@node9/proxy 2.31.3 → 2.33.0

package/dist/dashboard.mjs

@@ -109,6 +109,7 @@ import mvdanSh2 from "mvdan-sh";
 import safeRegex3 from "safe-regex2";
 import { createHash as createHash2 } from "crypto";
 import mvdanSh3 from "mvdan-sh";
+import mvdanSh4 from "mvdan-sh";
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -257,10 +258,10 @@ function compressIpv6(g) {
   if (bestLen < 2) return hex.join(":");
   return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
 }
-function normalizeIpLiteral(host) {
+function normalizeIpLiteral(host2) {
   try {
-    if (typeof host !== "string") return null;
-    let s = host.trim();
+    if (typeof host2 !== "string") return null;
+    let s = host2.trim();
     if (!s || s.length > SSRF_MAX_HOST) return null;
     if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
     const zone = s.indexOf("%");
@@ -280,11 +281,11 @@ function normalizeIpLiteral(host) {
     return null;
   }
 }
-function classifySsrf(host) {
+function classifySsrf(host2) {
   try {
-    if (typeof host !== "string" || !host) return null;
-    const lower2 = host.trim().toLowerCase().replace(/\.$/, "");
-    const ip = normalizeIpLiteral(host);
+    if (typeof host2 !== "string" || !host2) return null;
+    const lower2 = host2.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host2);
     if (ip === null) {
       return METADATA_HOSTNAMES.has(lower2) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
     }
@@ -372,6 +373,7 @@ function catalogSettingsFromConfig(settings, policy) {
     injectionScan: policy.injectionScan,
     skillPinning: policy.skillPinning,
     packageCheck: policy.packageCheck,
+    untrustedContent: policy.untrustedContent,
     appliedShields: policy.appliedShields ?? [],
     checks: policy.checks
   };
@@ -1660,32 +1662,102 @@ function evaluateSmartConditions(args, rule) {
 function isBashTool(tool) {
   return BASH_TOOL_NAMES.has(tool.toLowerCase());
 }
-function inspectionEntry(tool, inspection = {}) {
+function isShellEntry(value) {
+  return typeof value === "object" && value !== null && value.kind === "shell" && typeof value.field === "string" && Object.keys(value).length === 2;
+}
+function isInspectionLayers(input) {
+  const trusted = input.trusted;
+  return typeof trusted === "object" && trusted !== null && !isShellEntry(trusted);
+}
+function layersOf(input) {
+  return isInspectionLayers(input) ? { trusted: input.trusted, project: input.project ?? {} } : { trusted: input, project: {} };
+}
+function entryOf(tool, inspection) {
   const pattern = Object.keys(inspection).find((p) => matchesPattern(tool, p));
   return pattern === void 0 ? void 0 : inspection[pattern];
 }
+function executorName(tool) {
+  const name = tool.toLowerCase();
+  if (!name.startsWith("mcp__")) return name;
+  const at = name.lastIndexOf("__");
+  return at >= "mcp__".length ? name.slice(at + 2) : name;
+}
+function entryFields(entry) {
+  if (typeof entry === "object") return [entry.field];
+  return entry === "command" ? ["command"] : null;
+}
 function shellFields(tool, inspection) {
   if (isBashTool(tool)) return ["command"];
-  const entry = inspectionEntry(tool, inspection);
-  if (typeof entry === "object") return [entry.field];
-  if (entry !== void 0) return entry === "command" ? [entry] : null;
-  const name = tool.toLowerCase().replace(/^mcp__[a-z0-9_-]+?__/, "");
-  return MCP_EXECUTORS.has(name) ? ["command", "cmd", "script"] : null;
+  const { trusted, project } = layersOf(inspection);
+  const trustedEntry = entryOf(tool, trusted);
+  if (trustedEntry !== void 0) return entryFields(trustedEntry);
+  const builtin = MCP_EXECUTORS.has(executorName(tool)) ? BUILTIN_FIELDS : null;
+  const projectEntry = entryOf(tool, project);
+  if (projectEntry === void 0) return builtin;
+  const added = entryFields(projectEntry);
+  if (!builtin) return added;
+  if (!added) return builtin;
+  return [.../* @__PURE__ */ new Set([...builtin, ...added])];
 }
 function isShellShapedTool(tool, inspection = {}) {
   return shellFields(tool, inspection) !== null;
 }
+function shellWord(word) {
+  if (BARE_WORD.test(word)) return word;
+  return word === "" ? "''" : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function commandLine(args, fieldPath, value, native) {
+  const missing = { reason: "Shell command field is missing or is not a string" };
+  const unreadable = { reason: "Shell command arguments could not be read" };
+  if (typeof value !== "string" && (native || !Array.isArray(value))) return missing;
+  const dot = fieldPath.lastIndexOf(".");
+  const parent = dot === -1 ? args : getNestedValue(args, fieldPath.slice(0, dot));
+  const siblings = ARGV_FIELDS.map((key) => ({
+    key,
+    value: parent && typeof parent === "object" ? parent[key] : void 0
+  })).filter(({ value: value2 }) => value2 !== void 0 && value2 !== null);
+  let argv = siblings[0];
+  if (native) argv = siblings.find(({ value: v }) => isStringArray(v));
+  else if (siblings.length === 2 && JSON.stringify(siblings[0].value) !== JSON.stringify(siblings[1].value))
+    return { reason: "Shell command arguments disagree" };
+  let command;
+  let source = fieldPath;
+  if (Array.isArray(value)) {
+    if (argv || !value.length || !isStringArray(value)) return unreadable;
+    command = value.map(shellWord).join(" ");
+  } else if (!argv) {
+    return { command: value, fieldPath };
+  } else {
+    if (!isStringArray(argv.value)) return unreadable;
+    if (!argv.value.length) return { command: value, fieldPath };
+    command = `${value} ${argv.value.map(shellWord).join(" ")}`;
+    source = `${fieldPath}+${argv.key}`;
+  }
+  if (command.length > MAX_ARGV_CHARACTERS)
+    return { reason: "Shell command arguments exceed the inspectable size" };
+  return { command, fieldPath: source };
+}
 function resolveShellInput(tool, args, inspection = {}) {
   const fields = shellFields(tool, inspection);
   if (!fields) return { kind: "not-shell" };
   const values = fields.map((fieldPath) => ({ fieldPath, value: getNestedValue(args, fieldPath) })).filter(({ value }) => value !== void 0 && value !== null && value !== "");
-  if (!values.length || values.some(({ value }) => typeof value !== "string")) {
+  if (!values.length) {
     return { kind: "uninspectable", reason: "Shell command field is missing or is not a string" };
   }
-  if (new Set(values.map(({ value }) => value)).size !== 1) {
+  const native = isBashTool(tool);
+  const lines = values.map(({ fieldPath, value }) => commandLine(args, fieldPath, value, native));
+  const failed = lines.find((line) => "reason" in line);
+  if (failed) return { kind: "uninspectable", reason: failed.reason };
+  const commands = lines.filter(
+    (line) => "command" in line
+  );
+  if (new Set(commands.map(({ command }) => command)).size !== 1) {
     return { kind: "uninspectable", reason: "Multiple shell command fields disagree" };
   }
-  return { kind: "shell", command: values[0].value, fieldPath: values[0].fieldPath };
+  return { kind: "shell", ...commands[0] };
 }
 function shellRuleArgs(tool, args, ruleTool, inspection = {}) {
   if (!ruleTool || !matchesPattern("bash", ruleTool) || matchesPattern(tool, ruleTool)) return args;
@@ -1695,6 +1767,22 @@ function shellRuleArgs(tool, args, ruleTool, inspection = {}) {
 function opOf(sample) {
   return parseShared(sample).Stmts[0].Redirs[0].Op;
 }
+function validateIban(raw) {
+  const s = raw.replace(/[ -]/g, "").toUpperCase();
+  if (!/^[A-Z]{2}\d{2}/.test(s)) return false;
+  const want = IBAN_LENGTH[s.slice(0, 2)];
+  if (want === void 0 || s.length < want) return false;
+  const iban = s.slice(0, want);
+  if (!/^[A-Z0-9]+$/.test(iban)) return false;
+  const rearranged = iban.slice(4) + iban.slice(0, 4);
+  let mod = 0;
+  for (const ch of rearranged) {
+    const code = ch.charCodeAt(0);
+    const digits = code >= 65 ? String(code - 55) : ch;
+    for (const d of digits) mod = (mod * 10 + (d.charCodeAt(0) - 48)) % 97;
+  }
+  return mod === 1;
+}
 function validateBase58Check(s) {
   if (!s) return null;
   let n = 0n;
@@ -2071,6 +2159,13 @@ function checkToLegacyPolicy(policy, id, v) {
       return offOr("packageCheck", () => {
         obj("packageCheck").onMalicious = v === "review" ? "review" : "block";
       });
+    case "behavior.untrusted-content":
+      if (v !== "off" && v !== "log" && v !== "review") return false;
+      return offOr("untrustedContent", () => {
+        const uc = obj("untrustedContent");
+        if (v === "log") uc.afterExposure = "log-only";
+        else if (uc.afterExposure !== "ask-every-time") uc.afterExposure = "ask-once";
+      });
     default:
       return false;
   }
@@ -2084,6 +2179,79 @@ function configurableValues(id) {
   if (def.pack || MAP_GOVERNED.has(id)) return def.values;
   return KNOB_GOVERNED[id] ?? [];
 }
+function normalizeHost(raw) {
+  let h = raw.trim().toLowerCase();
+  if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
+  if (!h || h === "localhost") return null;
+  if (/^[0-9a-f:]+$/.test(h) && h.includes(":")) return h;
+  if (!h.includes(".") || !/^[\p{L}\p{N}.-]+$/u.test(h)) return null;
+  return h;
+}
+function hostOfUrl(value) {
+  const v = value.replace(/[.,;:!?)\]}>'"`]+$/, "");
+  try {
+    const u = new URL(v.toLowerCase().startsWith("www.") ? `http://${v}` : v);
+    return normalizeHost(u.hostname);
+  } catch {
+    return null;
+  }
+}
+function addIbans(text, out) {
+  for (const m of text.toUpperCase().matchAll(IBAN_RE)) {
+    const compact = m[0].replace(/[ -]/g, "");
+    if (validateIban(compact)) out.add(`iban:${compact}`);
+    else if (/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(compact)) out.add(`account:${compact}`);
+    if (out.size >= MAX_DESTINATIONS) return;
+  }
+}
+function addEmails(text, out) {
+  for (const m of text.matchAll(EMAIL_RE)) {
+    out.add(`email:${m[0].toLowerCase()}`);
+    if (out.size >= MAX_DESTINATIONS) return;
+  }
+}
+function addUrlHosts(text, out) {
+  for (const m of text.matchAll(URL_RE)) {
+    const h = hostOfUrl(m[0]);
+    if (h) out.add(`host:${h}`);
+    if (out.size >= MAX_DESTINATIONS) return;
+  }
+}
+function extractArgDestinations(args) {
+  const out = /* @__PURE__ */ new Set();
+  try {
+    walk(args, void 0, out, 0);
+  } catch {
+  }
+  return [...out];
+}
+function walk(value, key, out, depth) {
+  if (out.size >= MAX_DESTINATIONS || depth > 12) return;
+  if (typeof value === "string") {
+    const s = value.length > MAX_SCAN_CHARS ? value.slice(0, MAX_SCAN_CHARS) : value;
+    if (s.includes("@")) addEmails(s, out);
+    addUrlHosts(s, out);
+    addIbans(s, out);
+    if (key && RECIPIENT_KEYS.has(key.toLowerCase()) && !/[\s@]/.test(s)) {
+      const h = normalizeHost(
+        s.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/^\/\//, "").split(/[/?#]/)[0].replace(/:\d+$/, "")
+      );
+      if (h && (h.includes(":") || /\.\p{L}{2,}$/u.test(h))) out.add(`host:${h}`);
+      const acct = s.replace(/[ .-]/g, "").toUpperCase();
+      if (/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(acct) && !validateIban(acct))
+        out.add(`account:${acct}`);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const v of value) walk(v, key, out, depth + 1);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const [k, v] of Object.entries(value))
+      walk(v, k, out, depth + 1);
+  }
+}
 function stripTerminalEscapes(s) {
   return s.replace(TERMINAL_ESCAPE_RE, "");
 }
@@ -2153,8 +2321,8 @@ function matchCanaryArgs(args, values) {
   if (values.length === 0) return null;
   const needles = prepare(values);
   if (needles.length === 0) return null;
-  const walk = (v, depth, fieldPath) => {
-    if (depth > MAX_DEPTH3) return null;
+  const walk2 = (v, depth, fieldPath) => {
+    if (depth > MAX_DEPTH4) return null;
     if (typeof v === "string") {
       const hit = matchPrepared(v, needles);
       if (hit) return { id: hit.v.id, view: hit.view, fieldPath, retired: Boolean(hit.v.retired) };
@@ -2162,31 +2330,31 @@ function matchCanaryArgs(args, values) {
         const trimmed = v.trim();
         if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
           try {
-            return walk(JSON.parse(v), depth + 1, fieldPath);
+            return walk2(JSON.parse(v), depth + 1, fieldPath);
           } catch {
           }
         }
       }
       return null;
     }
-    if (typeof v === "number" && Number.isFinite(v)) return walk(String(v), depth, fieldPath);
+    if (typeof v === "number" && Number.isFinite(v)) return walk2(String(v), depth, fieldPath);
     if (Array.isArray(v)) {
       for (let i = 0; i < v.length; i++) {
-        const h = walk(v[i], depth + 1, `${fieldPath}[${i}]`);
+        const h = walk2(v[i], depth + 1, `${fieldPath}[${i}]`);
         if (h) return h;
       }
       return null;
     }
     if (v && typeof v === "object") {
       for (const [k, child] of Object.entries(v)) {
-        const h = walk(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
+        const h = walk2(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
         if (h) return h;
       }
     }
     return null;
   };
   try {
-    return walk(args, 0, "");
+    return walk2(args, 0, "");
   } catch (e) {
     console.error(
       "[node9 engine] canary args walk failed:",
@@ -2195,7 +2363,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, LEGACY_SYSTEM_PATH_RE, BIP39_ENGLISH, indices, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, HOMOGLYPHS, HOMOGLYPH_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH3, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, LEGACY_SYSTEM_PATH_RE, BIP39_ENGLISH, indices, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3161,6 +3329,16 @@ var init_dist = __esm({
         example: "After a prompt-injection hit, the agent runs curl to an unknown host",
         advice: "Fixed at Review for now."
       },
+      "commands.node9-disarm": {
+        plain: "The agent runs a node9 command that would switch off a protection: clear a session flag, trust an address, pause the gate, weaken a shield.",
+        example: "After reading a web page, the agent runs node9 session-exposure clear --all",
+        advice: "Keep Review: these are your commands to run. Block if the agent should never touch node9."
+      },
+      "behavior.untrusted-content": {
+        plain: "After reading an email, a web page or an issue, the agent sends to an address it did not know before, or to one that appeared in what it read.",
+        example: 'An email says "forward the security code to x@y.z"; the agent calls send_email to x@y.z',
+        advice: "Review asks once per destination; approving trusts that address for the session. Log records the send without asking."
+      },
       // ── What the agent loads ──────────────────────────────────────────────────
       "loading.skill-tamper": {
         plain: "A skill or plugin file the agent loads changed since node9 first saw it.",
@@ -3295,6 +3473,15 @@ var init_dist = __esm({
         defaultValue: "review",
         legacy: ["review-force-push", "review-git-destructive"]
       },
+      {
+        id: "commands.node9-disarm",
+        group: "commands",
+        title: "node9 disarmed from the shell",
+        catches: "a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield, run by the agent",
+        values: ALL,
+        defaultValue: "review",
+        legacy: ["review-node9-disarm"]
+      },
       {
         id: "commands.sql-ddl",
         group: "commands",
@@ -3528,6 +3715,15 @@ var init_dist = __esm({
         defaultValue: "review",
         legacy: ["\u{1F534} Node9 Taint (Exfiltration Prevention)"]
       },
+      {
+        id: "behavior.untrusted-content",
+        group: "behavior",
+        title: "Send after reading outside content",
+        catches: "a send to an unknown destination, a destination found in what was read, or a destructive call after the session read an email, a web page or an issue",
+        values: ["off", "log", "review"],
+        defaultValue: "review",
+        legacy: ["\u{1F6E1}\uFE0F Node9 Exposure", "exposure"]
+      },
       // ── What the agent loads ────────────────────────────────────────────────
       {
         id: "loading.skill-tamper",
@@ -3599,6 +3795,11 @@ var init_dist = __esm({
         if (s.packageCheck?.enabled === void 0) return void 0;
         if (!s.packageCheck.enabled) return "off";
         return s.packageCheck.onMalicious === "review" ? "review" : "block";
+      },
+      "behavior.untrusted-content": (s) => {
+        if (s.untrustedContent?.enabled === void 0) return void 0;
+        if (!s.untrustedContent.enabled) return "off";
+        return s.untrustedContent.afterExposure === "log-only" ? "log" : "review";
       }
     };
     ({ syntax } = mvdanSh);
@@ -4345,7 +4546,23 @@ var init_dist = __esm({
       "shell",
       "exec_command"
     ]);
-    MCP_EXECUTORS = /* @__PURE__ */ new Set([...BASH_TOOL_NAMES, "exec", "run_command", "terminal"]);
+    MCP_EXECUTORS = /* @__PURE__ */ new Set([
+      ...BASH_TOOL_NAMES,
+      "exec",
+      "run_command",
+      "terminal",
+      "execute_command",
+      "execute_shell",
+      "execute_shell_command",
+      "shell_execute",
+      "run_shell",
+      "run_terminal_command",
+      "start_process"
+    ]);
+    BUILTIN_FIELDS = ["command", "cmd", "script"];
+    ARGV_FIELDS = ["args", "argv"];
+    BARE_WORD = /^[A-Za-z0-9_./+:@%,-]+$/;
+    MAX_ARGV_CHARACTERS = 262144;
     ({ syntax: syntax2 } = mvdanSh2);
     WRITES = new Set([">x", ">>x", ">|x", "&>x", "&>>x", "<>x"].map(opOf));
     READS = new Set(["<x", "<>x"].map(opOf));
@@ -6408,6 +6625,98 @@ zero
 zone
 zoo`.split("\n");
     indices = new Map(BIP39_ENGLISH.map((word, i) => [word, i]));
+    IBAN_LENGTH = {
+      AD: 24,
+      AE: 23,
+      AL: 28,
+      AT: 20,
+      AZ: 28,
+      BA: 20,
+      BE: 16,
+      BG: 22,
+      BH: 22,
+      BI: 27,
+      BR: 29,
+      BY: 28,
+      CH: 21,
+      CR: 22,
+      CY: 28,
+      CZ: 24,
+      DE: 22,
+      DJ: 27,
+      DK: 18,
+      DO: 28,
+      EE: 20,
+      EG: 29,
+      ES: 24,
+      FI: 18,
+      FK: 18,
+      FO: 18,
+      FR: 27,
+      GB: 22,
+      GE: 22,
+      GI: 23,
+      GL: 18,
+      GR: 27,
+      GT: 28,
+      HN: 28,
+      HR: 21,
+      HU: 28,
+      IE: 22,
+      IL: 23,
+      IQ: 23,
+      IS: 26,
+      IT: 27,
+      JO: 30,
+      KW: 30,
+      KZ: 20,
+      LB: 28,
+      LC: 32,
+      LI: 21,
+      LT: 20,
+      LU: 20,
+      LV: 21,
+      LY: 25,
+      MC: 27,
+      MD: 24,
+      ME: 22,
+      MK: 19,
+      MN: 20,
+      MR: 27,
+      MT: 31,
+      MU: 30,
+      NI: 28,
+      NL: 18,
+      NO: 15,
+      OM: 23,
+      PK: 24,
+      PL: 28,
+      PS: 29,
+      PT: 25,
+      QA: 29,
+      RO: 24,
+      RS: 22,
+      RU: 33,
+      SA: 24,
+      SC: 31,
+      SD: 18,
+      SE: 24,
+      SI: 19,
+      SK: 24,
+      SM: 27,
+      SN: 28,
+      SO: 23,
+      ST: 25,
+      SV: 28,
+      TL: 23,
+      TN: 24,
+      TR: 26,
+      UA: 29,
+      VA: 22,
+      VG: 24,
+      XK: 20,
+      YE: 30
+    };
     B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
     B58_INDEX = Object.fromEntries(
       [...B58].map((c, i) => [c, i])
@@ -6422,6 +6731,8 @@ zoo`.split("\n");
     );
     CASK_TWO_ZERO_SUFFIX = /* @__PURE__ */ new Set([..."AEIMQUYcgkosw048"]);
     CASK_FOUR_ZERO_SUFFIX = /* @__PURE__ */ new Set([..."AQgw"]);
+    INVISIBLE_RE = /[­͏؜᠎​-‏‪-‮⁠-⁤-︀-️]|[\u{E0000}-\u{E007F}]/gu;
+    INVISIBLE_ONE = new RegExp(`^(?:${INVISIBLE_RE.source.split("|")[0]})$`, "u");
     HOMOGLYPHS = {
       // Cyrillic lowercase
       \u0430: "a",
@@ -7116,7 +7427,25 @@ zoo`.split("\n");
         name: "onlineFallback",
         legacy: ["packageCheck", "onlineFallback"]
       },
-      { checkId: "loading.malicious-package", name: "allow", legacy: ["packageCheck", "allow"] }
+      { checkId: "loading.malicious-package", name: "allow", legacy: ["packageCheck", "allow"] },
+      // fw#318: the verdict carries off / log (log-only) / review; the tuning
+      // carries whether a review asks once per destination or every time, the
+      // frame around outside content, and the organisation's own domains.
+      {
+        checkId: "behavior.untrusted-content",
+        name: "afterExposure",
+        legacy: ["untrustedContent", "afterExposure"]
+      },
+      {
+        checkId: "behavior.untrusted-content",
+        name: "spotlight",
+        legacy: ["untrustedContent", "spotlight"]
+      },
+      {
+        checkId: "behavior.untrusted-content",
+        name: "orgDomains",
+        legacy: ["untrustedContent", "orgDomains"]
+      }
     ];
     MAP_GOVERNED = /* @__PURE__ */ new Set([
       "files.shell-startup",
@@ -7133,6 +7462,7 @@ zoo`.split("\n");
       "commands.temp-binary",
       "commands.disk-destroy",
       "commands.dangerous-word",
+      "commands.node9-disarm",
       "data.pipe-chain"
     ]);
     KNOB_GOVERNED = {
@@ -7144,16 +7474,64 @@ zoo`.split("\n");
       "behavior.loops": ["off", "block"],
       "behavior.prompt-injection": ["off", "log"],
       "loading.skill-tamper": ["off", "log", "block"],
-      "loading.malicious-package": ["off", "review", "block"]
+      "loading.malicious-package": ["off", "review", "block"],
+      "behavior.untrusted-content": ["off", "log", "review"]
     };
     CONFIGURABLE_CHECK_IDS = CHECKS.filter(
       (c) => configurableValues(c.id).length > 0
     ).map((c) => c.id);
     SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
+    MAX_DESTINATIONS = 200;
+    MAX_SCAN_CHARS = 1e5;
+    EMAIL_RE = /[\p{L}\p{N}._%+-]+@[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?(?:\.[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?)*\.\p{L}{2,}/gu;
+    URL_RE = /\b(?:[a-z][a-z0-9+.-]*:\/\/|www\.)[^\s<>"'`){}]+/gi;
+    IBAN_RE = /\b[A-Z]{2}\d{2}(?:[ -]?[A-Z0-9]{4}){2,7}(?:[ -]?[A-Z0-9]{1,4})?\b/g;
+    RECIPIENT_KEYS = /* @__PURE__ */ new Set([
+      "to",
+      "cc",
+      "bcc",
+      "recipient",
+      "recipients",
+      "email",
+      "participants",
+      "attendees",
+      "destination",
+      "iban",
+      "account",
+      // Where a request goes, when the value is a bare host or a scheme-less URL.
+      "url",
+      "uri",
+      "host",
+      "hostname",
+      "endpoint",
+      "server",
+      "domain",
+      "address",
+      "webhook",
+      "webhook_url",
+      "callback",
+      "callback_url",
+      "target"
+    ]);
+    ({ syntax: syntax4 } = mvdanSh4);
+    PUBLISH = {
+      npm: { verbs: /* @__PURE__ */ new Set(["publish"]), registry: "registry.npmjs.org", flag: ["--registry"] },
+      pnpm: { verbs: /* @__PURE__ */ new Set(["publish"]), registry: "registry.npmjs.org", flag: ["--registry"] },
+      yarn: {
+        verbs: /* @__PURE__ */ new Set(["publish", "npm"]),
+        registry: "registry.npmjs.org",
+        flag: ["--registry"]
+      },
+      twine: { verbs: /* @__PURE__ */ new Set(["upload"]), registry: "upload.pypi.org", flag: ["--repository-url"] },
+      cargo: { verbs: /* @__PURE__ */ new Set(["publish"]), registry: "crates.io", flag: ["--registry", "--index"] },
+      gem: { verbs: /* @__PURE__ */ new Set(["push"]), registry: "rubygems.org", flag: ["--host"] },
+      docker: { verbs: /* @__PURE__ */ new Set(["push"]), registry: "docker.io" }
+    };
+    OWN_HEADS = /* @__PURE__ */ new Set([...Object.keys(PUBLISH), "git", "gh"]);
     TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     CANARY_MIN_LENGTH = 16;
     MAX_TEXT = 1e5;
-    MAX_DEPTH3 = 6;
+    MAX_DEPTH4 = 6;
     MAX_JSON_PARSE = 1e4;
     URL_DEPTH = 4;
     B64_DEPTH = 3;
@@ -7483,18 +7861,18 @@ function statAndFirstLine(file) {
 }
 function listCodexSessionFiles(base = codexSessionsDir()) {
   const files = [];
-  const walk = (dir) => {
+  const walk2 = (dir) => {
     try {
       for (const entry of fs2.readdirSync(dir, { withFileTypes: true })) {
         const file = path3.join(dir, entry.name);
-        if (entry.isDirectory()) walk(file);
+        if (entry.isDirectory()) walk2(file);
         else if (entry.isFile() && entry.name.endsWith(".jsonl")) files.push(file);
       }
     } catch {
     }
   };
-  walk(base);
-  if (path3.basename(base) === "sessions") walk(path3.join(path3.dirname(base), "archived_sessions"));
+  walk2(base);
+  if (path3.basename(base) === "sessions") walk2(path3.join(path3.dirname(base), "archived_sessions"));
   const sessions = /* @__PURE__ */ new Map();
   for (const file of files.sort()) {
     try {
@@ -7817,6 +8195,26 @@ var init_daemon = __esm({
   }
 });
 
+// src/auth/trusted-recipients.ts
+function normalizeRecipient(raw) {
+  const v = raw.trim();
+  if (!v) return null;
+  if (/^(email|host|iban):/i.test(v)) {
+    const i = v.indexOf(":");
+    const kind = v.slice(0, i).toLowerCase();
+    const inner = normalizeRecipient(v.slice(i + 1));
+    return inner && inner.startsWith(`${kind}:`) ? inner : null;
+  }
+  const found = extractArgDestinations({ to: v });
+  return found.length === 1 ? found[0] : null;
+}
+var init_trusted_recipients = __esm({
+  "src/auth/trusted-recipients.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
 // src/config-schema.ts
 import { z } from "zod";
 function formatIssues(issues) {
@@ -8071,6 +8469,13 @@ var init_config_schema = __esm({
           onlineFallback: z.boolean().optional(),
           allow: z.array(z.string()).optional()
         }).optional(),
+        untrustedContent: z.object({
+          enabled: z.boolean().optional(),
+          spotlight: z.boolean().optional(),
+          afterExposure: z.enum(["ask-once", "ask-every-time", "log-only"]).optional(),
+          orgDomains: z.array(z.string()).optional(),
+          roles: z.record(z.string(), z.record(z.string(), z.enum(["source", "action", "read"]))).optional()
+        }).optional(),
         skillPinning: z.object({
           enabled: z.boolean().optional(),
           mode: z.enum(["warn", "block"]).optional(),
@@ -8363,7 +8768,7 @@ var init_build = __esm({
 });
 
 // src/auth/trusted-hosts.ts
-function normalizeHost(raw) {
+function normalizeHost2(raw) {
   return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
 }
 var init_trusted_hosts = __esm({
@@ -8460,6 +8865,10 @@ function v2ToLegacy(raw, options = {}) {
     const [id] = pair.split(".", 1);
     if (CHECK_BY_ID.has(id)) warnings.push(`tuning.${pair}: no such setting`);
   }
+  if (stated["behavior.untrusted-content"] === "log") {
+    const uc = policy.untrustedContent;
+    if (uc) uc.afterExposure = "log-only";
+  }
   const legacy = { version: "1.0" };
   if (Object.keys(settings).length) legacy.settings = settings;
   if (Object.keys(policy).length) legacy.policy = policy;
@@ -8680,6 +9089,7 @@ function getConfig(cwd) {
     dangerousWords: [...DEFAULT_CONFIG.policy.dangerousWords],
     ignoredTools: [...DEFAULT_CONFIG.policy.ignoredTools],
     toolInspection: { ...DEFAULT_CONFIG.policy.toolInspection },
+    projectToolInspection: {},
     // Shipped rules carry `builtin`: the catalog's per-check value governs
     // them and only them (a user rule that reuses a name keeps its verdict).
     smartRules: DEFAULT_CONFIG.policy.smartRules.map((r) => ({ ...r, builtin: true })),
@@ -8703,6 +9113,12 @@ function getConfig(cwd) {
       ...DEFAULT_CONFIG.policy.skillPinning,
       roots: [...DEFAULT_CONFIG.policy.skillPinning.roots]
     },
+    untrustedContent: {
+      ...DEFAULT_CONFIG.policy.untrustedContent,
+      orgDomains: [...DEFAULT_CONFIG.policy.untrustedContent.orgDomains],
+      roles: {},
+      trustedRecipients: []
+    },
     // Left empty on purpose: the local file is read fresh at policy-eval time
     // (getCachedHosts via isTrustedHost), NOT snapshotted into the frozen config
     // here. A managed list fills this below and flips trustedHostsManaged.
@@ -8747,8 +9163,14 @@ function getConfig(cwd) {
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
     if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
-    if (p.toolInspection)
-      mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
+    if (p.toolInspection) {
+      if (isProject)
+        mergedPolicy.projectToolInspection = {
+          ...mergedPolicy.projectToolInspection,
+          ...p.toolInspection
+        };
+      else mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
+    }
     if (p.smartRules) {
       const defaultBlocks = mergedPolicy.smartRules.filter((r) => r.verdict === "block");
       const defaultNonBlocks = mergedPolicy.smartRules.filter((r) => r.verdict !== "block");
@@ -8862,6 +9284,9 @@ function getConfig(cwd) {
         }
       }
     }
+    if (p.untrustedContent && typeof p.untrustedContent === "object") {
+      applyUntrustedContent(mergedPolicy.untrustedContent, p.untrustedContent, false, isProject);
+    }
     const envs = source.environments || {};
     for (const [envName, envConfig] of Object.entries(envs)) {
       if (envConfig && typeof envConfig === "object") {
@@ -9061,6 +9486,9 @@ function getConfig(cwd) {
             allow: Array.isArray(pc.allow) ? pc.allow.filter((a) => typeof a === "string" && a.length > 0) : cur.allow
           };
         }
+        if (mc.untrustedContent && typeof mc.untrustedContent === "object") {
+          applyUntrustedContent(mergedPolicy.untrustedContent, mc.untrustedContent, true);
+        }
         if (mc.loopDetection && typeof mc.loopDetection === "object") {
           const l = mc.loopDetection;
           const cur = mergedPolicy.loopDetection;
@@ -9092,7 +9520,7 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.trustedHosts)) {
           mergedPolicy.trustedHostsManaged = true;
-          mergedPolicy.trustedHosts = mc.trustedHosts.filter((h) => typeof h === "string").map((h) => normalizeHost(h));
+          mergedPolicy.trustedHosts = mc.trustedHosts.filter((h) => typeof h === "string").map((h) => normalizeHost2(h));
         }
         if (mc.appPermissions && typeof mc.appPermissions === "object" && !Array.isArray(mc.appPermissions)) {
           const coerced = {};
@@ -9110,7 +9538,7 @@ function getConfig(cwd) {
           );
         }
         const on = (v) => !!v && typeof v === "object" && v.enabled === true;
-        cloudMandatesEnforcement = cloudMandatesAppPerm || Array.isArray(mc.jailPaths) && mc.jailPaths.some((jp) => typeof jp?.path === "string" && jp.path.trim() !== "") || on(mc.egress) || on(mc.dlp) || on(mc.injectionScan) || on(mc.skillPinning) || on(mc.loopDetection) || !!mc.commandChecks && typeof mc.commandChecks === "object" && Object.values(mc.commandChecks).some(
+        cloudMandatesEnforcement = cloudMandatesAppPerm || Array.isArray(mc.jailPaths) && mc.jailPaths.some((jp) => typeof jp?.path === "string" && jp.path.trim() !== "") || on(mc.egress) || on(mc.dlp) || on(mc.injectionScan) || on(mc.untrustedContent) || on(mc.skillPinning) || on(mc.loopDetection) || !!mc.commandChecks && typeof mc.commandChecks === "object" && Object.values(mc.commandChecks).some(
           (v) => typeof v === "string" && v !== "off"
         );
       }
@@ -9346,10 +9774,49 @@ ${error.replace("Invalid config:\n", "")}
   }
   return sanitized;
 }
+function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false) {
+  if (!raw || typeof raw !== "object") return;
+  const uc = raw;
+  const AFTER_RANK = { "log-only": 0, "ask-once": 1, "ask-every-time": 2 };
+  if (typeof uc.enabled === "boolean" && !(isProject && uc.enabled === false))
+    cur.enabled = uc.enabled;
+  if (typeof uc.spotlight === "boolean" && !(isProject && uc.spotlight === false))
+    cur.spotlight = uc.spotlight;
+  if ((uc.afterExposure === "ask-once" || uc.afterExposure === "ask-every-time" || uc.afterExposure === "log-only") && !(isProject && AFTER_RANK[uc.afterExposure] < AFTER_RANK[cur.afterExposure]))
+    cur.afterExposure = uc.afterExposure;
+  if (Array.isArray(uc.orgDomains) && !isProject) {
+    const domains = uc.orgDomains.filter((d) => typeof d === "string").map((d) => d.trim().toLowerCase().replace(/^@/, "")).filter((d) => /^[a-z0-9.-]+\.[a-z]{2,}$/.test(d));
+    if (replaceLists) cur.orgDomains = domains;
+    else for (const d of domains) if (!cur.orgDomains.includes(d)) cur.orgDomains.push(d);
+  }
+  if (replaceLists && Array.isArray(uc.trustedRecipients)) {
+    cur.trustedRecipients = [
+      ...new Set(
+        uc.trustedRecipients.filter((v) => typeof v === "string").map((v) => normalizeRecipient(v)).filter((v) => v !== null)
+      )
+    ].slice(0, 200);
+  }
+  if (uc.roles && typeof uc.roles === "object" && !Array.isArray(uc.roles)) {
+    const next = replaceLists ? {} : cur.roles;
+    for (const [server, tools] of Object.entries(uc.roles)) {
+      if (!tools || typeof tools !== "object" || Array.isArray(tools)) continue;
+      const m = { ...next[server] ?? {} };
+      for (const [tool, role] of Object.entries(tools)) {
+        if (role === "source" || role === "action" || role === "read") {
+          if (isProject && role !== "action") continue;
+          m[tool] = role;
+        }
+      }
+      if (Object.keys(m).length > 0) next[server] = m;
+    }
+    cur.roles = next;
+  }
+}
 var DANGEROUS_WORDS, RUNTIME_ONLY_CONFIG_KEYS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, rejectedApiUrlsSeen, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt, v2ChecksByPath, KNOB_TO_CHECK;
 var init_config = __esm({
   "src/config/index.ts"() {
     "use strict";
+    init_trusted_recipients();
     init_config_schema();
     init_shields();
     init_managed();
@@ -9475,6 +9942,29 @@ var init_config = __esm({
             reason: "SQL DDL destructive statement inside a shell command",
             description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
           },
+          // ── node9 itself ──────────────────────────────────────────────────────
+          // The agent runs as the user, so a `node9 ...` command from Bash can
+          // clear the session's taint or exposure, trust a destination or pause
+          // the gate. Those are the user's own commands; from the agent they are
+          // a review (fw#318 review finding 1).
+          {
+            name: "review-node9-disarm",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // Single spaces on purpose: a nested `\\s+` inside the alternation
+                // fails the engine's ReDoS check and the rule would be dropped.
+                value: "(^|&&|\\|\\||;)\\s*(npx )?node9 (session-(exposure|taint) clear|trust (add|recipient add)|pause|shield (disable|set)|egress allow|approver set)\\b",
+                flags: "i"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "node9 self-weakening command run by the agent",
+            description: "The AI wants to run a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield. These are your commands to run, not the agent's."
+          },
           // ── Git safety ────────────────────────────────────────────────────────
           {
             name: "review-force-push",
@@ -9576,6 +10066,14 @@ var init_config = __esm({
           allow: []
         },
         skillPinning: { enabled: false, mode: "warn", roots: [] },
+        untrustedContent: {
+          enabled: true,
+          spotlight: true,
+          afterExposure: "ask-once",
+          orgDomains: [],
+          roles: {},
+          trustedRecipients: []
+        },
         trustedHosts: [],
         trustedHostsManaged: false,
         appPermissions: {},
@@ -9692,7 +10190,7 @@ import * as fs7 from "fs";
 import * as path8 from "path";
 function listSessionFiles(dir, maxDepth = 6) {
   const out = [];
-  const walk = (d, rel, depth) => {
+  const walk2 = (d, rel, depth) => {
     if (depth > maxDepth) return;
     let entries;
     try {
@@ -9702,11 +10200,11 @@ function listSessionFiles(dir, maxDepth = 6) {
     }
     for (const e of entries) {
       const childRel = rel ? path8.join(rel, e.name) : e.name;
-      if (e.isDirectory()) walk(path8.join(d, e.name), childRel, depth + 1);
+      if (e.isDirectory()) walk2(path8.join(d, e.name), childRel, depth + 1);
       else if (e.name.endsWith(".jsonl")) out.push(childRel);
     }
   };
-  walk(dir, "", 0);
+  walk2(dir, "", 0);
   return out;
 }
 function sessionIdOf(relPath) {
@@ -10304,7 +10802,9 @@ function dimensionOfBlock(checkedBy, ruleName) {
   if (checkedBy.includes("egress")) return "network";
   if (ruleName.startsWith("ssrf:")) return "network";
   if (checkedBy.includes("pii") || checkedBy.includes("dlp")) return "data";
-  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection"))
+  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection") || // fw#318: a send held after the session read outside content, and the
+  // read rows themselves. Mirrors node9Firewall canon-taxonomy.ts.
+  ruleName.startsWith("exposure") || checkedBy.startsWith("exposure"))
     return "detection";
   if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "apps";
   if (ruleName.startsWith("shield:project-jail")) return "files";
@@ -10983,19 +11483,19 @@ function scrubDecoys(subject, values) {
     for (const v of values) if (v) out = out.split(v).join("[node9-decoy]");
     return out;
   };
-  const walk = (v, depth) => {
+  const walk2 = (v, depth) => {
     if (depth > 6) return v;
     if (typeof v === "string") return scrubText(v);
-    if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+    if (Array.isArray(v)) return v.map((x) => walk2(x, depth + 1));
     if (v && typeof v === "object") {
       const out = {};
       for (const [k, child] of Object.entries(v))
-        out[k] = walk(child, depth + 1);
+        out[k] = walk2(child, depth + 1);
       return out;
     }
     return v;
   };
-  return walk(subject, 0);
+  return walk2(subject, 0);
 }
 function pushFsOpAstFinding(command, toolName, input, timestamp2, projLabel, sessionId, agent, result, dedup) {
   const fsVerdict = analyzeFsOperation(command);