@node9/proxy 2.16.2 → 2.18.0

package/dist/cli.mjs

@@ -2262,32 +2262,61 @@ function classifySsrf(host) {
     return null;
   }
 }
+function ssrfExemptMatches(entries, normalized) {
+  if (!entries?.length || !normalized) return false;
+  const target = bitsOf(normalized);
+  for (const raw of entries) {
+    const entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    const slash = entry.indexOf("/");
+    if (slash === -1) {
+      if ((normalizeIpLiteral(entry) ?? entry) === normalized) return true;
+      continue;
+    }
+    if (!target) continue;
+    const base = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
+    const prefixText = entry.slice(slash + 1);
+    const prefix = /^\d+$/.test(prefixText) ? Number(prefixText) : NaN;
+    if (!base || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
+    // differ, so `0.0.0.0/0` does not release `::1`.
+    base.length !== target.length || prefix > base.length) {
+      continue;
+    }
+    if (base.slice(0, prefix) === target.slice(0, prefix)) return true;
+  }
+  return false;
+}
+function bitsOf(normalized) {
+  const o = v4Octets(normalized);
+  if (o) {
+    return o.every((n) => Number.isInteger(n) && n >= 0 && n <= 255) ? o.map((n) => n.toString(2).padStart(8, "0")).join("") : null;
+  }
+  const g = expandIpv6(normalized);
+  return g ? g.map((n) => n.toString(2).padStart(16, "0")).join("") : null;
+}
 function ssrfFloor(tokens, opts = {}) {
-  const exempt2 = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
     if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+    if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
     return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
 }
 function hostMatches(host, pattern) {
-  const h = host.toLowerCase();
-  const p = pattern.toLowerCase().trim();
+  const p = pattern.trim().toLowerCase();
   if (!p) return false;
   if (p === "*") return true;
+  const h = canonicalHost(host);
   if (p.startsWith("*.")) {
-    const suffix = p.slice(2);
+    const suffix = canonicalHost(p.slice(2));
     return h === suffix || h.endsWith("." + suffix);
   }
-  return h === p;
+  return h === canonicalHost(p);
 }
 function matchesAny(host, patterns) {
-  for (const p of patterns) if (hostMatches(host, p)) return true;
+  for (const p of patterns ?? []) if (hostMatches(host, p)) return true;
   return false;
 }
 function isUniqueLocalV6(host) {
@@ -2297,13 +2326,17 @@ function isUniqueLocalV6(host) {
   return g !== null && (g[0] & 65024) === 64512;
 }
 function isPrivateHost(host) {
-  const h = host.trim().toLowerCase();
+  const h = host.trim().toLowerCase().replace(/\.$/, "");
   const m = classifySsrf(h);
   if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
   if (h === "localhost") return true;
   if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
   return isUniqueLocalV6(h);
 }
+function canonicalHost(host) {
+  const ip = normalizeIpLiteral(host);
+  return ip ?? host.trim().toLowerCase().replace(/\.$/, "");
+}
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
   let review = null;
@@ -2555,11 +2588,26 @@ function hostOf(value) {
     return null;
   }
 }
+function extractToolDestinations(toolName, args) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return [];
+    const out = [];
+    for (const path78 of paths) {
+      for (const value of valuesAt(args, path78)) {
+        const host = hostOf(value);
+        if (host) out.push({ host, binary: toolName, raw: value });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    const exempt2 = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
     for (const path78 of paths) {
       for (const value of valuesAt(args, path78)) {
         const host = hostOf(value);
@@ -2567,7 +2615,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const m = classifySsrf(host);
         if (!m) continue;
         if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-        if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+        if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
         return { ...m, argPath: path78, host, reason: ssrfReason(m, host) };
       }
     }
@@ -2656,6 +2704,16 @@ function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
     tier: 3
   };
 }
+function egressPolicyVerdict(eg) {
+  return {
+    decision: eg.verdict,
+    blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
+    reason: eg.reason,
+    ruleName: `egress:${eg.binary}:${eg.host}`,
+    ruleDescription: eg.reason,
+    tier: eg.verdict === "block" ? 3 : 4
+  };
+}
 async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
   const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2 } = hooks;
@@ -2690,7 +2748,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const pendingToolEgress = config.policy.egress?.enabled ? (() => {
+    const dests = extractToolDestinations(toolName, args);
+    const eg = dests.length > 0 ? evaluateEgress(dests, config.policy.egress) : null;
+    return eg ? egressPolicyVerdict(eg) : void 0;
+  })() : void 0;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) {
+    return pendingToolEgress ?? { decision: "allow" };
+  }
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
@@ -2779,6 +2844,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   let allTokens = [];
   let pathTokens = [];
+  if (pendingToolEgress) return pendingToolEgress;
   const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
@@ -2844,16 +2910,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
         const eg = evaluateEgress(dests, config.policy.egress);
-        if (eg) {
-          return {
-            decision: eg.verdict,
-            blockedByLabel: eg.verdict === "block" ? "\u{1F310} Node9 Egress (Blocked)" : "\u{1F310} Node9 Egress (Review)",
-            reason: eg.reason,
-            ruleName: `egress:${eg.binary}:${eg.host}`,
-            ruleDescription: eg.reason,
-            tier: eg.verdict === "block" ? 3 : 4
-          };
-        }
+        if (eg) return egressPolicyVerdict(eg);
       }
     }
     const firstToken = analyzed.actions[0] ?? "";
@@ -6777,10 +6834,12 @@ import os4 from "os";
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const m = classifySsrf(entry);
+    const base = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base);
     if (m && !m.overridable) {
+      const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
-        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+        `[node9] ${source} ssrfAllow entry "${entry}" ${what} (${m.tier}) and cannot be exempted; ignoring it.`
       );
       continue;
     }
@@ -9946,8 +10005,10 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  const declaredEgress = config.policy.egress?.enabled === true && extractToolDestinations(toolName, args).length > 0;
+  const judge = !isIgnoredTool2(toolName) || declaredEgress;
   if (isObserveMode) {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       const wouldBlock = policyResult.decision === "block";
       if (!isManual)
@@ -9972,7 +10033,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     return { approved: true, checkedBy: "audit" };
   }
   if (config.settings.mode === "audit") {
-    if (!isIgnoredTool2(toolName)) {
+    if (judge) {
       const policyResult = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd);
       if (policyResult.decision === "review") {
         appendLocalAudit(toolName, args, "allow", "audit-mode", meta, hashAuditArgs);
@@ -10011,9 +10072,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       appPermReviewTool = bareTool;
     }
   }
-  if (!taintWarning && !isIgnoredTool2(toolName)) {
+  if (!taintWarning && judge) {
     const ld = config.policy.loopDetection;
-    if (ld.enabled && !appPermReview) {
+    if (ld.enabled && !appPermReview && !isIgnoredTool2(toolName)) {
       const loopResult = recordAndCheck(toolName, args, ld.threshold, ld.windowSeconds * 1e3);
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;
@@ -20011,19 +20072,19 @@ function evaluateEgressConfig(egress) {
 function checkEgressFloor(egress) {
   const detail = [
     "the cloud instance-metadata endpoint",
-    "link-local, multicast, unspecified and CGNAT (100.64/10) addresses",
-    egress.ssrfStrict ? "the strict tier is on: loopback and the private ranges are blocked too" : `the strict tier is off: loopback and the private ranges stay reachable (${egress.policySource === "workspace" ? "turn it on in the dashboard, Enforcement \u2192 Network" : "`node9 egress strict on`"})`
+    "link-local and multicast addresses",
+    egress.ssrfStrict ? "the strict tier is on: loopback, the private ranges and CGNAT are blocked too" : `the strict tier is off: loopback, the private ranges and CGNAT (100.64/10) stay reachable (${egress.policySource === "workspace" ? "turn it on in the dashboard, Enforcement \u2192 Network" : "`node9 egress strict on`"})`
   ];
   if (egress.ssrfAllow.length) {
     detail.push(`you exempted: ${egress.ssrfAllow.join(", ")}`);
   }
-  detail.push("not covered: WebFetch and MCP fetch tools reach a URL without this gate");
+  detail.push("not covered: an interpreter one-liner (node -e, python3 -c) hides its destination");
   return [
     {
       category: "Egress",
       severity: "advisory",
-      title: "The cloud metadata endpoint is blocked in shell commands",
-      what: "node9 blocks it before any egress policy is consulted, and no setting releases it. It sees shell commands (curl, wget, ssh); a tool that fetches a URL itself does not pass this gate.",
+      title: "The cloud metadata endpoint is blocked",
+      what: "node9 blocks it before any egress policy is consulted, and no setting releases it. It sees shell commands (curl, wget, ssh) and tools that declare a URL (WebFetch, an MCP fetch tool, browser navigate); an interpreter one-liner does not reach it.",
       why: "One request to that address returns this machine's cloud credentials, to anyone who can make the agent send it.",
       who: "An agent talked into fetching that address hands over the keys and cannot, here.",
       owner: "node9",
@@ -57062,10 +57123,11 @@ function addEgressHost(list, host) {
   writeEgressRawConfig(config);
 }
 function addSsrfExemption(address) {
-  const m = classifySsrf(address);
+  const slash = address.indexOf("/");
+  const m = classifySsrf(slash === -1 ? address : address.slice(0, slash));
   if (m && !m.overridable) {
     throw new Error(
-      `${address} is a protected address (${m.tier}) and cannot be exempted by anyone. This is the one part of the floor no setting releases.`
+      `${address} ${slash === -1 ? "is a protected address" : "covers only protected addresses"} (${m.tier}) and cannot be exempted by anyone. This is the one part of the floor no setting releases.`
     );
   }
   const config = readEgressRawConfig();
@@ -57337,7 +57399,7 @@ var TOOLS = [
   },
   {
     name: "node9_egress_status",
-    description: "Show egress (outbound network) control: whether it is enabled, the mode (off / review / block), and your allow + deny host lists. Common dev/LLM hosts (github, npm, pypi, anthropic, \u2026) are always allowed by a built-in list. Also reports the SSRF floor: the addresses blocked in SHELL COMMANDS before any policy is consulted (cloud metadata, link-local, multicast, CGNAT), which tools bypass it, whether the strict tier (loopback + private ranges) is on, and the exemptions in force. Read-only.",
+    description: "Show egress (outbound network) control: whether it is enabled, the mode (off / review / block), and your allow + deny host lists. Common dev/LLM hosts (github, npm, pypi, anthropic, \u2026) are always allowed by a built-in list. Also reports the SSRF floor: the addresses blocked before any policy is consulted (cloud metadata, link-local, multicast), the carriers it covers, whether the strict tier (loopback, private ranges, CGNAT) is on, and the exemptions in force. Read-only.",
     inputSchema: { type: "object", properties: {}, required: [] }
   },
   {
@@ -57497,11 +57559,12 @@ function handleEgressStatus() {
     // The SSRF floor. Without these lines an agent reading this answer
     // concludes that internal addresses are reachable, because nothing said
     // otherwise. The LIMITS are here for the same reason and matter more on
-    // this surface than on any other: an agent treats this as ground truth,
-    // and the first version told it the floor was absolute. It is not. It sees
-    // shell commands only, and `node9 pause` suspends it.
-    "Protected addresses, IN SHELL COMMANDS ONLY: cloud metadata, link-local, multicast and CGNAT (100.64/10) are blocked before any of the above is consulted. No setting releases them, though `node9 pause` suspends all enforcement.",
-    "NOT covered by that: a tool that fetches a URL itself (WebFetch, an MCP fetch tool) does not pass this gate at all.",
+    // this surface than on any other: an agent treats this as ground truth.
+    // The first version said the floor was absolute; the correction said it
+    // was shell-only; both were wrong by the time they were read. What it
+    // actually covers is measured in egress.integration.test.ts.
+    "Protected addresses: cloud metadata, link-local and multicast are blocked before any of the above is consulted, in shell commands AND in tools that declare a URL (WebFetch, an MCP fetch tool, browser navigate). No setting releases them, though `node9 pause` suspends all enforcement.",
+    "NOT covered by that: an interpreter one-liner (node -e, python3 -c) carries its destination inside a program and does not reach this gate. CGNAT (100.64/10) is NOT in the always-blocked set \u2014 it is reachable until the strict tier is on, and an exemption can release it.",
     `Internal addresses: ${e.ssrfStrict ? "on" : "off"} \u2014 loopback and the private ranges are ${e.ssrfStrict ? "blocked too" : "reachable"}.`,
     `Floor exemptions: ${e.ssrfAllow?.length ? e.ssrfAllow.join(", ") : "(none)"}`
   ];
@@ -60260,26 +60323,76 @@ function exempt(address) {
   if (!cliGuardPolicyWrite(`egress exempt ${address}`)) return false;
   return guard(() => addSsrfExemption(address));
 }
+var INTERNAL_FIELDS = {
+  allowed: { ssrfStrict: false, allowPrivate: true },
+  listed: { ssrfStrict: false, allowPrivate: false },
+  blocked: { ssrfStrict: true, allowPrivate: false }
+};
+var INTERNAL_SAID = {
+  allowed: "reachable without listing them",
+  listed: "reachable only if they are on your allowlist",
+  blocked: "blocked"
+};
+function readInternalState(e) {
+  if (e.ssrfStrict === true) return "blocked";
+  return e.allowPrivate === false ? "listed" : "allowed";
+}
+function setInternal(value) {
+  const state = value.trim().toLowerCase();
+  if (!(state in INTERNAL_FIELDS)) {
+    console.error(
+      chalk34.red(`
+  \u2717 Expected "allowed", "listed" or "blocked", got "${value}".`) + chalk34.gray(
+        "\n    allowed  loopback, 10/172.16/192.168 and CGNAT are reachable (default)\n    listed   they are reachable only if you allowlist them\n    blocked  they are blocked at the floor\n"
+      )
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (!mutate(`egress internal ${state}`, INTERNAL_FIELDS[state])) return;
+  _resetConfigCache();
+  const effective = readInternalState(getConfig().policy.egress);
+  if (effective !== state) {
+    console.log(
+      chalk34.yellow(
+        `
+  \u26A0 Saved, but not in effect: your workspace sets internal addresses to ${effective.toUpperCase()} and that governs this machine.
+    Change it in the dashboard, Enforcement \u2192 Network.
+`
+      )
+    );
+    return;
+  }
+  const line = `
+  \u2713 Internal addresses: ${state} \u2014 loopback, the private ranges and CGNAT are ${INTERNAL_SAID[state]}.
+`;
+  console.log(state === "allowed" ? chalk34.yellow(line) : chalk34.green(line));
+}
 function showFloor(e, ssrfStrictSource) {
-  console.log(chalk34.gray("\n  Protected addresses") + chalk34.gray(" \u2014 in shell commands only"));
+  console.log(
+    chalk34.gray("\n  Protected addresses") + chalk34.gray(" \u2014 in shell commands and declared URLs")
+  );
   console.log(
     chalk34.gray(
-      "    always blocked: cloud metadata, link-local, multicast, CGNAT (100.64/10)\n    no setting releases these, though `node9 pause` suspends all enforcement"
+      "    always blocked: cloud metadata, link-local, multicast\n    no setting releases these, though `node9 pause` suspends all enforcement"
     )
   );
-  const strict = e.ssrfStrict === true;
+  const state = readInternalState(e);
   const by = ssrfStrictSource === "workspace" ? "workspace (app.node9.ai)" : ssrfStrictSource === "local" ? "this machine (config.json)" : "the shipped default";
+  const STATE_LABEL = {
+    allowed: "allowed",
+    listed: "allowlist only",
+    blocked: "blocked"
+  };
   console.log(
-    `    Internal addresses:  ${strict ? chalk34.green("on") : chalk34.yellow("off")}` + chalk34.gray(
-      strict ? "  loopback and 10/172.16/192.168 are blocked too" : "  loopback and 10/172.16/192.168 are reachable"
-    )
+    `    Internal addresses:  ${state === "blocked" ? chalk34.green(STATE_LABEL[state]) : chalk34.yellow(STATE_LABEL[state])}` + chalk34.gray(`  loopback, 10/172.16/192.168 and CGNAT are ${INTERNAL_SAID[state]}`)
   );
   console.log(chalk34.gray(`    set by: ${by}`));
   const exemptions = e.ssrfAllow ?? [];
   console.log(chalk34.gray(`    Exemptions: ${exemptions.length ? exemptions.join(", ") : "none"}`));
   console.log(
     chalk34.gray(
-      "    Not covered: an agent tool that fetches a URL itself (WebFetch, an MCP\n    fetch tool) does not pass this gate."
+      "    Covered: shell commands, and tools that declare a URL (WebFetch, an MCP\n    fetch tool, browser navigate).\n    Not covered: an interpreter one-liner (node -e, python3 -c) hides its\n    destination inside a program and does not reach this gate.\n    CGNAT (100.64/10) is NOT in the always-blocked set: it is reachable\n    until Internal addresses is on, and an exemption can release it."
     )
   );
 }
@@ -60344,7 +60457,10 @@ function registerEgressCommand(program2) {
       chalk34.yellow("\n\u2713 Egress control is off \u2014 the agent can reach any host again.\n")
     );
   });
-  egress.command("strict <on|off>").description("Also block loopback and private ranges (the strict SSRF tier)").action((value) => {
+  egress.command("internal <allowed|listed|blocked>").description(
+    "How loopback, private ranges and CGNAT are treated: allowed (default), listed (must be on the allowlist), or blocked"
+  ).action((value) => setInternal(value));
+  egress.command("strict <on|off>").description("Deprecated alias for `egress internal blocked|allowed`").action((value) => {
     const v = value.trim().toLowerCase();
     if (v !== "on" && v !== "off") {
       console.error(chalk34.red(`
@@ -60353,38 +60469,40 @@ function registerEgressCommand(program2) {
       process.exitCode = 1;
       return;
     }
-    if (!mutate(`egress strict ${v}`, { ssrfStrict: v === "on" })) return;
-    _resetConfigCache();
-    const effective = getConfig().policy.egress.ssrfStrict === true;
-    if (effective !== (v === "on")) {
-      console.log(
-        chalk34.yellow(
-          `
-  \u26A0 Saved, but not in effect: your workspace sets the strict tier ${effective ? "ON" : "OFF"} and that governs this machine.
-    Change it in the dashboard, Enforcement \u2192 Network.
-`
+    const state = v === "on" ? "blocked" : getConfig().policy.egress.allowPrivate === false ? "listed" : "allowed";
+    console.log(chalk34.gray(`
+  (\`egress strict ${v}\` is now \`egress internal ${state}\`)`));
+    setInternal(state);
+  });
+  egress.command("exempt <address>").description("Let an address or a CIDR range through the floor (e.g. 100.64.0.0/10)").action((address) => {
+    const a = normalizeEgressHost(address);
+    const slash = a.indexOf("/");
+    const base = slash === -1 ? a : a.slice(0, slash);
+    const prefixText = slash === -1 ? null : a.slice(slash + 1);
+    if (!normalizeIpLiteral(base) || prefixText !== null && !/^\d{1,3}$/.test(prefixText)) {
+      console.error(
+        chalk34.red(`
+  \u2717 "${address}" is not an address or a range.`) + chalk34.gray(
+          "\n    Exemptions are matched as an address (10.0.0.5) or a CIDR\n    range (100.64.0.0/10), never a name.\n"
         )
       );
+      process.exitCode = 1;
       return;
     }
-    console.log(
-      v === "on" ? chalk34.green("\n  \u2713 Strict tier on \u2014 loopback and private ranges are blocked.\n") : chalk34.yellow("\n  \u2713 Strict tier off \u2014 loopback and private ranges are reachable.\n")
-    );
-  });
-  egress.command("exempt <address>").description("Let ONE address through the floor (exact address, not a range)").action((address) => {
-    const a = normalizeEgressHost(address);
-    if (!normalizeIpLiteral(a)) {
+    const m = classifySsrf(base);
+    if (m && !m.overridable) {
       console.error(
         chalk34.red(`
-  \u2717 "${address}" is not an address.`) + chalk34.gray(
-          "\n    Exemptions are matched as one exact address, not a name or a range.\n"
+  \u2717 ${a} cannot be exempted.`) + chalk34.gray(
+          `
+    ${slash === -1 ? "That address is" : "That range covers only"} protected addresses (${m.tier}), which no setting releases.
+`
         )
       );
       process.exitCode = 1;
       return;
     }
     if (!exempt(a)) return;
-    const m = classifySsrf(a);
     console.log(chalk34.green(`
   \u2713 ${a} is exempt from the floor.`));
     if (!m)

package/dist/dashboard.mjs

@@ -4717,10 +4717,12 @@ import os7 from "os";
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const m = classifySsrf(entry);
+    const base = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base);
     if (m && !m.overridable) {
+      const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
-        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+        `[node9] ${source} ssrfAllow entry "${entry}" ${what} (${m.tier}) and cannot be exempted; ignoring it.`
       );
       continue;
     }