@node9/proxy 2.16.2 → 2.17.0

package/dist/cli.js

@@ -2265,18 +2265,18 @@ function ssrfFloor(tokens, opts = {}) {
   return null;
 }
 function hostMatches(host, pattern) {
-  const h = host.toLowerCase();
-  const p = pattern.toLowerCase().trim();
+  const p = pattern.trim().toLowerCase();
   if (!p) return false;
   if (p === "*") return true;
+  const h = canonicalHost(host);
   if (p.startsWith("*.")) {
-    const suffix = p.slice(2);
+    const suffix = canonicalHost(p.slice(2));
     return h === suffix || h.endsWith("." + suffix);
   }
-  return h === p;
+  return h === canonicalHost(p);
 }
 function matchesAny(host, patterns) {
-  for (const p of patterns) if (hostMatches(host, p)) return true;
+  for (const p of patterns ?? []) if (hostMatches(host, p)) return true;
   return false;
 }
 function isUniqueLocalV6(host) {
@@ -2286,13 +2286,17 @@ function isUniqueLocalV6(host) {
   return g !== null && (g[0] & 65024) === 64512;
 }
 function isPrivateHost(host) {
-  const h = host.trim().toLowerCase();
+  const h = host.trim().toLowerCase().replace(/\.$/, "");
   const m = classifySsrf(h);
   if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
   if (h === "localhost") return true;
   if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
   return isUniqueLocalV6(h);
 }
+function canonicalHost(host) {
+  const ip = normalizeIpLiteral(host);
+  return ip ?? host.trim().toLowerCase().replace(/\.$/, "");
+}
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
   let review = null;
@@ -2544,6 +2548,22 @@ function hostOf(value) {
     return null;
   }
 }
+function extractToolDestinations(toolName, args) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return [];
+    const out = [];
+    for (const path78 of paths) {
+      for (const value of valuesAt(args, path78)) {
+        const host = hostOf(value);
+        if (host) out.push({ host, binary: toolName, raw: value });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
@@ -2645,6 +2665,16 @@ function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
     tier: 3
   };
 }
+function egressPolicyVerdict(eg) {
+  return {
+    decision: eg.verdict,
+    blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+    reason: eg.reason,
+    ruleName: `egress:${eg.binary}:${eg.host}`,
+    ruleDescription: eg.reason,
+    tier: eg.verdict === "block" ? 3 : 4
+  };
+}
 async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
   const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2 } = hooks;
@@ -2679,7 +2709,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const pendingToolEgress = config.policy.egress?.enabled ? (() => {
+    const dests = extractToolDestinations(toolName, args);
+    const eg = dests.length > 0 ? evaluateEgress(dests, config.policy.egress) : null;
+    return eg ? egressPolicyVerdict(eg) : void 0;
+  })() : void 0;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) {
+    return pendingToolEgress ?? { decision: "allow" };
+  }
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
@@ -2768,6 +2805,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   let allTokens = [];
   let pathTokens = [];
+  if (pendingToolEgress) return pendingToolEgress;
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
@@ -2833,16 +2871,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
         const eg = evaluateEgress(dests, config.policy.egress);
-        if (eg) {
-          return {
-            decision: eg.verdict,
-            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
-            reason: eg.reason,
-            ruleName: `egress:${eg.binary}:${eg.host}`,
-            ruleDescription: eg.reason,
-            tier: eg.verdict === "block" ? 3 : 4
-          };
-        }
+        if (eg) return egressPolicyVerdict(eg);
       }
     }
     const firstToken = analyzed.actions[0] ?? "";
@@ -9945,8 +9974,10 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  const declaredEgress = config.policy.egress?.enabled === true && extractToolDestinations(toolName, args).length > 0;
+  const judge = !isIgnoredTool2(toolName) || declaredEgress;
   if (isObserveMode) {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       const wouldBlock = policyResult.decision === "block";
       if (!isManual)
@@ -9971,7 +10002,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     return { approved: true, checkedBy: "audit" };
   }
   if (config.settings.mode === "audit") {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       if (policyResult.decision === "review") {
         appendLocalAudit(toolName, args, "allow", "audit-mode", meta, hashAuditArgs);
@@ -10010,9 +10041,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       appPermReviewTool = bareTool;
     }
   }
-  if (!taintWarning && !isIgnoredTool2(toolName)) {
+  if (!taintWarning && judge) {
     const ld = config.policy.loopDetection;
-    if (ld.enabled && !appPermReview) {
+    if (ld.enabled && !appPermReview && !isIgnoredTool2(toolName)) {
       const loopResult = recordAndCheck(toolName, args, ld.threshold, ld.windowSeconds * 1e3);
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;

package/dist/cli.mjs

@@ -2276,18 +2276,18 @@ function ssrfFloor(tokens, opts = {}) {
   return null;
 }
 function hostMatches(host, pattern) {
-  const h = host.toLowerCase();
-  const p = pattern.toLowerCase().trim();
+  const p = pattern.trim().toLowerCase();
   if (!p) return false;
   if (p === "*") return true;
+  const h = canonicalHost(host);
   if (p.startsWith("*.")) {
-    const suffix = p.slice(2);
+    const suffix = canonicalHost(p.slice(2));
     return h === suffix || h.endsWith("." + suffix);
   }
-  return h === p;
+  return h === canonicalHost(p);
 }
 function matchesAny(host, patterns) {
-  for (const p of patterns) if (hostMatches(host, p)) return true;
+  for (const p of patterns ?? []) if (hostMatches(host, p)) return true;
   return false;
 }
 function isUniqueLocalV6(host) {
@@ -2297,13 +2297,17 @@ function isUniqueLocalV6(host) {
   return g !== null && (g[0] & 65024) === 64512;
 }
 function isPrivateHost(host) {
-  const h = host.trim().toLowerCase();
+  const h = host.trim().toLowerCase().replace(/\.$/, "");
   const m = classifySsrf(h);
   if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
   if (h === "localhost") return true;
   if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
   return isUniqueLocalV6(h);
 }
+function canonicalHost(host) {
+  const ip = normalizeIpLiteral(host);
+  return ip ?? host.trim().toLowerCase().replace(/\.$/, "");
+}
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
   let review = null;
@@ -2555,6 +2559,22 @@ function hostOf(value) {
     return null;
   }
 }
+function extractToolDestinations(toolName, args) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return [];
+    const out = [];
+    for (const path78 of paths) {
+      for (const value of valuesAt(args, path78)) {
+        const host = hostOf(value);
+        if (host) out.push({ host, binary: toolName, raw: value });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
@@ -2656,6 +2676,16 @@ function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
     tier: 3
   };
 }
+function egressPolicyVerdict(eg) {
+  return {
+    decision: eg.verdict,
+    blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+    reason: eg.reason,
+    ruleName: `egress:${eg.binary}:${eg.host}`,
+    ruleDescription: eg.reason,
+    tier: eg.verdict === "block" ? 3 : 4
+  };
+}
 async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
   const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2 } = hooks;
@@ -2690,7 +2720,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const pendingToolEgress = config.policy.egress?.enabled ? (() => {
+    const dests = extractToolDestinations(toolName, args);
+    const eg = dests.length > 0 ? evaluateEgress(dests, config.policy.egress) : null;
+    return eg ? egressPolicyVerdict(eg) : void 0;
+  })() : void 0;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) {
+    return pendingToolEgress ?? { decision: "allow" };
+  }
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
@@ -2779,6 +2816,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   let allTokens = [];
   let pathTokens = [];
+  if (pendingToolEgress) return pendingToolEgress;
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
@@ -2844,16 +2882,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
         const eg = evaluateEgress(dests, config.policy.egress);
-        if (eg) {
-          return {
-            decision: eg.verdict,
-            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
-            reason: eg.reason,
-            ruleName: `egress:${eg.binary}:${eg.host}`,
-            ruleDescription: eg.reason,
-            tier: eg.verdict === "block" ? 3 : 4
-          };
-        }
+        if (eg) return egressPolicyVerdict(eg);
       }
     }
     const firstToken = analyzed.actions[0] ?? "";
@@ -9946,8 +9975,10 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  const declaredEgress = config.policy.egress?.enabled === true && extractToolDestinations(toolName, args).length > 0;
+  const judge = !isIgnoredTool2(toolName) || declaredEgress;
   if (isObserveMode) {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       const wouldBlock = policyResult.decision === "block";
       if (!isManual)
@@ -9972,7 +10003,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     return { approved: true, checkedBy: "audit" };
   }
   if (config.settings.mode === "audit") {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       if (policyResult.decision === "review") {
         appendLocalAudit(toolName, args, "allow", "audit-mode", meta, hashAuditArgs);
@@ -10011,9 +10042,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       appPermReviewTool = bareTool;
     }
   }
-  if (!taintWarning && !isIgnoredTool2(toolName)) {
+  if (!taintWarning && judge) {
     const ld = config.policy.loopDetection;
-    if (ld.enabled && !appPermReview) {
+    if (ld.enabled && !appPermReview && !isIgnoredTool2(toolName)) {
       const loopResult = recordAndCheck(toolName, args, ld.threshold, ld.windowSeconds * 1e3);
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;

package/dist/index.js

@@ -3675,18 +3675,18 @@ var DEFAULT_EGRESS_ALLOWLIST = [
   "*.ubuntu.com"
 ];
 function hostMatches(host, pattern) {
-  const h = host.toLowerCase();
-  const p = pattern.toLowerCase().trim();
+  const p = pattern.trim().toLowerCase();
   if (!p) return false;
   if (p === "*") return true;
+  const h = canonicalHost(host);
   if (p.startsWith("*.")) {
-    const suffix = p.slice(2);
+    const suffix = canonicalHost(p.slice(2));
     return h === suffix || h.endsWith("." + suffix);
   }
-  return h === p;
+  return h === canonicalHost(p);
 }
 function matchesAny(host, patterns) {
-  for (const p of patterns) if (hostMatches(host, p)) return true;
+  for (const p of patterns ?? []) if (hostMatches(host, p)) return true;
   return false;
 }
 var PRIVATE_HOST_SUFFIXES = [".local", ".internal", ".localhost"];
@@ -3697,13 +3697,17 @@ function isUniqueLocalV6(host) {
   return g !== null && (g[0] & 65024) === 64512;
 }
 function isPrivateHost(host) {
-  const h = host.trim().toLowerCase();
+  const h = host.trim().toLowerCase().replace(/\.$/, "");
   const m = classifySsrf(h);
   if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
   if (h === "localhost") return true;
   if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
   return isUniqueLocalV6(h);
 }
+function canonicalHost(host) {
+  const ip = normalizeIpLiteral(host);
+  return ip ?? host.trim().toLowerCase().replace(/\.$/, "");
+}
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
   let review = null;
@@ -4085,6 +4089,22 @@ function hostOf(value) {
     return null;
   }
 }
+function extractToolDestinations(toolName, args) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return [];
+    const out = [];
+    for (const path16 of paths) {
+      for (const value of valuesAt(args, path16)) {
+        const host = hostOf(value);
+        if (host) out.push({ host, binary: toolName, raw: value });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
@@ -4192,6 +4212,16 @@ function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
     tier: 3
   };
 }
+function egressPolicyVerdict(eg) {
+  return {
+    decision: eg.verdict,
+    blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+    reason: eg.reason,
+    ruleName: `egress:${eg.binary}:${eg.host}`,
+    ruleDescription: eg.reason,
+    tier: eg.verdict === "block" ? 3 : 4
+  };
+}
 async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
   const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2 } = hooks;
@@ -4226,7 +4256,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const pendingToolEgress = config.policy.egress?.enabled ? (() => {
+    const dests = extractToolDestinations(toolName, args);
+    const eg = dests.length > 0 ? evaluateEgress(dests, config.policy.egress) : null;
+    return eg ? egressPolicyVerdict(eg) : void 0;
+  })() : void 0;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) {
+    return pendingToolEgress ?? { decision: "allow" };
+  }
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
@@ -4315,6 +4352,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   let allTokens = [];
   let pathTokens = [];
+  if (pendingToolEgress) return pendingToolEgress;
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
@@ -4380,16 +4418,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
         const eg = evaluateEgress(dests, config.policy.egress);
-        if (eg) {
-          return {
-            decision: eg.verdict,
-            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
-            reason: eg.reason,
-            ruleName: `egress:${eg.binary}:${eg.host}`,
-            ruleDescription: eg.reason,
-            tier: eg.verdict === "block" ? 3 : 4
-          };
-        }
+        if (eg) return egressPolicyVerdict(eg);
       }
     }
     const firstToken = analyzed.actions[0] ?? "";
@@ -8329,8 +8358,10 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  const declaredEgress = config.policy.egress?.enabled === true && extractToolDestinations(toolName, args).length > 0;
+  const judge = !isIgnoredTool2(toolName) || declaredEgress;
   if (isObserveMode) {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       const wouldBlock = policyResult.decision === "block";
       if (!isManual)
@@ -8355,7 +8386,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     return { approved: true, checkedBy: "audit" };
   }
   if (config.settings.mode === "audit") {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       if (policyResult.decision === "review") {
         appendLocalAudit(toolName, args, "allow", "audit-mode", meta, hashAuditArgs);
@@ -8394,9 +8425,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       appPermReviewTool = bareTool;
     }
   }
-  if (!taintWarning && !isIgnoredTool2(toolName)) {
+  if (!taintWarning && judge) {
     const ld = config.policy.loopDetection;
-    if (ld.enabled && !appPermReview) {
+    if (ld.enabled && !appPermReview && !isIgnoredTool2(toolName)) {
       const loopResult = recordAndCheck(toolName, args, ld.threshold, ld.windowSeconds * 1e3);
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;

package/dist/index.mjs

@@ -3645,18 +3645,18 @@ var DEFAULT_EGRESS_ALLOWLIST = [
   "*.ubuntu.com"
 ];
 function hostMatches(host, pattern) {
-  const h = host.toLowerCase();
-  const p = pattern.toLowerCase().trim();
+  const p = pattern.trim().toLowerCase();
   if (!p) return false;
   if (p === "*") return true;
+  const h = canonicalHost(host);
   if (p.startsWith("*.")) {
-    const suffix = p.slice(2);
+    const suffix = canonicalHost(p.slice(2));
     return h === suffix || h.endsWith("." + suffix);
   }
-  return h === p;
+  return h === canonicalHost(p);
 }
 function matchesAny(host, patterns) {
-  for (const p of patterns) if (hostMatches(host, p)) return true;
+  for (const p of patterns ?? []) if (hostMatches(host, p)) return true;
   return false;
 }
 var PRIVATE_HOST_SUFFIXES = [".local", ".internal", ".localhost"];
@@ -3667,13 +3667,17 @@ function isUniqueLocalV6(host) {
   return g !== null && (g[0] & 65024) === 64512;
 }
 function isPrivateHost(host) {
-  const h = host.trim().toLowerCase();
+  const h = host.trim().toLowerCase().replace(/\.$/, "");
   const m = classifySsrf(h);
   if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
   if (h === "localhost") return true;
   if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
   return isUniqueLocalV6(h);
 }
+function canonicalHost(host) {
+  const ip = normalizeIpLiteral(host);
+  return ip ?? host.trim().toLowerCase().replace(/\.$/, "");
+}
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
   let review = null;
@@ -4055,6 +4059,22 @@ function hostOf(value) {
     return null;
   }
 }
+function extractToolDestinations(toolName, args) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return [];
+    const out = [];
+    for (const path16 of paths) {
+      for (const value of valuesAt(args, path16)) {
+        const host = hostOf(value);
+        if (host) out.push({ host, binary: toolName, raw: value });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
@@ -4162,6 +4182,16 @@ function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
     tier: 3
   };
 }
+function egressPolicyVerdict(eg) {
+  return {
+    decision: eg.verdict,
+    blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+    reason: eg.reason,
+    ruleName: `egress:${eg.binary}:${eg.host}`,
+    ruleDescription: eg.reason,
+    tier: eg.verdict === "block" ? 3 : 4
+  };
+}
 async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
   const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2 } = hooks;
@@ -4196,7 +4226,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const pendingToolEgress = config.policy.egress?.enabled ? (() => {
+    const dests = extractToolDestinations(toolName, args);
+    const eg = dests.length > 0 ? evaluateEgress(dests, config.policy.egress) : null;
+    return eg ? egressPolicyVerdict(eg) : void 0;
+  })() : void 0;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) {
+    return pendingToolEgress ?? { decision: "allow" };
+  }
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
@@ -4285,6 +4322,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   let allTokens = [];
   let pathTokens = [];
+  if (pendingToolEgress) return pendingToolEgress;
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
@@ -4350,16 +4388,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
         const eg = evaluateEgress(dests, config.policy.egress);
-        if (eg) {
-          return {
-            decision: eg.verdict,
-            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
-            reason: eg.reason,
-            ruleName: `egress:${eg.binary}:${eg.host}`,
-            ruleDescription: eg.reason,
-            tier: eg.verdict === "block" ? 3 : 4
-          };
-        }
+        if (eg) return egressPolicyVerdict(eg);
       }
     }
     const firstToken = analyzed.actions[0] ?? "";
@@ -8299,8 +8328,10 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  const declaredEgress = config.policy.egress?.enabled === true && extractToolDestinations(toolName, args).length > 0;
+  const judge = !isIgnoredTool2(toolName) || declaredEgress;
   if (isObserveMode) {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       const wouldBlock = policyResult.decision === "block";
       if (!isManual)
@@ -8325,7 +8356,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     return { approved: true, checkedBy: "audit" };
   }
   if (config.settings.mode === "audit") {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       if (policyResult.decision === "review") {
         appendLocalAudit(toolName, args, "allow", "audit-mode", meta, hashAuditArgs);
@@ -8364,9 +8395,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       appPermReviewTool = bareTool;
     }
   }
-  if (!taintWarning && !isIgnoredTool2(toolName)) {
+  if (!taintWarning && judge) {
     const ld = config.policy.loopDetection;
-    if (ld.enabled && !appPermReview) {
+    if (ld.enabled && !appPermReview && !isIgnoredTool2(toolName)) {
       const loopResult = recordAndCheck(toolName, args, ld.threshold, ld.windowSeconds * 1e3);
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.16.2",
+  "version": "2.17.0",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",