@node9/proxy 2.17.0 → 2.19.0

package/dist/cli.mjs

@@ -2262,15 +2262,44 @@ function classifySsrf(host) {
     return null;
   }
 }
+function ssrfExemptMatches(entries, normalized) {
+  if (!entries?.length || !normalized) return false;
+  const target = bitsOf(normalized);
+  for (const raw of entries) {
+    const entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    const slash = entry.indexOf("/");
+    if (slash === -1) {
+      if ((normalizeIpLiteral(entry) ?? entry) === normalized) return true;
+      continue;
+    }
+    if (!target) continue;
+    const base = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
+    const prefixText = entry.slice(slash + 1);
+    const prefix = /^\d+$/.test(prefixText) ? Number(prefixText) : NaN;
+    if (!base || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
+    // differ, so `0.0.0.0/0` does not release `::1`.
+    base.length !== target.length || prefix > base.length) {
+      continue;
+    }
+    if (base.slice(0, prefix) === target.slice(0, prefix)) return true;
+  }
+  return false;
+}
+function bitsOf(normalized) {
+  const o = v4Octets(normalized);
+  if (o) {
+    return o.every((n) => Number.isInteger(n) && n >= 0 && n <= 255) ? o.map((n) => n.toString(2).padStart(8, "0")).join("") : null;
+  }
+  const g = expandIpv6(normalized);
+  return g ? g.map((n) => n.toString(2).padStart(16, "0")).join("") : null;
+}
 function ssrfFloor(tokens, opts = {}) {
-  const exempt2 = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
     if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+    if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
     return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
@@ -2579,7 +2608,6 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    const exempt2 = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
     for (const path78 of paths) {
       for (const value of valuesAt(args, path78)) {
         const host = hostOf(value);
@@ -2587,7 +2615,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const m = classifySsrf(host);
         if (!m) continue;
         if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-        if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+        if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
         return { ...m, argPath: path78, host, reason: ssrfReason(m, host) };
       }
     }
@@ -6806,10 +6834,12 @@ import os4 from "os";
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const m = classifySsrf(entry);
+    const base = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base);
     if (m && !m.overridable) {
+      const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
-        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+        `[node9] ${source} ssrfAllow entry "${entry}" ${what} (${m.tier}) and cannot be exempted; ignoring it.`
       );
       continue;
     }
@@ -9747,6 +9777,9 @@ async function authorizeHeadless(toolName, args, meta, options) {
   }
   return _authorizeHeadlessCore(toolName, args, meta, options);
 }
+function approvalTimeoutReason(approvalTimeoutMs) {
+  return `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy. Approve from your phone next time: run \`node9 login\`.`;
+}
 async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   const meta = options?.cwd && !metaArg?.workingDir ? { ...metaArg, workingDir: options.cwd } : metaArg;
   if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
@@ -10336,7 +10369,7 @@ ${appPermReview}`
         const timer = setTimeout(() => {
           resolve2({
             approved: false,
-            reason: `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy.`,
+            reason: approvalTimeoutReason(approvalTimeoutMs),
             blockedBy: "timeout",
             blockedByLabel: "Approval Timeout"
           });
@@ -20042,19 +20075,19 @@ function evaluateEgressConfig(egress) {
 function checkEgressFloor(egress) {
   const detail = [
     "the cloud instance-metadata endpoint",
-    "link-local, multicast, unspecified and CGNAT (100.64/10) addresses",
-    egress.ssrfStrict ? "the strict tier is on: loopback and the private ranges are blocked too" : `the strict tier is off: loopback and the private ranges stay reachable (${egress.policySource === "workspace" ? "turn it on in the dashboard, Enforcement \u2192 Network" : "`node9 egress strict on`"})`
+    "link-local and multicast addresses",
+    egress.ssrfStrict ? "the strict tier is on: loopback, the private ranges and CGNAT are blocked too" : `the strict tier is off: loopback, the private ranges and CGNAT (100.64/10) stay reachable (${egress.policySource === "workspace" ? "turn it on in the dashboard, Enforcement \u2192 Network" : "`node9 egress strict on`"})`
   ];
   if (egress.ssrfAllow.length) {
     detail.push(`you exempted: ${egress.ssrfAllow.join(", ")}`);
   }
-  detail.push("not covered: WebFetch and MCP fetch tools reach a URL without this gate");
+  detail.push("not covered: an interpreter one-liner (node -e, python3 -c) hides its destination");
   return [
     {
       category: "Egress",
       severity: "advisory",
-      title: "The cloud metadata endpoint is blocked in shell commands",
-      what: "node9 blocks it before any egress policy is consulted, and no setting releases it. It sees shell commands (curl, wget, ssh); a tool that fetches a URL itself does not pass this gate.",
+      title: "The cloud metadata endpoint is blocked",
+      what: "node9 blocks it before any egress policy is consulted, and no setting releases it. It sees shell commands (curl, wget, ssh) and tools that declare a URL (WebFetch, an MCP fetch tool, browser navigate); an interpreter one-liner does not reach it.",
       why: "One request to that address returns this machine's cloud credentials, to anyone who can make the agent send it.",
       who: "An agent talked into fetching that address hands over the keys and cannot, here.",
       owner: "node9",
@@ -56084,6 +56117,7 @@ function registerStatusCommand(program2) {
 // src/cli/commands/init.ts
 init_core();
 init_setup();
+init_machine_id();
 init_shields();
 init_service();
 init_core();
@@ -56100,7 +56134,8 @@ function buildTelemetryPayload(agents, firstInstall) {
     agents_detected: agents,
     os: process.platform,
     node9_version: node9Version(),
-    first_install: firstInstall
+    first_install: firstInstall,
+    machine_id: getMachineId()
   };
 }
 function fireTelemetryPing(agents, firstInstall) {
@@ -57093,10 +57128,11 @@ function addEgressHost(list, host) {
   writeEgressRawConfig(config);
 }
 function addSsrfExemption(address) {
-  const m = classifySsrf(address);
+  const slash = address.indexOf("/");
+  const m = classifySsrf(slash === -1 ? address : address.slice(0, slash));
   if (m && !m.overridable) {
     throw new Error(
-      `${address} is a protected address (${m.tier}) and cannot be exempted by anyone. This is the one part of the floor no setting releases.`
+      `${address} ${slash === -1 ? "is a protected address" : "covers only protected addresses"} (${m.tier}) and cannot be exempted by anyone. This is the one part of the floor no setting releases.`
     );
   }
   const config = readEgressRawConfig();
@@ -57368,7 +57404,7 @@ var TOOLS = [
   },
   {
     name: "node9_egress_status",
-    description: "Show egress (outbound network) control: whether it is enabled, the mode (off / review / block), and your allow + deny host lists. Common dev/LLM hosts (github, npm, pypi, anthropic, \u2026) are always allowed by a built-in list. Also reports the SSRF floor: the addresses blocked in SHELL COMMANDS before any policy is consulted (cloud metadata, link-local, multicast, CGNAT), which tools bypass it, whether the strict tier (loopback + private ranges) is on, and the exemptions in force. Read-only.",
+    description: "Show egress (outbound network) control: whether it is enabled, the mode (off / review / block), and your allow + deny host lists. Common dev/LLM hosts (github, npm, pypi, anthropic, \u2026) are always allowed by a built-in list. Also reports the SSRF floor: the addresses blocked before any policy is consulted (cloud metadata, link-local, multicast), the carriers it covers, whether the strict tier (loopback, private ranges, CGNAT) is on, and the exemptions in force. Read-only.",
     inputSchema: { type: "object", properties: {}, required: [] }
   },
   {
@@ -57528,11 +57564,12 @@ function handleEgressStatus() {
     // The SSRF floor. Without these lines an agent reading this answer
     // concludes that internal addresses are reachable, because nothing said
     // otherwise. The LIMITS are here for the same reason and matter more on
-    // this surface than on any other: an agent treats this as ground truth,
-    // and the first version told it the floor was absolute. It is not. It sees
-    // shell commands only, and `node9 pause` suspends it.
-    "Protected addresses, IN SHELL COMMANDS ONLY: cloud metadata, link-local, multicast and CGNAT (100.64/10) are blocked before any of the above is consulted. No setting releases them, though `node9 pause` suspends all enforcement.",
-    "NOT covered by that: a tool that fetches a URL itself (WebFetch, an MCP fetch tool) does not pass this gate at all.",
+    // this surface than on any other: an agent treats this as ground truth.
+    // The first version said the floor was absolute; the correction said it
+    // was shell-only; both were wrong by the time they were read. What it
+    // actually covers is measured in egress.integration.test.ts.
+    "Protected addresses: cloud metadata, link-local and multicast are blocked before any of the above is consulted, in shell commands AND in tools that declare a URL (WebFetch, an MCP fetch tool, browser navigate). No setting releases them, though `node9 pause` suspends all enforcement.",
+    "NOT covered by that: an interpreter one-liner (node -e, python3 -c) carries its destination inside a program and does not reach this gate. CGNAT (100.64/10) is NOT in the always-blocked set \u2014 it is reachable until the strict tier is on, and an exemption can release it.",
     `Internal addresses: ${e.ssrfStrict ? "on" : "off"} \u2014 loopback and the private ranges are ${e.ssrfStrict ? "blocked too" : "reachable"}.`,
     `Floor exemptions: ${e.ssrfAllow?.length ? e.ssrfAllow.join(", ") : "(none)"}`
   ];
@@ -60291,26 +60328,76 @@ function exempt(address) {
   if (!cliGuardPolicyWrite(`egress exempt ${address}`)) return false;
   return guard(() => addSsrfExemption(address));
 }
+var INTERNAL_FIELDS = {
+  allowed: { ssrfStrict: false, allowPrivate: true },
+  listed: { ssrfStrict: false, allowPrivate: false },
+  blocked: { ssrfStrict: true, allowPrivate: false }
+};
+var INTERNAL_SAID = {
+  allowed: "reachable without listing them",
+  listed: "reachable only if they are on your allowlist",
+  blocked: "blocked"
+};
+function readInternalState(e) {
+  if (e.ssrfStrict === true) return "blocked";
+  return e.allowPrivate === false ? "listed" : "allowed";
+}
+function setInternal(value) {
+  const state = value.trim().toLowerCase();
+  if (!(state in INTERNAL_FIELDS)) {
+    console.error(
+      chalk34.red(`
+  \u2717 Expected "allowed", "listed" or "blocked", got "${value}".`) + chalk34.gray(
+        "\n    allowed  loopback, 10/172.16/192.168 and CGNAT are reachable (default)\n    listed   they are reachable only if you allowlist them\n    blocked  they are blocked at the floor\n"
+      )
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (!mutate(`egress internal ${state}`, INTERNAL_FIELDS[state])) return;
+  _resetConfigCache();
+  const effective = readInternalState(getConfig().policy.egress);
+  if (effective !== state) {
+    console.log(
+      chalk34.yellow(
+        `
+  \u26A0 Saved, but not in effect: your workspace sets internal addresses to ${effective.toUpperCase()} and that governs this machine.
+    Change it in the dashboard, Enforcement \u2192 Network.
+`
+      )
+    );
+    return;
+  }
+  const line = `
+  \u2713 Internal addresses: ${state} \u2014 loopback, the private ranges and CGNAT are ${INTERNAL_SAID[state]}.
+`;
+  console.log(state === "allowed" ? chalk34.yellow(line) : chalk34.green(line));
+}
 function showFloor(e, ssrfStrictSource) {
-  console.log(chalk34.gray("\n  Protected addresses") + chalk34.gray(" \u2014 in shell commands only"));
+  console.log(
+    chalk34.gray("\n  Protected addresses") + chalk34.gray(" \u2014 in shell commands and declared URLs")
+  );
   console.log(
     chalk34.gray(
-      "    always blocked: cloud metadata, link-local, multicast, CGNAT (100.64/10)\n    no setting releases these, though `node9 pause` suspends all enforcement"
+      "    always blocked: cloud metadata, link-local, multicast\n    no setting releases these, though `node9 pause` suspends all enforcement"
     )
   );
-  const strict = e.ssrfStrict === true;
+  const state = readInternalState(e);
   const by = ssrfStrictSource === "workspace" ? "workspace (app.node9.ai)" : ssrfStrictSource === "local" ? "this machine (config.json)" : "the shipped default";
+  const STATE_LABEL = {
+    allowed: "allowed",
+    listed: "allowlist only",
+    blocked: "blocked"
+  };
   console.log(
-    `    Internal addresses:  ${strict ? chalk34.green("on") : chalk34.yellow("off")}` + chalk34.gray(
-      strict ? "  loopback and 10/172.16/192.168 are blocked too" : "  loopback and 10/172.16/192.168 are reachable"
-    )
+    `    Internal addresses:  ${state === "blocked" ? chalk34.green(STATE_LABEL[state]) : chalk34.yellow(STATE_LABEL[state])}` + chalk34.gray(`  loopback, 10/172.16/192.168 and CGNAT are ${INTERNAL_SAID[state]}`)
   );
   console.log(chalk34.gray(`    set by: ${by}`));
   const exemptions = e.ssrfAllow ?? [];
   console.log(chalk34.gray(`    Exemptions: ${exemptions.length ? exemptions.join(", ") : "none"}`));
   console.log(
     chalk34.gray(
-      "    Not covered: an agent tool that fetches a URL itself (WebFetch, an MCP\n    fetch tool) does not pass this gate."
+      "    Covered: shell commands, and tools that declare a URL (WebFetch, an MCP\n    fetch tool, browser navigate).\n    Not covered: an interpreter one-liner (node -e, python3 -c) hides its\n    destination inside a program and does not reach this gate.\n    CGNAT (100.64/10) is NOT in the always-blocked set: it is reachable\n    until Internal addresses is on, and an exemption can release it."
     )
   );
 }
@@ -60375,7 +60462,10 @@ function registerEgressCommand(program2) {
       chalk34.yellow("\n\u2713 Egress control is off \u2014 the agent can reach any host again.\n")
     );
   });
-  egress.command("strict <on|off>").description("Also block loopback and private ranges (the strict SSRF tier)").action((value) => {
+  egress.command("internal <allowed|listed|blocked>").description(
+    "How loopback, private ranges and CGNAT are treated: allowed (default), listed (must be on the allowlist), or blocked"
+  ).action((value) => setInternal(value));
+  egress.command("strict <on|off>").description("Deprecated alias for `egress internal blocked|allowed`").action((value) => {
     const v = value.trim().toLowerCase();
     if (v !== "on" && v !== "off") {
       console.error(chalk34.red(`
@@ -60384,38 +60474,40 @@ function registerEgressCommand(program2) {
       process.exitCode = 1;
       return;
     }
-    if (!mutate(`egress strict ${v}`, { ssrfStrict: v === "on" })) return;
-    _resetConfigCache();
-    const effective = getConfig().policy.egress.ssrfStrict === true;
-    if (effective !== (v === "on")) {
-      console.log(
-        chalk34.yellow(
-          `
-  \u26A0 Saved, but not in effect: your workspace sets the strict tier ${effective ? "ON" : "OFF"} and that governs this machine.
-    Change it in the dashboard, Enforcement \u2192 Network.
-`
+    const state = v === "on" ? "blocked" : getConfig().policy.egress.allowPrivate === false ? "listed" : "allowed";
+    console.log(chalk34.gray(`
+  (\`egress strict ${v}\` is now \`egress internal ${state}\`)`));
+    setInternal(state);
+  });
+  egress.command("exempt <address>").description("Let an address or a CIDR range through the floor (e.g. 100.64.0.0/10)").action((address) => {
+    const a = normalizeEgressHost(address);
+    const slash = a.indexOf("/");
+    const base = slash === -1 ? a : a.slice(0, slash);
+    const prefixText = slash === -1 ? null : a.slice(slash + 1);
+    if (!normalizeIpLiteral(base) || prefixText !== null && !/^\d{1,3}$/.test(prefixText)) {
+      console.error(
+        chalk34.red(`
+  \u2717 "${address}" is not an address or a range.`) + chalk34.gray(
+          "\n    Exemptions are matched as an address (10.0.0.5) or a CIDR\n    range (100.64.0.0/10), never a name.\n"
         )
       );
+      process.exitCode = 1;
       return;
     }
-    console.log(
-      v === "on" ? chalk34.green("\n  \u2713 Strict tier on \u2014 loopback and private ranges are blocked.\n") : chalk34.yellow("\n  \u2713 Strict tier off \u2014 loopback and private ranges are reachable.\n")
-    );
-  });
-  egress.command("exempt <address>").description("Let ONE address through the floor (exact address, not a range)").action((address) => {
-    const a = normalizeEgressHost(address);
-    if (!normalizeIpLiteral(a)) {
+    const m = classifySsrf(base);
+    if (m && !m.overridable) {
       console.error(
         chalk34.red(`
-  \u2717 "${address}" is not an address.`) + chalk34.gray(
-          "\n    Exemptions are matched as one exact address, not a name or a range.\n"
+  \u2717 ${a} cannot be exempted.`) + chalk34.gray(
+          `
+    ${slash === -1 ? "That address is" : "That range covers only"} protected addresses (${m.tier}), which no setting releases.
+`
         )
       );
       process.exitCode = 1;
       return;
     }
     if (!exempt(a)) return;
-    const m = classifySsrf(a);
     console.log(chalk34.green(`
   \u2713 ${a} is exempt from the floor.`));
     if (!m)

package/dist/dashboard.mjs

@@ -4717,10 +4717,12 @@ import os7 from "os";
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const m = classifySsrf(entry);
+    const base = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base);
     if (m && !m.overridable) {
+      const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
-        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+        `[node9] ${source} ssrfAllow entry "${entry}" ${what} (${m.tier}) and cannot be exempted; ignoring it.`
       );
       continue;
     }

package/dist/index.js

@@ -3630,6 +3630,38 @@ function classifySsrf(host) {
     return null;
   }
 }
+function ssrfExemptMatches(entries, normalized) {
+  if (!entries?.length || !normalized) return false;
+  const target = bitsOf(normalized);
+  for (const raw of entries) {
+    const entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    const slash = entry.indexOf("/");
+    if (slash === -1) {
+      if ((normalizeIpLiteral(entry) ?? entry) === normalized) return true;
+      continue;
+    }
+    if (!target) continue;
+    const base = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
+    const prefixText = entry.slice(slash + 1);
+    const prefix = /^\d+$/.test(prefixText) ? Number(prefixText) : NaN;
+    if (!base || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
+    // differ, so `0.0.0.0/0` does not release `::1`.
+    base.length !== target.length || prefix > base.length) {
+      continue;
+    }
+    if (base.slice(0, prefix) === target.slice(0, prefix)) return true;
+  }
+  return false;
+}
+function bitsOf(normalized) {
+  const o = v4Octets(normalized);
+  if (o) {
+    return o.every((n) => Number.isInteger(n) && n >= 0 && n <= 255) ? o.map((n) => n.toString(2).padStart(8, "0")).join("") : null;
+  }
+  const g = expandIpv6(normalized);
+  return g ? g.map((n) => n.toString(2).padStart(16, "0")).join("") : null;
+}
 var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
@@ -3639,14 +3671,11 @@ var TIER_REASON = {
   private: "a loopback or private address"
 };
 function ssrfFloor(tokens, opts = {}) {
-  const exempt = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
     if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+    if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
     return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
@@ -4109,7 +4138,6 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    const exempt = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
     for (const path16 of paths) {
       for (const value of valuesAt(args, path16)) {
         const host = hostOf(value);
@@ -4117,7 +4145,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const m = classifySsrf(host);
         if (!m) continue;
         if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-        if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+        if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
         return { ...m, argPath: path16, host, reason: ssrfReason(m, host) };
       }
     }
@@ -5950,10 +5978,12 @@ function safeApiUrl(raw, onReject) {
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const m = classifySsrf(entry);
+    const base = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base);
     if (m && !m.overridable) {
+      const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
-        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+        `[node9] ${source} ssrfAllow entry "${entry}" ${what} (${m.tier}) and cannot be exempted; ignoring it.`
       );
       continue;
     }
@@ -8130,6 +8160,9 @@ async function authorizeHeadless(toolName, args, meta, options) {
   }
   return _authorizeHeadlessCore(toolName, args, meta, options);
 }
+function approvalTimeoutReason(approvalTimeoutMs) {
+  return `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy. Approve from your phone next time: run \`node9 login\`.`;
+}
 async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   const meta = options?.cwd && !metaArg?.workingDir ? { ...metaArg, workingDir: options.cwd } : metaArg;
   if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
@@ -8719,7 +8752,7 @@ ${appPermReview}`
         const timer = setTimeout(() => {
           resolve({
             approved: false,
-            reason: `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy.`,
+            reason: approvalTimeoutReason(approvalTimeoutMs),
             blockedBy: "timeout",
             blockedByLabel: "Approval Timeout"
           });

package/dist/index.mjs

@@ -3600,6 +3600,38 @@ function classifySsrf(host) {
     return null;
   }
 }
+function ssrfExemptMatches(entries, normalized) {
+  if (!entries?.length || !normalized) return false;
+  const target = bitsOf(normalized);
+  for (const raw of entries) {
+    const entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    const slash = entry.indexOf("/");
+    if (slash === -1) {
+      if ((normalizeIpLiteral(entry) ?? entry) === normalized) return true;
+      continue;
+    }
+    if (!target) continue;
+    const base = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
+    const prefixText = entry.slice(slash + 1);
+    const prefix = /^\d+$/.test(prefixText) ? Number(prefixText) : NaN;
+    if (!base || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
+    // differ, so `0.0.0.0/0` does not release `::1`.
+    base.length !== target.length || prefix > base.length) {
+      continue;
+    }
+    if (base.slice(0, prefix) === target.slice(0, prefix)) return true;
+  }
+  return false;
+}
+function bitsOf(normalized) {
+  const o = v4Octets(normalized);
+  if (o) {
+    return o.every((n) => Number.isInteger(n) && n >= 0 && n <= 255) ? o.map((n) => n.toString(2).padStart(8, "0")).join("") : null;
+  }
+  const g = expandIpv6(normalized);
+  return g ? g.map((n) => n.toString(2).padStart(16, "0")).join("") : null;
+}
 var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
@@ -3609,14 +3641,11 @@ var TIER_REASON = {
   private: "a loopback or private address"
 };
 function ssrfFloor(tokens, opts = {}) {
-  const exempt = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
     if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+    if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
     return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
@@ -4079,7 +4108,6 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    const exempt = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
     for (const path16 of paths) {
       for (const value of valuesAt(args, path16)) {
         const host = hostOf(value);
@@ -4087,7 +4115,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const m = classifySsrf(host);
         if (!m) continue;
         if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-        if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+        if (m.overridable && ssrfExemptMatches(opts.ssrfAllow, m.normalized)) continue;
         return { ...m, argPath: path16, host, reason: ssrfReason(m, host) };
       }
     }
@@ -5920,10 +5948,12 @@ function safeApiUrl(raw, onReject) {
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const m = classifySsrf(entry);
+    const base = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base);
     if (m && !m.overridable) {
+      const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
-        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+        `[node9] ${source} ssrfAllow entry "${entry}" ${what} (${m.tier}) and cannot be exempted; ignoring it.`
       );
       continue;
     }
@@ -8100,6 +8130,9 @@ async function authorizeHeadless(toolName, args, meta, options) {
   }
   return _authorizeHeadlessCore(toolName, args, meta, options);
 }
+function approvalTimeoutReason(approvalTimeoutMs) {
+  return `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy. Approve from your phone next time: run \`node9 login\`.`;
+}
 async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   const meta = options?.cwd && !metaArg?.workingDir ? { ...metaArg, workingDir: options.cwd } : metaArg;
   if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
@@ -8689,7 +8722,7 @@ ${appPermReview}`
         const timer = setTimeout(() => {
           resolve({
             approved: false,
-            reason: `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy.`,
+            reason: approvalTimeoutReason(approvalTimeoutMs),
             blockedBy: "timeout",
             blockedByLabel: "Approval Timeout"
           });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.17.0",
+  "version": "2.19.0",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",