@node9/proxy 2.14.2 → 2.15.0

package/dist/index.js

@@ -5,8 +5,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -407,8 +412,8 @@ var ConfigFileSchema = import_zod.z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path15 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path15}: ${issue.message}`;
+    const path16 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path16}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -421,9 +426,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path15 of ordered) {
+  for (const path16 of ordered) {
     let cur = root;
-    for (const key of path15.slice(0, -1)) {
+    for (const key of path16.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -431,7 +436,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path15[path15.length - 1];
+    const last = path16[path16.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -467,7 +472,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path15) => path15.length > 0);
+      }).filter((path16) => path16.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -1379,9 +1384,9 @@ function matchesPattern(text, patterns) {
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
 var FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function getNestedValue(obj, path15) {
+function getNestedValue(obj, path16) {
   if (!obj || typeof obj !== "object") return null;
-  const segments2 = path15.split(".");
+  const segments2 = path16.split(".");
   for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -4046,9 +4051,9 @@ function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
 }
-function valuesAt(args, path15) {
+function valuesAt(args, path16) {
   let cursors = [args];
-  for (const rawSegment of path15.split(".")) {
+  for (const rawSegment of path16.split(".")) {
     const isArray = rawSegment.endsWith("[]");
     const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
     const next = [];
@@ -4080,15 +4085,15 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
     const exempt = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
-    for (const path15 of paths) {
-      for (const value of valuesAt(args, path15)) {
+    for (const path16 of paths) {
+      for (const value of valuesAt(args, path16)) {
         const host = hostOf(value);
         if (!host) continue;
         const m = classifySsrf(host);
         if (!m) continue;
         if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
         if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-        return { ...m, argPath: path15, host, reason: ssrfReason(m, host) };
+        return { ...m, argPath: path16, host, reason: ssrfReason(m, host) };
       }
     }
     return null;
@@ -4211,7 +4216,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         reason: dest.reason,
         ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
         ruleDescription: dest.reason,
-        tier: 3
+        tier: 3,
+        overridable: dest.overridable
       };
     }
   }
@@ -4360,7 +4366,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
           reason: ssrf.reason,
           ruleName: `ssrf:${ssrf.tier}:${ssrf.binary}:${ssrf.host}`,
           ruleDescription: ssrf.reason,
-          tier: 3
+          tier: 3,
+          overridable: ssrf.overridable
         };
       }
     }
@@ -5866,6 +5873,45 @@ function isTrustedHost(host) {
   );
 }
 
+// src/auth/api-url.ts
+var DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
+var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]", "0.0.0.0"]);
+var HOST_ALLOW_ENV = "NODE9_API_HOST_ALLOW";
+function defaultHostSuffixes() {
+  const host = new URL(DEFAULT_API_URL).hostname.toLowerCase();
+  const parent = host.split(".").slice(1).join(".");
+  return parent.includes(".") ? [host, parent] : [host];
+}
+function allowedSuffixes() {
+  const extra = (process.env[HOST_ALLOW_ENV] ?? "").split(",").map(
+    (s) => s.trim().toLowerCase().replace(/^\*?\./, "")
+  ).filter(Boolean);
+  return [...defaultHostSuffixes(), ...extra];
+}
+function validateApiUrl(raw) {
+  if (typeof raw !== "string" || raw.length === 0 || raw.length > 2048) return null;
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (u.username || u.password) return null;
+  if (u.protocol !== "https:" && u.protocol !== "http:") return null;
+  const host = u.hostname.toLowerCase();
+  if (LOOPBACK.has(host)) return u;
+  if (u.protocol !== "https:") return null;
+  const suffixes = allowedSuffixes();
+  const ok = suffixes.some((s) => host === s || host.endsWith("." + s));
+  return ok ? u : null;
+}
+function safeApiUrl(raw, onReject) {
+  const ok = validateApiUrl(raw);
+  if (ok) return typeof raw === "string" ? raw : ok.toString();
+  onReject?.(raw);
+  return DEFAULT_API_URL;
+}
+
 // src/config/index.ts
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
@@ -6154,12 +6200,27 @@ var ADVISORY_SMART_RULES = [
   }
 ];
 var cachedConfig = null;
+var rejectedApiUrlsSeen = /* @__PURE__ */ new Set();
+function noteRejectedApiUrl(raw) {
+  const key = String(raw).slice(0, 200);
+  if (rejectedApiUrlsSeen.has(key)) return;
+  rejectedApiUrlsSeen.add(key);
+  try {
+    import_fs4.default.appendFileSync(
+      import_path4.default.join(import_os4.default.homedir(), ".node9", "hook-debug.log"),
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] REFUSED apiUrl, using the default instead: ${String(raw).slice(0, 200).replace(/[\r\n]+/g, " ")}
+`
+    );
+  } catch {
+  }
+}
 function getCredentials() {
-  const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
   if (process.env.NODE9_API_KEY) {
     return {
       apiKey: process.env.NODE9_API_KEY,
-      apiUrl: process.env.NODE9_API_URL || DEFAULT_API_URL
+      // NODE9_API_URL is env, and a hook inherits the agent's env, so it is
+      // no more trusted than the file below.
+      apiUrl: safeApiUrl(process.env.NODE9_API_URL || DEFAULT_API_URL, noteRejectedApiUrl)
     };
   }
   try {
@@ -6171,14 +6232,14 @@ function getCredentials() {
       if (profile?.apiKey) {
         return {
           apiKey: profile.apiKey,
-          apiUrl: profile.apiUrl || DEFAULT_API_URL,
+          apiUrl: safeApiUrl(profile.apiUrl || DEFAULT_API_URL, noteRejectedApiUrl),
           localOnly: profile.localOnly === true || profileName !== "default"
         };
       }
       if (creds.apiKey) {
         return {
           apiKey: creds.apiKey,
-          apiUrl: creds.apiUrl || DEFAULT_API_URL,
+          apiUrl: safeApiUrl(creds.apiUrl || DEFAULT_API_URL, noteRejectedApiUrl),
           localOnly: creds.localOnly === true
         };
       }
@@ -6611,13 +6672,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path15 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path15) continue;
+            const path16 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path16) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path15, verdict, "org-managed jail")) {
+            for (const r of pathRules(path16, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path15, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path16, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -6954,11 +7015,41 @@ function isIgnoredTool2(toolName) {
 }
 
 // src/auth/state.ts
+var import_fs8 = __toESM(require("fs"));
+var import_path8 = __toESM(require("path"));
+var import_os6 = __toESM(require("os"));
+
+// src/utils/atomic-write.ts
 var import_fs7 = __toESM(require("fs"));
 var import_path7 = __toESM(require("path"));
-var import_os6 = __toESM(require("os"));
-var PAUSED_FILE = import_path7.default.join(import_os6.default.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = import_path7.default.join(import_os6.default.homedir(), ".node9", "trust.json");
+var import_crypto5 = require("crypto");
+function atomicWriteSync(filePath, data, options) {
+  const dir = import_path7.default.dirname(filePath);
+  if (!import_fs7.default.existsSync(dir)) import_fs7.default.mkdirSync(dir, { recursive: true });
+  const tmpPath = `${filePath}.${(0, import_crypto5.randomUUID)()}.tmp`;
+  try {
+    import_fs7.default.writeFileSync(tmpPath, data, options);
+  } catch (err) {
+    try {
+      import_fs7.default.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    import_fs7.default.renameSync(tmpPath, filePath);
+  } catch (err) {
+    try {
+      import_fs7.default.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
+
+// src/auth/state.ts
+var PAUSED_FILE = import_path8.default.join(import_os6.default.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = import_path8.default.join(import_os6.default.homedir(), ".node9", "trust.json");
 function extractCommandPattern(toolName, args) {
   const lower = toolName.toLowerCase();
   if (lower !== "bash" && lower !== "execute_bash" && lower !== "shell") return void 0;
@@ -6970,11 +7061,11 @@ function extractCommandPattern(toolName, args) {
 }
 function checkPause() {
   try {
-    if (!import_fs7.default.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(import_fs7.default.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!import_fs8.default.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(import_fs8.default.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        import_fs7.default.unlinkSync(PAUSED_FILE);
+        import_fs8.default.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -6984,21 +7075,14 @@ function checkPause() {
     return { paused: false };
   }
 }
-function atomicWriteSync(filePath, data, options) {
-  const dir = import_path7.default.dirname(filePath);
-  if (!import_fs7.default.existsSync(dir)) import_fs7.default.mkdirSync(dir, { recursive: true });
-  const tmpPath = `${filePath}.${import_os6.default.hostname()}.${process.pid}.tmp`;
-  import_fs7.default.writeFileSync(tmpPath, data, options);
-  import_fs7.default.renameSync(tmpPath, filePath);
-}
 function getActiveTrustSession(toolName, args) {
   try {
-    if (!import_fs7.default.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(import_fs7.default.readFileSync(TRUST_FILE, "utf-8"));
+    if (!import_fs8.default.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(import_fs8.default.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
-      import_fs7.default.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
+      atomicWriteSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
     return active.some((e) => {
       if (!(e.tool === toolName || matchesPattern(toolName, e.tool))) return false;
@@ -7017,8 +7101,8 @@ function writeTrustSession(toolName, durationMs, args) {
   try {
     let trust = { entries: [] };
     try {
-      if (import_fs7.default.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(import_fs7.default.readFileSync(TRUST_FILE, "utf-8"));
+      if (import_fs8.default.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(import_fs8.default.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -7040,9 +7124,9 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file = import_path7.default.join(import_os6.default.homedir(), ".node9", "decisions.json");
-    if (!import_fs7.default.existsSync(file)) return null;
-    const decisions = JSON.parse(import_fs7.default.readFileSync(file, "utf-8"));
+    const file = import_path8.default.join(import_os6.default.homedir(), ".node9", "decisions.json");
+    if (!import_fs8.default.existsSync(file)) return null;
+    const decisions = JSON.parse(import_fs8.default.readFileSync(file, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
@@ -7051,11 +7135,11 @@ function getPersistentDecision(toolName) {
 }
 
 // src/auth/daemon.ts
-var import_fs8 = __toESM(require("fs"));
+var import_fs9 = __toESM(require("fs"));
 var import_net = __toESM(require("net"));
-var import_path8 = __toESM(require("path"));
+var import_path9 = __toESM(require("path"));
 var import_os7 = __toESM(require("os"));
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path8.default.join(import_os7.default.tmpdir(), "node9-activity.sock");
+var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path9.default.join(import_os7.default.tmpdir(), "node9-activity.sock");
 function notifyActivitySocket(data) {
   return new Promise((resolve) => {
     try {
@@ -7088,9 +7172,9 @@ var DAEMON_PORT = 7391;
 var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   try {
-    const pidFile = import_path8.default.join(import_os7.default.homedir(), ".node9", "daemon.pid");
-    if (!import_fs8.default.existsSync(pidFile)) return null;
-    const data = JSON.parse(import_fs8.default.readFileSync(pidFile, "utf-8"));
+    const pidFile = import_path9.default.join(import_os7.default.homedir(), ".node9", "daemon.pid");
+    if (!import_fs9.default.existsSync(pidFile)) return null;
+    const data = JSON.parse(import_fs9.default.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -7098,12 +7182,12 @@ function getInternalToken() {
   }
 }
 function isDaemonRunning() {
-  const pidFile = import_path8.default.join(import_os7.default.homedir(), ".node9", "daemon.pid");
-  if (import_fs8.default.existsSync(pidFile)) {
+  const pidFile = import_path9.default.join(import_os7.default.homedir(), ".node9", "daemon.pid");
+  if (import_fs9.default.existsSync(pidFile)) {
     let pid;
     let port;
     try {
-      const data = JSON.parse(import_fs8.default.readFileSync(pidFile, "utf-8"));
+      const data = JSON.parse(import_fs9.default.readFileSync(pidFile, "utf-8"));
       pid = data.pid;
       port = data.port;
     } catch {
@@ -7121,7 +7205,7 @@ function isDaemonRunning() {
     } catch (err) {
       if (err instanceof Error && "code" in err && err.code === "ESRCH") {
         try {
-          import_fs8.default.unlinkSync(pidFile);
+          import_fs9.default.unlinkSync(pidFile);
         } catch {
         }
       }
@@ -7287,14 +7371,14 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
 }
 
 // src/auth/orchestrator.ts
-var import_crypto5 = require("crypto");
+var import_crypto6 = require("crypto");
 
 // src/ui/native.ts
 var import_child_process = require("child_process");
-var import_path10 = __toESM(require("path"));
+var import_path11 = __toESM(require("path"));
 
 // src/context-sniper.ts
-var import_path9 = __toESM(require("path"));
+var import_path10 = __toESM(require("path"));
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -7362,7 +7446,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = import_path9.default.basename(editFilePath);
+        editFileName = import_path10.default.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -7426,7 +7510,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file = obj.file_path ? import_path10.default.basename(String(obj.file_path)) : "file";
+      const file = obj.file_path ? import_path11.default.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -7624,22 +7708,22 @@ end run`;
 }
 
 // src/canary/registry.ts
-var import_fs10 = __toESM(require("fs"));
+var import_fs11 = __toESM(require("fs"));
 var import_os9 = __toESM(require("os"));
-var import_path12 = __toESM(require("path"));
+var import_path13 = __toESM(require("path"));
 
 // src/shields/jail.ts
-var import_fs9 = __toESM(require("fs"));
+var import_fs10 = __toESM(require("fs"));
 var import_os8 = __toESM(require("os"));
-var import_path11 = __toESM(require("path"));
+var import_path12 = __toESM(require("path"));
 var USER_JAIL_SHIELD = "user-jail";
 function jailStorePath() {
-  return import_path11.default.join(import_os8.default.homedir(), ".node9", "jail-paths.json");
+  return import_path12.default.join(import_os8.default.homedir(), ".node9", "jail-paths.json");
 }
 function readJailPaths() {
   let text;
   try {
-    text = import_fs9.default.readFileSync(jailStorePath(), "utf8");
+    text = import_fs10.default.readFileSync(jailStorePath(), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -7668,7 +7752,7 @@ function findJailedPathIn(candidate, paths) {
 
 // src/canary/registry.ts
 function canaryStorePath() {
-  return import_path12.default.join(import_os9.default.homedir(), ".node9", "canaries.json");
+  return import_path13.default.join(import_os9.default.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -7679,7 +7763,7 @@ function loadCanaries(opts) {
   const p = canaryStorePath();
   let raw;
   try {
-    raw = import_fs10.default.readFileSync(p, "utf-8");
+    raw = import_fs11.default.readFileSync(p, "utf-8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -7705,10 +7789,51 @@ function canaryValues() {
 init_audit();
 
 // src/auth/cloud.ts
-var import_fs11 = __toESM(require("fs"));
+var import_fs13 = __toESM(require("fs"));
 var import_os10 = __toESM(require("os"));
-var import_path13 = __toESM(require("path"));
+var import_path14 = __toESM(require("path"));
 init_audit();
+
+// src/utils/read-capped.ts
+var import_fs12 = __toESM(require("fs"));
+function readCapped(file, maxBytes) {
+  if (maxBytes < 0) return null;
+  let fd;
+  try {
+    fd = import_fs12.default.openSync(file, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const st = import_fs12.default.fstatSync(fd);
+    if (!st.isFile()) return null;
+    const want = Math.min(st.size, maxBytes + 1);
+    const buf = Buffer.alloc(want);
+    let read = 0;
+    while (read < want) {
+      const n = import_fs12.default.readSync(fd, buf, read, want - read, read);
+      if (n <= 0) break;
+      read += n;
+    }
+    return {
+      bytes: buf.subarray(0, Math.min(read, maxBytes)),
+      truncated: read > maxBytes
+    };
+  } catch {
+    return null;
+  } finally {
+    try {
+      import_fs12.default.closeSync(fd);
+    } catch {
+    }
+  }
+}
+function readCappedText(file, maxBytes) {
+  const r = readCapped(file, maxBytes);
+  return r ? { text: r.bytes.toString("utf8"), truncated: r.truncated } : null;
+}
+
+// src/auth/cloud.ts
 async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPolicy, forceReview) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1e4);
@@ -7716,10 +7841,11 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = import_path13.default.join(import_os10.default.homedir(), ".node9", "ci-context.json");
-      const stats = import_fs11.default.statSync(ciContextPath);
-      if (stats.size > 1e4) throw new Error("ci-context.json exceeds 10 KB");
-      const raw = import_fs11.default.readFileSync(ciContextPath, "utf8");
+      const ciContextPath = import_path14.default.join(import_os10.default.homedir(), ".node9", "ci-context.json");
+      const ci = readCappedText(ciContextPath, 1e4);
+      if (!ci) throw new Error("ci-context.json unreadable");
+      if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
+      const raw = ci.text;
       const parsed = JSON.parse(raw);
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
         throw new Error("ci-context.json is not a plain object");
@@ -7818,14 +7944,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      import_fs11.default.appendFileSync(
+      import_fs13.default.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    import_fs11.default.appendFileSync(
+    import_fs13.default.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err)}
 `
@@ -7834,16 +7960,16 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 }
 
 // src/loop-detector.ts
-var import_fs12 = __toESM(require("fs"));
-var import_path14 = __toESM(require("path"));
+var import_fs14 = __toESM(require("fs"));
+var import_path15 = __toESM(require("path"));
 var import_os11 = __toESM(require("os"));
 function loopStateFile() {
-  return import_path14.default.join(import_os11.default.homedir(), ".node9", "loop-state.json");
+  return import_path15.default.join(import_os11.default.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
-    if (!import_fs12.default.existsSync(loopStateFile())) return [];
-    const raw = import_fs12.default.readFileSync(loopStateFile(), "utf-8");
+    if (!import_fs14.default.existsSync(loopStateFile())) return [];
+    const raw = import_fs14.default.readFileSync(loopStateFile(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return [];
     return parsed;
@@ -7852,11 +7978,11 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir = import_path14.default.dirname(loopStateFile());
-  if (!import_fs12.default.existsSync(dir)) import_fs12.default.mkdirSync(dir, { recursive: true });
+  const dir = import_path15.default.dirname(loopStateFile());
+  if (!import_fs14.default.existsSync(dir)) import_fs14.default.mkdirSync(dir, { recursive: true });
   const tmpPath = `${loopStateFile()}.${import_os11.default.hostname()}.${process.pid}.tmp`;
-  import_fs12.default.writeFileSync(tmpPath, JSON.stringify(records));
-  import_fs12.default.renameSync(tmpPath, loopStateFile());
+  import_fs14.default.writeFileSync(tmpPath, JSON.stringify(records));
+  import_fs14.default.renameSync(tmpPath, loopStateFile());
 }
 function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   try {
@@ -7924,9 +8050,13 @@ async function hasReachableHumanApprover(opts) {
   if (nativeReachable) return true;
   return opts.approvers.terminal !== false && await daemonHasInteractiveApprover();
 }
+function mayDowngradeHardBlock(opts) {
+  if (opts.overridable === false) return false;
+  return opts.daemonUp && !opts.isTestEnv && opts.humanApproverReachable;
+}
 async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
-    const actId = (0, import_crypto5.randomUUID)();
+    const actId = (0, import_crypto6.randomUUID)();
     const actTs = Date.now();
     const sanitizedAgent = meta?.agent ? safeMessage(meta.agent, 80) : void 0;
     const sanitizedMcpServer = meta?.mcpServer ? safeMessage(meta.mcpServer, 40) : void 0;
@@ -8314,7 +8444,12 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           calledFromDaemon: options?.calledFromDaemon
         });
       }
-      const mayDowngrade = daemonUp && !isTestEnv2 && humanApproverReachable;
+      const mayDowngrade = mayDowngradeHardBlock({
+        daemonUp,
+        isTestEnv: isTestEnv2,
+        humanApproverReachable,
+        overridable: policyResult.overridable
+      });
       const hardBlock = () => {
         if (!isManual)
           appendLocalAudit(