@node9/proxy 2.17.0 → 2.19.0

package/dist/cli.js

@@ -2251,15 +2251,44 @@ function classifySsrf(host) {
     return null;
   }
 }
+function ssrfExemptMatches(entries, normalized) {
+  if (!entries?.length || !normalized) return false;
+  const target = bitsOf(normalized);
+  for (const raw of entries) {
+    const entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    const slash = entry.indexOf("/");
+    if (slash === -1) {
+      if ((normalizeIpLiteral(entry) ?? entry) === normalized) return true;
+      continue;
+    }
+    if (!target) continue;
+    const base = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
+    const prefixText = entry.slice(slash + 1);
+    const prefix = /^\d+$/.test(prefixText) ? Number(prefixText) : NaN;
+    if (!base || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
+    // differ, so `0.0.0.0/0` does not release `::1`.
+    base.length !== target.length || prefix > base.length) {
+      continue;
+    }
+    if (base.slice(0, prefix) === target.slice(0, prefix)) return true;
+  }
+  return false;
+}
+function bitsOf(normalized) {
+  const o = v4Octets(normalized);
+  if (o) {
+    return o.every((n) => Number.isInteger(n) && n >= 0 && n <= 255) ? o.map((n) => n.toString(2).padStart(8, "0")).join("") : null;
+  }
+  const g = expandIpv6(normalized);
+  return g ? g.map((n) => n.toString(2).padStart(16, "0")).join("") : null;
+}
 function ssrfFloor(tokens, opts = {}) {
-  const exempt2 = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
     if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+    if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
     return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
@@ -2568,7 +2597,6 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    const exempt2 = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
     for (const path78 of paths) {
       for (const value of valuesAt(args, path78)) {
         const host = hostOf(value);
@@ -2576,7 +2604,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const m = classifySsrf(host);
         if (!m) continue;
         if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-        if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+        if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
         return { ...m, argPath: path78, host, reason: ssrfReason(m, host) };
       }
     }
@@ -6799,10 +6827,12 @@ var init_api_url = __esm({
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const m = classifySsrf(entry);
+    const base = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base);
     if (m && !m.overridable) {
+      const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
-        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+        `[node9] ${source} ssrfAllow entry "${entry}" ${what} (${m.tier}) and cannot be exempted; ignoring it.`
       );
       continue;
     }
@@ -9746,6 +9776,9 @@ async function authorizeHeadless(toolName, args, meta, options) {
   }
   return _authorizeHeadlessCore(toolName, args, meta, options);
 }
+function approvalTimeoutReason(approvalTimeoutMs) {
+  return `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy. Approve from your phone next time: run \`node9 login\`.`;
+}
 async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   const meta = options?.cwd && !metaArg?.workingDir ? { ...metaArg, workingDir: options.cwd } : metaArg;
   if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
@@ -10335,7 +10368,7 @@ ${appPermReview}`
         const timer = setTimeout(() => {
           resolve2({
             approved: false,
-            reason: `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy.`,
+            reason: approvalTimeoutReason(approvalTimeoutMs),
             blockedBy: "timeout",
             blockedByLabel: "Approval Timeout"
           });
@@ -20044,19 +20077,19 @@ function evaluateEgressConfig(egress) {
 function checkEgressFloor(egress) {
   const detail = [
     "the cloud instance-metadata endpoint",
-    "link-local, multicast, unspecified and CGNAT (100.64/10) addresses",
-    egress.ssrfStrict ? "the strict tier is on: loopback and the private ranges are blocked too" : `the strict tier is off: loopback and the private ranges stay reachable (${egress.policySource === "workspace" ? "turn it on in the dashboard, Enforcement \u2192 Network" : "`node9 egress strict on`"})`
+    "link-local and multicast addresses",
+    egress.ssrfStrict ? "the strict tier is on: loopback, the private ranges and CGNAT are blocked too" : `the strict tier is off: loopback, the private ranges and CGNAT (100.64/10) stay reachable (${egress.policySource === "workspace" ? "turn it on in the dashboard, Enforcement \u2192 Network" : "`node9 egress strict on`"})`
   ];
   if (egress.ssrfAllow.length) {
     detail.push(`you exempted: ${egress.ssrfAllow.join(", ")}`);
   }
-  detail.push("not covered: WebFetch and MCP fetch tools reach a URL without this gate");
+  detail.push("not covered: an interpreter one-liner (node -e, python3 -c) hides its destination");
   return [
     {
       category: "Egress",
       severity: "advisory",
-      title: "The cloud metadata endpoint is blocked in shell commands",
-      what: "node9 blocks it before any egress policy is consulted, and no setting releases it. It sees shell commands (curl, wget, ssh); a tool that fetches a URL itself does not pass this gate.",
+      title: "The cloud metadata endpoint is blocked",
+      what: "node9 blocks it before any egress policy is consulted, and no setting releases it. It sees shell commands (curl, wget, ssh) and tools that declare a URL (WebFetch, an MCP fetch tool, browser navigate); an interpreter one-liner does not reach it.",
       why: "One request to that address returns this machine's cloud credentials, to anyone who can make the agent send it.",
       who: "An agent talked into fetching that address hands over the keys and cannot, here.",
       owner: "node9",
@@ -56099,6 +56132,7 @@ var import_os52 = __toESM(require("os"));
 var import_https6 = __toESM(require("https"));
 init_core();
 init_setup();
+init_machine_id();
 init_shields();
 init_service();
 init_core();
@@ -56110,7 +56144,8 @@ function buildTelemetryPayload(agents, firstInstall) {
     agents_detected: agents,
     os: process.platform,
     node9_version: node9Version(),
-    first_install: firstInstall
+    first_install: firstInstall,
+    machine_id: getMachineId()
   };
 }
 function fireTelemetryPing(agents, firstInstall) {
@@ -57103,10 +57138,11 @@ function addEgressHost(list, host) {
   writeEgressRawConfig(config);
 }
 function addSsrfExemption(address) {
-  const m = classifySsrf(address);
+  const slash = address.indexOf("/");
+  const m = classifySsrf(slash === -1 ? address : address.slice(0, slash));
   if (m && !m.overridable) {
     throw new Error(
-      `${address} is a protected address (${m.tier}) and cannot be exempted by anyone. This is the one part of the floor no setting releases.`
+      `${address} ${slash === -1 ? "is a protected address" : "covers only protected addresses"} (${m.tier}) and cannot be exempted by anyone. This is the one part of the floor no setting releases.`
     );
   }
   const config = readEgressRawConfig();
@@ -57378,7 +57414,7 @@ var TOOLS = [
   },
   {
     name: "node9_egress_status",
-    description: "Show egress (outbound network) control: whether it is enabled, the mode (off / review / block), and your allow + deny host lists. Common dev/LLM hosts (github, npm, pypi, anthropic, \u2026) are always allowed by a built-in list. Also reports the SSRF floor: the addresses blocked in SHELL COMMANDS before any policy is consulted (cloud metadata, link-local, multicast, CGNAT), which tools bypass it, whether the strict tier (loopback + private ranges) is on, and the exemptions in force. Read-only.",
+    description: "Show egress (outbound network) control: whether it is enabled, the mode (off / review / block), and your allow + deny host lists. Common dev/LLM hosts (github, npm, pypi, anthropic, \u2026) are always allowed by a built-in list. Also reports the SSRF floor: the addresses blocked before any policy is consulted (cloud metadata, link-local, multicast), the carriers it covers, whether the strict tier (loopback, private ranges, CGNAT) is on, and the exemptions in force. Read-only.",
     inputSchema: { type: "object", properties: {}, required: [] }
   },
   {
@@ -57538,11 +57574,12 @@ function handleEgressStatus() {
     // The SSRF floor. Without these lines an agent reading this answer
     // concludes that internal addresses are reachable, because nothing said
     // otherwise. The LIMITS are here for the same reason and matter more on
-    // this surface than on any other: an agent treats this as ground truth,
-    // and the first version told it the floor was absolute. It is not. It sees
-    // shell commands only, and `node9 pause` suspends it.
-    "Protected addresses, IN SHELL COMMANDS ONLY: cloud metadata, link-local, multicast and CGNAT (100.64/10) are blocked before any of the above is consulted. No setting releases them, though `node9 pause` suspends all enforcement.",
-    "NOT covered by that: a tool that fetches a URL itself (WebFetch, an MCP fetch tool) does not pass this gate at all.",
+    // this surface than on any other: an agent treats this as ground truth.
+    // The first version said the floor was absolute; the correction said it
+    // was shell-only; both were wrong by the time they were read. What it
+    // actually covers is measured in egress.integration.test.ts.
+    "Protected addresses: cloud metadata, link-local and multicast are blocked before any of the above is consulted, in shell commands AND in tools that declare a URL (WebFetch, an MCP fetch tool, browser navigate). No setting releases them, though `node9 pause` suspends all enforcement.",
+    "NOT covered by that: an interpreter one-liner (node -e, python3 -c) carries its destination inside a program and does not reach this gate. CGNAT (100.64/10) is NOT in the always-blocked set \u2014 it is reachable until the strict tier is on, and an exemption can release it.",
     `Internal addresses: ${e.ssrfStrict ? "on" : "off"} \u2014 loopback and the private ranges are ${e.ssrfStrict ? "blocked too" : "reachable"}.`,
     `Floor exemptions: ${e.ssrfAllow?.length ? e.ssrfAllow.join(", ") : "(none)"}`
   ];
@@ -60301,26 +60338,76 @@ function exempt(address) {
   if (!cliGuardPolicyWrite(`egress exempt ${address}`)) return false;
   return guard(() => addSsrfExemption(address));
 }
+var INTERNAL_FIELDS = {
+  allowed: { ssrfStrict: false, allowPrivate: true },
+  listed: { ssrfStrict: false, allowPrivate: false },
+  blocked: { ssrfStrict: true, allowPrivate: false }
+};
+var INTERNAL_SAID = {
+  allowed: "reachable without listing them",
+  listed: "reachable only if they are on your allowlist",
+  blocked: "blocked"
+};
+function readInternalState(e) {
+  if (e.ssrfStrict === true) return "blocked";
+  return e.allowPrivate === false ? "listed" : "allowed";
+}
+function setInternal(value) {
+  const state = value.trim().toLowerCase();
+  if (!(state in INTERNAL_FIELDS)) {
+    console.error(
+      import_chalk34.default.red(`
+  \u2717 Expected "allowed", "listed" or "blocked", got "${value}".`) + import_chalk34.default.gray(
+        "\n    allowed  loopback, 10/172.16/192.168 and CGNAT are reachable (default)\n    listed   they are reachable only if you allowlist them\n    blocked  they are blocked at the floor\n"
+      )
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (!mutate(`egress internal ${state}`, INTERNAL_FIELDS[state])) return;
+  _resetConfigCache();
+  const effective = readInternalState(getConfig().policy.egress);
+  if (effective !== state) {
+    console.log(
+      import_chalk34.default.yellow(
+        `
+  \u26A0 Saved, but not in effect: your workspace sets internal addresses to ${effective.toUpperCase()} and that governs this machine.
+    Change it in the dashboard, Enforcement \u2192 Network.
+`
+      )
+    );
+    return;
+  }
+  const line = `
+  \u2713 Internal addresses: ${state} \u2014 loopback, the private ranges and CGNAT are ${INTERNAL_SAID[state]}.
+`;
+  console.log(state === "allowed" ? import_chalk34.default.yellow(line) : import_chalk34.default.green(line));
+}
 function showFloor(e, ssrfStrictSource) {
-  console.log(import_chalk34.default.gray("\n  Protected addresses") + import_chalk34.default.gray(" \u2014 in shell commands only"));
+  console.log(
+    import_chalk34.default.gray("\n  Protected addresses") + import_chalk34.default.gray(" \u2014 in shell commands and declared URLs")
+  );
   console.log(
     import_chalk34.default.gray(
-      "    always blocked: cloud metadata, link-local, multicast, CGNAT (100.64/10)\n    no setting releases these, though `node9 pause` suspends all enforcement"
+      "    always blocked: cloud metadata, link-local, multicast\n    no setting releases these, though `node9 pause` suspends all enforcement"
     )
   );
-  const strict = e.ssrfStrict === true;
+  const state = readInternalState(e);
   const by = ssrfStrictSource === "workspace" ? "workspace (app.node9.ai)" : ssrfStrictSource === "local" ? "this machine (config.json)" : "the shipped default";
+  const STATE_LABEL = {
+    allowed: "allowed",
+    listed: "allowlist only",
+    blocked: "blocked"
+  };
   console.log(
-    `    Internal addresses:  ${strict ? import_chalk34.default.green("on") : import_chalk34.default.yellow("off")}` + import_chalk34.default.gray(
-      strict ? "  loopback and 10/172.16/192.168 are blocked too" : "  loopback and 10/172.16/192.168 are reachable"
-    )
+    `    Internal addresses:  ${state === "blocked" ? import_chalk34.default.green(STATE_LABEL[state]) : import_chalk34.default.yellow(STATE_LABEL[state])}` + import_chalk34.default.gray(`  loopback, 10/172.16/192.168 and CGNAT are ${INTERNAL_SAID[state]}`)
   );
   console.log(import_chalk34.default.gray(`    set by: ${by}`));
   const exemptions = e.ssrfAllow ?? [];
   console.log(import_chalk34.default.gray(`    Exemptions: ${exemptions.length ? exemptions.join(", ") : "none"}`));
   console.log(
     import_chalk34.default.gray(
-      "    Not covered: an agent tool that fetches a URL itself (WebFetch, an MCP\n    fetch tool) does not pass this gate."
+      "    Covered: shell commands, and tools that declare a URL (WebFetch, an MCP\n    fetch tool, browser navigate).\n    Not covered: an interpreter one-liner (node -e, python3 -c) hides its\n    destination inside a program and does not reach this gate.\n    CGNAT (100.64/10) is NOT in the always-blocked set: it is reachable\n    until Internal addresses is on, and an exemption can release it."
     )
   );
 }
@@ -60385,7 +60472,10 @@ function registerEgressCommand(program2) {
       import_chalk34.default.yellow("\n\u2713 Egress control is off \u2014 the agent can reach any host again.\n")
     );
   });
-  egress.command("strict <on|off>").description("Also block loopback and private ranges (the strict SSRF tier)").action((value) => {
+  egress.command("internal <allowed|listed|blocked>").description(
+    "How loopback, private ranges and CGNAT are treated: allowed (default), listed (must be on the allowlist), or blocked"
+  ).action((value) => setInternal(value));
+  egress.command("strict <on|off>").description("Deprecated alias for `egress internal blocked|allowed`").action((value) => {
     const v = value.trim().toLowerCase();
     if (v !== "on" && v !== "off") {
       console.error(import_chalk34.default.red(`
@@ -60394,38 +60484,40 @@ function registerEgressCommand(program2) {
       process.exitCode = 1;
       return;
     }
-    if (!mutate(`egress strict ${v}`, { ssrfStrict: v === "on" })) return;
-    _resetConfigCache();
-    const effective = getConfig().policy.egress.ssrfStrict === true;
-    if (effective !== (v === "on")) {
-      console.log(
-        import_chalk34.default.yellow(
-          `
-  \u26A0 Saved, but not in effect: your workspace sets the strict tier ${effective ? "ON" : "OFF"} and that governs this machine.
-    Change it in the dashboard, Enforcement \u2192 Network.
-`
+    const state = v === "on" ? "blocked" : getConfig().policy.egress.allowPrivate === false ? "listed" : "allowed";
+    console.log(import_chalk34.default.gray(`
+  (\`egress strict ${v}\` is now \`egress internal ${state}\`)`));
+    setInternal(state);
+  });
+  egress.command("exempt <address>").description("Let an address or a CIDR range through the floor (e.g. 100.64.0.0/10)").action((address) => {
+    const a = normalizeEgressHost(address);
+    const slash = a.indexOf("/");
+    const base = slash === -1 ? a : a.slice(0, slash);
+    const prefixText = slash === -1 ? null : a.slice(slash + 1);
+    if (!normalizeIpLiteral(base) || prefixText !== null && !/^\d{1,3}$/.test(prefixText)) {
+      console.error(
+        import_chalk34.default.red(`
+  \u2717 "${address}" is not an address or a range.`) + import_chalk34.default.gray(
+          "\n    Exemptions are matched as an address (10.0.0.5) or a CIDR\n    range (100.64.0.0/10), never a name.\n"
         )
       );
+      process.exitCode = 1;
       return;
     }
-    console.log(
-      v === "on" ? import_chalk34.default.green("\n  \u2713 Strict tier on \u2014 loopback and private ranges are blocked.\n") : import_chalk34.default.yellow("\n  \u2713 Strict tier off \u2014 loopback and private ranges are reachable.\n")
-    );
-  });
-  egress.command("exempt <address>").description("Let ONE address through the floor (exact address, not a range)").action((address) => {
-    const a = normalizeEgressHost(address);
-    if (!normalizeIpLiteral(a)) {
+    const m = classifySsrf(base);
+    if (m && !m.overridable) {
       console.error(
         import_chalk34.default.red(`
-  \u2717 "${address}" is not an address.`) + import_chalk34.default.gray(
-          "\n    Exemptions are matched as one exact address, not a name or a range.\n"
+  \u2717 ${a} cannot be exempted.`) + import_chalk34.default.gray(
+          `
+    ${slash === -1 ? "That address is" : "That range covers only"} protected addresses (${m.tier}), which no setting releases.
+`
         )
       );
       process.exitCode = 1;
       return;
     }
     if (!exempt(a)) return;
-    const m = classifySsrf(a);
     console.log(import_chalk34.default.green(`
   \u2713 ${a} is exempt from the floor.`));
     if (!m)