@node9/proxy 1.67.0 → 1.67.2

package/dist/index.mjs

@@ -380,8 +380,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path13 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path13}: ${issue.message}`;
+    const path14 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path14}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -1001,6 +1001,129 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
   }
   return null;
 }
+var MAX_REGEX_LENGTH = 256;
+var REGEX_CACHE_MAX = 500;
+var regexCache = /* @__PURE__ */ new Map();
+function validateRegex(pattern) {
+  if (!pattern) return "Pattern is required";
+  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return `Invalid regex syntax: ${e.message}`;
+  }
+  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
+  if (!safeRegex2(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
+  return null;
+}
+function getCompiledRegex(pattern, flags = "") {
+  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
+  const key = `${pattern}\0${flags}`;
+  if (regexCache.has(key)) {
+    const cached = regexCache.get(key);
+    regexCache.delete(key);
+    regexCache.set(key, cached);
+    return cached;
+  }
+  if (validateRegex(pattern) !== null) return null;
+  try {
+    const re = new RegExp(pattern, flags);
+    if (regexCache.size >= REGEX_CACHE_MAX) {
+      const oldest = regexCache.keys().next().value;
+      if (oldest) regexCache.delete(oldest);
+    }
+    regexCache.set(key, re);
+    return re;
+  } catch {
+    return null;
+  }
+}
+function matchesPattern(text, patterns) {
+  const p = Array.isArray(patterns) ? patterns : [patterns];
+  if (p.length === 0) return false;
+  const isMatch = pm(p, { nocase: true, dot: true });
+  const target = text.toLowerCase();
+  const directMatch = isMatch(target);
+  if (directMatch) return true;
+  const withoutDotSlash = text.replace(/^\.\//, "");
+  return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
+}
+var FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function getNestedValue(obj, path14) {
+  if (!obj || typeof obj !== "object") return null;
+  const segments = path14.split(".");
+  for (const seg of segments) {
+    if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
+  }
+  return segments.reduce((prev, curr) => prev?.[curr], obj);
+}
+function evaluateSmartConditions(args, rule) {
+  if (!rule.conditions || rule.conditions.length === 0) return true;
+  const mode = rule.conditionMode ?? "all";
+  const fieldCache = /* @__PURE__ */ new Map();
+  const resolveField = (field) => {
+    if (fieldCache.has(field)) return fieldCache.get(field) ?? null;
+    const rawVal = getNestedValue(args, field);
+    const rawStr = rawVal !== null && rawVal !== void 0 ? String(rawVal) : null;
+    const stripped = field === "command" && rawStr !== null ? normalizeCommandForPolicy(rawStr) : rawStr;
+    const val = stripped !== null ? stripped.replace(/\s+/g, " ").trim() : null;
+    fieldCache.set(field, val);
+    return val;
+  };
+  const readingsCache = /* @__PURE__ */ new Map();
+  const resolveFieldReadings = (field) => {
+    const cached = readingsCache.get(field);
+    if (cached) return cached;
+    const primary = resolveField(field);
+    if (primary === null) {
+      readingsCache.set(field, []);
+      return [];
+    }
+    let out = [primary];
+    if (field === "command") {
+      const raw = getNestedValue(args, field);
+      if (typeof raw === "string") {
+        const collapsed = commandReadings(raw).map((r) => r.replace(/\s+/g, " ").trim());
+        out = [.../* @__PURE__ */ new Set([primary, ...collapsed])];
+      }
+    }
+    readingsCache.set(field, out);
+    return out;
+  };
+  const results = rule.conditions.map((cond) => {
+    const val = resolveField(cond.field);
+    switch (cond.op) {
+      case "exists":
+        return val !== null && val !== "";
+      case "notExists":
+        return val === null || val === "";
+      case "contains":
+        return val !== null && cond.value ? val.includes(cond.value) : false;
+      case "notContains":
+        return val !== null && cond.value ? !val.includes(cond.value) : true;
+      case "matches": {
+        if (val === null || !cond.value) return false;
+        const reM = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reM) return false;
+        return resolveFieldReadings(cond.field).some((v) => reM.test(v));
+      }
+      case "notMatches": {
+        if (!cond.value) return false;
+        if (val === null) return true;
+        const reN = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reN) return false;
+        return !resolveFieldReadings(cond.field).some((v) => reN.test(v));
+      }
+      case "matchesGlob":
+        return val !== null && cond.value ? pm.isMatch(val, cond.value) : false;
+      case "notMatchesGlob":
+        return val !== null && cond.value ? !pm.isMatch(val, cond.value) : false;
+      default:
+        return false;
+    }
+  });
+  return mode === "any" ? results.some((r) => r) : results.every((r) => r);
+}
 var { syntax } = mvdanSh;
 var sharedParser = syntax.NewParser();
 var MESSAGE_FLAGS = /* @__PURE__ */ new Set([
@@ -1073,14 +1196,22 @@ function cachedNormalize(command, compute) {
   return result;
 }
 function normalizeCommandForPolicy(command) {
+  return commandReadingsImpl(command).posix;
+}
+function commandReadings(command) {
+  const r = commandReadingsImpl(command);
+  return r.separator === r.posix ? [r.posix] : [r.posix, r.separator];
+}
+function commandReadingsImpl(command) {
   return cachedNormalize(command, () => normalizeCommandForPolicyImpl(command));
 }
 function normalizeCommandForPolicyImpl(command) {
   const f = parseShared(command);
-  if (f === PARSE_FAIL) return command;
+  if (f === PARSE_FAIL) return { posix: command, separator: command };
   try {
     const strips = [];
     const rewrites = [];
+    const quoteOnlyRewrites = [];
     const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
@@ -1125,22 +1256,23 @@ function normalizeCommandForPolicyImpl(command) {
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
+        const quoteOnly = source.replace(/['"]/g, "");
+        if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
       }
       return true;
     });
-    const edits = [
-      ...strips.map(([s, e]) => [s, e, '""']),
-      ...rewrites
-    ];
-    if (edits.length === 0) return command;
-    edits.sort((a, b) => b[0] - a[0]);
-    let result = command;
-    for (const [s, e, rep] of edits) {
-      result = result.slice(0, s) + rep + result.slice(e);
-    }
-    return result;
+    const stripEdits = strips.map(([s, e]) => [s, e, '""']);
+    const apply = (extra) => {
+      const edits = [...stripEdits, ...extra];
+      if (edits.length === 0) return command;
+      edits.sort((a, b) => b[0] - a[0]);
+      let out = command;
+      for (const [s, e, rep] of edits) out = out.slice(0, s) + rep + out.slice(e);
+      return out;
+    };
+    return { posix: apply(rewrites), separator: apply(quoteOnlyRewrites) };
   } catch {
-    return command;
+    return { posix: command, separator: command };
   }
 }
 function scanArgsForDynamicExec(args, startIdx) {
@@ -1381,6 +1513,208 @@ function chmodHasOpenPermMode(command) {
   }
   return found;
 }
+function isShellShapedTool(toolName, toolInspection) {
+  if (isBashTool(toolName)) return true;
+  if (!toolInspection) return false;
+  const pattern = Object.keys(toolInspection).find((p) => matchesPattern(toolName, p));
+  return pattern !== void 0 && toolInspection[pattern] === "command";
+}
+function toolMatchesRule(toolName, ruleTool, toolInspection) {
+  if (!ruleTool) return true;
+  if (matchesPattern(toolName, ruleTool)) return true;
+  return isShellShapedTool(toolName, toolInspection) && matchesPattern("bash", ruleTool);
+}
+var INLINE_INTERPRETER = /^(python[\d.]*|perl|ruby|node|tsx|ts-node|php|lua|deno|bun|pwsh|powershell(?:\.exe)?|osascript|rscript|irb|bash|sh|zsh|script|su)$/i;
+var RUNNER_WRAPPERS = /* @__PURE__ */ new Set([
+  "uv",
+  "uvx",
+  "poetry",
+  "pipenv",
+  "pdm",
+  "rye",
+  "hatch",
+  "conda",
+  "mamba",
+  "micromamba",
+  "npx",
+  "pnpm",
+  "yarn",
+  "bunx",
+  "watch",
+  "strace",
+  "ltrace",
+  "chroot",
+  "unshare",
+  "runuser"
+]);
+function isInlineCodeFlag(interp, w) {
+  const lw = w.toLowerCase();
+  if (lw === "--eval" || lw === "--command" || lw === "--print") return true;
+  if (/^(pwsh|powershell)/.test(interp)) return /^-(c|command|e|ec|enc|encodedcommand)$/i.test(lw);
+  if (!w.startsWith("-") || w.startsWith("--")) return false;
+  const codeLetters = /^(perl|ruby|lua|bun|osascript|rscript|irb)$/.test(interp) ? "e" : /^(node|tsx|ts-node)$/.test(interp) ? "ep" : interp === "php" ? "r" : "c";
+  const body = lw.slice(1);
+  const cutAt = /^(perl|ruby|node|tsx|ts-node)$/.test(interp) ? /[mirw]|[^a-z0-9]/ : /[^a-z0-9]/;
+  const cut = body.search(cutAt);
+  const bundle = cut >= 0 ? body.slice(0, cut) : body;
+  return [...codeLetters].some((l) => bundle.includes(l));
+}
+var _redirStdinOps = null;
+function redirStdinOps() {
+  if (_redirStdinOps) return _redirStdinOps;
+  _redirStdinOps = new Set(
+    [
+      deriveRedirOp("cat <<X\nX"),
+      deriveRedirOp("cat <<-X\nX"),
+      deriveRedirOp("cat < f"),
+      deriveRedirOp("cat <<< x")
+    ].filter((op) => op >= 0)
+  );
+  return _redirStdinOps;
+}
+function deriveBinaryOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "BinaryCmd" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var _listOps = null;
+function listOps() {
+  if (_listOps) return _listOps;
+  _listOps = new Set(
+    [deriveBinaryOp("a && b"), deriveBinaryOp("a || b")].filter((o) => o >= 0)
+  );
+  return _listOps;
+}
+var WRAPPER_TAKES_TARGET = /* @__PURE__ */ new Set(["chroot"]);
+var INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
+function unwrapCommandHead(words) {
+  let i = 0;
+  while (i < words.length) {
+    const head = (words[i] ?? "").toLowerCase().split("/").pop() ?? "";
+    if (head === "find") {
+      const x = words.findIndex(
+        (w, k) => k > i && (w === "-exec" || w === "-execdir" || w === "-ok")
+      );
+      if (x < 0) break;
+      i = x + 1;
+      continue;
+    }
+    if (!COMMAND_WRAPPERS.has(head) && !RUNNER_WRAPPERS.has(head)) break;
+    i++;
+    let targetConsumed = false;
+    while (i < words.length) {
+      const t = words[i];
+      if (t === null) {
+        i++;
+        continue;
+      }
+      const lt = t.toLowerCase();
+      if (/^[A-Za-z_]\w*=/.test(t)) {
+        i++;
+        continue;
+      }
+      if (t.startsWith("-")) {
+        i++;
+        const nxt = words[i];
+        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()))
+          i++;
+        continue;
+      }
+      if (lt === "run" || lt === "exec" || lt === "dlx" || /^\d+(\.\d+)?[smhd]?$/.test(lt)) {
+        i++;
+        continue;
+      }
+      if (!targetConsumed && WRAPPER_TAKES_TARGET.has(head)) {
+        targetConsumed = true;
+        i++;
+        continue;
+      }
+      break;
+    }
+  }
+  return i;
+}
+function inlineExecStmt(stmt, pipeFed) {
+  const cmd = stmt?.Cmd;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return false;
+  const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0) return false;
+  const headIdx = unwrapCommandHead(words);
+  const rawHead = words[headIdx];
+  if (rawHead == null) return false;
+  const interp = (rawHead.split("/").pop() ?? "").toLowerCase();
+  if (!INLINE_INTERPRETER.test(interp)) return false;
+  let args = words.slice(headIdx + 1);
+  if (interp === "deno" && (args[0] ?? "").toLowerCase() === "eval") return true;
+  if (INTERP_LEADING_TARGET.has(interp)) {
+    const firstFlag = args.findIndex((a) => a == null || a.startsWith("-"));
+    args = firstFlag >= 0 ? args.slice(firstFlag) : [];
+  }
+  let positionals = 0;
+  let selectedProgram = false;
+  for (const a of args) {
+    if (a == null) {
+      positionals++;
+      selectedProgram = true;
+      continue;
+    }
+    if (!selectedProgram && isInlineCodeFlag(interp, a)) return true;
+    if (a === "-m") {
+      selectedProgram = true;
+      continue;
+    }
+    if (a === "-" && !selectedProgram) return true;
+    if (!a.startsWith("-")) {
+      positionals++;
+      selectedProgram = true;
+    }
+  }
+  const redirs = stmt.Redirs || cmd.Redirs || [];
+  const stdinFed = redirs.some((r) => r && redirStdinOps().has(r.Op));
+  if (positionals === 0 && (stdinFed || pipeFed)) {
+    if (!/^(bash|sh|zsh)$/i.test(interp)) return true;
+  }
+  return false;
+}
+function detectInlineExec(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) {
+    return /(^|[|;&]|&&)\s*(?:[\w./-]*\/)?(python[\d.]*|perl|ruby|node|php|lua|deno|bun|pwsh|osascript|rscript|bash|sh|zsh)\s+-{1,2}[a-z]*[ceEr]/i.test(
+      command
+    );
+  }
+  let found = false;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || found) return false;
+      const n = node;
+      const t = syntax.NodeType(n);
+      if (t === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
+        if (inlineExecStmt(n.Y, true)) {
+          found = true;
+          return false;
+        }
+      }
+      if (t === "Stmt" && inlineExecStmt(n, false)) {
+        found = true;
+        return false;
+      }
+      return true;
+    });
+  } catch {
+    return found;
+  }
+  return found;
+}
 function analyzeChmod777(command) {
   if (!/chmod/i.test(command.replace(/[\\'"]/g, ""))) return null;
   if (!chmodHasOpenPermMode(command)) return null;
@@ -2245,150 +2579,12 @@ function extractAllSshHosts(tokens) {
   }
   return [...hosts].filter(Boolean);
 }
-var MAX_REGEX_LENGTH = 100;
-var REGEX_CACHE_MAX = 500;
-var regexCache = /* @__PURE__ */ new Map();
-function validateRegex(pattern) {
-  if (!pattern) return "Pattern is required";
-  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
-  try {
-    new RegExp(pattern);
-  } catch (e) {
-    return `Invalid regex syntax: ${e.message}`;
-  }
-  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
-  if (!safeRegex2(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
-  return null;
-}
-function getCompiledRegex(pattern, flags = "") {
-  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
-  const key = `${pattern}\0${flags}`;
-  if (regexCache.has(key)) {
-    const cached = regexCache.get(key);
-    regexCache.delete(key);
-    regexCache.set(key, cached);
-    return cached;
-  }
-  if (validateRegex(pattern) !== null) return null;
-  try {
-    const re = new RegExp(pattern, flags);
-    if (regexCache.size >= REGEX_CACHE_MAX) {
-      const oldest = regexCache.keys().next().value;
-      if (oldest) regexCache.delete(oldest);
-    }
-    regexCache.set(key, re);
-    return re;
-  } catch {
-    return null;
-  }
-}
-function matchesPattern(text, patterns) {
-  const p = Array.isArray(patterns) ? patterns : [patterns];
-  if (p.length === 0) return false;
-  const isMatch = pm(p, { nocase: true, dot: true });
-  const target = text.toLowerCase();
-  const directMatch = isMatch(target);
-  if (directMatch) return true;
-  const withoutDotSlash = text.replace(/^\.\//, "");
-  return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
-}
-var FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function getNestedValue(obj, path13) {
-  if (!obj || typeof obj !== "object") return null;
-  const segments = path13.split(".");
-  for (const seg of segments) {
-    if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
-  }
-  return segments.reduce((prev, curr) => prev?.[curr], obj);
-}
-function evaluateSmartConditions(args, rule) {
-  if (!rule.conditions || rule.conditions.length === 0) return true;
-  const mode = rule.conditionMode ?? "all";
-  const fieldCache = /* @__PURE__ */ new Map();
-  const resolveField = (field) => {
-    if (fieldCache.has(field)) return fieldCache.get(field) ?? null;
-    const rawVal = getNestedValue(args, field);
-    const rawStr = rawVal !== null && rawVal !== void 0 ? String(rawVal) : null;
-    const stripped = field === "command" && rawStr !== null ? normalizeCommandForPolicy(rawStr) : rawStr;
-    const val = stripped !== null ? stripped.replace(/\s+/g, " ").trim() : null;
-    fieldCache.set(field, val);
-    return val;
-  };
-  const results = rule.conditions.map((cond) => {
-    const val = resolveField(cond.field);
-    switch (cond.op) {
-      case "exists":
-        return val !== null && val !== "";
-      case "notExists":
-        return val === null || val === "";
-      case "contains":
-        return val !== null && cond.value ? val.includes(cond.value) : false;
-      case "notContains":
-        return val !== null && cond.value ? !val.includes(cond.value) : true;
-      case "matches": {
-        if (val === null || !cond.value) return false;
-        const reM = getCompiledRegex(cond.value, cond.flags ?? "");
-        if (!reM) return false;
-        return reM.test(val);
-      }
-      case "notMatches": {
-        if (!cond.value) return false;
-        if (val === null) return true;
-        const reN = getCompiledRegex(cond.value, cond.flags ?? "");
-        if (!reN) return false;
-        return !reN.test(val);
-      }
-      case "matchesGlob":
-        return val !== null && cond.value ? pm.isMatch(val, cond.value) : false;
-      case "notMatchesGlob":
-        return val !== null && cond.value ? !pm.isMatch(val, cond.value) : false;
-      default:
-        return false;
-    }
-  });
-  return mode === "any" ? results.some((r) => r) : results.every((r) => r);
-}
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
 }
 function resolveCheckTight(v) {
   return v === "block" ? "block" : "review";
 }
-var INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
-var INLINE_SHELL = /^(bash|sh|zsh)$/i;
-function detectInlineExec(command) {
-  const pipeFed = command.includes("|");
-  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
-  for (const rawSeg of segments) {
-    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
-    let i = 0;
-    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
-    if (i >= tokens.length) continue;
-    const base = tokens[i].split("/").pop() ?? tokens[i];
-    if (!INLINE_INTERP.test(base)) continue;
-    const args = tokens.slice(i + 1);
-    let hadRedirect = false;
-    const positionals = [];
-    for (let j = 0; j < args.length; j++) {
-      const a = args[j];
-      if (a === "-") return true;
-      if (a.startsWith("<")) {
-        hadRedirect = true;
-        if (a === "<" || a === "<<") j++;
-        continue;
-      }
-      if (a.startsWith("-")) {
-        if (/^-(c|e|eval)$/i.test(a)) return true;
-        continue;
-      }
-      positionals.push(a);
-    }
-    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
-      return true;
-    }
-  }
-  return false;
-}
 var VERDICT_RANK = {
   allow: 0,
   review: 1,
@@ -2402,6 +2598,12 @@ function resolvePinned(matches) {
     (best, r) => VERDICT_RANK[r.verdict] > VERDICT_RANK[best.verdict] ? r : best
   );
 }
+function strictestVerdict(candidates) {
+  if (candidates.length === 0) return void 0;
+  return candidates.reduce(
+    (best, c) => VERDICT_RANK[c.decision] > VERDICT_RANK[best.decision] ? c : best
+  );
+}
 function tokenize2(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
 }
@@ -2413,6 +2615,11 @@ function extractShellCommand(toolName, args, toolInspection) {
   const value = getNestedValue(args, fieldPath);
   return typeof value === "string" ? value : null;
 }
+function inspectsShellCommand(toolName, toolInspection) {
+  const patterns = Object.keys(toolInspection);
+  const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
+  return matchingPattern !== void 0 && toolInspection[matchingPattern] === "command";
+}
 function isSqlTool(toolName, toolInspection) {
   const patterns = Object.keys(toolInspection);
   const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
@@ -2475,8 +2682,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored) return { decision: "allow" };
-  const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
+  const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
+  const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
   if (bashCommand !== null) {
     const pipeVerdict = pipeChainVerdict(
       bashCommand,
@@ -2526,8 +2735,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   if (config.policy.smartRules.length > 0) {
     const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
+    const astSuppressed = (rule) => {
+      if (bashCommand === null || !rule.name || !AST_FS_REGEX_RULES.has(rule.name)) return false;
+      const knob = rule.name === "review-drop-truncate-shell" ? resolveCheck(config.policy.commandChecks?.sqlDdl) : rule.name === "shield:filesystem:review-chmod-777" ? resolveCheck(config.policy.commandChecks?.chmod) : void 0;
+      if (knob === "off" && rule.pinned) return false;
+      return true;
+    };
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
+      (rule) => toolMatchesRule(toolName, rule.tool, config.policy.toolInspection) && !astSuppressed(rule) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
@@ -2558,15 +2773,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
-    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
-      return {
-        decision: inlineAction === "block" ? "block" : "review",
-        blockedByLabel: "Node9 Standard (Inline Execution)",
-        ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
-        tier: 3
-      };
-    }
+    const candidates = [];
     const evalVerdict = detectDangerousShellExec(shellCommand);
     if (evalVerdict === "block") {
       return {
@@ -2577,24 +2784,33 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         tier: 3
       };
     }
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
+    if (ptVerdict?.decision === "allow") return ptVerdict;
+    if (ptVerdict) candidates.push(ptVerdict);
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
+      candidates.push({
+        decision: inlineAction === "block" ? "block" : "review",
+        blockedByLabel: "Node9 Standard (Inline Execution)",
+        ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
+        tier: 3
+      });
+    }
     if (evalVerdict === "review") {
-      return {
-        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
-        // block but can never turn this off (eval-remote above is Class A —
-        // no knob at all).
+      candidates.push({
         decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
-      };
+      });
     }
-    const ptVerdict = pipeChainVerdict(
-      shellCommand,
-      isTrustedHost2,
-      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
-    );
-    if (ptVerdict) return ptVerdict;
+    const builtin = strictestVerdict(candidates);
+    if (builtin) return builtin;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
@@ -3645,28 +3861,41 @@ function readShieldOverrides() {
 var MODE_ORDER = ["observe", "audit", "standard", "strict"];
 var EGRESS_MODE_ORDER = ["off", "review", "block"];
 function rankIn(order, value) {
-  return order.indexOf(value);
+  return value === void 0 ? -1 : order.indexOf(value);
 }
-function resolveByOrder(order, local, cloud, locked) {
-  if (rankIn(order, cloud) === -1) return local;
-  if (locked) return cloud;
+function floorValue(order, local, cloud, opts = {}) {
+  if (cloud === void 0 || rankIn(order, cloud) === -1) return local;
+  if (opts.locked) return cloud;
+  const localSet = opts.localWasSet ?? local !== void 0;
+  if (!localSet || rankIn(order, local) === -1) return cloud;
   return rankIn(order, local) > rankIn(order, cloud) ? local : cloud;
 }
+function strictestOf(order, ...values) {
+  let best;
+  for (const v of values) {
+    if (rankIn(order, v) === -1) continue;
+    if (best === void 0 || rankIn(order, v) > rankIn(order, best)) best = v;
+  }
+  return best;
+}
+function resolveByOrder(order, local, cloud, locked) {
+  return floorValue(order, local, cloud, { locked }) ?? local;
+}
 function resolveManagedMode(local, cloud, locked) {
   return resolveByOrder(MODE_ORDER, local, cloud, locked);
 }
-function applyManagedEgress(local, managed, locked) {
+function applyManagedEgress(local, managed, locked, localModeUserSet = true) {
   const next = { ...local };
   if (typeof managed.enabled === "boolean") {
     next.enabled = locked.includes("egressEnabled") ? managed.enabled : local.enabled || managed.enabled;
   }
   if (typeof managed.mode === "string") {
-    next.mode = resolveByOrder(
-      EGRESS_MODE_ORDER,
-      local.mode,
-      managed.mode,
-      locked.includes("egressMode")
-    );
+    next.mode = floorValue(EGRESS_MODE_ORDER, local.mode, managed.mode, {
+      locked: locked.includes("egressMode"),
+      // The default 'review' is seeded into egress before any merge, so absence
+      // is invisible from `local.mode` alone — the caller tracks it for us.
+      localWasSet: localModeUserSet
+    }) ?? local.mode;
   }
   if (Array.isArray(managed.allow) && managed.allow.length > 0) {
     next.allow = [...managed.allow];
@@ -3686,6 +3915,9 @@ function applyManagedDlp(local, managed, locked) {
   if (typeof managed.enabled === "boolean") {
     next.enabled = locked.includes("dlpEnabled") ? managed.enabled : local.enabled || managed.enabled;
   }
+  if (managed.enabled === true) {
+    next.scanIgnoredTools = true;
+  }
   if (typeof managed.pii === "string") {
     next.pii = resolveByOrder(
       DLP_PII_ORDER,
@@ -3719,12 +3951,9 @@ function applyManagedCommandChecks(local, managed, locked) {
     const m = managed[key];
     if (typeof m !== "string") continue;
     const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
-    const resolved = resolveByOrder(
-      COMMAND_CHECK_ORDER,
-      local[key] ?? "review",
-      m,
-      locked.includes(lockKey)
-    );
+    const resolved = floorValue(COMMAND_CHECK_ORDER, local[key], m, {
+      locked: locked.includes(lockKey)
+    });
     if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
     next[key] = resolved;
   }
@@ -3750,11 +3979,18 @@ function slug(s) {
 var B = "[\\s/\\\\]";
 var SEP = "[/\\\\]";
 function pathToRegexFragment(rawPath) {
-  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
+  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
   const segments = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
   if (segments.length === 0) return "";
   return `(^|${B})${segments.join(SEP)}(${B}|$)`;
 }
+function pathMatchesFragment(candidate, rawPath) {
+  const value = pathToRegexFragment(rawPath);
+  if (!value || !candidate) return false;
+  const re = getCompiledRegex(value);
+  if (!re) return false;
+  return re.test(candidate);
+}
 function pathRules(rawPath, verdict, reason) {
   const value = pathToRegexFragment(rawPath);
   if (!value) return [];
@@ -3768,12 +4004,28 @@ function pathRules(rawPath, verdict, reason) {
       verdict,
       reason: why
     },
+    // Keep the historical `-anytool` name for the file_path rule: the
+    // rule→shield attribution maps (Report SHIELDS panel) key on rule names.
     {
       name: `${verdict}-path-${s}-anytool`,
       tool: "*",
       conditions: [{ field: "file_path", op: "matches", value }],
       verdict,
       reason: why
+    },
+    {
+      name: `${verdict}-path-${s}-anytool-path`,
+      tool: "*",
+      conditions: [{ field: "path", op: "matches", value }],
+      verdict,
+      reason: why
+    },
+    {
+      name: `${verdict}-path-${s}-anytool-pattern`,
+      tool: "*",
+      conditions: [{ field: "pattern", op: "matches", value }],
+      verdict,
+      reason: why
     }
   ];
 }
@@ -3846,8 +4098,14 @@ var DEFAULT_CONFIG = {
   settings: {
     mode: "standard",
     autoStartDaemon: true,
-    enableUndo: true,
-    // 🔥 ALWAYS TRUE BY DEFAULT for the safety net
+    // OFF by default. The snapshot store is a per-project bare git repo with
+    // no size ceiling, and eviction drops the index row without deleting the
+    // objects — on one machine it reached 378G (352G of it orphaned tmp_pack_*
+    // from interrupted `git gc`) and filled the disk. A security tool must not
+    // be what fills a customer's disk. Re-enable per install with
+    // `{"settings":{"enableUndo":true}}`; the default flips back when the
+    // bounded copy-store lands (doc/undo-v2-copy-store-design.md).
+    enableUndo: false,
     enableHookLogDebug: true,
     approvalTimeoutMs: 12e4,
     // 120-second auto-deny timeout
@@ -4046,10 +4304,13 @@ var DEFAULT_CONFIG = {
     skillPinning: { enabled: false, mode: "warn", roots: [] },
     trustedHosts: [],
     trustedHostsManaged: false,
-    appPermissions: {}
+    appPermissions: {},
+    managedJailPaths: []
   },
   environments: {}
 };
+var RM_SAFE_PATH_PATTERN = "(node_modules|\\bdist\\b|\\.next|\\bcoverage\\b|\\.cache|\\btmp\\b|\\btemp\\b|\\.DS_Store)(\\/|\\s|$)";
+var VERDICT_ORDER = ["allow", "review", "block"];
 var ADVISORY_SMART_RULES = [
   // ── rm safety ─────────────────────────────────────────────────────────────
   // tool: '*' so they cover bash, shell, run_shell_command, and Gemini's Shell.
@@ -4061,12 +4322,7 @@ var ADVISORY_SMART_RULES = [
     conditionMode: "all",
     conditions: [
       { field: "command", op: "matches", value: "(^|&&|\\|\\||;)\\s*rm\\b" },
-      {
-        field: "command",
-        op: "matches",
-        // Matches known-safe build artifact paths in the command.
-        value: "(node_modules|\\bdist\\b|\\.next|\\bcoverage\\b|\\.cache|\\btmp\\b|\\btemp\\b|\\.DS_Store)(\\/|\\s|$)"
-      }
+      { field: "command", op: "matches", value: RM_SAFE_PATH_PATTERN }
     ],
     verdict: "allow",
     reason: "Deleting a known-safe build artifact path"
@@ -4244,10 +4500,15 @@ function getConfig(cwd) {
     // here. A managed list fills this below and flips trustedHostsManaged.
     trustedHosts: [],
     trustedHostsManaged: false,
-    appPermissions: {}
+    appPermissions: {},
+    managedJailPaths: []
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
-  const applyLayer = (source) => {
+  const rank = (v) => {
+    const i = COMMAND_CHECK_ORDER.indexOf(v ?? "");
+    return i === -1 ? 1 : i;
+  };
+  const applyLayer = (source, isProject = false) => {
     if (!source) return;
     const s = source.settings || {};
     const p = source.policy || {};
@@ -4307,7 +4568,9 @@ function getConfig(cwd) {
       };
       for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
         const v = src[k];
-        if (v === "off" || v === "review" || v === "block") cc2[k] = v;
+        if (v !== "off" && v !== "review" && v !== "block") continue;
+        if (isProject && rank(v) < rank(cc2[k])) continue;
+        cc2[k] = v;
       }
       for (const k of ["evalDynamic", "pipeChainHigh"]) {
         const v = src[k];
@@ -4317,11 +4580,22 @@ function getConfig(cwd) {
     }
     if (p.egress) {
       const e = p.egress;
-      if (e.enabled !== void 0) mergedPolicy.egress.enabled = e.enabled;
-      if (e.mode !== void 0) mergedPolicy.egress.mode = e.mode;
-      if (Array.isArray(e.allow)) mergedPolicy.egress.allow.push(...e.allow);
+      if (e.enabled !== void 0 && !(isProject && e.enabled === false))
+        mergedPolicy.egress.enabled = e.enabled;
+      if (e.mode !== void 0) {
+        const weaker = isProject && rank(e.mode) < rank(mergedPolicy.egress.mode);
+        if (!weaker) {
+          mergedPolicy.egress.mode = e.mode;
+          egressModeUserSet = true;
+        }
+      }
+      if (Array.isArray(e.allow) && (!isProject || !egressAllowUserSet)) {
+        mergedPolicy.egress.allow.push(...e.allow);
+      }
+      if (Array.isArray(e.allow) && !isProject) egressAllowUserSet = true;
       if (Array.isArray(e.deny)) mergedPolicy.egress.deny.push(...e.deny);
-      if (e.allowPrivate !== void 0) mergedPolicy.egress.allowPrivate = e.allowPrivate;
+      if (e.allowPrivate !== void 0 && !(isProject && e.allowPrivate === true))
+        mergedPolicy.egress.allowPrivate = e.allowPrivate;
     }
     if (p.loopDetection) {
       const ld = p.loopDetection;
@@ -4363,11 +4637,21 @@ function getConfig(cwd) {
       }
     }
   };
+  let egressModeUserSet = false;
+  let egressAllowUserSet = false;
   applyLayer(globalConfig);
-  applyLayer(projectConfig);
+  applyLayer(
+    projectConfig,
+    /* isProject */
+    true
+  );
   let cloudManagedShields = [];
+  const managedCommandCheckKeys = /* @__PURE__ */ new Set();
+  const lockedCommandCheckKeys = /* @__PURE__ */ new Set();
   let modeCloudControlled = false;
   let modeCloudStaged = false;
+  let cloudMandatesEnforcement = false;
+  let cloudMandatesAppPerm = false;
   {
     const cacheFile = path4.join(os4.homedir(), ".node9", "rules-cache.json");
     try {
@@ -4402,7 +4686,8 @@ function getConfig(cwd) {
               deny: hosts(mc.egress.deny),
               allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0
             },
-            locked
+            locked,
+            egressModeUserSet
           );
         }
         if (mc.dlp && typeof mc.dlp === "object") {
@@ -4422,6 +4707,12 @@ function getConfig(cwd) {
             mc.commandChecks,
             locked
           );
+          for (const [key, val] of Object.entries(mc.commandChecks)) {
+            if (typeof val !== "string") continue;
+            managedCommandCheckKeys.add(key);
+            const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
+            if (locked.includes(lockKey)) lockedCommandCheckKeys.add(key);
+          }
         }
         if (mc.approvers && typeof mc.approvers === "object") {
           const bool = (v) => typeof v === "boolean" ? v : void 0;
@@ -4468,12 +4759,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path13 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path13) continue;
+            const path14 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path14) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path13, verdict, "org-managed jail")) {
+            for (const r of pathRules(path14, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
+            mergedPolicy.managedJailPaths.push({ path: path14, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -4491,7 +4783,14 @@ function getConfig(cwd) {
             if (Object.keys(m).length) coerced[srv] = m;
           }
           mergedPolicy.appPermissions = coerced;
+          cloudMandatesAppPerm = Object.values(coerced).some(
+            (tools) => Object.values(tools).some((d) => d === "block" || d === "review")
+          );
         }
+        const on = (v) => !!v && typeof v === "object" && v.enabled === true;
+        cloudMandatesEnforcement = cloudMandatesAppPerm || Array.isArray(mc.jailPaths) && mc.jailPaths.some((jp) => typeof jp?.path === "string" && jp.path.trim() !== "") || on(mc.egress) || on(mc.dlp) || on(mc.injectionScan) || on(mc.skillPinning) || on(mc.loopDetection) || !!mc.commandChecks && typeof mc.commandChecks === "object" && Object.values(mc.commandChecks).some(
+          (v) => typeof v === "string" && v !== "off"
+        );
       }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
@@ -4533,25 +4832,45 @@ function getConfig(cwd) {
   }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
   const cc = mergedPolicy.commandChecks ?? {};
-  const advisoryKnob = (name) => {
-    if (name === "review-rm") return cc.rmAdvisory;
-    if (name?.endsWith("-sql")) return cc.sqlDdl;
+  const advisoryKnobKey = (name) => {
+    if (name === "review-rm") return "rmAdvisory";
+    if (name?.endsWith("-sql")) return "sqlDdl";
     return void 0;
   };
   for (const rule of ADVISORY_SMART_RULES) {
-    if (existingAdvisoryNames.has(rule.name)) continue;
-    const knob = rule.verdict === "review" ? advisoryKnob(rule.name) : void 0;
+    const knobKey = rule.verdict === "review" ? advisoryKnobKey(rule.name) : void 0;
+    const knob = knobKey ? cc[knobKey] : void 0;
     if (knob === "off") continue;
-    mergedPolicy.smartRules.push(knob === "block" ? { ...rule, verdict: "block" } : rule);
+    const managed = knobKey ? managedCommandCheckKeys.has(knobKey) : false;
+    const locked = knobKey ? lockedCommandCheckKeys.has(knobKey) : false;
+    const twin = existingAdvisoryNames.has(rule.name) ? mergedPolicy.smartRules.find((r) => r.name === rule.name) : void 0;
+    const knobVerdict = knob === "block" ? "block" : rule.verdict;
+    if (!managed) {
+      if (!twin) mergedPolicy.smartRules.push({ ...rule, verdict: knobVerdict });
+      continue;
+    }
+    const effective = locked ? knobVerdict : strictestOf(VERDICT_ORDER, knobVerdict, twin?.verdict) ?? knobVerdict;
+    if (twin) {
+      mergedPolicy.smartRules = mergedPolicy.smartRules.filter((r) => r.name !== rule.name);
+    }
+    const injected = { ...rule, verdict: effective, pinned: true };
+    if (rule.name === "review-rm" && effective !== "block") {
+      injected.conditions = [
+        ...rule.conditions ?? [],
+        { field: "command", op: "notMatches", value: RM_SAFE_PATH_PATTERN }
+      ];
+      injected.conditionMode = "all";
+    }
+    mergedPolicy.smartRules.push(injected);
   }
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
     mergedSettings.mode = envMode;
   }
-  if (cloudManagedShields.length > 0 && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
+  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
     mergedSettings.mode = "standard";
   }
-  const managedFloorActive = cloudManagedShields.length > 0 || modeCloudControlled && mergedSettings.mode === "strict";
+  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && mergedSettings.mode === "strict";
   if (modeCloudControlled && mergedSettings.mode === "strict") {
     for (const name of Object.keys(mergedEnvironments)) {
       if (mergedEnvironments[name]?.requireApproval === false) {
@@ -4752,14 +5071,14 @@ function checkProvenance(cmd, cwd) {
 }
 
 // src/policy/index.ts
-async function evaluatePolicy2(toolName, args, agent, cwd) {
+async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
   const config = getConfig();
   const activeEnvironment = getActiveEnvironment(config) ?? void 0;
   return evaluatePolicy(
     config,
     toolName,
     args,
-    { agent, cwd, activeEnvironment },
+    { agent, cwd, activeEnvironment, skipIgnoredFastPath: opts?.skipIgnoredFastPath },
     {
       checkProvenance,
       // Managed → match against the org list (frozen with the rest of managed
@@ -5611,6 +5930,44 @@ function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   }
 }
 
+// src/shields/jail.ts
+import fs11 from "fs";
+import os10 from "os";
+import path13 from "path";
+var USER_JAIL_SHIELD = "user-jail";
+function jailStorePath() {
+  return path13.join(os10.homedir(), ".node9", "jail-paths.json");
+}
+function readJailPaths() {
+  let text;
+  try {
+    text = fs11.readFileSync(jailStorePath(), "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`${jailStorePath()} is not valid JSON \u2014 fix it before changing the jail.`);
+  }
+  if (!Array.isArray(parsed.paths)) return [];
+  return parsed.paths.filter(
+    (p) => !!p && typeof p.path === "string" && (p.verdict === "block" || p.verdict === "review")
+  );
+}
+function findJailedPath(candidate) {
+  return findJailedPathIn(candidate, readJailPaths());
+}
+function findJailedPathIn(candidate, paths) {
+  if (!candidate) return null;
+  for (const entry of paths) {
+    if (pathMatchesFragment(candidate, entry.path)) return entry;
+  }
+  return null;
+}
+
 // src/auth/orchestrator.ts
 var WRITE_TOOLS = /* @__PURE__ */ new Set([
   "write",
@@ -6086,12 +6443,35 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   } else if (!taintWarning && !appPermReview) {
     const toolLower = toolName.toLowerCase();
     const isFileTool = toolLower === "read" || toolLower === "grep" || toolLower === "glob" || toolLower === "read_file" || toolLower === "grep_search" || toolLower === "list_files";
-    if (isFileTool && readActiveShields().includes("project-jail")) {
+    const activeShields = isFileTool ? readActiveShields() : [];
+    const managedJail = isFileTool ? config.policy.managedJailPaths ?? [] : [];
+    if (isFileTool && (activeShields.includes("project-jail") || activeShields.includes(USER_JAIL_SHIELD) || managedJail.length > 0)) {
       const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
-      const filePath = String(
-        argsObj.file_path ?? argsObj.path ?? argsObj.pattern ?? argsObj.filename ?? ""
-      );
-      if (filePath && scanFilePath(filePath)) {
+      const candidates = ["file_path", "path", "pattern", "filename"].map((k) => argsObj[k]).filter((v) => typeof v === "string" && v.length > 0);
+      const jailHit = (candidates.map(findJailedPath).find(Boolean) ?? candidates.map((c) => findJailedPathIn(c, managedJail)).find(Boolean)) || null;
+      const sensitiveHit = candidates.some((c) => scanFilePath(c));
+      if (jailHit || sensitiveHit) {
+        const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd, {
+          skipIgnoredFastPath: true
+        });
+        if (policyResult.decision === "block") {
+          if (!isManual)
+            appendLocalAudit(
+              toolName,
+              args,
+              "deny",
+              "smart-rule-block",
+              { ...meta, ruleName: policyResult.ruleName },
+              hashAuditArgs
+            );
+          return {
+            approved: false,
+            reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
+            blockedBy: "local-config",
+            blockedByLabel: policyResult.blockedByLabel,
+            ruleHit: policyResult.ruleName
+          };
+        }
       } else {
         if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
         return { approved: true };
@@ -6154,7 +6534,12 @@ ${appPermReview}`
   }
   let cloudRequestId = null;
   const cloudEnforced = approvers.cloud && !!creds?.apiKey;
-  const forceReview = localSmartRuleMatched === true || options?.localSmartRuleMatched === true || !!appPermReview || void 0;
+  const forceReview = localSmartRuleMatched === true || options?.localSmartRuleMatched === true || !!appPermReview || // Task #16 vector C: a taint review needs a GENUINE pending entry. Taint is
+  // a client-side heuristic the SaaS has no rule for, so without forceReview
+  // its checkRule answers "no org rule matched" → {approved:true}, which is
+  // not an approval of an exfiltration risk. Measured against the live BE:
+  // {approved:true} without this flag, {pending:true} with it.
+  !!taintWarning || void 0;
   if (cloudEnforced) {
     try {
       const initResult = await initNode9SaaS(
@@ -6167,10 +6552,10 @@ ${appPermReview}`
         forceReview
       );
       if (!initResult.pending) {
-        if (initResult.shadowMode && !localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview) {
+        if (initResult.shadowMode && !localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview && !taintWarning) {
           return { approved: true, checkedBy: "cloud" };
         }
-        if (!localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview) {
+        if (!localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview && !taintWarning) {
           return {
             approved: !!initResult.approved,
             reason: initResult.reason || (initResult.approved ? void 0 : "Action rejected by organization policy."),