@node9/proxy 2.16.1 → 2.17.0

package/dist/cli.mjs

@@ -2100,30 +2100,213 @@ function analyzeShellCommand(command) {
   }
   return { actions, paths, allTokens };
 }
+function parseComponent(s) {
+  if (!s) return null;
+  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
+  if (s === "0") return 0;
+  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
+  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
+  return null;
+}
+function parseIpv4(input) {
+  let s = input;
+  if (s.endsWith(".")) s = s.slice(0, -1);
+  if (!s) return null;
+  const parts = s.split(".");
+  if (parts.length > 4) return null;
+  const vals = [];
+  for (const p of parts) {
+    const v = parseComponent(p);
+    if (v === null || !Number.isFinite(v) || v < 0) return null;
+    vals.push(v);
+  }
+  const n = vals.length;
+  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
+  const last = vals[n - 1];
+  const remainingBytes = 4 - (n - 1);
+  const limit = Math.pow(256, remainingBytes);
+  if (last >= limit) return null;
+  let value = last;
+  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
+  if (value > 4294967295) return null;
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function expandIpv6(input) {
+  const s = input.toLowerCase();
+  if (!/^[0-9a-f:.]+$/.test(s)) return null;
+  if ((s.match(/::/g) ?? []).length > 1) return null;
+  let head = s;
+  let tailV4 = null;
+  const lastColon = s.lastIndexOf(":");
+  const afterLast = s.slice(lastColon + 1);
+  if (afterLast.includes(".")) {
+    const dotted = parseIpv4(afterLast);
+    if (!dotted) return null;
+    const o = dotted.split(".").map(Number);
+    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
+    head = s.slice(0, lastColon + 1) + "0";
+  }
+  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
+  const toGroups = (part) => {
+    if (!part) return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const left = toGroups(lhs);
+  if (left === null) return null;
+  let right = [];
+  if (rhs !== null) {
+    const r = toGroups(rhs);
+    if (r === null) return null;
+    right = r;
+  }
+  if (tailV4) {
+    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
+    else left.splice(left.length - 1, 1, ...tailV4);
+  }
+  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
+  if (rhs === null && groups.length !== 8) return null;
+  if (rhs !== null && left.length + right.length > 8) return null;
+  if (groups.length !== 8) return null;
+  return groups;
+}
+function compressIpv6(g) {
+  let bestStart = -1;
+  let bestLen = 0;
+  let i = 0;
+  while (i < 8) {
+    if (g[i] !== 0) {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && g[j] === 0) j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  const hex = g.map((x) => x.toString(16));
+  if (bestLen < 2) return hex.join(":");
+  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
+}
+function normalizeIpLiteral(host) {
+  try {
+    if (typeof host !== "string") return null;
+    let s = host.trim();
+    if (!s || s.length > SSRF_MAX_HOST) return null;
+    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+    const zone = s.indexOf("%");
+    if (zone >= 0) s = s.slice(0, zone);
+    if (!s) return null;
+    if (s.includes(":")) {
+      const g = expandIpv6(s);
+      if (!g) return null;
+      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
+      if (mapped) {
+        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
+      }
+      return compressIpv6(g);
+    }
+    return parseIpv4(s);
+  } catch {
+    return null;
+  }
+}
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
+function classifySsrf(host) {
+  try {
+    if (typeof host !== "string" || !host) return null;
+    const lower = host.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host);
+    if (ip === null) {
+      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
+    }
+    const hit = (tier, overridable) => ({
+      tier,
+      overridable,
+      kind: "address",
+      normalized: ip
+    });
+    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
+    const o = v4Octets(ip);
+    if (o) {
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
+      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
+      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
+      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
+      if (o[0] === 127) return hit("private", true);
+      if (o[0] === 10) return hit("private", true);
+      if (o[0] === 192 && o[1] === 168) return hit("private", true);
+      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
+      return null;
+    }
+    const g = expandIpv6(ip);
+    if (!g) return null;
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
+    if ((g[0] & 65472) === 65152) return hit("link-local", false);
+    if ((g[0] & 65280) === 65280) return hit("multicast", false);
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
+    return null;
+  } catch {
+    return null;
+  }
+}
+function ssrfFloor(tokens, opts = {}) {
+  const exempt2 = new Set(
+    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
+  );
+  for (const { token, binary } of tokens) {
+    const m = classifySsrf(token);
+    if (!m) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+    if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
+  }
+  return null;
+}
 function hostMatches(host, pattern) {
-  const h = host.toLowerCase();
-  const p = pattern.toLowerCase().trim();
+  const p = pattern.trim().toLowerCase();
   if (!p) return false;
   if (p === "*") return true;
+  const h = canonicalHost(host);
   if (p.startsWith("*.")) {
-    const suffix = p.slice(2);
+    const suffix = canonicalHost(p.slice(2));
     return h === suffix || h.endsWith("." + suffix);
   }
-  return h === p;
+  return h === canonicalHost(p);
 }
 function matchesAny(host, patterns) {
-  for (const p of patterns) if (hostMatches(host, p)) return true;
+  for (const p of patterns ?? []) if (hostMatches(host, p)) return true;
   return false;
 }
+function isUniqueLocalV6(host) {
+  const ip = normalizeIpLiteral(host);
+  if (!ip || !ip.includes(":")) return false;
+  const g = expandIpv6(ip);
+  return g !== null && (g[0] & 65024) === 64512;
+}
 function isPrivateHost(host) {
-  const h = host.toLowerCase();
-  if (h === "localhost" || h === "0.0.0.0") return true;
-  if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".localhost")) return true;
-  if (/^127\./.test(h)) return true;
-  if (/^10\./.test(h)) return true;
-  if (/^192\.168\./.test(h)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
-  return false;
+  const h = host.trim().toLowerCase().replace(/\.$/, "");
+  const m = classifySsrf(h);
+  if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
+  if (h === "localhost") return true;
+  if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
+  return isUniqueLocalV6(h);
+}
+function canonicalHost(host) {
+  const ip = normalizeIpLiteral(host);
+  return ip ?? host.trim().toLowerCase().replace(/\.$/, "");
 }
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
@@ -2343,181 +2526,6 @@ function extractAllSshHosts(tokens) {
   }
   return [...hosts].filter(Boolean);
 }
-function parseComponent(s) {
-  if (!s) return null;
-  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
-  if (s === "0") return 0;
-  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
-  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
-  return null;
-}
-function parseIpv4(input) {
-  let s = input;
-  if (s.endsWith(".")) s = s.slice(0, -1);
-  if (!s) return null;
-  const parts = s.split(".");
-  if (parts.length > 4) return null;
-  const vals = [];
-  for (const p of parts) {
-    const v = parseComponent(p);
-    if (v === null || !Number.isFinite(v) || v < 0) return null;
-    vals.push(v);
-  }
-  const n = vals.length;
-  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
-  const last = vals[n - 1];
-  const remainingBytes = 4 - (n - 1);
-  const limit = Math.pow(256, remainingBytes);
-  if (last >= limit) return null;
-  let value = last;
-  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
-  if (value > 4294967295) return null;
-  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
-}
-function expandIpv6(input) {
-  const s = input.toLowerCase();
-  if (!/^[0-9a-f:.]+$/.test(s)) return null;
-  if ((s.match(/::/g) ?? []).length > 1) return null;
-  let head = s;
-  let tailV4 = null;
-  const lastColon = s.lastIndexOf(":");
-  const afterLast = s.slice(lastColon + 1);
-  if (afterLast.includes(".")) {
-    const dotted = parseIpv4(afterLast);
-    if (!dotted) return null;
-    const o = dotted.split(".").map(Number);
-    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
-    head = s.slice(0, lastColon + 1) + "0";
-  }
-  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
-  const toGroups = (part) => {
-    if (!part) return [];
-    const out = [];
-    for (const g of part.split(":")) {
-      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
-      out.push(parseInt(g, 16));
-    }
-    return out;
-  };
-  const left = toGroups(lhs);
-  if (left === null) return null;
-  let right = [];
-  if (rhs !== null) {
-    const r = toGroups(rhs);
-    if (r === null) return null;
-    right = r;
-  }
-  if (tailV4) {
-    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
-    else left.splice(left.length - 1, 1, ...tailV4);
-  }
-  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
-  if (rhs === null && groups.length !== 8) return null;
-  if (rhs !== null && left.length + right.length > 8) return null;
-  if (groups.length !== 8) return null;
-  return groups;
-}
-function compressIpv6(g) {
-  let bestStart = -1;
-  let bestLen = 0;
-  let i = 0;
-  while (i < 8) {
-    if (g[i] !== 0) {
-      i++;
-      continue;
-    }
-    let j = i;
-    while (j < 8 && g[j] === 0) j++;
-    if (j - i > bestLen) {
-      bestLen = j - i;
-      bestStart = i;
-    }
-    i = j;
-  }
-  const hex = g.map((x) => x.toString(16));
-  if (bestLen < 2) return hex.join(":");
-  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
-}
-function normalizeIpLiteral(host) {
-  try {
-    if (typeof host !== "string") return null;
-    let s = host.trim();
-    if (!s || s.length > SSRF_MAX_HOST) return null;
-    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
-    const zone = s.indexOf("%");
-    if (zone >= 0) s = s.slice(0, zone);
-    if (!s) return null;
-    if (s.includes(":")) {
-      const g = expandIpv6(s);
-      if (!g) return null;
-      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
-      if (mapped) {
-        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
-      }
-      return compressIpv6(g);
-    }
-    return parseIpv4(s);
-  } catch {
-    return null;
-  }
-}
-function isStrictGatedTier(tier) {
-  return STRICT_TIERS.has(tier);
-}
-function ssrfReason(m, asWritten) {
-  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
-}
-function classifySsrf(host) {
-  try {
-    if (typeof host !== "string" || !host) return null;
-    const lower = host.trim().toLowerCase().replace(/\.$/, "");
-    const ip = normalizeIpLiteral(host);
-    if (ip === null) {
-      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
-    }
-    const hit = (tier, overridable) => ({
-      tier,
-      overridable,
-      kind: "address",
-      normalized: ip
-    });
-    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
-    const o = v4Octets(ip);
-    if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
-      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
-      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
-      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
-      if (o[0] === 127) return hit("private", true);
-      if (o[0] === 10) return hit("private", true);
-      if (o[0] === 192 && o[1] === 168) return hit("private", true);
-      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
-      return null;
-    }
-    const g = expandIpv6(ip);
-    if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", true);
-    if ((g[0] & 65472) === 65152) return hit("link-local", false);
-    if ((g[0] & 65280) === 65280) return hit("multicast", false);
-    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
-    return null;
-  } catch {
-    return null;
-  }
-}
-function ssrfFloor(tokens, opts = {}) {
-  const exempt2 = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
-  for (const { token, binary } of tokens) {
-    const m = classifySsrf(token);
-    if (!m) continue;
-    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
-    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
-  }
-  return null;
-}
 function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
@@ -2551,6 +2559,22 @@ function hostOf(value) {
     return null;
   }
 }
+function extractToolDestinations(toolName, args) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return [];
+    const out = [];
+    for (const path78 of paths) {
+      for (const value of valuesAt(args, path78)) {
+        const host = hostOf(value);
+        if (host) out.push({ host, binary: toolName, raw: value });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
@@ -2652,6 +2676,16 @@ function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
     tier: 3
   };
 }
+function egressPolicyVerdict(eg) {
+  return {
+    decision: eg.verdict,
+    blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+    reason: eg.reason,
+    ruleName: `egress:${eg.binary}:${eg.host}`,
+    ruleDescription: eg.reason,
+    tier: eg.verdict === "block" ? 3 : 4
+  };
+}
 async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
   const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2 } = hooks;
@@ -2686,7 +2720,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const pendingToolEgress = config.policy.egress?.enabled ? (() => {
+    const dests = extractToolDestinations(toolName, args);
+    const eg = dests.length > 0 ? evaluateEgress(dests, config.policy.egress) : null;
+    return eg ? egressPolicyVerdict(eg) : void 0;
+  })() : void 0;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) {
+    return pendingToolEgress ?? { decision: "allow" };
+  }
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
@@ -2775,6 +2816,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   let allTokens = [];
   let pathTokens = [];
+  if (pendingToolEgress) return pendingToolEgress;
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
@@ -2840,16 +2882,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
         const eg = evaluateEgress(dests, config.policy.egress);
-        if (eg) {
-          return {
-            decision: eg.verdict,
-            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
-            reason: eg.reason,
-            ruleName: `egress:${eg.binary}:${eg.host}`,
-            ruleDescription: eg.reason,
-            tier: eg.verdict === "block" ? 3 : 4
-          };
-        }
+        if (eg) return egressPolicyVerdict(eg);
       }
     }
     const firstToken = analyzed.actions[0] ?? "";
@@ -3723,7 +3756,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
+var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -5161,6 +5194,36 @@ var init_dist = __esm({
     positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
     NONE = { kind: "none" };
     UNKNOWN = { kind: "unknown" };
+    SSRF_MAX_HOST = 253;
+    METADATA_ADDRESSES = /* @__PURE__ */ new Set([
+      "169.254.169.254",
+      // AWS / Azure / DigitalOcean / OpenStack IMDS
+      "169.254.170.2",
+      // AWS ECS task role
+      "168.63.129.16",
+      // Azure WireServer
+      "fd00:ec2::254",
+      // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+      // live credential endpoint. It has to be named here, above the range check,
+      // and it is the reason relaxing cgnat is safe.
+      "100.100.100.200"
+    ]);
+    STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+    METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+    v4Octets = (a) => {
+      const p = a.split(".");
+      return p.length === 4 ? p.map(Number) : null;
+    };
+    TIER_REASON = {
+      metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
+      "link-local": "a link-local address",
+      multicast: "a multicast address",
+      unspecified: "the unspecified address, which reaches this host",
+      cgnat: "a carrier-grade NAT address",
+      private: "a loopback or private address"
+    };
     DEFAULT_EGRESS_ALLOWLIST = [
       // node9's own control plane (api, app, dev-api, staging and the apex).
       // Without it, turning egress on asks the user to approve node9 itself.
@@ -5184,6 +5247,7 @@ var init_dist = __esm({
       "deb.debian.org",
       "*.ubuntu.com"
     ];
+    PRIVATE_HOST_SUFFIXES = [".local", ".internal", ".localhost"];
     SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
     SINK_COMMANDS = /* @__PURE__ */ new Set([
       "curl",
@@ -5307,36 +5371,6 @@ var init_dist = __esm({
       socat: /* @__PURE__ */ new Set([])
       // socat uses address syntax, not flags — no value-flags
     };
-    SSRF_MAX_HOST = 253;
-    METADATA_ADDRESSES = /* @__PURE__ */ new Set([
-      "169.254.169.254",
-      // AWS / Azure / DigitalOcean / OpenStack IMDS
-      "169.254.170.2",
-      // AWS ECS task role
-      "168.63.129.16",
-      // Azure WireServer
-      "fd00:ec2::254",
-      // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
-      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
-      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
-      // live credential endpoint. It has to be named here, above the range check,
-      // and it is the reason relaxing cgnat is safe.
-      "100.100.100.200"
-    ]);
-    STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
-    METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
-    v4Octets = (a) => {
-      const p = a.split(".");
-      return p.length === 4 ? p.map(Number) : null;
-    };
-    TIER_REASON = {
-      metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
-      "link-local": "a link-local address",
-      multicast: "a multicast address",
-      unspecified: "the unspecified address, which reaches this host",
-      cgnat: "a carrier-grade NAT address",
-      private: "a loopback or private address"
-    };
     DESTINATION_ARGS = /* @__PURE__ */ new Map([
       ["webfetch", ["url"]],
       ["fetch", ["url", "uri"]],
@@ -9941,8 +9975,10 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  const declaredEgress = config.policy.egress?.enabled === true && extractToolDestinations(toolName, args).length > 0;
+  const judge = !isIgnoredTool2(toolName) || declaredEgress;
   if (isObserveMode) {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       const wouldBlock = policyResult.decision === "block";
       if (!isManual)
@@ -9967,7 +10003,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     return { approved: true, checkedBy: "audit" };
   }
   if (config.settings.mode === "audit") {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       if (policyResult.decision === "review") {
         appendLocalAudit(toolName, args, "allow", "audit-mode", meta, hashAuditArgs);
@@ -10006,9 +10042,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       appPermReviewTool = bareTool;
     }
   }
-  if (!taintWarning && !isIgnoredTool2(toolName)) {
+  if (!taintWarning && judge) {
     const ld = config.policy.loopDetection;
-    if (ld.enabled && !appPermReview) {
+    if (ld.enabled && !appPermReview && !isIgnoredTool2(toolName)) {
       const loopResult = recordAndCheck(toolName, args, ld.threshold, ld.windowSeconds * 1e3);
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;

package/dist/dashboard.mjs

@@ -1944,7 +1944,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SOURCE_COMMANDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, TERMINAL_ESCAPE_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, SOURCE_COMMANDS, TERMINAL_ESCAPE_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3136,7 +3136,6 @@ var init_dist = __esm({
     positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
     NONE = { kind: "none" };
     UNKNOWN = { kind: "unknown" };
-    SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
     SSRF_MAX_HOST = 253;
     METADATA_ADDRESSES = /* @__PURE__ */ new Set([
       "169.254.169.254",
@@ -3158,6 +3157,7 @@ var init_dist = __esm({
       const p = a.split(".");
       return p.length === 4 ? p.map(Number) : null;
     };
+    SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
     TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     aws_default = {
       name: "aws",