@node9/proxy 1.66.0 → 1.67.0

package/dist/cli.js

@@ -376,6 +376,16 @@ var init_config_schema = __esm({
           pii: import_zod.z.enum(["off", "block"]).optional(),
           reviewAction: import_zod.z.enum(["review", "block"]).optional()
         }).optional(),
+        // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
+        // deliberately exclude 'off' — tighten-only.
+        commandChecks: import_zod.z.object({
+          inlineExec: import_zod.z.enum(["off", "review", "block"]).optional(),
+          rmAdvisory: import_zod.z.enum(["off", "review", "block"]).optional(),
+          chmod: import_zod.z.enum(["off", "review", "block"]).optional(),
+          sqlDdl: import_zod.z.enum(["off", "review", "block"]).optional(),
+          evalDynamic: import_zod.z.enum(["review", "block"]).optional(),
+          pipeChainHigh: import_zod.z.enum(["review", "block"]).optional()
+        }).optional(),
         egress: import_zod.z.object({
           enabled: import_zod.z.boolean().optional(),
           mode: import_zod.z.enum(["off", "review", "block"]).optional(),
@@ -1513,6 +1523,45 @@ function evaluateSmartConditions(args, rule) {
   });
   return mode === "any" ? results.some((r) => r) : results.every((r) => r);
 }
+function resolveCheck(v) {
+  return v === "off" || v === "block" ? v : "review";
+}
+function resolveCheckTight(v) {
+  return v === "block" ? "block" : "review";
+}
+function detectInlineExec(command) {
+  const pipeFed = command.includes("|");
+  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
+  for (const rawSeg of segments) {
+    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
+    if (i >= tokens.length) continue;
+    const base = tokens[i].split("/").pop() ?? tokens[i];
+    if (!INLINE_INTERP.test(base)) continue;
+    const args = tokens.slice(i + 1);
+    let hadRedirect = false;
+    const positionals = [];
+    for (let j = 0; j < args.length; j++) {
+      const a = args[j];
+      if (a === "-") return true;
+      if (a.startsWith("<")) {
+        hadRedirect = true;
+        if (a === "<" || a === "<<") j++;
+        continue;
+      }
+      if (a.startsWith("-")) {
+        if (/^-(c|e|eval)$/i.test(a)) return true;
+        continue;
+      }
+      positionals.push(a);
+    }
+    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
+      return true;
+    }
+  }
+  return false;
+}
 function resolvePinned(matches) {
   if (matches.length === 0) return void 0;
   const pinned = matches.filter((r) => r.pinned);
@@ -1539,7 +1588,7 @@ function isSqlTool(toolName, toolInspection) {
   const fieldName = toolInspection[matchingPattern];
   return fieldName === "sql" || fieldName === "query";
 }
-function pipeChainVerdict(command, isTrustedHost2) {
+function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
   const pipeAnalysis = analyzePipeChain(command);
   if (!pipeAnalysis.isPipeline) return null;
   if (pipeAnalysis.risk !== "critical" && pipeAnalysis.risk !== "high") return null;
@@ -1570,7 +1619,7 @@ function pipeChainVerdict(command, isTrustedHost2) {
     };
   }
   return {
-    decision: "review",
+    decision: highAction,
     blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
     reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
     tier: 3
@@ -1596,7 +1645,11 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   if (wouldBeIgnored) return { decision: "allow" };
   const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
   if (bashCommand !== null) {
-    const pipeVerdict = pipeChainVerdict(bashCommand, isTrustedHost2);
+    const pipeVerdict = pipeChainVerdict(
+      bashCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (pipeVerdict) return pipeVerdict;
     const fsVerdict = analyzeFsOperation(bashCommand);
     if (fsVerdict) {
@@ -1611,10 +1664,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
-    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
+    const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
     if (sqlVerdict) {
       return {
-        decision: sqlVerdict.verdict,
+        // analyzeSqlDestructive is typed review-only, so the knob maps 1:1.
+        decision: sqlAction === "block" ? "block" : "review",
         blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
         reason: sqlVerdict.reason,
         tier: 2,
@@ -1622,10 +1677,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
-    const chmodVerdict = analyzeChmod777(bashCommand);
+    const chmodAction = resolveCheck(config.policy.commandChecks?.chmod);
+    const chmodVerdict = chmodAction === "off" ? null : analyzeChmod777(bashCommand);
     if (chmodVerdict) {
       return {
-        decision: chmodVerdict.verdict,
+        // analyzeChmod777 is typed review-only, so the knob maps 1:1.
+        decision: chmodAction === "block" ? "block" : "review",
         blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
         reason: chmodVerdict.reason,
         tier: 2,
@@ -1668,10 +1725,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
       return {
-        decision: "review",
+        decision: inlineAction === "block" ? "block" : "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
         ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
         tier: 3
@@ -1689,14 +1746,21 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     if (evalVerdict === "review") {
       return {
-        decision: "review",
+        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
+        // block but can never turn this off (eval-remote above is Class A —
+        // no knob at all).
+        decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
       };
     }
-    const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost2);
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (ptVerdict) return ptVerdict;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
@@ -2378,7 +2442,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, INLINE_INTERP, INLINE_SHELL, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3315,6 +3379,8 @@ var init_dist = __esm({
     REGEX_CACHE_MAX = 500;
     regexCache = /* @__PURE__ */ new Map();
     FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+    INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
+    INLINE_SHELL = /^(bash|sh|zsh)$/i;
     VERDICT_RANK = {
       allow: 0,
       review: 1,
@@ -4382,6 +4448,23 @@ function applyManagedDlp(local, managed, locked) {
   }
   return next;
 }
+function applyManagedCommandChecks(local, managed, locked) {
+  const next = { ...local };
+  for (const key of COMMAND_CHECK_KEYS) {
+    const m = managed[key];
+    if (typeof m !== "string") continue;
+    const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
+    const resolved = resolveByOrder(
+      COMMAND_CHECK_ORDER,
+      local[key] ?? "review",
+      m,
+      locked.includes(lockKey)
+    );
+    if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
+    next[key] = resolved;
+  }
+  return next;
+}
 function applyManagedApprovers(local, managed) {
   return {
     ...local,
@@ -4391,7 +4474,7 @@ function applyManagedApprovers(local, managed) {
     terminal: typeof managed.terminal === "boolean" ? managed.terminal : local.terminal
   };
 }
-var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER;
+var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER, COMMAND_CHECK_ORDER, COMMAND_CHECK_KEYS;
 var init_managed = __esm({
   "src/config/managed.ts"() {
     "use strict";
@@ -4399,6 +4482,15 @@ var init_managed = __esm({
     EGRESS_MODE_ORDER = ["off", "review", "block"];
     DLP_PII_ORDER = ["off", "block"];
     DLP_REVIEW_ACTION_ORDER = ["review", "block"];
+    COMMAND_CHECK_ORDER = ["off", "review", "block"];
+    COMMAND_CHECK_KEYS = [
+      "inlineExec",
+      "rmAdvisory",
+      "chmod",
+      "sqlDdl",
+      "evalDynamic",
+      "pipeChainHigh"
+    ];
   }
 });
 
@@ -4775,6 +4867,21 @@ function getConfig(cwd) {
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
       if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
     }
+    if (p.commandChecks && typeof p.commandChecks === "object") {
+      const src = p.commandChecks;
+      const cc2 = {
+        ...mergedPolicy.commandChecks
+      };
+      for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+        const v = src[k];
+        if (v === "off" || v === "review" || v === "block") cc2[k] = v;
+      }
+      for (const k of ["evalDynamic", "pipeChainHigh"]) {
+        const v = src[k];
+        if (v === "review" || v === "block") cc2[k] = v;
+      }
+      if (Object.keys(cc2).length > 0) mergedPolicy.commandChecks = cc2;
+    }
     if (p.egress) {
       const e = p.egress;
       if (e.enabled !== void 0) mergedPolicy.egress.enabled = e.enabled;
@@ -4876,6 +4983,13 @@ function getConfig(cwd) {
             locked
           );
         }
+        if (mc.commandChecks && typeof mc.commandChecks === "object") {
+          mergedPolicy.commandChecks = applyManagedCommandChecks(
+            mergedPolicy.commandChecks ?? {},
+            mc.commandChecks,
+            locked
+          );
+        }
         if (mc.approvers && typeof mc.approvers === "object") {
           const bool = (v) => typeof v === "boolean" ? v : void 0;
           mergedSettings.approvers = applyManagedApprovers(mergedSettings.approvers, {
@@ -4985,8 +5099,17 @@ function getConfig(cwd) {
     }
   }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
+  const cc = mergedPolicy.commandChecks ?? {};
+  const advisoryKnob = (name) => {
+    if (name === "review-rm") return cc.rmAdvisory;
+    if (name?.endsWith("-sql")) return cc.sqlDdl;
+    return void 0;
+  };
   for (const rule of ADVISORY_SMART_RULES) {
-    if (!existingAdvisoryNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
+    if (existingAdvisoryNames.has(rule.name)) continue;
+    const knob = rule.verdict === "review" ? advisoryKnob(rule.name) : void 0;
+    if (knob === "off") continue;
+    mergedPolicy.smartRules.push(knob === "block" ? { ...rule, verdict: "block" } : rule);
   }
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
@@ -18378,6 +18501,18 @@ function extractManagedConfig(body) {
       d.reviewAction = mc.dlp.reviewAction;
     if (d.enabled !== void 0 || d.pii !== void 0 || d.reviewAction !== void 0) out.dlp = d;
   }
+  if (mc.commandChecks && typeof mc.commandChecks === "object") {
+    const cc = {};
+    for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+      const v = mc.commandChecks[k];
+      if (v === "off" || v === "review" || v === "block") cc[k] = v;
+    }
+    for (const k of ["evalDynamic", "pipeChainHigh"]) {
+      const v = mc.commandChecks[k];
+      if (v === "review" || v === "block") cc[k] = v;
+    }
+    if (Object.keys(cc).length > 0) out.commandChecks = cc;
+  }
   if (mc.approvers && typeof mc.approvers === "object") {
     const a = {};
     for (const k of ["native", "browser", "cloud", "terminal"]) {
@@ -18440,7 +18575,7 @@ function extractManagedConfig(body) {
     }
     if (Object.keys(ap).length) out.appPermissions = ap;
   }
-  return out.mode !== void 0 || out.egress !== void 0 || out.dlp !== void 0 || out.approvers !== void 0 || out.reviewChannel !== void 0 || out.approvalTimeoutMs !== void 0 || out.injectionScan !== void 0 || out.loopDetection !== void 0 || out.skillPinning !== void 0 || out.jailPaths !== void 0 || out.trustedHosts !== void 0 || out.appPermissions !== void 0 ? out : void 0;
+  return out.mode !== void 0 || out.egress !== void 0 || out.dlp !== void 0 || out.commandChecks !== void 0 || out.approvers !== void 0 || out.reviewChannel !== void 0 || out.approvalTimeoutMs !== void 0 || out.injectionScan !== void 0 || out.loopDetection !== void 0 || out.skillPinning !== void 0 || out.jailPaths !== void 0 || out.trustedHosts !== void 0 || out.appPermissions !== void 0 ? out : void 0;
 }
 function sweepStaleTmp(target) {
   try {
@@ -48808,6 +48943,7 @@ init_audit();
 init_config();
 init_daemon();
 init_dlp();
+init_hasher();
 
 // src/utils/cp-mv-parser.ts
 function parseCpMvOp(command) {
@@ -48869,6 +49005,20 @@ function atLeastConfidence(c, min) {
 function sanitize3(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
+function buildArgsField(rawInput) {
+  let hashed = {};
+  try {
+    hashed = { argsHash: hashArgs(rawInput) };
+  } catch {
+  }
+  try {
+    const hit = scanArgs(rawInput);
+    if (hit) return { ...hashed, dlpPattern: hit.patternName, dlpSample: hit.redactedSample };
+    return { args: JSON.parse(redactSecrets(JSON.stringify(rawInput))) };
+  } catch {
+    return hashed;
+  }
+}
 function registerLogCommand(program2) {
   program2.command("log", { hidden: true }).description("PostToolUse hook \u2014 records executed tool calls").argument("[data]", "JSON string of the tool call").option(
     "--agent <name>",
@@ -48907,7 +49057,7 @@ function registerLogCommand(program2) {
         const entry = {
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           tool,
-          args: JSON.parse(redactSecrets(JSON.stringify(rawInput))),
+          ...buildArgsField(rawInput),
           decision: "allowed",
           source: reviewApproved ? "inline-review-approved" : "post-hook"
         };

package/dist/cli.mjs

@@ -380,6 +380,16 @@ var init_config_schema = __esm({
           pii: z.enum(["off", "block"]).optional(),
           reviewAction: z.enum(["review", "block"]).optional()
         }).optional(),
+        // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
+        // deliberately exclude 'off' — tighten-only.
+        commandChecks: z.object({
+          inlineExec: z.enum(["off", "review", "block"]).optional(),
+          rmAdvisory: z.enum(["off", "review", "block"]).optional(),
+          chmod: z.enum(["off", "review", "block"]).optional(),
+          sqlDdl: z.enum(["off", "review", "block"]).optional(),
+          evalDynamic: z.enum(["review", "block"]).optional(),
+          pipeChainHigh: z.enum(["review", "block"]).optional()
+        }).optional(),
         egress: z.object({
           enabled: z.boolean().optional(),
           mode: z.enum(["off", "review", "block"]).optional(),
@@ -1523,6 +1533,45 @@ function evaluateSmartConditions(args, rule) {
   });
   return mode === "any" ? results.some((r) => r) : results.every((r) => r);
 }
+function resolveCheck(v) {
+  return v === "off" || v === "block" ? v : "review";
+}
+function resolveCheckTight(v) {
+  return v === "block" ? "block" : "review";
+}
+function detectInlineExec(command) {
+  const pipeFed = command.includes("|");
+  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
+  for (const rawSeg of segments) {
+    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
+    if (i >= tokens.length) continue;
+    const base = tokens[i].split("/").pop() ?? tokens[i];
+    if (!INLINE_INTERP.test(base)) continue;
+    const args = tokens.slice(i + 1);
+    let hadRedirect = false;
+    const positionals = [];
+    for (let j = 0; j < args.length; j++) {
+      const a = args[j];
+      if (a === "-") return true;
+      if (a.startsWith("<")) {
+        hadRedirect = true;
+        if (a === "<" || a === "<<") j++;
+        continue;
+      }
+      if (a.startsWith("-")) {
+        if (/^-(c|e|eval)$/i.test(a)) return true;
+        continue;
+      }
+      positionals.push(a);
+    }
+    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
+      return true;
+    }
+  }
+  return false;
+}
 function resolvePinned(matches) {
   if (matches.length === 0) return void 0;
   const pinned = matches.filter((r) => r.pinned);
@@ -1549,7 +1598,7 @@ function isSqlTool(toolName, toolInspection) {
   const fieldName = toolInspection[matchingPattern];
   return fieldName === "sql" || fieldName === "query";
 }
-function pipeChainVerdict(command, isTrustedHost2) {
+function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
   const pipeAnalysis = analyzePipeChain(command);
   if (!pipeAnalysis.isPipeline) return null;
   if (pipeAnalysis.risk !== "critical" && pipeAnalysis.risk !== "high") return null;
@@ -1580,7 +1629,7 @@ function pipeChainVerdict(command, isTrustedHost2) {
     };
   }
   return {
-    decision: "review",
+    decision: highAction,
     blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
     reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
     tier: 3
@@ -1606,7 +1655,11 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   if (wouldBeIgnored) return { decision: "allow" };
   const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
   if (bashCommand !== null) {
-    const pipeVerdict = pipeChainVerdict(bashCommand, isTrustedHost2);
+    const pipeVerdict = pipeChainVerdict(
+      bashCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (pipeVerdict) return pipeVerdict;
     const fsVerdict = analyzeFsOperation(bashCommand);
     if (fsVerdict) {
@@ -1621,10 +1674,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
-    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
+    const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
     if (sqlVerdict) {
       return {
-        decision: sqlVerdict.verdict,
+        // analyzeSqlDestructive is typed review-only, so the knob maps 1:1.
+        decision: sqlAction === "block" ? "block" : "review",
         blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
         reason: sqlVerdict.reason,
         tier: 2,
@@ -1632,10 +1687,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
-    const chmodVerdict = analyzeChmod777(bashCommand);
+    const chmodAction = resolveCheck(config.policy.commandChecks?.chmod);
+    const chmodVerdict = chmodAction === "off" ? null : analyzeChmod777(bashCommand);
     if (chmodVerdict) {
       return {
-        decision: chmodVerdict.verdict,
+        // analyzeChmod777 is typed review-only, so the knob maps 1:1.
+        decision: chmodAction === "block" ? "block" : "review",
         blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
         reason: chmodVerdict.reason,
         tier: 2,
@@ -1678,10 +1735,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
       return {
-        decision: "review",
+        decision: inlineAction === "block" ? "block" : "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
         ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
         tier: 3
@@ -1699,14 +1756,21 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     if (evalVerdict === "review") {
       return {
-        decision: "review",
+        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
+        // block but can never turn this off (eval-remote above is Class A —
+        // no knob at all).
+        decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
       };
     }
-    const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost2);
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (ptVerdict) return ptVerdict;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
@@ -2388,7 +2452,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, INLINE_INTERP, INLINE_SHELL, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3319,6 +3383,8 @@ var init_dist = __esm({
     REGEX_CACHE_MAX = 500;
     regexCache = /* @__PURE__ */ new Map();
     FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+    INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
+    INLINE_SHELL = /^(bash|sh|zsh)$/i;
     VERDICT_RANK = {
       allow: 0,
       review: 1,
@@ -4386,6 +4452,23 @@ function applyManagedDlp(local, managed, locked) {
   }
   return next;
 }
+function applyManagedCommandChecks(local, managed, locked) {
+  const next = { ...local };
+  for (const key of COMMAND_CHECK_KEYS) {
+    const m = managed[key];
+    if (typeof m !== "string") continue;
+    const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
+    const resolved = resolveByOrder(
+      COMMAND_CHECK_ORDER,
+      local[key] ?? "review",
+      m,
+      locked.includes(lockKey)
+    );
+    if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
+    next[key] = resolved;
+  }
+  return next;
+}
 function applyManagedApprovers(local, managed) {
   return {
     ...local,
@@ -4395,7 +4478,7 @@ function applyManagedApprovers(local, managed) {
     terminal: typeof managed.terminal === "boolean" ? managed.terminal : local.terminal
   };
 }
-var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER;
+var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER, COMMAND_CHECK_ORDER, COMMAND_CHECK_KEYS;
 var init_managed = __esm({
   "src/config/managed.ts"() {
     "use strict";
@@ -4403,6 +4486,15 @@ var init_managed = __esm({
     EGRESS_MODE_ORDER = ["off", "review", "block"];
     DLP_PII_ORDER = ["off", "block"];
     DLP_REVIEW_ACTION_ORDER = ["review", "block"];
+    COMMAND_CHECK_ORDER = ["off", "review", "block"];
+    COMMAND_CHECK_KEYS = [
+      "inlineExec",
+      "rmAdvisory",
+      "chmod",
+      "sqlDdl",
+      "evalDynamic",
+      "pipeChainHigh"
+    ];
   }
 });
 
@@ -4782,6 +4874,21 @@ function getConfig(cwd) {
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
       if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
     }
+    if (p.commandChecks && typeof p.commandChecks === "object") {
+      const src = p.commandChecks;
+      const cc2 = {
+        ...mergedPolicy.commandChecks
+      };
+      for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+        const v = src[k];
+        if (v === "off" || v === "review" || v === "block") cc2[k] = v;
+      }
+      for (const k of ["evalDynamic", "pipeChainHigh"]) {
+        const v = src[k];
+        if (v === "review" || v === "block") cc2[k] = v;
+      }
+      if (Object.keys(cc2).length > 0) mergedPolicy.commandChecks = cc2;
+    }
     if (p.egress) {
       const e = p.egress;
       if (e.enabled !== void 0) mergedPolicy.egress.enabled = e.enabled;
@@ -4883,6 +4990,13 @@ function getConfig(cwd) {
             locked
           );
         }
+        if (mc.commandChecks && typeof mc.commandChecks === "object") {
+          mergedPolicy.commandChecks = applyManagedCommandChecks(
+            mergedPolicy.commandChecks ?? {},
+            mc.commandChecks,
+            locked
+          );
+        }
         if (mc.approvers && typeof mc.approvers === "object") {
           const bool = (v) => typeof v === "boolean" ? v : void 0;
           mergedSettings.approvers = applyManagedApprovers(mergedSettings.approvers, {
@@ -4992,8 +5106,17 @@ function getConfig(cwd) {
     }
   }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
+  const cc = mergedPolicy.commandChecks ?? {};
+  const advisoryKnob = (name) => {
+    if (name === "review-rm") return cc.rmAdvisory;
+    if (name?.endsWith("-sql")) return cc.sqlDdl;
+    return void 0;
+  };
   for (const rule of ADVISORY_SMART_RULES) {
-    if (!existingAdvisoryNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
+    if (existingAdvisoryNames.has(rule.name)) continue;
+    const knob = rule.verdict === "review" ? advisoryKnob(rule.name) : void 0;
+    if (knob === "off") continue;
+    mergedPolicy.smartRules.push(knob === "block" ? { ...rule, verdict: "block" } : rule);
   }
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
@@ -18376,6 +18499,18 @@ function extractManagedConfig(body) {
       d.reviewAction = mc.dlp.reviewAction;
     if (d.enabled !== void 0 || d.pii !== void 0 || d.reviewAction !== void 0) out.dlp = d;
   }
+  if (mc.commandChecks && typeof mc.commandChecks === "object") {
+    const cc = {};
+    for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+      const v = mc.commandChecks[k];
+      if (v === "off" || v === "review" || v === "block") cc[k] = v;
+    }
+    for (const k of ["evalDynamic", "pipeChainHigh"]) {
+      const v = mc.commandChecks[k];
+      if (v === "review" || v === "block") cc[k] = v;
+    }
+    if (Object.keys(cc).length > 0) out.commandChecks = cc;
+  }
   if (mc.approvers && typeof mc.approvers === "object") {
     const a = {};
     for (const k of ["native", "browser", "cloud", "terminal"]) {
@@ -18438,7 +18573,7 @@ function extractManagedConfig(body) {
     }
     if (Object.keys(ap).length) out.appPermissions = ap;
   }
-  return out.mode !== void 0 || out.egress !== void 0 || out.dlp !== void 0 || out.approvers !== void 0 || out.reviewChannel !== void 0 || out.approvalTimeoutMs !== void 0 || out.injectionScan !== void 0 || out.loopDetection !== void 0 || out.skillPinning !== void 0 || out.jailPaths !== void 0 || out.trustedHosts !== void 0 || out.appPermissions !== void 0 ? out : void 0;
+  return out.mode !== void 0 || out.egress !== void 0 || out.dlp !== void 0 || out.commandChecks !== void 0 || out.approvers !== void 0 || out.reviewChannel !== void 0 || out.approvalTimeoutMs !== void 0 || out.injectionScan !== void 0 || out.loopDetection !== void 0 || out.skillPinning !== void 0 || out.jailPaths !== void 0 || out.trustedHosts !== void 0 || out.appPermissions !== void 0 ? out : void 0;
 }
 function sweepStaleTmp(target) {
   try {
@@ -48801,6 +48936,7 @@ import path48 from "path";
 import os45 from "os";
 init_daemon();
 init_dlp();
+init_hasher();
 
 // src/utils/cp-mv-parser.ts
 function parseCpMvOp(command) {
@@ -48862,6 +48998,20 @@ function atLeastConfidence(c, min) {
 function sanitize3(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
+function buildArgsField(rawInput) {
+  let hashed = {};
+  try {
+    hashed = { argsHash: hashArgs(rawInput) };
+  } catch {
+  }
+  try {
+    const hit = scanArgs(rawInput);
+    if (hit) return { ...hashed, dlpPattern: hit.patternName, dlpSample: hit.redactedSample };
+    return { args: JSON.parse(redactSecrets(JSON.stringify(rawInput))) };
+  } catch {
+    return hashed;
+  }
+}
 function registerLogCommand(program2) {
   program2.command("log", { hidden: true }).description("PostToolUse hook \u2014 records executed tool calls").argument("[data]", "JSON string of the tool call").option(
     "--agent <name>",
@@ -48900,7 +49050,7 @@ function registerLogCommand(program2) {
         const entry = {
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           tool,
-          args: JSON.parse(redactSecrets(JSON.stringify(rawInput))),
+          ...buildArgsField(rawInput),
           decision: "allowed",
           source: reviewApproved ? "inline-review-approved" : "post-hook"
         };

package/dist/dashboard.mjs

@@ -2336,6 +2336,16 @@ var init_config_schema = __esm({
           pii: z.enum(["off", "block"]).optional(),
           reviewAction: z.enum(["review", "block"]).optional()
         }).optional(),
+        // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
+        // deliberately exclude 'off' — tighten-only.
+        commandChecks: z.object({
+          inlineExec: z.enum(["off", "review", "block"]).optional(),
+          rmAdvisory: z.enum(["off", "review", "block"]).optional(),
+          chmod: z.enum(["off", "review", "block"]).optional(),
+          sqlDdl: z.enum(["off", "review", "block"]).optional(),
+          evalDynamic: z.enum(["review", "block"]).optional(),
+          pipeChainHigh: z.enum(["review", "block"]).optional()
+        }).optional(),
         egress: z.object({
           enabled: z.boolean().optional(),
           mode: z.enum(["off", "review", "block"]).optional(),

package/dist/index.js

@@ -358,6 +358,16 @@ var ConfigFileSchema = import_zod.z.object({
       pii: import_zod.z.enum(["off", "block"]).optional(),
       reviewAction: import_zod.z.enum(["review", "block"]).optional()
     }).optional(),
+    // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
+    // deliberately exclude 'off' — tighten-only.
+    commandChecks: import_zod.z.object({
+      inlineExec: import_zod.z.enum(["off", "review", "block"]).optional(),
+      rmAdvisory: import_zod.z.enum(["off", "review", "block"]).optional(),
+      chmod: import_zod.z.enum(["off", "review", "block"]).optional(),
+      sqlDdl: import_zod.z.enum(["off", "review", "block"]).optional(),
+      evalDynamic: import_zod.z.enum(["review", "block"]).optional(),
+      pipeChainHigh: import_zod.z.enum(["review", "block"]).optional()
+    }).optional(),
     egress: import_zod.z.object({
       enabled: import_zod.z.boolean().optional(),
       mode: import_zod.z.enum(["off", "review", "block"]).optional(),
@@ -2368,6 +2378,47 @@ function evaluateSmartConditions(args, rule) {
   });
   return mode === "any" ? results.some((r) => r) : results.every((r) => r);
 }
+function resolveCheck(v) {
+  return v === "off" || v === "block" ? v : "review";
+}
+function resolveCheckTight(v) {
+  return v === "block" ? "block" : "review";
+}
+var INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
+var INLINE_SHELL = /^(bash|sh|zsh)$/i;
+function detectInlineExec(command) {
+  const pipeFed = command.includes("|");
+  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
+  for (const rawSeg of segments) {
+    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
+    if (i >= tokens.length) continue;
+    const base = tokens[i].split("/").pop() ?? tokens[i];
+    if (!INLINE_INTERP.test(base)) continue;
+    const args = tokens.slice(i + 1);
+    let hadRedirect = false;
+    const positionals = [];
+    for (let j = 0; j < args.length; j++) {
+      const a = args[j];
+      if (a === "-") return true;
+      if (a.startsWith("<")) {
+        hadRedirect = true;
+        if (a === "<" || a === "<<") j++;
+        continue;
+      }
+      if (a.startsWith("-")) {
+        if (/^-(c|e|eval)$/i.test(a)) return true;
+        continue;
+      }
+      positionals.push(a);
+    }
+    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
+      return true;
+    }
+  }
+  return false;
+}
 var VERDICT_RANK = {
   allow: 0,
   review: 1,
@@ -2400,7 +2451,7 @@ function isSqlTool(toolName, toolInspection) {
   return fieldName === "sql" || fieldName === "query";
 }
 var SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
-function pipeChainVerdict(command, isTrustedHost2) {
+function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
   const pipeAnalysis = analyzePipeChain(command);
   if (!pipeAnalysis.isPipeline) return null;
   if (pipeAnalysis.risk !== "critical" && pipeAnalysis.risk !== "high") return null;
@@ -2431,7 +2482,7 @@ function pipeChainVerdict(command, isTrustedHost2) {
     };
   }
   return {
-    decision: "review",
+    decision: highAction,
     blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
     reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
     tier: 3
@@ -2457,7 +2508,11 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   if (wouldBeIgnored) return { decision: "allow" };
   const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
   if (bashCommand !== null) {
-    const pipeVerdict = pipeChainVerdict(bashCommand, isTrustedHost2);
+    const pipeVerdict = pipeChainVerdict(
+      bashCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (pipeVerdict) return pipeVerdict;
     const fsVerdict = analyzeFsOperation(bashCommand);
     if (fsVerdict) {
@@ -2472,10 +2527,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
-    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
+    const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
     if (sqlVerdict) {
       return {
-        decision: sqlVerdict.verdict,
+        // analyzeSqlDestructive is typed review-only, so the knob maps 1:1.
+        decision: sqlAction === "block" ? "block" : "review",
         blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
         reason: sqlVerdict.reason,
         tier: 2,
@@ -2483,10 +2540,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
-    const chmodVerdict = analyzeChmod777(bashCommand);
+    const chmodAction = resolveCheck(config.policy.commandChecks?.chmod);
+    const chmodVerdict = chmodAction === "off" ? null : analyzeChmod777(bashCommand);
     if (chmodVerdict) {
       return {
-        decision: chmodVerdict.verdict,
+        // analyzeChmod777 is typed review-only, so the knob maps 1:1.
+        decision: chmodAction === "block" ? "block" : "review",
         blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
         reason: chmodVerdict.reason,
         tier: 2,
@@ -2529,10 +2588,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
       return {
-        decision: "review",
+        decision: inlineAction === "block" ? "block" : "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
         ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
         tier: 3
@@ -2550,14 +2609,21 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     if (evalVerdict === "review") {
       return {
-        decision: "review",
+        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
+        // block but can never turn this off (eval-remote above is Class A —
+        // no knob at all).
+        decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
       };
     }
-    const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost2);
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (ptVerdict) return ptVerdict;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
@@ -3668,6 +3734,32 @@ function applyManagedDlp(local, managed, locked) {
   }
   return next;
 }
+var COMMAND_CHECK_ORDER = ["off", "review", "block"];
+var COMMAND_CHECK_KEYS = [
+  "inlineExec",
+  "rmAdvisory",
+  "chmod",
+  "sqlDdl",
+  "evalDynamic",
+  "pipeChainHigh"
+];
+function applyManagedCommandChecks(local, managed, locked) {
+  const next = { ...local };
+  for (const key of COMMAND_CHECK_KEYS) {
+    const m = managed[key];
+    if (typeof m !== "string") continue;
+    const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
+    const resolved = resolveByOrder(
+      COMMAND_CHECK_ORDER,
+      local[key] ?? "review",
+      m,
+      locked.includes(lockKey)
+    );
+    if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
+    next[key] = resolved;
+  }
+  return next;
+}
 function applyManagedApprovers(local, managed) {
   return {
     ...local,
@@ -4238,6 +4330,21 @@ function getConfig(cwd) {
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
       if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
     }
+    if (p.commandChecks && typeof p.commandChecks === "object") {
+      const src = p.commandChecks;
+      const cc2 = {
+        ...mergedPolicy.commandChecks
+      };
+      for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+        const v = src[k];
+        if (v === "off" || v === "review" || v === "block") cc2[k] = v;
+      }
+      for (const k of ["evalDynamic", "pipeChainHigh"]) {
+        const v = src[k];
+        if (v === "review" || v === "block") cc2[k] = v;
+      }
+      if (Object.keys(cc2).length > 0) mergedPolicy.commandChecks = cc2;
+    }
     if (p.egress) {
       const e = p.egress;
       if (e.enabled !== void 0) mergedPolicy.egress.enabled = e.enabled;
@@ -4339,6 +4446,13 @@ function getConfig(cwd) {
             locked
           );
         }
+        if (mc.commandChecks && typeof mc.commandChecks === "object") {
+          mergedPolicy.commandChecks = applyManagedCommandChecks(
+            mergedPolicy.commandChecks ?? {},
+            mc.commandChecks,
+            locked
+          );
+        }
         if (mc.approvers && typeof mc.approvers === "object") {
           const bool = (v) => typeof v === "boolean" ? v : void 0;
           mergedSettings.approvers = applyManagedApprovers(mergedSettings.approvers, {
@@ -4448,8 +4562,17 @@ function getConfig(cwd) {
     }
   }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
+  const cc = mergedPolicy.commandChecks ?? {};
+  const advisoryKnob = (name) => {
+    if (name === "review-rm") return cc.rmAdvisory;
+    if (name?.endsWith("-sql")) return cc.sqlDdl;
+    return void 0;
+  };
   for (const rule of ADVISORY_SMART_RULES) {
-    if (!existingAdvisoryNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
+    if (existingAdvisoryNames.has(rule.name)) continue;
+    const knob = rule.verdict === "review" ? advisoryKnob(rule.name) : void 0;
+    if (knob === "off") continue;
+    mergedPolicy.smartRules.push(knob === "block" ? { ...rule, verdict: "block" } : rule);
   }
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {

package/dist/index.mjs

@@ -328,6 +328,16 @@ var ConfigFileSchema = z.object({
       pii: z.enum(["off", "block"]).optional(),
       reviewAction: z.enum(["review", "block"]).optional()
     }).optional(),
+    // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
+    // deliberately exclude 'off' — tighten-only.
+    commandChecks: z.object({
+      inlineExec: z.enum(["off", "review", "block"]).optional(),
+      rmAdvisory: z.enum(["off", "review", "block"]).optional(),
+      chmod: z.enum(["off", "review", "block"]).optional(),
+      sqlDdl: z.enum(["off", "review", "block"]).optional(),
+      evalDynamic: z.enum(["review", "block"]).optional(),
+      pipeChainHigh: z.enum(["review", "block"]).optional()
+    }).optional(),
     egress: z.object({
       enabled: z.boolean().optional(),
       mode: z.enum(["off", "review", "block"]).optional(),
@@ -2338,6 +2348,47 @@ function evaluateSmartConditions(args, rule) {
   });
   return mode === "any" ? results.some((r) => r) : results.every((r) => r);
 }
+function resolveCheck(v) {
+  return v === "off" || v === "block" ? v : "review";
+}
+function resolveCheckTight(v) {
+  return v === "block" ? "block" : "review";
+}
+var INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
+var INLINE_SHELL = /^(bash|sh|zsh)$/i;
+function detectInlineExec(command) {
+  const pipeFed = command.includes("|");
+  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
+  for (const rawSeg of segments) {
+    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
+    if (i >= tokens.length) continue;
+    const base = tokens[i].split("/").pop() ?? tokens[i];
+    if (!INLINE_INTERP.test(base)) continue;
+    const args = tokens.slice(i + 1);
+    let hadRedirect = false;
+    const positionals = [];
+    for (let j = 0; j < args.length; j++) {
+      const a = args[j];
+      if (a === "-") return true;
+      if (a.startsWith("<")) {
+        hadRedirect = true;
+        if (a === "<" || a === "<<") j++;
+        continue;
+      }
+      if (a.startsWith("-")) {
+        if (/^-(c|e|eval)$/i.test(a)) return true;
+        continue;
+      }
+      positionals.push(a);
+    }
+    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
+      return true;
+    }
+  }
+  return false;
+}
 var VERDICT_RANK = {
   allow: 0,
   review: 1,
@@ -2370,7 +2421,7 @@ function isSqlTool(toolName, toolInspection) {
   return fieldName === "sql" || fieldName === "query";
 }
 var SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
-function pipeChainVerdict(command, isTrustedHost2) {
+function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
   const pipeAnalysis = analyzePipeChain(command);
   if (!pipeAnalysis.isPipeline) return null;
   if (pipeAnalysis.risk !== "critical" && pipeAnalysis.risk !== "high") return null;
@@ -2401,7 +2452,7 @@ function pipeChainVerdict(command, isTrustedHost2) {
     };
   }
   return {
-    decision: "review",
+    decision: highAction,
     blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
     reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
     tier: 3
@@ -2427,7 +2478,11 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   if (wouldBeIgnored) return { decision: "allow" };
   const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
   if (bashCommand !== null) {
-    const pipeVerdict = pipeChainVerdict(bashCommand, isTrustedHost2);
+    const pipeVerdict = pipeChainVerdict(
+      bashCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (pipeVerdict) return pipeVerdict;
     const fsVerdict = analyzeFsOperation(bashCommand);
     if (fsVerdict) {
@@ -2442,10 +2497,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
-    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
+    const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
     if (sqlVerdict) {
       return {
-        decision: sqlVerdict.verdict,
+        // analyzeSqlDestructive is typed review-only, so the knob maps 1:1.
+        decision: sqlAction === "block" ? "block" : "review",
         blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
         reason: sqlVerdict.reason,
         tier: 2,
@@ -2453,10 +2510,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
-    const chmodVerdict = analyzeChmod777(bashCommand);
+    const chmodAction = resolveCheck(config.policy.commandChecks?.chmod);
+    const chmodVerdict = chmodAction === "off" ? null : analyzeChmod777(bashCommand);
     if (chmodVerdict) {
       return {
-        decision: chmodVerdict.verdict,
+        // analyzeChmod777 is typed review-only, so the knob maps 1:1.
+        decision: chmodAction === "block" ? "block" : "review",
         blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
         reason: chmodVerdict.reason,
         tier: 2,
@@ -2499,10 +2558,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
       return {
-        decision: "review",
+        decision: inlineAction === "block" ? "block" : "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
         ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
         tier: 3
@@ -2520,14 +2579,21 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     if (evalVerdict === "review") {
       return {
-        decision: "review",
+        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
+        // block but can never turn this off (eval-remote above is Class A —
+        // no knob at all).
+        decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
       };
     }
-    const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost2);
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (ptVerdict) return ptVerdict;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
@@ -3638,6 +3704,32 @@ function applyManagedDlp(local, managed, locked) {
   }
   return next;
 }
+var COMMAND_CHECK_ORDER = ["off", "review", "block"];
+var COMMAND_CHECK_KEYS = [
+  "inlineExec",
+  "rmAdvisory",
+  "chmod",
+  "sqlDdl",
+  "evalDynamic",
+  "pipeChainHigh"
+];
+function applyManagedCommandChecks(local, managed, locked) {
+  const next = { ...local };
+  for (const key of COMMAND_CHECK_KEYS) {
+    const m = managed[key];
+    if (typeof m !== "string") continue;
+    const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
+    const resolved = resolveByOrder(
+      COMMAND_CHECK_ORDER,
+      local[key] ?? "review",
+      m,
+      locked.includes(lockKey)
+    );
+    if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
+    next[key] = resolved;
+  }
+  return next;
+}
 function applyManagedApprovers(local, managed) {
   return {
     ...local,
@@ -4208,6 +4300,21 @@ function getConfig(cwd) {
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
       if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
     }
+    if (p.commandChecks && typeof p.commandChecks === "object") {
+      const src = p.commandChecks;
+      const cc2 = {
+        ...mergedPolicy.commandChecks
+      };
+      for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+        const v = src[k];
+        if (v === "off" || v === "review" || v === "block") cc2[k] = v;
+      }
+      for (const k of ["evalDynamic", "pipeChainHigh"]) {
+        const v = src[k];
+        if (v === "review" || v === "block") cc2[k] = v;
+      }
+      if (Object.keys(cc2).length > 0) mergedPolicy.commandChecks = cc2;
+    }
     if (p.egress) {
       const e = p.egress;
       if (e.enabled !== void 0) mergedPolicy.egress.enabled = e.enabled;
@@ -4309,6 +4416,13 @@ function getConfig(cwd) {
             locked
           );
         }
+        if (mc.commandChecks && typeof mc.commandChecks === "object") {
+          mergedPolicy.commandChecks = applyManagedCommandChecks(
+            mergedPolicy.commandChecks ?? {},
+            mc.commandChecks,
+            locked
+          );
+        }
         if (mc.approvers && typeof mc.approvers === "object") {
           const bool = (v) => typeof v === "boolean" ? v : void 0;
           mergedSettings.approvers = applyManagedApprovers(mergedSettings.approvers, {
@@ -4418,8 +4532,17 @@ function getConfig(cwd) {
     }
   }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
+  const cc = mergedPolicy.commandChecks ?? {};
+  const advisoryKnob = (name) => {
+    if (name === "review-rm") return cc.rmAdvisory;
+    if (name?.endsWith("-sql")) return cc.sqlDdl;
+    return void 0;
+  };
   for (const rule of ADVISORY_SMART_RULES) {
-    if (!existingAdvisoryNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
+    if (existingAdvisoryNames.has(rule.name)) continue;
+    const knob = rule.verdict === "review" ? advisoryKnob(rule.name) : void 0;
+    if (knob === "off") continue;
+    mergedPolicy.smartRules.push(knob === "block" ? { ...rule, verdict: "block" } : rule);
   }
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.66.0",
+  "version": "1.67.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",