.replace(
-    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/\\=]+/gi,
+    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/=]+/gi,
     "$1********"
   );
   redacted = redacted.replace(
@@ -155,7 +155,7 @@ function filePathFromArgs(args) {
   return void 0;
 }
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
-  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern);
+  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern) || /dlp|taint/i.test(String(meta?.ruleName ?? ""));
   const preview2 = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args), ...preview2 ? { argsPreview: preview2 } : {} } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
@@ -332,8 +332,10 @@ var init_config_schema = __esm({
         agentPolicy: import_zod.z.enum(["require_approval", "block_on_rules"]).optional(),
         // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
         // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
-        // node9's own approver (terminal/native/cloud). Unset → smart default
-        // (ask for ask-capable agents unless a cloud approver is configured).
+        // node9's own approver (terminal/native/cloud). Unset → default ASK for
+        // ask-capable agents (v2: cloud no longer disables inline — the outcome
+        // ships to the dashboard as audit; admins force routing via managed
+        // reviewChannel, which outranks the local --ask flag).
         reviewChannel: import_zod.z.enum(["ask", "approver"]).optional(),
         // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
         // approver_set). Default (unset/false): those tools refuse over MCP — a human
@@ -371,7 +373,8 @@ var init_config_schema = __esm({
         dlp: import_zod.z.object({
           enabled: import_zod.z.boolean().optional(),
           scanIgnoredTools: import_zod.z.boolean().optional(),
-          pii: import_zod.z.enum(["off", "block"]).optional()
+          pii: import_zod.z.enum(["off", "block"]).optional(),
+          reviewAction: import_zod.z.enum(["review", "block"]).optional()
         }).optional(),
         egress: import_zod.z.object({
           enabled: import_zod.z.boolean().optional(),
@@ -1581,7 +1584,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const dlpMatch = args !== void 0 ? scanArgs(args) : null;
     if (dlpMatch) {
       return {
-        decision: dlpMatch.severity,
+        // reviewAction:'block' (inline-ask v2): the admin upgraded
+        // review-severity matches to a hard block — every evaluatePolicy
+        // caller (orchestrator, explain, gateway) must agree with the gate.
+        decision: dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block" ? "block" : "review",
         blockedByLabel: `DLP: ${dlpMatch.patternName}`,
         reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
       };
@@ -4366,6 +4372,14 @@ function applyManagedDlp(local, managed, locked) {
       locked.includes("dlpPii")
     );
   }
+  if (typeof managed.reviewAction === "string") {
+    next.reviewAction = resolveByOrder(
+      DLP_REVIEW_ACTION_ORDER,
+      local.reviewAction ?? "review",
+      managed.reviewAction,
+      locked.includes("dlpReviewAction")
+    );
+  }
   return next;
 }
 function applyManagedApprovers(local, managed) {
@@ -4377,13 +4391,14 @@ function applyManagedApprovers(local, managed) {
     terminal: typeof managed.terminal === "boolean" ? managed.terminal : local.terminal
   };
 }
-var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER;
+var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER;
 var init_managed = __esm({
   "src/config/managed.ts"() {
     "use strict";
     MODE_ORDER = ["observe", "audit", "standard", "strict"];
     EGRESS_MODE_ORDER = ["off", "review", "block"];
     DLP_PII_ORDER = ["off", "block"];
+    DLP_REVIEW_ACTION_ORDER = ["review", "block"];
   }
 });
 
@@ -4758,6 +4773,7 @@ function getConfig(cwd) {
       if (d.enabled !== void 0) mergedPolicy.dlp.enabled = d.enabled;
       if (d.scanIgnoredTools !== void 0) mergedPolicy.dlp.scanIgnoredTools = d.scanIgnoredTools;
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
+      if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
     }
     if (p.egress) {
       const e = p.egress;
@@ -4854,7 +4870,8 @@ function getConfig(cwd) {
             mergedPolicy.dlp,
             {
               enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
-              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0
+              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
+              reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
             },
             locked
           );
@@ -4870,6 +4887,7 @@ function getConfig(cwd) {
         }
         if (mc.reviewChannel === "ask" || mc.reviewChannel === "approver") {
           mergedSettings.reviewChannel = mc.reviewChannel;
+          mergedSettings.reviewChannelManaged = true;
         }
         if (typeof mc.approvalTimeoutMs === "number" && mc.approvalTimeoutMs > 0) {
           mergedSettings.approvalTimeoutMs = mc.approvalTimeoutMs;
@@ -5614,13 +5632,14 @@ async function deriveExplainTrace(toolName, args) {
     const filePathE = String(argsObjE.file_path ?? argsObjE.path ?? argsObjE.filename ?? "");
     const dlpMatch = (filePathE ? scanFilePath(filePathE) : null) ?? (args !== void 0 ? scanArgs(args) : null);
     if (dlpMatch) {
+      const dlpBlocks = dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block";
       steps.push({
         name: "DLP Content Scanner",
-        outcome: dlpMatch.severity === "block" ? "block" : "review",
+        outcome: dlpBlocks ? "block" : "review",
         detail: `\u{1F6A8} ${dlpMatch.patternName} detected in ${dlpMatch.fieldPath} \u2014 sample: ${dlpMatch.redactedSample}`,
-        isFinal: dlpMatch.severity === "block"
+        isFinal: dlpBlocks
       });
-      if (dlpMatch.severity === "block") {
+      if (dlpBlocks) {
         return { tool: toolName, args, waterfall, steps, decision: "block" };
       }
     } else {
@@ -7119,7 +7138,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const dlpMatch = (filePath ? scanFilePath(filePath) : null) ?? scanArgs(args);
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
-      if (dlpMatch.severity === "block") {
+      if (dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block") {
         let dlpEid;
         if (!isManual)
           dlpEid = appendLocalAudit(
@@ -7457,12 +7476,14 @@ ${appPermReview}`
       );
     }
   }
-  const cloudEnforcedForDefer = approvers.cloud && !!creds?.apiKey;
-  if (options?.deferReview && !taintWarning && !appPermReview && !cloudEnforcedForDefer) {
+  if (options?.deferReview && !hardBlockDowngraded) {
     return {
       approved: false,
       review: true,
-      reason: explainableLabel || "Node9 flagged this action for review.",
+      // The prompt must say WHY: the taint sentence beats the bare label so
+      // the dev sees the actual risk context inline. (No appPermReview term:
+      // deferReview and serverKey never co-occur in production — see above.)
+      reason: taintWarning || explainableLabel || "Node9 flagged this action for review.",
       ruleDescription: policyRuleDescription,
       blockedByLabel: explainableLabel
     };
@@ -8404,7 +8425,7 @@ function printInlineAskNotice() {
   );
   console.log(
     import_chalk.default.gray(
-      '      Prefer node9\u2019s own approver? Set "reviewChannel": "approver" in config, or add --no-ask to the hook.\n      (Inline prompts are auto-disabled when a cloud approver is configured.)'
+      '      Prefer node9\u2019s own approver? Set "reviewChannel": "approver" in config, or add --no-ask to the hook.\n      (Inline is the default for every review; with a cloud workspace the outcome ships to the dashboard as audit.)'
     )
   );
 }
@@ -18353,7 +18374,9 @@ function extractManagedConfig(body) {
     const d = {};
     if (typeof mc.dlp.enabled === "boolean") d.enabled = mc.dlp.enabled;
     if (typeof mc.dlp.pii === "string") d.pii = mc.dlp.pii;
-    if (d.enabled !== void 0 || d.pii !== void 0) out.dlp = d;
+    if (mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block")
+      d.reviewAction = mc.dlp.reviewAction;
+    if (d.enabled !== void 0 || d.pii !== void 0 || d.reviewAction !== void 0) out.dlp = d;
   }
   if (mc.approvers && typeof mc.approvers === "object") {
     const a = {};
@@ -19049,12 +19072,23 @@ function classifyDecision(a, b) {
 function decisionTag(view) {
   return `[${view.label}]`.padEnd(14);
 }
-var HUMAN_SOURCES, TIMEOUT_SOURCES, has;
+var HUMAN_SOURCES, TIMEOUT_SOURCES, NON_DECISION_SOURCES, has;
 var init_decision = __esm({
   "src/audit/decision.ts"() {
     "use strict";
-    HUMAN_SOURCES = /* @__PURE__ */ new Set(["daemon", "cloud", "local-decision", "inline-review-approved"]);
+    HUMAN_SOURCES = /* @__PURE__ */ new Set([
+      "daemon",
+      "cloud",
+      "local-decision",
+      "inline-review-approved",
+      "inline-review"
+    ]);
     TIMEOUT_SOURCES = /* @__PURE__ */ new Set(["timeout"]);
+    NON_DECISION_SOURCES = /* @__PURE__ */ new Set([
+      "post-hook",
+      "inline-review-approved",
+      "response-dlp"
+    ]);
     has = (s, needle) => s.includes(needle);
   }
 });
@@ -19630,7 +19664,7 @@ function buildDaemonReport(allEntries, period, now) {
   else if (period === "30d") start.setDate(start.getDate() - 29);
   else if (period === "month") start = new Date(now.getFullYear(), now.getMonth(), 1);
   const entries = allEntries.filter((e) => {
-    if (e.source === "post-hook" || e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     return new Date(e.ts) >= start;
   });
   const isBlocked = (e) => classifyDecision(e).outcome === "deny";
@@ -47379,8 +47413,8 @@ INSTRUCTIONS:
 - Do NOT retry this exact command or attempt to bypass the rule.${recovery}
 - Inform the user which security rule was triggered and ask how to proceed.`;
 }
-function buildReviewMessage(blockedByLabel, ruleDescription) {
-  const why = ruleDescription || blockedByLabel || "this action needs your review";
+function buildReviewMessage(blockedByLabel, ruleDescription, reason) {
+  const why = ruleDescription || (reason && reason !== blockedByLabel ? reason : void 0) || blockedByLabel || "this action needs your review";
   return `Node9 flagged this for your review: ${why}. Approve to proceed, or deny to cancel.`;
 }
 
@@ -48121,6 +48155,7 @@ init_hasher();
 function storePath() {
   return process.env.NODE9_PENDING_STORE || import_path45.default.join(import_os42.default.homedir(), ".node9", "pending-reviews.json");
 }
+var TTL_TUID_MS = 72 * 60 * 60 * 1e3;
 var TTL_MS2 = 6 * 60 * 60 * 1e3;
 var MAX_ENTRIES = 500;
 function reviewCorrelationKey(payload) {
@@ -48154,7 +48189,9 @@ function write(store) {
   }
 }
 function prune(entries, now) {
-  const fresh = entries.filter((e) => now - e.ts < TTL_MS2);
+  const fresh = entries.filter(
+    (e) => now - e.ts < (e.key.startsWith("tuid:") ? TTL_TUID_MS : TTL_MS2)
+  );
   return fresh.length > MAX_ENTRIES ? fresh.slice(fresh.length - MAX_ENTRIES) : fresh;
 }
 function recordPendingReview(entry) {
@@ -48169,19 +48206,30 @@ function recordPendingReview(entry) {
 function resolvePendingReview(key, now = Date.now()) {
   try {
     const store = read();
-    const idx = store.entries.findIndex((e) => e.key === key);
+    const live = prune(store.entries, now);
+    const idx = live.findIndex((e) => e.key === key);
     if (idx === -1) {
-      const pruned = prune(store.entries, now);
-      if (pruned.length !== store.entries.length) write({ entries: pruned });
+      if (live.length !== store.entries.length) write({ entries: live });
       return null;
     }
-    const [match] = store.entries.splice(idx, 1);
-    write({ entries: prune(store.entries, now) });
+    const [match] = live.splice(idx, 1);
+    write({ entries: live });
     return match;
   } catch {
     return null;
   }
 }
+function discardPendingReview(key, now = Date.now()) {
+  try {
+    const store = read();
+    const kept = prune(
+      store.entries.filter((e) => e.key !== key),
+      now
+    );
+    if (kept.length !== store.entries.length) write({ entries: kept });
+  } catch {
+  }
+}
 
 // src/cli/commands/check.ts
 init_hook_payload();
@@ -48237,7 +48285,10 @@ function agentSupportsAsk(agent) {
 }
 function resolveAskMode(agent, opts, config) {
   if (!agentSupportsAsk(agent)) return false;
-  if (config.settings.approvers.cloud === true) return false;
+  if (config.settings.reviewChannelManaged === true) {
+    if (config.settings.reviewChannel === "ask") return true;
+    if (config.settings.reviewChannel === "approver") return false;
+  }
   if (opts.ask === true) return true;
   if (opts.ask === false) return false;
   if (config.settings.reviewChannel === "ask") return true;
@@ -48476,7 +48527,11 @@ RAW: ${raw}
           process.exit(2);
         };
         const sendAsk = (result2) => {
-          const msg = buildReviewMessage(result2.blockedByLabel, result2.ruleDescription);
+          const msg = buildReviewMessage(
+            result2.blockedByLabel,
+            result2.ruleDescription,
+            result2.reason
+          );
           try {
             const key = reviewCorrelationKey(payload);
             if (key) {
@@ -48659,6 +48714,13 @@ RAW: ${raw}
           cwd: safeCwdForAuth,
           deferReview: askMode
         });
+        if (!result.review) {
+          try {
+            const key = reviewCorrelationKey(payload);
+            if (key) discardPendingReview(key);
+          } catch {
+          }
+        }
         if (result.approved) {
           if (result.checkedBy && process.env.NODE9_DEBUG === "1")
             process.stderr.write(`\u2713 node9 [${result.checkedBy}]: "${toolName}" allowed
@@ -48835,9 +48897,11 @@ function registerLogCommand(program2) {
         })();
         const agent = agentOverride !== void 0 ? agentOverride : metaTag !== void 0 ? metaTag : payload.turn_id !== void 0 ? "Codex" : payload.toolCall !== void 0 || payload.conversationId !== void 0 ? "Antigravity" : payload.hook_event_name === "pre_tool_call" || payload.hook_event_name === "post_tool_call" ? "Hermes" : payload.hook_event_name === "PreToolUse" || payload.hook_event_name === "PostToolUse" || payload.tool_use_id !== void 0 || payload.permission_mode !== void 0 ? "Claude Code" : payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0 ? "Gemini CLI" : process.env.HERMES_SESSION_ID || process.env.HERMES_HOME || process.env.HERMES_INTERACTIVE ? "Hermes" : process.env.ANTIGRAVITY_CONVERSATION_ID ? "Antigravity" : void 0;
         let reviewApproved = false;
+        let resolvedReview = null;
         try {
           const key = reviewCorrelationKey(payload);
-          if (key && resolvePendingReview(key)) reviewApproved = true;
+          if (key) resolvedReview = resolvePendingReview(key);
+          if (resolvedReview) reviewApproved = true;
         } catch {
         }
         const entry = {
@@ -48890,6 +48954,33 @@ function registerLogCommand(program2) {
         const payloadCwd = typeof payload.cwd === "string" ? payload.cwd : Array.isArray(payload.workspacePaths) && typeof payload.workspacePaths[0] === "string" ? payload.workspacePaths[0] : void 0;
         const safeCwd = typeof payloadCwd === "string" && import_path47.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         const config = getConfig(safeCwd);
+        if (resolvedReview) {
+          try {
+            const reviewLabel = resolvedReview.label || "inline-review";
+            const sensitiveReview = /dlp|taint/i.test(reviewLabel);
+            appendLocalAudit(
+              tool,
+              rawInput,
+              "allow",
+              "inline-review",
+              {
+                agent,
+                ruleName: reviewLabel,
+                ...rawToolName !== tool ? { agentToolName: rawToolName } : {},
+                ...typeof payloadSessionId === "string" ? { sessionId: payloadSessionId } : {},
+                ...safeCwd ? { workingDir: safeCwd } : {}
+              },
+              sensitiveReview || config.settings.auditHashArgs === true
+            );
+          } catch (err2) {
+            appendToLog(HOOK_DEBUG_LOG, {
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              event: "inline-review-ship-row-fail",
+              tool,
+              error: err2 instanceof Error ? err2.message : String(err2)
+            });
+          }
+        }
         {
           const toolOutput = payload.tool_response?.output;
           const inj = config.policy.injectionScan;
@@ -50358,8 +50449,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const priorEnd = new Date(start.getTime() - 1);
   const priorStart = new Date(start.getTime() - periodMs);
   const priorEntries = allEntries.filter((e) => {
-    if (e.source === "post-hook") return false;
-    if (e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     return ts >= priorStart && ts <= priorEnd;
@@ -50370,8 +50460,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const testTs = excludeTests ? buildTestTimestamps(allEntries) : /* @__PURE__ */ new Set();
   let excludedTests = 0;
   const entries = allEntries.filter((e) => {
-    if (e.source === "post-hook") return false;
-    if (e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     if (ts < start || ts > end) return false;

package/dist/cli.mjs

@@ -102,7 +102,7 @@ function redactSecrets(text) {
   if (!text) return text;
   let redacted = text;
   redacted = redacted.replace(
-    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/\\=]+/gi,
+    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/=]+/gi,
     "$1********"
   );
   redacted = redacted.replace(
@@ -163,7 +163,7 @@ function filePathFromArgs(args) {
   return void 0;
 }
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
-  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern);
+  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern) || /dlp|taint/i.test(String(meta?.ruleName ?? ""));
   const preview2 = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args), ...preview2 ? { argsPreview: preview2 } : {} } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
@@ -336,8 +336,10 @@ var init_config_schema = __esm({
         agentPolicy: z.enum(["require_approval", "block_on_rules"]).optional(),
         // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
         // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
-        // node9's own approver (terminal/native/cloud). Unset → smart default
-        // (ask for ask-capable agents unless a cloud approver is configured).
+        // node9's own approver (terminal/native/cloud). Unset → default ASK for
+        // ask-capable agents (v2: cloud no longer disables inline — the outcome
+        // ships to the dashboard as audit; admins force routing via managed
+        // reviewChannel, which outranks the local --ask flag).
         reviewChannel: z.enum(["ask", "approver"]).optional(),
         // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
         // approver_set). Default (unset/false): those tools refuse over MCP — a human
@@ -375,7 +377,8 @@ var init_config_schema = __esm({
         dlp: z.object({
           enabled: z.boolean().optional(),
           scanIgnoredTools: z.boolean().optional(),
-          pii: z.enum(["off", "block"]).optional()
+          pii: z.enum(["off", "block"]).optional(),
+          reviewAction: z.enum(["review", "block"]).optional()
         }).optional(),
         egress: z.object({
           enabled: z.boolean().optional(),
@@ -1591,7 +1594,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const dlpMatch = args !== void 0 ? scanArgs(args) : null;
     if (dlpMatch) {
       return {
-        decision: dlpMatch.severity,
+        // reviewAction:'block' (inline-ask v2): the admin upgraded
+        // review-severity matches to a hard block — every evaluatePolicy
+        // caller (orchestrator, explain, gateway) must agree with the gate.
+        decision: dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block" ? "block" : "review",
         blockedByLabel: `DLP: ${dlpMatch.patternName}`,
         reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
       };
@@ -4370,6 +4376,14 @@ function applyManagedDlp(local, managed, locked) {
       locked.includes("dlpPii")
     );
   }
+  if (typeof managed.reviewAction === "string") {
+    next.reviewAction = resolveByOrder(
+      DLP_REVIEW_ACTION_ORDER,
+      local.reviewAction ?? "review",
+      managed.reviewAction,
+      locked.includes("dlpReviewAction")
+    );
+  }
   return next;
 }
 function applyManagedApprovers(local, managed) {
@@ -4381,13 +4395,14 @@ function applyManagedApprovers(local, managed) {
     terminal: typeof managed.terminal === "boolean" ? managed.terminal : local.terminal
   };
 }
-var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER;
+var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER;
 var init_managed = __esm({
   "src/config/managed.ts"() {
     "use strict";
     MODE_ORDER = ["observe", "audit", "standard", "strict"];
     EGRESS_MODE_ORDER = ["off", "review", "block"];
     DLP_PII_ORDER = ["off", "block"];
+    DLP_REVIEW_ACTION_ORDER = ["review", "block"];
   }
 });
 
@@ -4765,6 +4780,7 @@ function getConfig(cwd) {
       if (d.enabled !== void 0) mergedPolicy.dlp.enabled = d.enabled;
       if (d.scanIgnoredTools !== void 0) mergedPolicy.dlp.scanIgnoredTools = d.scanIgnoredTools;
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
+      if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
     }
     if (p.egress) {
       const e = p.egress;
@@ -4861,7 +4877,8 @@ function getConfig(cwd) {
             mergedPolicy.dlp,
             {
               enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
-              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0
+              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
+              reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
             },
             locked
           );
@@ -4877,6 +4894,7 @@ function getConfig(cwd) {
         }
         if (mc.reviewChannel === "ask" || mc.reviewChannel === "approver") {
           mergedSettings.reviewChannel = mc.reviewChannel;
+          mergedSettings.reviewChannelManaged = true;
         }
         if (typeof mc.approvalTimeoutMs === "number" && mc.approvalTimeoutMs > 0) {
           mergedSettings.approvalTimeoutMs = mc.approvalTimeoutMs;
@@ -5621,13 +5639,14 @@ async function deriveExplainTrace(toolName, args) {
     const filePathE = String(argsObjE.file_path ?? argsObjE.path ?? argsObjE.filename ?? "");
     const dlpMatch = (filePathE ? scanFilePath(filePathE) : null) ?? (args !== void 0 ? scanArgs(args) : null);
     if (dlpMatch) {
+      const dlpBlocks = dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block";
       steps.push({
         name: "DLP Content Scanner",
-        outcome: dlpMatch.severity === "block" ? "block" : "review",
+        outcome: dlpBlocks ? "block" : "review",
         detail: `\u{1F6A8} ${dlpMatch.patternName} detected in ${dlpMatch.fieldPath} \u2014 sample: ${dlpMatch.redactedSample}`,
-        isFinal: dlpMatch.severity === "block"
+        isFinal: dlpBlocks
       });
-      if (dlpMatch.severity === "block") {
+      if (dlpBlocks) {
         return { tool: toolName, args, waterfall, steps, decision: "block" };
       }
     } else {
@@ -7122,7 +7141,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const dlpMatch = (filePath ? scanFilePath(filePath) : null) ?? scanArgs(args);
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
-      if (dlpMatch.severity === "block") {
+      if (dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block") {
         let dlpEid;
         if (!isManual)
           dlpEid = appendLocalAudit(
@@ -7460,12 +7479,14 @@ ${appPermReview}`
       );
     }
   }
-  const cloudEnforcedForDefer = approvers.cloud && !!creds?.apiKey;
-  if (options?.deferReview && !taintWarning && !appPermReview && !cloudEnforcedForDefer) {
+  if (options?.deferReview && !hardBlockDowngraded) {
     return {
       approved: false,
       review: true,
-      reason: explainableLabel || "Node9 flagged this action for review.",
+      // The prompt must say WHY: the taint sentence beats the bare label so
+      // the dev sees the actual risk context inline. (No appPermReview term:
+      // deferReview and serverKey never co-occur in production — see above.)
+      reason: taintWarning || explainableLabel || "Node9 flagged this action for review.",
       ruleDescription: policyRuleDescription,
       blockedByLabel: explainableLabel
     };
@@ -8412,7 +8433,7 @@ function printInlineAskNotice() {
   );
   console.log(
     chalk.gray(
-      '      Prefer node9\u2019s own approver? Set "reviewChannel": "approver" in config, or add --no-ask to the hook.\n      (Inline prompts are auto-disabled when a cloud approver is configured.)'
+      '      Prefer node9\u2019s own approver? Set "reviewChannel": "approver" in config, or add --no-ask to the hook.\n      (Inline is the default for every review; with a cloud workspace the outcome ships to the dashboard as audit.)'
     )
   );
 }
@@ -18351,7 +18372,9 @@ function extractManagedConfig(body) {
     const d = {};
     if (typeof mc.dlp.enabled === "boolean") d.enabled = mc.dlp.enabled;
     if (typeof mc.dlp.pii === "string") d.pii = mc.dlp.pii;
-    if (d.enabled !== void 0 || d.pii !== void 0) out.dlp = d;
+    if (mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block")
+      d.reviewAction = mc.dlp.reviewAction;
+    if (d.enabled !== void 0 || d.pii !== void 0 || d.reviewAction !== void 0) out.dlp = d;
   }
   if (mc.approvers && typeof mc.approvers === "object") {
     const a = {};
@@ -19043,12 +19066,23 @@ function classifyDecision(a, b) {
 function decisionTag(view) {
   return `[${view.label}]`.padEnd(14);
 }
-var HUMAN_SOURCES, TIMEOUT_SOURCES, has;
+var HUMAN_SOURCES, TIMEOUT_SOURCES, NON_DECISION_SOURCES, has;
 var init_decision = __esm({
   "src/audit/decision.ts"() {
     "use strict";
-    HUMAN_SOURCES = /* @__PURE__ */ new Set(["daemon", "cloud", "local-decision", "inline-review-approved"]);
+    HUMAN_SOURCES = /* @__PURE__ */ new Set([
+      "daemon",
+      "cloud",
+      "local-decision",
+      "inline-review-approved",
+      "inline-review"
+    ]);
     TIMEOUT_SOURCES = /* @__PURE__ */ new Set(["timeout"]);
+    NON_DECISION_SOURCES = /* @__PURE__ */ new Set([
+      "post-hook",
+      "inline-review-approved",
+      "response-dlp"
+    ]);
     has = (s, needle) => s.includes(needle);
   }
 });
@@ -19631,7 +19665,7 @@ function buildDaemonReport(allEntries, period, now) {
   else if (period === "30d") start.setDate(start.getDate() - 29);
   else if (period === "month") start = new Date(now.getFullYear(), now.getMonth(), 1);
   const entries = allEntries.filter((e) => {
-    if (e.source === "post-hook" || e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     return new Date(e.ts) >= start;
   });
   const isBlocked = (e) => classifyDecision(e).outcome === "deny";
@@ -47372,8 +47406,8 @@ INSTRUCTIONS:
 - Do NOT retry this exact command or attempt to bypass the rule.${recovery}
 - Inform the user which security rule was triggered and ask how to proceed.`;
 }
-function buildReviewMessage(blockedByLabel, ruleDescription) {
-  const why = ruleDescription || blockedByLabel || "this action needs your review";
+function buildReviewMessage(blockedByLabel, ruleDescription, reason) {
+  const why = ruleDescription || (reason && reason !== blockedByLabel ? reason : void 0) || blockedByLabel || "this action needs your review";
   return `Node9 flagged this for your review: ${why}. Approve to proceed, or deny to cancel.`;
 }
 
@@ -48114,6 +48148,7 @@ import path46 from "path";
 function storePath() {
   return process.env.NODE9_PENDING_STORE || path46.join(os43.homedir(), ".node9", "pending-reviews.json");
 }
+var TTL_TUID_MS = 72 * 60 * 60 * 1e3;
 var TTL_MS2 = 6 * 60 * 60 * 1e3;
 var MAX_ENTRIES = 500;
 function reviewCorrelationKey(payload) {
@@ -48147,7 +48182,9 @@ function write(store) {
   }
 }
 function prune(entries, now) {
-  const fresh = entries.filter((e) => now - e.ts < TTL_MS2);
+  const fresh = entries.filter(
+    (e) => now - e.ts < (e.key.startsWith("tuid:") ? TTL_TUID_MS : TTL_MS2)
+  );
   return fresh.length > MAX_ENTRIES ? fresh.slice(fresh.length - MAX_ENTRIES) : fresh;
 }
 function recordPendingReview(entry) {
@@ -48162,19 +48199,30 @@ function recordPendingReview(entry) {
 function resolvePendingReview(key, now = Date.now()) {
   try {
     const store = read();
-    const idx = store.entries.findIndex((e) => e.key === key);
+    const live = prune(store.entries, now);
+    const idx = live.findIndex((e) => e.key === key);
     if (idx === -1) {
-      const pruned = prune(store.entries, now);
-      if (pruned.length !== store.entries.length) write({ entries: pruned });
+      if (live.length !== store.entries.length) write({ entries: live });
       return null;
     }
-    const [match] = store.entries.splice(idx, 1);
-    write({ entries: prune(store.entries, now) });
+    const [match] = live.splice(idx, 1);
+    write({ entries: live });
     return match;
   } catch {
     return null;
   }
 }
+function discardPendingReview(key, now = Date.now()) {
+  try {
+    const store = read();
+    const kept = prune(
+      store.entries.filter((e) => e.key !== key),
+      now
+    );
+    if (kept.length !== store.entries.length) write({ entries: kept });
+  } catch {
+  }
+}
 
 // src/cli/commands/check.ts
 init_hook_payload();
@@ -48230,7 +48278,10 @@ function agentSupportsAsk(agent) {
 }
 function resolveAskMode(agent, opts, config) {
   if (!agentSupportsAsk(agent)) return false;
-  if (config.settings.approvers.cloud === true) return false;
+  if (config.settings.reviewChannelManaged === true) {
+    if (config.settings.reviewChannel === "ask") return true;
+    if (config.settings.reviewChannel === "approver") return false;
+  }
   if (opts.ask === true) return true;
   if (opts.ask === false) return false;
   if (config.settings.reviewChannel === "ask") return true;
@@ -48469,7 +48520,11 @@ RAW: ${raw}
           process.exit(2);
         };
         const sendAsk = (result2) => {
-          const msg = buildReviewMessage(result2.blockedByLabel, result2.ruleDescription);
+          const msg = buildReviewMessage(
+            result2.blockedByLabel,
+            result2.ruleDescription,
+            result2.reason
+          );
           try {
             const key = reviewCorrelationKey(payload);
             if (key) {
@@ -48652,6 +48707,13 @@ RAW: ${raw}
           cwd: safeCwdForAuth,
           deferReview: askMode
         });
+        if (!result.review) {
+          try {
+            const key = reviewCorrelationKey(payload);
+            if (key) discardPendingReview(key);
+          } catch {
+          }
+        }
         if (result.approved) {
           if (result.checkedBy && process.env.NODE9_DEBUG === "1")
             process.stderr.write(`\u2713 node9 [${result.checkedBy}]: "${toolName}" allowed
@@ -48828,9 +48890,11 @@ function registerLogCommand(program2) {
         })();
         const agent = agentOverride !== void 0 ? agentOverride : metaTag !== void 0 ? metaTag : payload.turn_id !== void 0 ? "Codex" : payload.toolCall !== void 0 || payload.conversationId !== void 0 ? "Antigravity" : payload.hook_event_name === "pre_tool_call" || payload.hook_event_name === "post_tool_call" ? "Hermes" : payload.hook_event_name === "PreToolUse" || payload.hook_event_name === "PostToolUse" || payload.tool_use_id !== void 0 || payload.permission_mode !== void 0 ? "Claude Code" : payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0 ? "Gemini CLI" : process.env.HERMES_SESSION_ID || process.env.HERMES_HOME || process.env.HERMES_INTERACTIVE ? "Hermes" : process.env.ANTIGRAVITY_CONVERSATION_ID ? "Antigravity" : void 0;
         let reviewApproved = false;
+        let resolvedReview = null;
         try {
           const key = reviewCorrelationKey(payload);
-          if (key && resolvePendingReview(key)) reviewApproved = true;
+          if (key) resolvedReview = resolvePendingReview(key);
+          if (resolvedReview) reviewApproved = true;
         } catch {
         }
         const entry = {
@@ -48883,6 +48947,33 @@ function registerLogCommand(program2) {
         const payloadCwd = typeof payload.cwd === "string" ? payload.cwd : Array.isArray(payload.workspacePaths) && typeof payload.workspacePaths[0] === "string" ? payload.workspacePaths[0] : void 0;
         const safeCwd = typeof payloadCwd === "string" && path48.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         const config = getConfig(safeCwd);
+        if (resolvedReview) {
+          try {
+            const reviewLabel = resolvedReview.label || "inline-review";
+            const sensitiveReview = /dlp|taint/i.test(reviewLabel);
+            appendLocalAudit(
+              tool,
+              rawInput,
+              "allow",
+              "inline-review",
+              {
+                agent,
+                ruleName: reviewLabel,
+                ...rawToolName !== tool ? { agentToolName: rawToolName } : {},
+                ...typeof payloadSessionId === "string" ? { sessionId: payloadSessionId } : {},
+                ...safeCwd ? { workingDir: safeCwd } : {}
+              },
+              sensitiveReview || config.settings.auditHashArgs === true
+            );
+          } catch (err2) {
+            appendToLog(HOOK_DEBUG_LOG, {
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              event: "inline-review-ship-row-fail",
+              tool,
+              error: err2 instanceof Error ? err2.message : String(err2)
+            });
+          }
+        }
         {
           const toolOutput = payload.tool_response?.output;
           const inj = config.policy.injectionScan;
@@ -50351,8 +50442,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const priorEnd = new Date(start.getTime() - 1);
   const priorStart = new Date(start.getTime() - periodMs);
   const priorEntries = allEntries.filter((e) => {
-    if (e.source === "post-hook") return false;
-    if (e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     return ts >= priorStart && ts <= priorEnd;
@@ -50363,8 +50453,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const testTs = excludeTests ? buildTestTimestamps(allEntries) : /* @__PURE__ */ new Set();
   let excludedTests = 0;
   const entries = allEntries.filter((e) => {
-    if (e.source === "post-hook") return false;
-    if (e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     if (ts < start || ts > end) return false;

package/dist/dashboard.mjs

@@ -2292,8 +2292,10 @@ var init_config_schema = __esm({
         agentPolicy: z.enum(["require_approval", "block_on_rules"]).optional(),
         // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
         // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
-        // node9's own approver (terminal/native/cloud). Unset → smart default
-        // (ask for ask-capable agents unless a cloud approver is configured).
+        // node9's own approver (terminal/native/cloud). Unset → default ASK for
+        // ask-capable agents (v2: cloud no longer disables inline — the outcome
+        // ships to the dashboard as audit; admins force routing via managed
+        // reviewChannel, which outranks the local --ask flag).
         reviewChannel: z.enum(["ask", "approver"]).optional(),
         // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
         // approver_set). Default (unset/false): those tools refuse over MCP — a human
@@ -2331,7 +2333,8 @@ var init_config_schema = __esm({
         dlp: z.object({
           enabled: z.boolean().optional(),
           scanIgnoredTools: z.boolean().optional(),
-          pii: z.enum(["off", "block"]).optional()
+          pii: z.enum(["off", "block"]).optional(),
+          reviewAction: z.enum(["review", "block"]).optional()
         }).optional(),
         egress: z.object({
           enabled: z.boolean().optional(),
@@ -2960,17 +2963,6 @@ var init_costSync = __esm({
   }
 });
 
-// src/daemon/scan-watermark.ts
-var MAX_LINE_BYTES;
-var init_scan_watermark = __esm({
-  "src/daemon/scan-watermark.ts"() {
-    "use strict";
-    init_dlp();
-    init_dist();
-    MAX_LINE_BYTES = 2 * 1024 * 1024;
-  }
-});
-
 // src/audit/decision.ts
 function classifyDecision(a, b) {
   const isRow = !!a && typeof a === "object";
@@ -3005,16 +2997,38 @@ function classifyDecision(a, b) {
   }
   return { outcome: "unknown", label: raw ? `? ${raw}` : "? (none)", raw };
 }
-var HUMAN_SOURCES, TIMEOUT_SOURCES, has;
+var HUMAN_SOURCES, TIMEOUT_SOURCES, NON_DECISION_SOURCES, has;
 var init_decision = __esm({
   "src/audit/decision.ts"() {
     "use strict";
-    HUMAN_SOURCES = /* @__PURE__ */ new Set(["daemon", "cloud", "local-decision", "inline-review-approved"]);
+    HUMAN_SOURCES = /* @__PURE__ */ new Set([
+      "daemon",
+      "cloud",
+      "local-decision",
+      "inline-review-approved",
+      "inline-review"
+    ]);
     TIMEOUT_SOURCES = /* @__PURE__ */ new Set(["timeout"]);
+    NON_DECISION_SOURCES = /* @__PURE__ */ new Set([
+      "post-hook",
+      "inline-review-approved",
+      "response-dlp"
+    ]);
     has = (s, needle) => s.includes(needle);
   }
 });
 
+// src/daemon/scan-watermark.ts
+var MAX_LINE_BYTES;
+var init_scan_watermark = __esm({
+  "src/daemon/scan-watermark.ts"() {
+    "use strict";
+    init_dlp();
+    init_dist();
+    MAX_LINE_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // src/cli/aggregate/report-audit.ts
 import fs5 from "fs";
 import os6 from "os";
@@ -3574,8 +3588,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const priorEnd = new Date(start.getTime() - 1);
   const priorStart = new Date(start.getTime() - periodMs);
   const priorEntries = allEntries.filter((e) => {
-    if (e.source === "post-hook") return false;
-    if (e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     return ts >= priorStart && ts <= priorEnd;
@@ -3586,8 +3599,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const testTs = excludeTests ? buildTestTimestamps(allEntries) : /* @__PURE__ */ new Set();
   let excludedTests = 0;
   const entries = allEntries.filter((e) => {
-    if (e.source === "post-hook") return false;
-    if (e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     if (ts < start || ts > end) return false;
@@ -4915,7 +4927,7 @@ function readAuditEntriesAsync(chunkSize = 1e3, customPath) {
 }
 function aggregateAudit(entries, startMs, endMs = Date.now()) {
   const inWindow = entries.filter((e) => {
-    if (e.source === "post-hook" || e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     const t = Date.parse(e.ts);
     return t >= startMs && t <= endMs;
   });
@@ -5361,6 +5373,7 @@ var init_data = __esm({
     init_daemon();
     init_costSync();
     init_shields();
+    init_decision();
     init_scan_watermark();
     init_report_audit();
     init_litellm();

package/dist/index.js

@@ -91,7 +91,7 @@ function redactSecrets(text) {
   if (!text) return text;
   let redacted = text;
   redacted = redacted.replace(
-    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/\\=]+/gi,
+    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/=]+/gi,
     "$1********"
   );
   redacted = redacted.replace(
@@ -152,7 +152,7 @@ function filePathFromArgs(args) {
   return void 0;
 }
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
-  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern);
+  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern) || /dlp|taint/i.test(String(meta?.ruleName ?? ""));
   const preview = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args), ...preview ? { argsPreview: preview } : {} } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
@@ -314,8 +314,10 @@ var ConfigFileSchema = import_zod.z.object({
     agentPolicy: import_zod.z.enum(["require_approval", "block_on_rules"]).optional(),
     // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
     // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
-    // node9's own approver (terminal/native/cloud). Unset → smart default
-    // (ask for ask-capable agents unless a cloud approver is configured).
+    // node9's own approver (terminal/native/cloud). Unset → default ASK for
+    // ask-capable agents (v2: cloud no longer disables inline — the outcome
+    // ships to the dashboard as audit; admins force routing via managed
+    // reviewChannel, which outranks the local --ask flag).
     reviewChannel: import_zod.z.enum(["ask", "approver"]).optional(),
     // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
     // approver_set). Default (unset/false): those tools refuse over MCP — a human
@@ -353,7 +355,8 @@ var ConfigFileSchema = import_zod.z.object({
     dlp: import_zod.z.object({
       enabled: import_zod.z.boolean().optional(),
       scanIgnoredTools: import_zod.z.boolean().optional(),
-      pii: import_zod.z.enum(["off", "block"]).optional()
+      pii: import_zod.z.enum(["off", "block"]).optional(),
+      reviewAction: import_zod.z.enum(["review", "block"]).optional()
     }).optional(),
     egress: import_zod.z.object({
       enabled: import_zod.z.boolean().optional(),
@@ -2442,7 +2445,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const dlpMatch = args !== void 0 ? scanArgs(args) : null;
     if (dlpMatch) {
       return {
-        decision: dlpMatch.severity,
+        // reviewAction:'block' (inline-ask v2): the admin upgraded
+        // review-severity matches to a hard block — every evaluatePolicy
+        // caller (orchestrator, explain, gateway) must agree with the gate.
+        decision: dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block" ? "block" : "review",
         blockedByLabel: `DLP: ${dlpMatch.patternName}`,
         reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
       };
@@ -3638,6 +3644,7 @@ function applyManagedEgress(local, managed, locked) {
   return next;
 }
 var DLP_PII_ORDER = ["off", "block"];
+var DLP_REVIEW_ACTION_ORDER = ["review", "block"];
 function applyManagedDlp(local, managed, locked) {
   const next = { ...local };
   if (typeof managed.enabled === "boolean") {
@@ -3651,6 +3658,14 @@ function applyManagedDlp(local, managed, locked) {
       locked.includes("dlpPii")
     );
   }
+  if (typeof managed.reviewAction === "string") {
+    next.reviewAction = resolveByOrder(
+      DLP_REVIEW_ACTION_ORDER,
+      local.reviewAction ?? "review",
+      managed.reviewAction,
+      locked.includes("dlpReviewAction")
+    );
+  }
   return next;
 }
 function applyManagedApprovers(local, managed) {
@@ -4221,6 +4236,7 @@ function getConfig(cwd) {
       if (d.enabled !== void 0) mergedPolicy.dlp.enabled = d.enabled;
       if (d.scanIgnoredTools !== void 0) mergedPolicy.dlp.scanIgnoredTools = d.scanIgnoredTools;
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
+      if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
     }
     if (p.egress) {
       const e = p.egress;
@@ -4317,7 +4333,8 @@ function getConfig(cwd) {
             mergedPolicy.dlp,
             {
               enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
-              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0
+              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
+              reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
             },
             locked
           );
@@ -4333,6 +4350,7 @@ function getConfig(cwd) {
         }
         if (mc.reviewChannel === "ask" || mc.reviewChannel === "approver") {
           mergedSettings.reviewChannel = mc.reviewChannel;
+          mergedSettings.reviewChannelManaged = true;
         }
         if (typeof mc.approvalTimeoutMs === "number" && mc.approvalTimeoutMs > 0) {
           mergedSettings.approvalTimeoutMs = mc.approvalTimeoutMs;
@@ -5691,7 +5709,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const dlpMatch = (filePath ? scanFilePath(filePath) : null) ?? scanArgs(args);
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
-      if (dlpMatch.severity === "block") {
+      if (dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block") {
         let dlpEid;
         if (!isManual)
           dlpEid = appendLocalAudit(
@@ -6029,12 +6047,14 @@ ${appPermReview}`
       );
     }
   }
-  const cloudEnforcedForDefer = approvers.cloud && !!creds?.apiKey;
-  if (options?.deferReview && !taintWarning && !appPermReview && !cloudEnforcedForDefer) {
+  if (options?.deferReview && !hardBlockDowngraded) {
     return {
       approved: false,
       review: true,
-      reason: explainableLabel || "Node9 flagged this action for review.",
+      // The prompt must say WHY: the taint sentence beats the bare label so
+      // the dev sees the actual risk context inline. (No appPermReview term:
+      // deferReview and serverKey never co-occur in production — see above.)
+      reason: taintWarning || explainableLabel || "Node9 flagged this action for review.",
       ruleDescription: policyRuleDescription,
       blockedByLabel: explainableLabel
     };

package/dist/index.mjs

@@ -72,7 +72,7 @@ function redactSecrets(text) {
   if (!text) return text;
   let redacted = text;
   redacted = redacted.replace(
-    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/\\=]+/gi,
+    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/=]+/gi,
     "$1********"
   );
   redacted = redacted.replace(
@@ -133,7 +133,7 @@ function filePathFromArgs(args) {
   return void 0;
 }
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
-  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern);
+  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern) || /dlp|taint/i.test(String(meta?.ruleName ?? ""));
   const preview = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args), ...preview ? { argsPreview: preview } : {} } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
@@ -284,8 +284,10 @@ var ConfigFileSchema = z.object({
     agentPolicy: z.enum(["require_approval", "block_on_rules"]).optional(),
     // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
     // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
-    // node9's own approver (terminal/native/cloud). Unset → smart default
-    // (ask for ask-capable agents unless a cloud approver is configured).
+    // node9's own approver (terminal/native/cloud). Unset → default ASK for
+    // ask-capable agents (v2: cloud no longer disables inline — the outcome
+    // ships to the dashboard as audit; admins force routing via managed
+    // reviewChannel, which outranks the local --ask flag).
     reviewChannel: z.enum(["ask", "approver"]).optional(),
     // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
     // approver_set). Default (unset/false): those tools refuse over MCP — a human
@@ -323,7 +325,8 @@ var ConfigFileSchema = z.object({
     dlp: z.object({
       enabled: z.boolean().optional(),
       scanIgnoredTools: z.boolean().optional(),
-      pii: z.enum(["off", "block"]).optional()
+      pii: z.enum(["off", "block"]).optional(),
+      reviewAction: z.enum(["review", "block"]).optional()
     }).optional(),
     egress: z.object({
       enabled: z.boolean().optional(),
@@ -2412,7 +2415,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const dlpMatch = args !== void 0 ? scanArgs(args) : null;
     if (dlpMatch) {
       return {
-        decision: dlpMatch.severity,
+        // reviewAction:'block' (inline-ask v2): the admin upgraded
+        // review-severity matches to a hard block — every evaluatePolicy
+        // caller (orchestrator, explain, gateway) must agree with the gate.
+        decision: dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block" ? "block" : "review",
         blockedByLabel: `DLP: ${dlpMatch.patternName}`,
         reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
       };
@@ -3608,6 +3614,7 @@ function applyManagedEgress(local, managed, locked) {
   return next;
 }
 var DLP_PII_ORDER = ["off", "block"];
+var DLP_REVIEW_ACTION_ORDER = ["review", "block"];
 function applyManagedDlp(local, managed, locked) {
   const next = { ...local };
   if (typeof managed.enabled === "boolean") {
@@ -3621,6 +3628,14 @@ function applyManagedDlp(local, managed, locked) {
       locked.includes("dlpPii")
     );
   }
+  if (typeof managed.reviewAction === "string") {
+    next.reviewAction = resolveByOrder(
+      DLP_REVIEW_ACTION_ORDER,
+      local.reviewAction ?? "review",
+      managed.reviewAction,
+      locked.includes("dlpReviewAction")
+    );
+  }
   return next;
 }
 function applyManagedApprovers(local, managed) {
@@ -4191,6 +4206,7 @@ function getConfig(cwd) {
       if (d.enabled !== void 0) mergedPolicy.dlp.enabled = d.enabled;
       if (d.scanIgnoredTools !== void 0) mergedPolicy.dlp.scanIgnoredTools = d.scanIgnoredTools;
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
+      if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
     }
     if (p.egress) {
       const e = p.egress;
@@ -4287,7 +4303,8 @@ function getConfig(cwd) {
             mergedPolicy.dlp,
             {
               enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
-              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0
+              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
+              reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
             },
             locked
           );
@@ -4303,6 +4320,7 @@ function getConfig(cwd) {
         }
         if (mc.reviewChannel === "ask" || mc.reviewChannel === "approver") {
           mergedSettings.reviewChannel = mc.reviewChannel;
+          mergedSettings.reviewChannelManaged = true;
         }
         if (typeof mc.approvalTimeoutMs === "number" && mc.approvalTimeoutMs > 0) {
           mergedSettings.approvalTimeoutMs = mc.approvalTimeoutMs;
@@ -5661,7 +5679,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const dlpMatch = (filePath ? scanFilePath(filePath) : null) ?? scanArgs(args);
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
-      if (dlpMatch.severity === "block") {
+      if (dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block") {
         let dlpEid;
         if (!isManual)
           dlpEid = appendLocalAudit(
@@ -5999,12 +6017,14 @@ ${appPermReview}`
       );
     }
   }
-  const cloudEnforcedForDefer = approvers.cloud && !!creds?.apiKey;
-  if (options?.deferReview && !taintWarning && !appPermReview && !cloudEnforcedForDefer) {
+  if (options?.deferReview && !hardBlockDowngraded) {
     return {
       approved: false,
       review: true,
-      reason: explainableLabel || "Node9 flagged this action for review.",
+      // The prompt must say WHY: the taint sentence beats the bare label so
+      // the dev sees the actual risk context inline. (No appPermReview term:
+      // deferReview and serverKey never co-occur in production — see above.)
+      reason: taintWarning || explainableLabel || "Node9 flagged this action for review.",
       ruleDescription: policyRuleDescription,
       blockedByLabel: explainableLabel
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.65.0",
+  "version": "1.66.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",