@node9/proxy 1.65.1 → 1.67.0

package/dist/cli.js

@@ -94,7 +94,7 @@ function redactSecrets(text) {
   if (!text) return text;
   let redacted = text;
   redacted = redacted.replace(
-    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/\\=]+/gi,
+    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/=]+/gi,
     "$1********"
   );
   redacted = redacted.replace(
@@ -155,7 +155,7 @@ function filePathFromArgs(args) {
   return void 0;
 }
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
-  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern);
+  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern) || /dlp|taint/i.test(String(meta?.ruleName ?? ""));
   const preview2 = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args), ...preview2 ? { argsPreview: preview2 } : {} } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
@@ -332,8 +332,10 @@ var init_config_schema = __esm({
         agentPolicy: import_zod.z.enum(["require_approval", "block_on_rules"]).optional(),
         // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
         // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
-        // node9's own approver (terminal/native/cloud). Unset → smart default
-        // (ask for ask-capable agents unless a cloud approver is configured).
+        // node9's own approver (terminal/native/cloud). Unset → default ASK for
+        // ask-capable agents (v2: cloud no longer disables inline — the outcome
+        // ships to the dashboard as audit; admins force routing via managed
+        // reviewChannel, which outranks the local --ask flag).
         reviewChannel: import_zod.z.enum(["ask", "approver"]).optional(),
         // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
         // approver_set). Default (unset/false): those tools refuse over MCP — a human
@@ -371,7 +373,18 @@ var init_config_schema = __esm({
         dlp: import_zod.z.object({
           enabled: import_zod.z.boolean().optional(),
           scanIgnoredTools: import_zod.z.boolean().optional(),
-          pii: import_zod.z.enum(["off", "block"]).optional()
+          pii: import_zod.z.enum(["off", "block"]).optional(),
+          reviewAction: import_zod.z.enum(["review", "block"]).optional()
+        }).optional(),
+        // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
+        // deliberately exclude 'off' — tighten-only.
+        commandChecks: import_zod.z.object({
+          inlineExec: import_zod.z.enum(["off", "review", "block"]).optional(),
+          rmAdvisory: import_zod.z.enum(["off", "review", "block"]).optional(),
+          chmod: import_zod.z.enum(["off", "review", "block"]).optional(),
+          sqlDdl: import_zod.z.enum(["off", "review", "block"]).optional(),
+          evalDynamic: import_zod.z.enum(["review", "block"]).optional(),
+          pipeChainHigh: import_zod.z.enum(["review", "block"]).optional()
         }).optional(),
         egress: import_zod.z.object({
           enabled: import_zod.z.boolean().optional(),
@@ -1510,6 +1523,45 @@ function evaluateSmartConditions(args, rule) {
   });
   return mode === "any" ? results.some((r) => r) : results.every((r) => r);
 }
+function resolveCheck(v) {
+  return v === "off" || v === "block" ? v : "review";
+}
+function resolveCheckTight(v) {
+  return v === "block" ? "block" : "review";
+}
+function detectInlineExec(command) {
+  const pipeFed = command.includes("|");
+  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
+  for (const rawSeg of segments) {
+    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
+    if (i >= tokens.length) continue;
+    const base = tokens[i].split("/").pop() ?? tokens[i];
+    if (!INLINE_INTERP.test(base)) continue;
+    const args = tokens.slice(i + 1);
+    let hadRedirect = false;
+    const positionals = [];
+    for (let j = 0; j < args.length; j++) {
+      const a = args[j];
+      if (a === "-") return true;
+      if (a.startsWith("<")) {
+        hadRedirect = true;
+        if (a === "<" || a === "<<") j++;
+        continue;
+      }
+      if (a.startsWith("-")) {
+        if (/^-(c|e|eval)$/i.test(a)) return true;
+        continue;
+      }
+      positionals.push(a);
+    }
+    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
+      return true;
+    }
+  }
+  return false;
+}
 function resolvePinned(matches) {
   if (matches.length === 0) return void 0;
   const pinned = matches.filter((r) => r.pinned);
@@ -1536,7 +1588,7 @@ function isSqlTool(toolName, toolInspection) {
   const fieldName = toolInspection[matchingPattern];
   return fieldName === "sql" || fieldName === "query";
 }
-function pipeChainVerdict(command, isTrustedHost2) {
+function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
   const pipeAnalysis = analyzePipeChain(command);
   if (!pipeAnalysis.isPipeline) return null;
   if (pipeAnalysis.risk !== "critical" && pipeAnalysis.risk !== "high") return null;
@@ -1567,7 +1619,7 @@ function pipeChainVerdict(command, isTrustedHost2) {
     };
   }
   return {
-    decision: "review",
+    decision: highAction,
     blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
     reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
     tier: 3
@@ -1581,7 +1633,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const dlpMatch = args !== void 0 ? scanArgs(args) : null;
     if (dlpMatch) {
       return {
-        decision: dlpMatch.severity,
+        // reviewAction:'block' (inline-ask v2): the admin upgraded
+        // review-severity matches to a hard block — every evaluatePolicy
+        // caller (orchestrator, explain, gateway) must agree with the gate.
+        decision: dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block" ? "block" : "review",
         blockedByLabel: `DLP: ${dlpMatch.patternName}`,
         reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
       };
@@ -1590,7 +1645,11 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   if (wouldBeIgnored) return { decision: "allow" };
   const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
   if (bashCommand !== null) {
-    const pipeVerdict = pipeChainVerdict(bashCommand, isTrustedHost2);
+    const pipeVerdict = pipeChainVerdict(
+      bashCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (pipeVerdict) return pipeVerdict;
     const fsVerdict = analyzeFsOperation(bashCommand);
     if (fsVerdict) {
@@ -1605,10 +1664,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
-    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
+    const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
     if (sqlVerdict) {
       return {
-        decision: sqlVerdict.verdict,
+        // analyzeSqlDestructive is typed review-only, so the knob maps 1:1.
+        decision: sqlAction === "block" ? "block" : "review",
         blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
         reason: sqlVerdict.reason,
         tier: 2,
@@ -1616,10 +1677,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
-    const chmodVerdict = analyzeChmod777(bashCommand);
+    const chmodAction = resolveCheck(config.policy.commandChecks?.chmod);
+    const chmodVerdict = chmodAction === "off" ? null : analyzeChmod777(bashCommand);
     if (chmodVerdict) {
       return {
-        decision: chmodVerdict.verdict,
+        // analyzeChmod777 is typed review-only, so the knob maps 1:1.
+        decision: chmodAction === "block" ? "block" : "review",
         blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
         reason: chmodVerdict.reason,
         tier: 2,
@@ -1662,10 +1725,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
       return {
-        decision: "review",
+        decision: inlineAction === "block" ? "block" : "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
         ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
         tier: 3
@@ -1683,14 +1746,21 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     if (evalVerdict === "review") {
       return {
-        decision: "review",
+        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
+        // block but can never turn this off (eval-remote above is Class A —
+        // no knob at all).
+        decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
       };
     }
-    const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost2);
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (ptVerdict) return ptVerdict;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
@@ -2372,7 +2442,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, INLINE_INTERP, INLINE_SHELL, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3309,6 +3379,8 @@ var init_dist = __esm({
     REGEX_CACHE_MAX = 500;
     regexCache = /* @__PURE__ */ new Map();
     FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+    INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
+    INLINE_SHELL = /^(bash|sh|zsh)$/i;
     VERDICT_RANK = {
       allow: 0,
       review: 1,
@@ -4366,6 +4438,31 @@ function applyManagedDlp(local, managed, locked) {
       locked.includes("dlpPii")
     );
   }
+  if (typeof managed.reviewAction === "string") {
+    next.reviewAction = resolveByOrder(
+      DLP_REVIEW_ACTION_ORDER,
+      local.reviewAction ?? "review",
+      managed.reviewAction,
+      locked.includes("dlpReviewAction")
+    );
+  }
+  return next;
+}
+function applyManagedCommandChecks(local, managed, locked) {
+  const next = { ...local };
+  for (const key of COMMAND_CHECK_KEYS) {
+    const m = managed[key];
+    if (typeof m !== "string") continue;
+    const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
+    const resolved = resolveByOrder(
+      COMMAND_CHECK_ORDER,
+      local[key] ?? "review",
+      m,
+      locked.includes(lockKey)
+    );
+    if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
+    next[key] = resolved;
+  }
   return next;
 }
 function applyManagedApprovers(local, managed) {
@@ -4377,13 +4474,23 @@ function applyManagedApprovers(local, managed) {
     terminal: typeof managed.terminal === "boolean" ? managed.terminal : local.terminal
   };
 }
-var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER;
+var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER, COMMAND_CHECK_ORDER, COMMAND_CHECK_KEYS;
 var init_managed = __esm({
   "src/config/managed.ts"() {
     "use strict";
     MODE_ORDER = ["observe", "audit", "standard", "strict"];
     EGRESS_MODE_ORDER = ["off", "review", "block"];
     DLP_PII_ORDER = ["off", "block"];
+    DLP_REVIEW_ACTION_ORDER = ["review", "block"];
+    COMMAND_CHECK_ORDER = ["off", "review", "block"];
+    COMMAND_CHECK_KEYS = [
+      "inlineExec",
+      "rmAdvisory",
+      "chmod",
+      "sqlDdl",
+      "evalDynamic",
+      "pipeChainHigh"
+    ];
   }
 });
 
@@ -4758,6 +4865,22 @@ function getConfig(cwd) {
       if (d.enabled !== void 0) mergedPolicy.dlp.enabled = d.enabled;
       if (d.scanIgnoredTools !== void 0) mergedPolicy.dlp.scanIgnoredTools = d.scanIgnoredTools;
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
+      if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
+    }
+    if (p.commandChecks && typeof p.commandChecks === "object") {
+      const src = p.commandChecks;
+      const cc2 = {
+        ...mergedPolicy.commandChecks
+      };
+      for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+        const v = src[k];
+        if (v === "off" || v === "review" || v === "block") cc2[k] = v;
+      }
+      for (const k of ["evalDynamic", "pipeChainHigh"]) {
+        const v = src[k];
+        if (v === "review" || v === "block") cc2[k] = v;
+      }
+      if (Object.keys(cc2).length > 0) mergedPolicy.commandChecks = cc2;
     }
     if (p.egress) {
       const e = p.egress;
@@ -4854,11 +4977,19 @@ function getConfig(cwd) {
             mergedPolicy.dlp,
             {
               enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
-              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0
+              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
+              reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
             },
             locked
           );
         }
+        if (mc.commandChecks && typeof mc.commandChecks === "object") {
+          mergedPolicy.commandChecks = applyManagedCommandChecks(
+            mergedPolicy.commandChecks ?? {},
+            mc.commandChecks,
+            locked
+          );
+        }
         if (mc.approvers && typeof mc.approvers === "object") {
           const bool = (v) => typeof v === "boolean" ? v : void 0;
           mergedSettings.approvers = applyManagedApprovers(mergedSettings.approvers, {
@@ -4870,6 +5001,7 @@ function getConfig(cwd) {
         }
         if (mc.reviewChannel === "ask" || mc.reviewChannel === "approver") {
           mergedSettings.reviewChannel = mc.reviewChannel;
+          mergedSettings.reviewChannelManaged = true;
         }
         if (typeof mc.approvalTimeoutMs === "number" && mc.approvalTimeoutMs > 0) {
           mergedSettings.approvalTimeoutMs = mc.approvalTimeoutMs;
@@ -4967,8 +5099,17 @@ function getConfig(cwd) {
     }
   }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
+  const cc = mergedPolicy.commandChecks ?? {};
+  const advisoryKnob = (name) => {
+    if (name === "review-rm") return cc.rmAdvisory;
+    if (name?.endsWith("-sql")) return cc.sqlDdl;
+    return void 0;
+  };
   for (const rule of ADVISORY_SMART_RULES) {
-    if (!existingAdvisoryNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
+    if (existingAdvisoryNames.has(rule.name)) continue;
+    const knob = rule.verdict === "review" ? advisoryKnob(rule.name) : void 0;
+    if (knob === "off") continue;
+    mergedPolicy.smartRules.push(knob === "block" ? { ...rule, verdict: "block" } : rule);
   }
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
@@ -5614,13 +5755,14 @@ async function deriveExplainTrace(toolName, args) {
     const filePathE = String(argsObjE.file_path ?? argsObjE.path ?? argsObjE.filename ?? "");
     const dlpMatch = (filePathE ? scanFilePath(filePathE) : null) ?? (args !== void 0 ? scanArgs(args) : null);
     if (dlpMatch) {
+      const dlpBlocks = dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block";
       steps.push({
         name: "DLP Content Scanner",
-        outcome: dlpMatch.severity === "block" ? "block" : "review",
+        outcome: dlpBlocks ? "block" : "review",
         detail: `\u{1F6A8} ${dlpMatch.patternName} detected in ${dlpMatch.fieldPath} \u2014 sample: ${dlpMatch.redactedSample}`,
-        isFinal: dlpMatch.severity === "block"
+        isFinal: dlpBlocks
       });
-      if (dlpMatch.severity === "block") {
+      if (dlpBlocks) {
         return { tool: toolName, args, waterfall, steps, decision: "block" };
       }
     } else {
@@ -7119,7 +7261,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const dlpMatch = (filePath ? scanFilePath(filePath) : null) ?? scanArgs(args);
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
-      if (dlpMatch.severity === "block") {
+      if (dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block") {
         let dlpEid;
         if (!isManual)
           dlpEid = appendLocalAudit(
@@ -7457,12 +7599,14 @@ ${appPermReview}`
       );
     }
   }
-  const cloudEnforcedForDefer = approvers.cloud && !!creds?.apiKey;
-  if (options?.deferReview && !hardBlockDowngraded && !taintWarning && !appPermReview && !cloudEnforcedForDefer) {
+  if (options?.deferReview && !hardBlockDowngraded) {
     return {
       approved: false,
       review: true,
-      reason: explainableLabel || "Node9 flagged this action for review.",
+      // The prompt must say WHY: the taint sentence beats the bare label so
+      // the dev sees the actual risk context inline. (No appPermReview term:
+      // deferReview and serverKey never co-occur in production — see above.)
+      reason: taintWarning || explainableLabel || "Node9 flagged this action for review.",
       ruleDescription: policyRuleDescription,
       blockedByLabel: explainableLabel
     };
@@ -8404,7 +8548,7 @@ function printInlineAskNotice() {
   );
   console.log(
     import_chalk.default.gray(
-      '      Prefer node9\u2019s own approver? Set "reviewChannel": "approver" in config, or add --no-ask to the hook.\n      (Inline prompts are auto-disabled when a cloud approver is configured.)'
+      '      Prefer node9\u2019s own approver? Set "reviewChannel": "approver" in config, or add --no-ask to the hook.\n      (Inline is the default for every review; with a cloud workspace the outcome ships to the dashboard as audit.)'
     )
   );
 }
@@ -18353,7 +18497,21 @@ function extractManagedConfig(body) {
     const d = {};
     if (typeof mc.dlp.enabled === "boolean") d.enabled = mc.dlp.enabled;
     if (typeof mc.dlp.pii === "string") d.pii = mc.dlp.pii;
-    if (d.enabled !== void 0 || d.pii !== void 0) out.dlp = d;
+    if (mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block")
+      d.reviewAction = mc.dlp.reviewAction;
+    if (d.enabled !== void 0 || d.pii !== void 0 || d.reviewAction !== void 0) out.dlp = d;
+  }
+  if (mc.commandChecks && typeof mc.commandChecks === "object") {
+    const cc = {};
+    for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+      const v = mc.commandChecks[k];
+      if (v === "off" || v === "review" || v === "block") cc[k] = v;
+    }
+    for (const k of ["evalDynamic", "pipeChainHigh"]) {
+      const v = mc.commandChecks[k];
+      if (v === "review" || v === "block") cc[k] = v;
+    }
+    if (Object.keys(cc).length > 0) out.commandChecks = cc;
   }
   if (mc.approvers && typeof mc.approvers === "object") {
     const a = {};
@@ -18417,7 +18575,7 @@ function extractManagedConfig(body) {
     }
     if (Object.keys(ap).length) out.appPermissions = ap;
   }
-  return out.mode !== void 0 || out.egress !== void 0 || out.dlp !== void 0 || out.approvers !== void 0 || out.reviewChannel !== void 0 || out.approvalTimeoutMs !== void 0 || out.injectionScan !== void 0 || out.loopDetection !== void 0 || out.skillPinning !== void 0 || out.jailPaths !== void 0 || out.trustedHosts !== void 0 || out.appPermissions !== void 0 ? out : void 0;
+  return out.mode !== void 0 || out.egress !== void 0 || out.dlp !== void 0 || out.commandChecks !== void 0 || out.approvers !== void 0 || out.reviewChannel !== void 0 || out.approvalTimeoutMs !== void 0 || out.injectionScan !== void 0 || out.loopDetection !== void 0 || out.skillPinning !== void 0 || out.jailPaths !== void 0 || out.trustedHosts !== void 0 || out.appPermissions !== void 0 ? out : void 0;
 }
 function sweepStaleTmp(target) {
   try {
@@ -19049,12 +19207,23 @@ function classifyDecision(a, b) {
 function decisionTag(view) {
   return `[${view.label}]`.padEnd(14);
 }
-var HUMAN_SOURCES, TIMEOUT_SOURCES, has;
+var HUMAN_SOURCES, TIMEOUT_SOURCES, NON_DECISION_SOURCES, has;
 var init_decision = __esm({
   "src/audit/decision.ts"() {
     "use strict";
-    HUMAN_SOURCES = /* @__PURE__ */ new Set(["daemon", "cloud", "local-decision", "inline-review-approved"]);
+    HUMAN_SOURCES = /* @__PURE__ */ new Set([
+      "daemon",
+      "cloud",
+      "local-decision",
+      "inline-review-approved",
+      "inline-review"
+    ]);
     TIMEOUT_SOURCES = /* @__PURE__ */ new Set(["timeout"]);
+    NON_DECISION_SOURCES = /* @__PURE__ */ new Set([
+      "post-hook",
+      "inline-review-approved",
+      "response-dlp"
+    ]);
     has = (s, needle) => s.includes(needle);
   }
 });
@@ -19630,7 +19799,7 @@ function buildDaemonReport(allEntries, period, now) {
   else if (period === "30d") start.setDate(start.getDate() - 29);
   else if (period === "month") start = new Date(now.getFullYear(), now.getMonth(), 1);
   const entries = allEntries.filter((e) => {
-    if (e.source === "post-hook" || e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     return new Date(e.ts) >= start;
   });
   const isBlocked = (e) => classifyDecision(e).outcome === "deny";
@@ -47379,8 +47548,8 @@ INSTRUCTIONS:
 - Do NOT retry this exact command or attempt to bypass the rule.${recovery}
 - Inform the user which security rule was triggered and ask how to proceed.`;
 }
-function buildReviewMessage(blockedByLabel, ruleDescription) {
-  const why = ruleDescription || blockedByLabel || "this action needs your review";
+function buildReviewMessage(blockedByLabel, ruleDescription, reason) {
+  const why = ruleDescription || (reason && reason !== blockedByLabel ? reason : void 0) || blockedByLabel || "this action needs your review";
   return `Node9 flagged this for your review: ${why}. Approve to proceed, or deny to cancel.`;
 }
 
@@ -48121,6 +48290,7 @@ init_hasher();
 function storePath() {
   return process.env.NODE9_PENDING_STORE || import_path45.default.join(import_os42.default.homedir(), ".node9", "pending-reviews.json");
 }
+var TTL_TUID_MS = 72 * 60 * 60 * 1e3;
 var TTL_MS2 = 6 * 60 * 60 * 1e3;
 var MAX_ENTRIES = 500;
 function reviewCorrelationKey(payload) {
@@ -48154,7 +48324,9 @@ function write(store) {
   }
 }
 function prune(entries, now) {
-  const fresh = entries.filter((e) => now - e.ts < TTL_MS2);
+  const fresh = entries.filter(
+    (e) => now - e.ts < (e.key.startsWith("tuid:") ? TTL_TUID_MS : TTL_MS2)
+  );
   return fresh.length > MAX_ENTRIES ? fresh.slice(fresh.length - MAX_ENTRIES) : fresh;
 }
 function recordPendingReview(entry) {
@@ -48169,19 +48341,30 @@ function recordPendingReview(entry) {
 function resolvePendingReview(key, now = Date.now()) {
   try {
     const store = read();
-    const idx = store.entries.findIndex((e) => e.key === key);
+    const live = prune(store.entries, now);
+    const idx = live.findIndex((e) => e.key === key);
     if (idx === -1) {
-      const pruned = prune(store.entries, now);
-      if (pruned.length !== store.entries.length) write({ entries: pruned });
+      if (live.length !== store.entries.length) write({ entries: live });
       return null;
     }
-    const [match] = store.entries.splice(idx, 1);
-    write({ entries: prune(store.entries, now) });
+    const [match] = live.splice(idx, 1);
+    write({ entries: live });
     return match;
   } catch {
     return null;
   }
 }
+function discardPendingReview(key, now = Date.now()) {
+  try {
+    const store = read();
+    const kept = prune(
+      store.entries.filter((e) => e.key !== key),
+      now
+    );
+    if (kept.length !== store.entries.length) write({ entries: kept });
+  } catch {
+  }
+}
 
 // src/cli/commands/check.ts
 init_hook_payload();
@@ -48237,7 +48420,10 @@ function agentSupportsAsk(agent) {
 }
 function resolveAskMode(agent, opts, config) {
   if (!agentSupportsAsk(agent)) return false;
-  if (config.settings.approvers.cloud === true) return false;
+  if (config.settings.reviewChannelManaged === true) {
+    if (config.settings.reviewChannel === "ask") return true;
+    if (config.settings.reviewChannel === "approver") return false;
+  }
   if (opts.ask === true) return true;
   if (opts.ask === false) return false;
   if (config.settings.reviewChannel === "ask") return true;
@@ -48476,7 +48662,11 @@ RAW: ${raw}
           process.exit(2);
         };
         const sendAsk = (result2) => {
-          const msg = buildReviewMessage(result2.blockedByLabel, result2.ruleDescription);
+          const msg = buildReviewMessage(
+            result2.blockedByLabel,
+            result2.ruleDescription,
+            result2.reason
+          );
           try {
             const key = reviewCorrelationKey(payload);
             if (key) {
@@ -48659,6 +48849,13 @@ RAW: ${raw}
           cwd: safeCwdForAuth,
           deferReview: askMode
         });
+        if (!result.review) {
+          try {
+            const key = reviewCorrelationKey(payload);
+            if (key) discardPendingReview(key);
+          } catch {
+          }
+        }
         if (result.approved) {
           if (result.checkedBy && process.env.NODE9_DEBUG === "1")
             process.stderr.write(`\u2713 node9 [${result.checkedBy}]: "${toolName}" allowed
@@ -48746,6 +48943,7 @@ init_audit();
 init_config();
 init_daemon();
 init_dlp();
+init_hasher();
 
 // src/utils/cp-mv-parser.ts
 function parseCpMvOp(command) {
@@ -48807,6 +49005,20 @@ function atLeastConfidence(c, min) {
 function sanitize3(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
+function buildArgsField(rawInput) {
+  let hashed = {};
+  try {
+    hashed = { argsHash: hashArgs(rawInput) };
+  } catch {
+  }
+  try {
+    const hit = scanArgs(rawInput);
+    if (hit) return { ...hashed, dlpPattern: hit.patternName, dlpSample: hit.redactedSample };
+    return { args: JSON.parse(redactSecrets(JSON.stringify(rawInput))) };
+  } catch {
+    return hashed;
+  }
+}
 function registerLogCommand(program2) {
   program2.command("log", { hidden: true }).description("PostToolUse hook \u2014 records executed tool calls").argument("[data]", "JSON string of the tool call").option(
     "--agent <name>",
@@ -48835,15 +49047,17 @@ function registerLogCommand(program2) {
         })();
         const agent = agentOverride !== void 0 ? agentOverride : metaTag !== void 0 ? metaTag : payload.turn_id !== void 0 ? "Codex" : payload.toolCall !== void 0 || payload.conversationId !== void 0 ? "Antigravity" : payload.hook_event_name === "pre_tool_call" || payload.hook_event_name === "post_tool_call" ? "Hermes" : payload.hook_event_name === "PreToolUse" || payload.hook_event_name === "PostToolUse" || payload.tool_use_id !== void 0 || payload.permission_mode !== void 0 ? "Claude Code" : payload.hook_event_name === "BeforeTool" || payload.hook_event_name === "AfterTool" || payload.timestamp !== void 0 ? "Gemini CLI" : process.env.HERMES_SESSION_ID || process.env.HERMES_HOME || process.env.HERMES_INTERACTIVE ? "Hermes" : process.env.ANTIGRAVITY_CONVERSATION_ID ? "Antigravity" : void 0;
         let reviewApproved = false;
+        let resolvedReview = null;
         try {
           const key = reviewCorrelationKey(payload);
-          if (key && resolvePendingReview(key)) reviewApproved = true;
+          if (key) resolvedReview = resolvePendingReview(key);
+          if (resolvedReview) reviewApproved = true;
         } catch {
         }
         const entry = {
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           tool,
-          args: JSON.parse(redactSecrets(JSON.stringify(rawInput))),
+          ...buildArgsField(rawInput),
           decision: "allowed",
           source: reviewApproved ? "inline-review-approved" : "post-hook"
         };
@@ -48890,6 +49104,33 @@ function registerLogCommand(program2) {
         const payloadCwd = typeof payload.cwd === "string" ? payload.cwd : Array.isArray(payload.workspacePaths) && typeof payload.workspacePaths[0] === "string" ? payload.workspacePaths[0] : void 0;
         const safeCwd = typeof payloadCwd === "string" && import_path47.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         const config = getConfig(safeCwd);
+        if (resolvedReview) {
+          try {
+            const reviewLabel = resolvedReview.label || "inline-review";
+            const sensitiveReview = /dlp|taint/i.test(reviewLabel);
+            appendLocalAudit(
+              tool,
+              rawInput,
+              "allow",
+              "inline-review",
+              {
+                agent,
+                ruleName: reviewLabel,
+                ...rawToolName !== tool ? { agentToolName: rawToolName } : {},
+                ...typeof payloadSessionId === "string" ? { sessionId: payloadSessionId } : {},
+                ...safeCwd ? { workingDir: safeCwd } : {}
+              },
+              sensitiveReview || config.settings.auditHashArgs === true
+            );
+          } catch (err2) {
+            appendToLog(HOOK_DEBUG_LOG, {
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              event: "inline-review-ship-row-fail",
+              tool,
+              error: err2 instanceof Error ? err2.message : String(err2)
+            });
+          }
+        }
         {
           const toolOutput = payload.tool_response?.output;
           const inj = config.policy.injectionScan;
@@ -50358,8 +50599,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const priorEnd = new Date(start.getTime() - 1);
   const priorStart = new Date(start.getTime() - periodMs);
   const priorEntries = allEntries.filter((e) => {
-    if (e.source === "post-hook") return false;
-    if (e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     return ts >= priorStart && ts <= priorEnd;
@@ -50370,8 +50610,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const testTs = excludeTests ? buildTestTimestamps(allEntries) : /* @__PURE__ */ new Set();
   let excludedTests = 0;
   const entries = allEntries.filter((e) => {
-    if (e.source === "post-hook") return false;
-    if (e.source === "response-dlp") return false;
+    if (typeof e.source === "string" && NON_DECISION_SOURCES.has(e.source)) return false;
     if (typeof e.decision !== "string") return false;
     const ts = new Date(e.ts);
     if (ts < start || ts > end) return false;