@node9/proxy 2.16.0 → 2.16.2

package/dist/cli.mjs

@@ -2100,6 +2100,181 @@ function analyzeShellCommand(command) {
   }
   return { actions, paths, allTokens };
 }
+function parseComponent(s) {
+  if (!s) return null;
+  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
+  if (s === "0") return 0;
+  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
+  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
+  return null;
+}
+function parseIpv4(input) {
+  let s = input;
+  if (s.endsWith(".")) s = s.slice(0, -1);
+  if (!s) return null;
+  const parts = s.split(".");
+  if (parts.length > 4) return null;
+  const vals = [];
+  for (const p of parts) {
+    const v = parseComponent(p);
+    if (v === null || !Number.isFinite(v) || v < 0) return null;
+    vals.push(v);
+  }
+  const n = vals.length;
+  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
+  const last = vals[n - 1];
+  const remainingBytes = 4 - (n - 1);
+  const limit = Math.pow(256, remainingBytes);
+  if (last >= limit) return null;
+  let value = last;
+  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
+  if (value > 4294967295) return null;
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function expandIpv6(input) {
+  const s = input.toLowerCase();
+  if (!/^[0-9a-f:.]+$/.test(s)) return null;
+  if ((s.match(/::/g) ?? []).length > 1) return null;
+  let head = s;
+  let tailV4 = null;
+  const lastColon = s.lastIndexOf(":");
+  const afterLast = s.slice(lastColon + 1);
+  if (afterLast.includes(".")) {
+    const dotted = parseIpv4(afterLast);
+    if (!dotted) return null;
+    const o = dotted.split(".").map(Number);
+    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
+    head = s.slice(0, lastColon + 1) + "0";
+  }
+  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
+  const toGroups = (part) => {
+    if (!part) return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const left = toGroups(lhs);
+  if (left === null) return null;
+  let right = [];
+  if (rhs !== null) {
+    const r = toGroups(rhs);
+    if (r === null) return null;
+    right = r;
+  }
+  if (tailV4) {
+    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
+    else left.splice(left.length - 1, 1, ...tailV4);
+  }
+  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
+  if (rhs === null && groups.length !== 8) return null;
+  if (rhs !== null && left.length + right.length > 8) return null;
+  if (groups.length !== 8) return null;
+  return groups;
+}
+function compressIpv6(g) {
+  let bestStart = -1;
+  let bestLen = 0;
+  let i = 0;
+  while (i < 8) {
+    if (g[i] !== 0) {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && g[j] === 0) j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  const hex = g.map((x) => x.toString(16));
+  if (bestLen < 2) return hex.join(":");
+  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
+}
+function normalizeIpLiteral(host) {
+  try {
+    if (typeof host !== "string") return null;
+    let s = host.trim();
+    if (!s || s.length > SSRF_MAX_HOST) return null;
+    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+    const zone = s.indexOf("%");
+    if (zone >= 0) s = s.slice(0, zone);
+    if (!s) return null;
+    if (s.includes(":")) {
+      const g = expandIpv6(s);
+      if (!g) return null;
+      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
+      if (mapped) {
+        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
+      }
+      return compressIpv6(g);
+    }
+    return parseIpv4(s);
+  } catch {
+    return null;
+  }
+}
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
+function classifySsrf(host) {
+  try {
+    if (typeof host !== "string" || !host) return null;
+    const lower = host.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host);
+    if (ip === null) {
+      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
+    }
+    const hit = (tier, overridable) => ({
+      tier,
+      overridable,
+      kind: "address",
+      normalized: ip
+    });
+    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
+    const o = v4Octets(ip);
+    if (o) {
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
+      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
+      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
+      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
+      if (o[0] === 127) return hit("private", true);
+      if (o[0] === 10) return hit("private", true);
+      if (o[0] === 192 && o[1] === 168) return hit("private", true);
+      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
+      return null;
+    }
+    const g = expandIpv6(ip);
+    if (!g) return null;
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
+    if ((g[0] & 65472) === 65152) return hit("link-local", false);
+    if ((g[0] & 65280) === 65280) return hit("multicast", false);
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
+    return null;
+  } catch {
+    return null;
+  }
+}
+function ssrfFloor(tokens, opts = {}) {
+  const exempt2 = new Set(
+    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
+  );
+  for (const { token, binary } of tokens) {
+    const m = classifySsrf(token);
+    if (!m) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+    if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
+  }
+  return null;
+}
 function hostMatches(host, pattern) {
   const h = host.toLowerCase();
   const p = pattern.toLowerCase().trim();
@@ -2115,15 +2290,19 @@ function matchesAny(host, patterns) {
   for (const p of patterns) if (hostMatches(host, p)) return true;
   return false;
 }
+function isUniqueLocalV6(host) {
+  const ip = normalizeIpLiteral(host);
+  if (!ip || !ip.includes(":")) return false;
+  const g = expandIpv6(ip);
+  return g !== null && (g[0] & 65024) === 64512;
+}
 function isPrivateHost(host) {
-  const h = host.toLowerCase();
-  if (h === "localhost" || h === "0.0.0.0") return true;
-  if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".localhost")) return true;
-  if (/^127\./.test(h)) return true;
-  if (/^10\./.test(h)) return true;
-  if (/^192\.168\./.test(h)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
-  return false;
+  const h = host.trim().toLowerCase();
+  const m = classifySsrf(h);
+  if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
+  if (h === "localhost") return true;
+  if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
+  return isUniqueLocalV6(h);
 }
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
@@ -2343,181 +2522,6 @@ function extractAllSshHosts(tokens) {
   }
   return [...hosts].filter(Boolean);
 }
-function parseComponent(s) {
-  if (!s) return null;
-  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
-  if (s === "0") return 0;
-  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
-  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
-  return null;
-}
-function parseIpv4(input) {
-  let s = input;
-  if (s.endsWith(".")) s = s.slice(0, -1);
-  if (!s) return null;
-  const parts = s.split(".");
-  if (parts.length > 4) return null;
-  const vals = [];
-  for (const p of parts) {
-    const v = parseComponent(p);
-    if (v === null || !Number.isFinite(v) || v < 0) return null;
-    vals.push(v);
-  }
-  const n = vals.length;
-  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
-  const last = vals[n - 1];
-  const remainingBytes = 4 - (n - 1);
-  const limit = Math.pow(256, remainingBytes);
-  if (last >= limit) return null;
-  let value = last;
-  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
-  if (value > 4294967295) return null;
-  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
-}
-function expandIpv6(input) {
-  const s = input.toLowerCase();
-  if (!/^[0-9a-f:.]+$/.test(s)) return null;
-  if ((s.match(/::/g) ?? []).length > 1) return null;
-  let head = s;
-  let tailV4 = null;
-  const lastColon = s.lastIndexOf(":");
-  const afterLast = s.slice(lastColon + 1);
-  if (afterLast.includes(".")) {
-    const dotted = parseIpv4(afterLast);
-    if (!dotted) return null;
-    const o = dotted.split(".").map(Number);
-    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
-    head = s.slice(0, lastColon + 1) + "0";
-  }
-  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
-  const toGroups = (part) => {
-    if (!part) return [];
-    const out = [];
-    for (const g of part.split(":")) {
-      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
-      out.push(parseInt(g, 16));
-    }
-    return out;
-  };
-  const left = toGroups(lhs);
-  if (left === null) return null;
-  let right = [];
-  if (rhs !== null) {
-    const r = toGroups(rhs);
-    if (r === null) return null;
-    right = r;
-  }
-  if (tailV4) {
-    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
-    else left.splice(left.length - 1, 1, ...tailV4);
-  }
-  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
-  if (rhs === null && groups.length !== 8) return null;
-  if (rhs !== null && left.length + right.length > 8) return null;
-  if (groups.length !== 8) return null;
-  return groups;
-}
-function compressIpv6(g) {
-  let bestStart = -1;
-  let bestLen = 0;
-  let i = 0;
-  while (i < 8) {
-    if (g[i] !== 0) {
-      i++;
-      continue;
-    }
-    let j = i;
-    while (j < 8 && g[j] === 0) j++;
-    if (j - i > bestLen) {
-      bestLen = j - i;
-      bestStart = i;
-    }
-    i = j;
-  }
-  const hex = g.map((x) => x.toString(16));
-  if (bestLen < 2) return hex.join(":");
-  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
-}
-function normalizeIpLiteral(host) {
-  try {
-    if (typeof host !== "string") return null;
-    let s = host.trim();
-    if (!s || s.length > SSRF_MAX_HOST) return null;
-    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
-    const zone = s.indexOf("%");
-    if (zone >= 0) s = s.slice(0, zone);
-    if (!s) return null;
-    if (s.includes(":")) {
-      const g = expandIpv6(s);
-      if (!g) return null;
-      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
-      if (mapped) {
-        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
-      }
-      return compressIpv6(g);
-    }
-    return parseIpv4(s);
-  } catch {
-    return null;
-  }
-}
-function isStrictGatedTier(tier) {
-  return STRICT_TIERS.has(tier);
-}
-function ssrfReason(m, asWritten) {
-  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
-}
-function classifySsrf(host) {
-  try {
-    if (typeof host !== "string" || !host) return null;
-    const lower = host.trim().toLowerCase().replace(/\.$/, "");
-    const ip = normalizeIpLiteral(host);
-    if (ip === null) {
-      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
-    }
-    const hit = (tier, overridable) => ({
-      tier,
-      overridable,
-      kind: "address",
-      normalized: ip
-    });
-    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
-    const o = v4Octets(ip);
-    if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
-      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
-      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
-      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
-      if (o[0] === 127) return hit("private", true);
-      if (o[0] === 10) return hit("private", true);
-      if (o[0] === 192 && o[1] === 168) return hit("private", true);
-      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
-      return null;
-    }
-    const g = expandIpv6(ip);
-    if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", true);
-    if ((g[0] & 65472) === 65152) return hit("link-local", false);
-    if ((g[0] & 65280) === 65280) return hit("multicast", false);
-    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
-    return null;
-  } catch {
-    return null;
-  }
-}
-function ssrfFloor(tokens, opts = {}) {
-  const exempt2 = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
-  for (const { token, binary } of tokens) {
-    const m = classifySsrf(token);
-    if (!m) continue;
-    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
-    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
-  }
-  return null;
-}
 function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
@@ -3723,7 +3727,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
+var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -5161,6 +5165,36 @@ var init_dist = __esm({
     positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
     NONE = { kind: "none" };
     UNKNOWN = { kind: "unknown" };
+    SSRF_MAX_HOST = 253;
+    METADATA_ADDRESSES = /* @__PURE__ */ new Set([
+      "169.254.169.254",
+      // AWS / Azure / DigitalOcean / OpenStack IMDS
+      "169.254.170.2",
+      // AWS ECS task role
+      "168.63.129.16",
+      // Azure WireServer
+      "fd00:ec2::254",
+      // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+      // live credential endpoint. It has to be named here, above the range check,
+      // and it is the reason relaxing cgnat is safe.
+      "100.100.100.200"
+    ]);
+    STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+    METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+    v4Octets = (a) => {
+      const p = a.split(".");
+      return p.length === 4 ? p.map(Number) : null;
+    };
+    TIER_REASON = {
+      metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
+      "link-local": "a link-local address",
+      multicast: "a multicast address",
+      unspecified: "the unspecified address, which reaches this host",
+      cgnat: "a carrier-grade NAT address",
+      private: "a loopback or private address"
+    };
     DEFAULT_EGRESS_ALLOWLIST = [
       // node9's own control plane (api, app, dev-api, staging and the apex).
       // Without it, turning egress on asks the user to approve node9 itself.
@@ -5184,6 +5218,7 @@ var init_dist = __esm({
       "deb.debian.org",
       "*.ubuntu.com"
     ];
+    PRIVATE_HOST_SUFFIXES = [".local", ".internal", ".localhost"];
     SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
     SINK_COMMANDS = /* @__PURE__ */ new Set([
       "curl",
@@ -5307,36 +5342,6 @@ var init_dist = __esm({
       socat: /* @__PURE__ */ new Set([])
       // socat uses address syntax, not flags — no value-flags
     };
-    SSRF_MAX_HOST = 253;
-    METADATA_ADDRESSES = /* @__PURE__ */ new Set([
-      "169.254.169.254",
-      // AWS / Azure / DigitalOcean / OpenStack IMDS
-      "169.254.170.2",
-      // AWS ECS task role
-      "168.63.129.16",
-      // Azure WireServer
-      "fd00:ec2::254",
-      // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
-      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
-      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
-      // live credential endpoint. It has to be named here, above the range check,
-      // and it is the reason relaxing cgnat is safe.
-      "100.100.100.200"
-    ]);
-    STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
-    METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
-    v4Octets = (a) => {
-      const p = a.split(".");
-      return p.length === 4 ? p.map(Number) : null;
-    };
-    TIER_REASON = {
-      metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
-      "link-local": "a link-local address",
-      multicast: "a multicast address",
-      unspecified: "the unspecified address, which reaches this host",
-      cgnat: "a carrier-grade NAT address",
-      private: "a loopback or private address"
-    };
     DESTINATION_ARGS = /* @__PURE__ */ new Map([
       ["webfetch", ["url"]],
       ["fetch", ["url", "uri"]],
@@ -6838,14 +6843,14 @@ function getCredentials() {
       const creds = JSON.parse(fs4.readFileSync(credPath, "utf-8"));
       const profileName = process.env.NODE9_PROFILE || "default";
       const profile = creds[profileName];
-      if (profile?.apiKey) {
+      if (typeof profile?.apiKey === "string" && profile.apiKey.length > 0) {
         return {
           apiKey: profile.apiKey,
           apiUrl: safeApiUrl(profile.apiUrl || DEFAULT_API_URL, noteRejectedApiUrl),
           localOnly: profile.localOnly === true || profileName !== "default"
         };
       }
-      if (creds.apiKey) {
+      if (typeof creds.apiKey === "string" && creds.apiKey.length > 0) {
         return {
           apiKey: creds.apiKey,
           apiUrl: safeApiUrl(creds.apiUrl || DEFAULT_API_URL, noteRejectedApiUrl),
@@ -9356,23 +9361,8 @@ var init_read_capped = __esm({
 import fs14 from "fs";
 import os11 from "os";
 import path15 from "path";
-function validateApiUrl2(raw) {
-  let u;
-  try {
-    u = new URL(raw);
-  } catch {
-    return null;
-  }
-  if (u.username || u.password) return null;
-  if (u.protocol === "https:") return u;
-  if (u.protocol === "http:") {
-    const h = u.hostname;
-    if (h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]") return u;
-  }
-  return null;
-}
 function auditLocalAllow(toolName, args, checkedBy, creds, meta, dlpInfo, containsSensitiveArgs = false, riskMetadata) {
-  const validated = validateApiUrl2(creds.apiUrl);
+  const validated = validateApiUrl(creds.apiUrl);
   if (!validated) {
     try {
       fs14.appendFileSync(
@@ -9553,6 +9543,7 @@ var init_cloud = __esm({
     init_audit();
     init_safe_text();
     init_read_capped();
+    init_api_url();
     DLP_SAMPLE_MAX_LEN = 200;
     DLP_PATTERN_MAX_LEN = 100;
     KNOWN_CHECKED_BY = /* @__PURE__ */ new Set([
@@ -21560,37 +21551,13 @@ function resolveSyncIntervalMs(settings) {
   return clamped * 1e3;
 }
 function readCredentials() {
-  if (process.env.NODE9_API_KEY) {
-    return {
-      apiKey: process.env.NODE9_API_KEY,
-      apiUrl: process.env.NODE9_API_URL ?? DEFAULT_API_URL2
-    };
-  }
-  try {
-    const credPath = path41.join(os36.homedir(), ".node9", "credentials.json");
-    const creds = JSON.parse(fs42.readFileSync(credPath, "utf-8"));
-    const profileName = process.env.NODE9_PROFILE ?? "default";
-    const profile = creds[profileName];
-    if (typeof profile?.apiKey === "string" && profile.apiKey.length > 0) {
-      return {
-        apiKey: profile.apiKey,
-        apiUrl: typeof profile.apiUrl === "string" ? (
-          // Credentials store the firewall base URL (e.g.
-          // `https://api.node9.ai/api/v1/intercept`) so existing CLI
-          // calls keep working. Sync lives at `/intercept/policies/sync`
-          // — append the suffix when the stored URL ends in `/intercept`.
-          // Anything else is taken as-is so users can override the full
-          // URL via NODE9_API_URL or a non-standard apiUrl.
-          /\/intercept$/.test(profile.apiUrl) ? profile.apiUrl + "/policies/sync" : profile.apiUrl
-        ) : DEFAULT_API_URL2
-      };
-    }
-    if (typeof creds.apiKey === "string" && creds.apiKey.length > 0) {
-      return { apiKey: creds.apiKey, apiUrl: DEFAULT_API_URL2 };
-    }
-  } catch {
-  }
-  return null;
+  const creds = getCredentials();
+  if (!creds) return null;
+  const base = creds.apiUrl.replace(/\/+$/, "");
+  return {
+    apiKey: creds.apiKey,
+    apiUrl: /\/intercept$/.test(base) ? base + "/policies/sync" : base
+  };
 }
 function readCachedEtag() {
   try {
@@ -22208,7 +22175,7 @@ function startForensicBroadcast() {
   const recurring = setInterval(() => void tick(), FORENSIC_BROADCAST_INTERVAL_MS);
   recurring.unref();
 }
-var FINDING_TO_SIGNAL3, rulesCacheFile, rulesCacheBackupFile, DEFAULT_API_URL2, DEFAULT_INTERVAL_HOURS, MIN_INTERVAL_SECONDS, MAX_INTERVAL_SECONDS, syncHealthFile, STALE_MIN_MS, STALE_MAX_MS, STALE_FACTOR, FORENSIC_BROADCAST_INTERVAL_MS, FORENSIC_INITIAL_DELAY_MS, forensicBroadcastOffsets;
+var FINDING_TO_SIGNAL3, rulesCacheFile, rulesCacheBackupFile, DEFAULT_INTERVAL_HOURS, MIN_INTERVAL_SECONDS, MAX_INTERVAL_SECONDS, syncHealthFile, STALE_MIN_MS, STALE_MAX_MS, STALE_FACTOR, FORENSIC_BROADCAST_INTERVAL_MS, FORENSIC_INITIAL_DELAY_MS, forensicBroadcastOffsets;
 var init_sync = __esm({
   "src/daemon/sync.ts"() {
     "use strict";
@@ -22227,7 +22194,6 @@ var init_sync = __esm({
     init_state2();
     init_audit();
     init_machine_id();
-    init_api_url();
     FINDING_TO_SIGNAL3 = {
       dlp: "dlpFindings",
       pii: "piiFindings",
@@ -22242,7 +22208,6 @@ var init_sync = __esm({
     };
     rulesCacheFile = () => path41.join(os36.homedir(), ".node9", "rules-cache.json");
     rulesCacheBackupFile = () => path41.join(os36.homedir(), ".node9", "rules-cache.last-good.json");
-    DEFAULT_API_URL2 = `${DEFAULT_API_URL}/policies/sync`;
     DEFAULT_INTERVAL_HOURS = 5;
     MIN_INTERVAL_SECONDS = 15;
     MAX_INTERVAL_SECONDS = 24 * 60 * 60;
@@ -22353,7 +22318,7 @@ function buildWireRows(chunk2) {
   return { rows, consumed: lastNl + 1 };
 }
 function buildBatchEndpoint(rawApiUrl) {
-  const validated = validateApiUrl2(rawApiUrl);
+  const validated = validateApiUrl(rawApiUrl);
   if (!validated) return null;
   const base = validated.toString().replace(/\/$/, "").replace(/\/policies\/sync$/, "");
   return `${base}/audit/batch`;
@@ -24318,12 +24283,20 @@ function resolveNode9Binary() {
 function xmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+function daemonServiceEnv() {
+  const env = { NODE9_AUTO_STARTED: "1" };
+  const allow = process.env[HOST_ALLOW_ENV]?.trim();
+  if (allow && /^[A-Za-z0-9.*,_ -]+$/.test(allow)) env[HOST_ALLOW_ENV] = allow;
+  return env;
+}
 function launchdPlist(binaryPath) {
   const logDir = path47.join(os42.homedir(), ".node9");
   const nodePath = xmlEscape(process.execPath);
   const scriptPath = xmlEscape(binaryPath);
   const outLog = xmlEscape(path47.join(logDir, "daemon.log"));
   const errLog = xmlEscape(path47.join(logDir, "daemon-error.log"));
+  const envEntries = Object.entries(daemonServiceEnv()).map(([k, v]) => `        <key>${xmlEscape(k)}</key>
+        <string>${xmlEscape(v)}</string>`).join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -24348,8 +24321,7 @@ function launchdPlist(binaryPath) {
     <string>${errLog}</string>
     <key>EnvironmentVariables</key>
     <dict>
-        <key>NODE9_AUTO_STARTED</key>
-        <string>1</string>
+${envEntries}
     </dict>
 </dict>
 </plist>
@@ -24378,6 +24350,7 @@ function isLaunchdInstalled() {
   return fs48.existsSync(LAUNCHD_PLIST);
 }
 function systemdUnit(binaryPath) {
+  const envLines = Object.entries(daemonServiceEnv()).map(([k, v]) => `Environment="${k}=${v}"`).join("\n");
   return `[Unit]
 Description=node9 approval daemon
 After=network.target
@@ -24387,7 +24360,7 @@ Type=simple
 ExecStart=${process.execPath} ${binaryPath} daemon
 Restart=on-failure
 RestartSec=10s
-Environment=NODE9_AUTO_STARTED=1
+${envLines}
 
 [Install]
 WantedBy=default.target
@@ -24443,7 +24416,10 @@ function windowsLauncherVbs(nodePath, scriptPath) {
     "' Auto-generated by node9 - starts the approval daemon with no console window.",
     "' Recreated by `node9 daemon install`; removed by `node9 daemon uninstall`.",
     'Set sh = CreateObject("Wscript.Shell")',
-    'sh.Environment("PROCESS")("NODE9_AUTO_STARTED") = "1"',
+    // Values are vetted by daemonServiceEnv: no double quote can reach here.
+    ...Object.entries(daemonServiceEnv()).map(
+      ([k, v]) => `sh.Environment("PROCESS")("${k}") = "${v}"`
+    ),
     `sh.Run """${nodePath}"" ""${scriptPath}"" daemon", 0, False`,
     ""
   ].join("\r\n");
@@ -24650,6 +24626,7 @@ var LAUNCHD_LABEL, LAUNCHD_PLIST, SYSTEMD_UNIT_DIR, SYSTEMD_UNIT, STARTUP_FILE,
 var init_service = __esm({
   "src/daemon/service.ts"() {
     "use strict";
+    init_api_url();
     LAUNCHD_LABEL = "ai.node9.daemon";
     LAUNCHD_PLIST = path47.join(os42.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     SYSTEMD_UNIT_DIR = path47.join(os42.homedir(), ".config", "systemd", "user");
@@ -52313,12 +52290,18 @@ import * as os44 from "os";
 import chalk11 from "chalk";
 
 // src/auth/cloud-endpoints.ts
+init_api_url();
 var PROD_BASE = "https://api.node9.ai/api/v1";
 function resolveCloudEndpoint(pathSuffix, override) {
+  const raw = override || process.env.NODE9_API_URL;
+  if (!raw) return PROD_BASE + pathSuffix;
+  if (!validateApiUrl(raw)) {
+    throw new Error(
+      `${override ? "--api-url" : "NODE9_API_URL"} "${raw.slice(0, 200)}" is not an allowed node9 host. For a self-hosted control plane set ${HOST_ALLOW_ENV}=<your-domain>.`
+    );
+  }
   if (override) return override;
-  const base = process.env.NODE9_API_URL;
-  if (base) return base.replace(/\/intercept\/?$/, "") + pathSuffix;
-  return PROD_BASE + pathSuffix;
+  return raw.replace(/\/intercept\/?$/, "") + pathSuffix;
 }
 
 // src/auth/device-login.ts
@@ -52479,14 +52462,27 @@ import * as os45 from "os";
 import * as path49 from "path";
 import chalk12 from "chalk";
 init_safe_text();
+init_api_url();
 async function revokeSelf(creds) {
-  const url = creds.apiUrl.replace(/\/$/, "") + "/machines/self/disconnect";
+  let rejected = null;
+  const base = safeApiUrl(creds.apiUrl, (raw) => {
+    rejected = String(raw).slice(0, 200);
+  }).replace(/\/$/, "");
+  const url = base + "/machines/self/disconnect";
   try {
     const r = await postJson2(url, {}, creds.apiKey);
     return { outcome: "revoked", name: r.name };
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    if (/HTTP 401/.test(msg)) return { outcome: "already" };
+    if (/HTTP 401/.test(msg)) {
+      if (rejected) {
+        return {
+          outcome: "unreachable",
+          detail: `stored apiUrl ${rejected} is not an allowed host (set ${HOST_ALLOW_ENV} for self-hosted); the revoke went to ${base} and was refused`
+        };
+      }
+      return { outcome: "already" };
+    }
     return { outcome: "unreachable", detail: msg };
   }
 }
@@ -52506,10 +52502,7 @@ function registerLogoutCommand(program2) {
       console.log(chalk12.gray("Not logged in \u2014 nothing to disconnect."));
       return;
     }
-    const res = await revokeSelf({
-      apiKey: entry.apiKey,
-      apiUrl: entry.apiUrl || "https://api.node9.ai/api/v1/intercept"
-    });
+    const res = await revokeSelf({ apiKey: entry.apiKey, apiUrl: entry.apiUrl });
     if (res.outcome === "revoked") {
       console.log(
         chalk12.green(
@@ -62635,10 +62628,7 @@ program.command("uninstall").description("Remove all Node9 hooks and optionally
     const prof = JSON.parse(credRaw)[process.env.NODE9_PROFILE || "default"];
     if (prof?.apiKey) {
       console.log(chalk45.bold("Disconnecting from the cloud..."));
-      const r = await revokeSelf({
-        apiKey: prof.apiKey,
-        apiUrl: prof.apiUrl || "https://api.node9.ai/api/v1/intercept"
-      });
+      const r = await revokeSelf({ apiKey: prof.apiKey, apiUrl: prof.apiUrl });
       if (r.outcome === "revoked") {
         console.log(chalk45.green("  \u2705 Machine disconnected \u2014 its key is revoked"));
       } else if (r.outcome === "already") {