@node9/proxy 2.16.1 → 2.17.0

package/dist/index.js

@@ -3446,6 +3446,211 @@ function analyzeShellCommand(command) {
   }
   return { actions, paths, allTokens };
 }
+var SSRF_MAX_HOST = 253;
+function parseComponent(s) {
+  if (!s) return null;
+  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
+  if (s === "0") return 0;
+  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
+  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
+  return null;
+}
+function parseIpv4(input) {
+  let s = input;
+  if (s.endsWith(".")) s = s.slice(0, -1);
+  if (!s) return null;
+  const parts = s.split(".");
+  if (parts.length > 4) return null;
+  const vals = [];
+  for (const p of parts) {
+    const v = parseComponent(p);
+    if (v === null || !Number.isFinite(v) || v < 0) return null;
+    vals.push(v);
+  }
+  const n = vals.length;
+  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
+  const last = vals[n - 1];
+  const remainingBytes = 4 - (n - 1);
+  const limit = Math.pow(256, remainingBytes);
+  if (last >= limit) return null;
+  let value = last;
+  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
+  if (value > 4294967295) return null;
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function expandIpv6(input) {
+  const s = input.toLowerCase();
+  if (!/^[0-9a-f:.]+$/.test(s)) return null;
+  if ((s.match(/::/g) ?? []).length > 1) return null;
+  let head = s;
+  let tailV4 = null;
+  const lastColon = s.lastIndexOf(":");
+  const afterLast = s.slice(lastColon + 1);
+  if (afterLast.includes(".")) {
+    const dotted = parseIpv4(afterLast);
+    if (!dotted) return null;
+    const o = dotted.split(".").map(Number);
+    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
+    head = s.slice(0, lastColon + 1) + "0";
+  }
+  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
+  const toGroups = (part) => {
+    if (!part) return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const left = toGroups(lhs);
+  if (left === null) return null;
+  let right = [];
+  if (rhs !== null) {
+    const r = toGroups(rhs);
+    if (r === null) return null;
+    right = r;
+  }
+  if (tailV4) {
+    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
+    else left.splice(left.length - 1, 1, ...tailV4);
+  }
+  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
+  if (rhs === null && groups.length !== 8) return null;
+  if (rhs !== null && left.length + right.length > 8) return null;
+  if (groups.length !== 8) return null;
+  return groups;
+}
+function compressIpv6(g) {
+  let bestStart = -1;
+  let bestLen = 0;
+  let i = 0;
+  while (i < 8) {
+    if (g[i] !== 0) {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && g[j] === 0) j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  const hex = g.map((x) => x.toString(16));
+  if (bestLen < 2) return hex.join(":");
+  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
+}
+function normalizeIpLiteral(host) {
+  try {
+    if (typeof host !== "string") return null;
+    let s = host.trim();
+    if (!s || s.length > SSRF_MAX_HOST) return null;
+    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+    const zone = s.indexOf("%");
+    if (zone >= 0) s = s.slice(0, zone);
+    if (!s) return null;
+    if (s.includes(":")) {
+      const g = expandIpv6(s);
+      if (!g) return null;
+      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
+      if (mapped) {
+        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
+      }
+      return compressIpv6(g);
+    }
+    return parseIpv4(s);
+  } catch {
+    return null;
+  }
+}
+var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
+  "169.254.169.254",
+  // AWS / Azure / DigitalOcean / OpenStack IMDS
+  "169.254.170.2",
+  // AWS ECS task role
+  "168.63.129.16",
+  // Azure WireServer
+  "fd00:ec2::254",
+  // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
+]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
+var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+var v4Octets = (a) => {
+  const p = a.split(".");
+  return p.length === 4 ? p.map(Number) : null;
+};
+function classifySsrf(host) {
+  try {
+    if (typeof host !== "string" || !host) return null;
+    const lower = host.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host);
+    if (ip === null) {
+      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
+    }
+    const hit = (tier, overridable) => ({
+      tier,
+      overridable,
+      kind: "address",
+      normalized: ip
+    });
+    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
+    const o = v4Octets(ip);
+    if (o) {
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
+      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
+      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
+      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
+      if (o[0] === 127) return hit("private", true);
+      if (o[0] === 10) return hit("private", true);
+      if (o[0] === 192 && o[1] === 168) return hit("private", true);
+      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
+      return null;
+    }
+    const g = expandIpv6(ip);
+    if (!g) return null;
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
+    if ((g[0] & 65472) === 65152) return hit("link-local", false);
+    if ((g[0] & 65280) === 65280) return hit("multicast", false);
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
+    return null;
+  } catch {
+    return null;
+  }
+}
+var TIER_REASON = {
+  metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
+  "link-local": "a link-local address",
+  multicast: "a multicast address",
+  unspecified: "the unspecified address, which reaches this host",
+  cgnat: "a carrier-grade NAT address",
+  private: "a loopback or private address"
+};
+function ssrfFloor(tokens, opts = {}) {
+  const exempt = new Set(
+    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
+  );
+  for (const { token, binary } of tokens) {
+    const m = classifySsrf(token);
+    if (!m) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
+  }
+  return null;
+}
 var DEFAULT_EGRESS_ALLOWLIST = [
   // node9's own control plane (api, app, dev-api, staging and the apex).
   // Without it, turning egress on asks the user to approve node9 itself.
@@ -3470,29 +3675,38 @@ var DEFAULT_EGRESS_ALLOWLIST = [
   "*.ubuntu.com"
 ];
 function hostMatches(host, pattern) {
-  const h = host.toLowerCase();
-  const p = pattern.toLowerCase().trim();
+  const p = pattern.trim().toLowerCase();
   if (!p) return false;
   if (p === "*") return true;
+  const h = canonicalHost(host);
   if (p.startsWith("*.")) {
-    const suffix = p.slice(2);
+    const suffix = canonicalHost(p.slice(2));
     return h === suffix || h.endsWith("." + suffix);
   }
-  return h === p;
+  return h === canonicalHost(p);
 }
 function matchesAny(host, patterns) {
-  for (const p of patterns) if (hostMatches(host, p)) return true;
+  for (const p of patterns ?? []) if (hostMatches(host, p)) return true;
   return false;
 }
+var PRIVATE_HOST_SUFFIXES = [".local", ".internal", ".localhost"];
+function isUniqueLocalV6(host) {
+  const ip = normalizeIpLiteral(host);
+  if (!ip || !ip.includes(":")) return false;
+  const g = expandIpv6(ip);
+  return g !== null && (g[0] & 65024) === 64512;
+}
 function isPrivateHost(host) {
-  const h = host.toLowerCase();
-  if (h === "localhost" || h === "0.0.0.0") return true;
-  if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".localhost")) return true;
-  if (/^127\./.test(h)) return true;
-  if (/^10\./.test(h)) return true;
-  if (/^192\.168\./.test(h)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
-  return false;
+  const h = host.trim().toLowerCase().replace(/\.$/, "");
+  const m = classifySsrf(h);
+  if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
+  if (h === "localhost") return true;
+  if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
+  return isUniqueLocalV6(h);
+}
+function canonicalHost(host) {
+  const ip = normalizeIpLiteral(host);
+  return ip ?? host.trim().toLowerCase().replace(/\.$/, "");
 }
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
@@ -3835,211 +4049,6 @@ function extractAllSshHosts(tokens) {
   }
   return [...hosts].filter(Boolean);
 }
-var SSRF_MAX_HOST = 253;
-function parseComponent(s) {
-  if (!s) return null;
-  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
-  if (s === "0") return 0;
-  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
-  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
-  return null;
-}
-function parseIpv4(input) {
-  let s = input;
-  if (s.endsWith(".")) s = s.slice(0, -1);
-  if (!s) return null;
-  const parts = s.split(".");
-  if (parts.length > 4) return null;
-  const vals = [];
-  for (const p of parts) {
-    const v = parseComponent(p);
-    if (v === null || !Number.isFinite(v) || v < 0) return null;
-    vals.push(v);
-  }
-  const n = vals.length;
-  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
-  const last = vals[n - 1];
-  const remainingBytes = 4 - (n - 1);
-  const limit = Math.pow(256, remainingBytes);
-  if (last >= limit) return null;
-  let value = last;
-  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
-  if (value > 4294967295) return null;
-  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
-}
-function expandIpv6(input) {
-  const s = input.toLowerCase();
-  if (!/^[0-9a-f:.]+$/.test(s)) return null;
-  if ((s.match(/::/g) ?? []).length > 1) return null;
-  let head = s;
-  let tailV4 = null;
-  const lastColon = s.lastIndexOf(":");
-  const afterLast = s.slice(lastColon + 1);
-  if (afterLast.includes(".")) {
-    const dotted = parseIpv4(afterLast);
-    if (!dotted) return null;
-    const o = dotted.split(".").map(Number);
-    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
-    head = s.slice(0, lastColon + 1) + "0";
-  }
-  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
-  const toGroups = (part) => {
-    if (!part) return [];
-    const out = [];
-    for (const g of part.split(":")) {
-      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
-      out.push(parseInt(g, 16));
-    }
-    return out;
-  };
-  const left = toGroups(lhs);
-  if (left === null) return null;
-  let right = [];
-  if (rhs !== null) {
-    const r = toGroups(rhs);
-    if (r === null) return null;
-    right = r;
-  }
-  if (tailV4) {
-    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
-    else left.splice(left.length - 1, 1, ...tailV4);
-  }
-  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
-  if (rhs === null && groups.length !== 8) return null;
-  if (rhs !== null && left.length + right.length > 8) return null;
-  if (groups.length !== 8) return null;
-  return groups;
-}
-function compressIpv6(g) {
-  let bestStart = -1;
-  let bestLen = 0;
-  let i = 0;
-  while (i < 8) {
-    if (g[i] !== 0) {
-      i++;
-      continue;
-    }
-    let j = i;
-    while (j < 8 && g[j] === 0) j++;
-    if (j - i > bestLen) {
-      bestLen = j - i;
-      bestStart = i;
-    }
-    i = j;
-  }
-  const hex = g.map((x) => x.toString(16));
-  if (bestLen < 2) return hex.join(":");
-  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
-}
-function normalizeIpLiteral(host) {
-  try {
-    if (typeof host !== "string") return null;
-    let s = host.trim();
-    if (!s || s.length > SSRF_MAX_HOST) return null;
-    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
-    const zone = s.indexOf("%");
-    if (zone >= 0) s = s.slice(0, zone);
-    if (!s) return null;
-    if (s.includes(":")) {
-      const g = expandIpv6(s);
-      if (!g) return null;
-      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
-      if (mapped) {
-        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
-      }
-      return compressIpv6(g);
-    }
-    return parseIpv4(s);
-  } catch {
-    return null;
-  }
-}
-var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
-  "169.254.169.254",
-  // AWS / Azure / DigitalOcean / OpenStack IMDS
-  "169.254.170.2",
-  // AWS ECS task role
-  "168.63.129.16",
-  // Azure WireServer
-  "fd00:ec2::254",
-  // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
-  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
-  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
-  // live credential endpoint. It has to be named here, above the range check,
-  // and it is the reason relaxing cgnat is safe.
-  "100.100.100.200"
-]);
-var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
-function isStrictGatedTier(tier) {
-  return STRICT_TIERS.has(tier);
-}
-function ssrfReason(m, asWritten) {
-  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
-}
-var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
-var v4Octets = (a) => {
-  const p = a.split(".");
-  return p.length === 4 ? p.map(Number) : null;
-};
-function classifySsrf(host) {
-  try {
-    if (typeof host !== "string" || !host) return null;
-    const lower = host.trim().toLowerCase().replace(/\.$/, "");
-    const ip = normalizeIpLiteral(host);
-    if (ip === null) {
-      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
-    }
-    const hit = (tier, overridable) => ({
-      tier,
-      overridable,
-      kind: "address",
-      normalized: ip
-    });
-    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
-    const o = v4Octets(ip);
-    if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
-      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
-      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
-      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
-      if (o[0] === 127) return hit("private", true);
-      if (o[0] === 10) return hit("private", true);
-      if (o[0] === 192 && o[1] === 168) return hit("private", true);
-      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
-      return null;
-    }
-    const g = expandIpv6(ip);
-    if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", true);
-    if ((g[0] & 65472) === 65152) return hit("link-local", false);
-    if ((g[0] & 65280) === 65280) return hit("multicast", false);
-    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
-    return null;
-  } catch {
-    return null;
-  }
-}
-var TIER_REASON = {
-  metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
-  "link-local": "a link-local address",
-  multicast: "a multicast address",
-  unspecified: "the unspecified address, which reaches this host",
-  cgnat: "a carrier-grade NAT address",
-  private: "a loopback or private address"
-};
-function ssrfFloor(tokens, opts = {}) {
-  const exempt = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
-  for (const { token, binary } of tokens) {
-    const m = classifySsrf(token);
-    if (!m) continue;
-    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
-  }
-  return null;
-}
 var DESTINATION_ARGS = /* @__PURE__ */ new Map([
   ["webfetch", ["url"]],
   ["fetch", ["url", "uri"]],
@@ -4080,6 +4089,22 @@ function hostOf(value) {
     return null;
   }
 }
+function extractToolDestinations(toolName, args) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return [];
+    const out = [];
+    for (const path16 of paths) {
+      for (const value of valuesAt(args, path16)) {
+        const host = hostOf(value);
+        if (host) out.push({ host, binary: toolName, raw: value });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
@@ -4187,6 +4212,16 @@ function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
     tier: 3
   };
 }
+function egressPolicyVerdict(eg) {
+  return {
+    decision: eg.verdict,
+    blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+    reason: eg.reason,
+    ruleName: `egress:${eg.binary}:${eg.host}`,
+    ruleDescription: eg.reason,
+    tier: eg.verdict === "block" ? 3 : 4
+  };
+}
 async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
   const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2 } = hooks;
@@ -4221,7 +4256,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const pendingToolEgress = config.policy.egress?.enabled ? (() => {
+    const dests = extractToolDestinations(toolName, args);
+    const eg = dests.length > 0 ? evaluateEgress(dests, config.policy.egress) : null;
+    return eg ? egressPolicyVerdict(eg) : void 0;
+  })() : void 0;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) {
+    return pendingToolEgress ?? { decision: "allow" };
+  }
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
@@ -4310,6 +4352,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   let allTokens = [];
   let pathTokens = [];
+  if (pendingToolEgress) return pendingToolEgress;
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
@@ -4375,16 +4418,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
         const eg = evaluateEgress(dests, config.policy.egress);
-        if (eg) {
-          return {
-            decision: eg.verdict,
-            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
-            reason: eg.reason,
-            ruleName: `egress:${eg.binary}:${eg.host}`,
-            ruleDescription: eg.reason,
-            tier: eg.verdict === "block" ? 3 : 4
-          };
-        }
+        if (eg) return egressPolicyVerdict(eg);
       }
     }
     const firstToken = analyzed.actions[0] ?? "";
@@ -8324,8 +8358,10 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  const declaredEgress = config.policy.egress?.enabled === true && extractToolDestinations(toolName, args).length > 0;
+  const judge = !isIgnoredTool2(toolName) || declaredEgress;
   if (isObserveMode) {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       const wouldBlock = policyResult.decision === "block";
       if (!isManual)
@@ -8350,7 +8386,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     return { approved: true, checkedBy: "audit" };
   }
   if (config.settings.mode === "audit") {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       if (policyResult.decision === "review") {
         appendLocalAudit(toolName, args, "allow", "audit-mode", meta, hashAuditArgs);
@@ -8389,9 +8425,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       appPermReviewTool = bareTool;
     }
   }
-  if (!taintWarning && !isIgnoredTool2(toolName)) {
+  if (!taintWarning && judge) {
     const ld = config.policy.loopDetection;
-    if (ld.enabled && !appPermReview) {
+    if (ld.enabled && !appPermReview && !isIgnoredTool2(toolName)) {
       const loopResult = recordAndCheck(toolName, args, ld.threshold, ld.windowSeconds * 1e3);
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;