@node9/proxy 2.32.0 → 2.33.0

package/dist/dashboard.mjs

@@ -1662,32 +1662,102 @@ function evaluateSmartConditions(args, rule) {
 function isBashTool(tool) {
   return BASH_TOOL_NAMES.has(tool.toLowerCase());
 }
-function inspectionEntry(tool, inspection = {}) {
+function isShellEntry(value) {
+  return typeof value === "object" && value !== null && value.kind === "shell" && typeof value.field === "string" && Object.keys(value).length === 2;
+}
+function isInspectionLayers(input) {
+  const trusted = input.trusted;
+  return typeof trusted === "object" && trusted !== null && !isShellEntry(trusted);
+}
+function layersOf(input) {
+  return isInspectionLayers(input) ? { trusted: input.trusted, project: input.project ?? {} } : { trusted: input, project: {} };
+}
+function entryOf(tool, inspection) {
   const pattern = Object.keys(inspection).find((p) => matchesPattern(tool, p));
   return pattern === void 0 ? void 0 : inspection[pattern];
 }
+function executorName(tool) {
+  const name = tool.toLowerCase();
+  if (!name.startsWith("mcp__")) return name;
+  const at = name.lastIndexOf("__");
+  return at >= "mcp__".length ? name.slice(at + 2) : name;
+}
+function entryFields(entry) {
+  if (typeof entry === "object") return [entry.field];
+  return entry === "command" ? ["command"] : null;
+}
 function shellFields(tool, inspection) {
   if (isBashTool(tool)) return ["command"];
-  const entry = inspectionEntry(tool, inspection);
-  if (typeof entry === "object") return [entry.field];
-  if (entry !== void 0) return entry === "command" ? [entry] : null;
-  const name = tool.toLowerCase().replace(/^mcp__[a-z0-9_-]+?__/, "");
-  return MCP_EXECUTORS.has(name) ? ["command", "cmd", "script"] : null;
+  const { trusted, project } = layersOf(inspection);
+  const trustedEntry = entryOf(tool, trusted);
+  if (trustedEntry !== void 0) return entryFields(trustedEntry);
+  const builtin = MCP_EXECUTORS.has(executorName(tool)) ? BUILTIN_FIELDS : null;
+  const projectEntry = entryOf(tool, project);
+  if (projectEntry === void 0) return builtin;
+  const added = entryFields(projectEntry);
+  if (!builtin) return added;
+  if (!added) return builtin;
+  return [.../* @__PURE__ */ new Set([...builtin, ...added])];
 }
 function isShellShapedTool(tool, inspection = {}) {
   return shellFields(tool, inspection) !== null;
 }
+function shellWord(word) {
+  if (BARE_WORD.test(word)) return word;
+  return word === "" ? "''" : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function commandLine(args, fieldPath, value, native) {
+  const missing = { reason: "Shell command field is missing or is not a string" };
+  const unreadable = { reason: "Shell command arguments could not be read" };
+  if (typeof value !== "string" && (native || !Array.isArray(value))) return missing;
+  const dot = fieldPath.lastIndexOf(".");
+  const parent = dot === -1 ? args : getNestedValue(args, fieldPath.slice(0, dot));
+  const siblings = ARGV_FIELDS.map((key) => ({
+    key,
+    value: parent && typeof parent === "object" ? parent[key] : void 0
+  })).filter(({ value: value2 }) => value2 !== void 0 && value2 !== null);
+  let argv = siblings[0];
+  if (native) argv = siblings.find(({ value: v }) => isStringArray(v));
+  else if (siblings.length === 2 && JSON.stringify(siblings[0].value) !== JSON.stringify(siblings[1].value))
+    return { reason: "Shell command arguments disagree" };
+  let command;
+  let source = fieldPath;
+  if (Array.isArray(value)) {
+    if (argv || !value.length || !isStringArray(value)) return unreadable;
+    command = value.map(shellWord).join(" ");
+  } else if (!argv) {
+    return { command: value, fieldPath };
+  } else {
+    if (!isStringArray(argv.value)) return unreadable;
+    if (!argv.value.length) return { command: value, fieldPath };
+    command = `${value} ${argv.value.map(shellWord).join(" ")}`;
+    source = `${fieldPath}+${argv.key}`;
+  }
+  if (command.length > MAX_ARGV_CHARACTERS)
+    return { reason: "Shell command arguments exceed the inspectable size" };
+  return { command, fieldPath: source };
+}
 function resolveShellInput(tool, args, inspection = {}) {
   const fields = shellFields(tool, inspection);
   if (!fields) return { kind: "not-shell" };
   const values = fields.map((fieldPath) => ({ fieldPath, value: getNestedValue(args, fieldPath) })).filter(({ value }) => value !== void 0 && value !== null && value !== "");
-  if (!values.length || values.some(({ value }) => typeof value !== "string")) {
+  if (!values.length) {
     return { kind: "uninspectable", reason: "Shell command field is missing or is not a string" };
   }
-  if (new Set(values.map(({ value }) => value)).size !== 1) {
+  const native = isBashTool(tool);
+  const lines = values.map(({ fieldPath, value }) => commandLine(args, fieldPath, value, native));
+  const failed = lines.find((line) => "reason" in line);
+  if (failed) return { kind: "uninspectable", reason: failed.reason };
+  const commands = lines.filter(
+    (line) => "command" in line
+  );
+  if (new Set(commands.map(({ command }) => command)).size !== 1) {
     return { kind: "uninspectable", reason: "Multiple shell command fields disagree" };
   }
-  return { kind: "shell", command: values[0].value, fieldPath: values[0].fieldPath };
+  return { kind: "shell", ...commands[0] };
 }
 function shellRuleArgs(tool, args, ruleTool, inspection = {}) {
   if (!ruleTool || !matchesPattern("bash", ruleTool) || matchesPattern(tool, ruleTool)) return args;
@@ -1697,6 +1767,22 @@ function shellRuleArgs(tool, args, ruleTool, inspection = {}) {
 function opOf(sample) {
   return parseShared(sample).Stmts[0].Redirs[0].Op;
 }
+function validateIban(raw) {
+  const s = raw.replace(/[ -]/g, "").toUpperCase();
+  if (!/^[A-Z]{2}\d{2}/.test(s)) return false;
+  const want = IBAN_LENGTH[s.slice(0, 2)];
+  if (want === void 0 || s.length < want) return false;
+  const iban = s.slice(0, want);
+  if (!/^[A-Z0-9]+$/.test(iban)) return false;
+  const rearranged = iban.slice(4) + iban.slice(0, 4);
+  let mod = 0;
+  for (const ch of rearranged) {
+    const code = ch.charCodeAt(0);
+    const digits = code >= 65 ? String(code - 55) : ch;
+    for (const d of digits) mod = (mod * 10 + (d.charCodeAt(0) - 48)) % 97;
+  }
+  return mod === 1;
+}
 function validateBase58Check(s) {
   if (!s) return null;
   let n = 0n;
@@ -2093,6 +2179,79 @@ function configurableValues(id) {
   if (def.pack || MAP_GOVERNED.has(id)) return def.values;
   return KNOB_GOVERNED[id] ?? [];
 }
+function normalizeHost(raw) {
+  let h = raw.trim().toLowerCase();
+  if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
+  if (!h || h === "localhost") return null;
+  if (/^[0-9a-f:]+$/.test(h) && h.includes(":")) return h;
+  if (!h.includes(".") || !/^[\p{L}\p{N}.-]+$/u.test(h)) return null;
+  return h;
+}
+function hostOfUrl(value) {
+  const v = value.replace(/[.,;:!?)\]}>'"`]+$/, "");
+  try {
+    const u = new URL(v.toLowerCase().startsWith("www.") ? `http://${v}` : v);
+    return normalizeHost(u.hostname);
+  } catch {
+    return null;
+  }
+}
+function addIbans(text, out) {
+  for (const m of text.toUpperCase().matchAll(IBAN_RE)) {
+    const compact = m[0].replace(/[ -]/g, "");
+    if (validateIban(compact)) out.add(`iban:${compact}`);
+    else if (/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(compact)) out.add(`account:${compact}`);
+    if (out.size >= MAX_DESTINATIONS) return;
+  }
+}
+function addEmails(text, out) {
+  for (const m of text.matchAll(EMAIL_RE)) {
+    out.add(`email:${m[0].toLowerCase()}`);
+    if (out.size >= MAX_DESTINATIONS) return;
+  }
+}
+function addUrlHosts(text, out) {
+  for (const m of text.matchAll(URL_RE)) {
+    const h = hostOfUrl(m[0]);
+    if (h) out.add(`host:${h}`);
+    if (out.size >= MAX_DESTINATIONS) return;
+  }
+}
+function extractArgDestinations(args) {
+  const out = /* @__PURE__ */ new Set();
+  try {
+    walk(args, void 0, out, 0);
+  } catch {
+  }
+  return [...out];
+}
+function walk(value, key, out, depth) {
+  if (out.size >= MAX_DESTINATIONS || depth > 12) return;
+  if (typeof value === "string") {
+    const s = value.length > MAX_SCAN_CHARS ? value.slice(0, MAX_SCAN_CHARS) : value;
+    if (s.includes("@")) addEmails(s, out);
+    addUrlHosts(s, out);
+    addIbans(s, out);
+    if (key && RECIPIENT_KEYS.has(key.toLowerCase()) && !/[\s@]/.test(s)) {
+      const h = normalizeHost(
+        s.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/^\/\//, "").split(/[/?#]/)[0].replace(/:\d+$/, "")
+      );
+      if (h && (h.includes(":") || /\.\p{L}{2,}$/u.test(h))) out.add(`host:${h}`);
+      const acct = s.replace(/[ .-]/g, "").toUpperCase();
+      if (/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(acct) && !validateIban(acct))
+        out.add(`account:${acct}`);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const v of value) walk(v, key, out, depth + 1);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const [k, v] of Object.entries(value))
+      walk(v, k, out, depth + 1);
+  }
+}
 function stripTerminalEscapes(s) {
   return s.replace(TERMINAL_ESCAPE_RE, "");
 }
@@ -2204,7 +2363,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, LEGACY_SYSTEM_PATH_RE, BIP39_ENGLISH, indices, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, HOMOGLYPHS, HOMOGLYPH_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, LEGACY_SYSTEM_PATH_RE, BIP39_ENGLISH, indices, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4387,7 +4546,23 @@ var init_dist = __esm({
       "shell",
       "exec_command"
     ]);
-    MCP_EXECUTORS = /* @__PURE__ */ new Set([...BASH_TOOL_NAMES, "exec", "run_command", "terminal"]);
+    MCP_EXECUTORS = /* @__PURE__ */ new Set([
+      ...BASH_TOOL_NAMES,
+      "exec",
+      "run_command",
+      "terminal",
+      "execute_command",
+      "execute_shell",
+      "execute_shell_command",
+      "shell_execute",
+      "run_shell",
+      "run_terminal_command",
+      "start_process"
+    ]);
+    BUILTIN_FIELDS = ["command", "cmd", "script"];
+    ARGV_FIELDS = ["args", "argv"];
+    BARE_WORD = /^[A-Za-z0-9_./+:@%,-]+$/;
+    MAX_ARGV_CHARACTERS = 262144;
     ({ syntax: syntax2 } = mvdanSh2);
     WRITES = new Set([">x", ">>x", ">|x", "&>x", "&>>x", "<>x"].map(opOf));
     READS = new Set(["<x", "<>x"].map(opOf));
@@ -6450,6 +6625,98 @@ zero
 zone
 zoo`.split("\n");
     indices = new Map(BIP39_ENGLISH.map((word, i) => [word, i]));
+    IBAN_LENGTH = {
+      AD: 24,
+      AE: 23,
+      AL: 28,
+      AT: 20,
+      AZ: 28,
+      BA: 20,
+      BE: 16,
+      BG: 22,
+      BH: 22,
+      BI: 27,
+      BR: 29,
+      BY: 28,
+      CH: 21,
+      CR: 22,
+      CY: 28,
+      CZ: 24,
+      DE: 22,
+      DJ: 27,
+      DK: 18,
+      DO: 28,
+      EE: 20,
+      EG: 29,
+      ES: 24,
+      FI: 18,
+      FK: 18,
+      FO: 18,
+      FR: 27,
+      GB: 22,
+      GE: 22,
+      GI: 23,
+      GL: 18,
+      GR: 27,
+      GT: 28,
+      HN: 28,
+      HR: 21,
+      HU: 28,
+      IE: 22,
+      IL: 23,
+      IQ: 23,
+      IS: 26,
+      IT: 27,
+      JO: 30,
+      KW: 30,
+      KZ: 20,
+      LB: 28,
+      LC: 32,
+      LI: 21,
+      LT: 20,
+      LU: 20,
+      LV: 21,
+      LY: 25,
+      MC: 27,
+      MD: 24,
+      ME: 22,
+      MK: 19,
+      MN: 20,
+      MR: 27,
+      MT: 31,
+      MU: 30,
+      NI: 28,
+      NL: 18,
+      NO: 15,
+      OM: 23,
+      PK: 24,
+      PL: 28,
+      PS: 29,
+      PT: 25,
+      QA: 29,
+      RO: 24,
+      RS: 22,
+      RU: 33,
+      SA: 24,
+      SC: 31,
+      SD: 18,
+      SE: 24,
+      SI: 19,
+      SK: 24,
+      SM: 27,
+      SN: 28,
+      SO: 23,
+      ST: 25,
+      SV: 28,
+      TL: 23,
+      TN: 24,
+      TR: 26,
+      UA: 29,
+      VA: 22,
+      VG: 24,
+      XK: 20,
+      YE: 30
+    };
     B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
     B58_INDEX = Object.fromEntries(
       [...B58].map((c, i) => [c, i])
@@ -6464,6 +6731,8 @@ zoo`.split("\n");
     );
     CASK_TWO_ZERO_SUFFIX = /* @__PURE__ */ new Set([..."AEIMQUYcgkosw048"]);
     CASK_FOUR_ZERO_SUFFIX = /* @__PURE__ */ new Set([..."AQgw"]);
+    INVISIBLE_RE = /[­͏؜᠎​-‏‪-‮⁠-⁤-︀-️]|[\u{E0000}-\u{E007F}]/gu;
+    INVISIBLE_ONE = new RegExp(`^(?:${INVISIBLE_RE.source.split("|")[0]})$`, "u");
     HOMOGLYPHS = {
       // Cyrillic lowercase
       \u0430: "a",
@@ -7212,6 +7481,38 @@ zoo`.split("\n");
       (c) => configurableValues(c.id).length > 0
     ).map((c) => c.id);
     SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
+    MAX_DESTINATIONS = 200;
+    MAX_SCAN_CHARS = 1e5;
+    EMAIL_RE = /[\p{L}\p{N}._%+-]+@[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?(?:\.[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?)*\.\p{L}{2,}/gu;
+    URL_RE = /\b(?:[a-z][a-z0-9+.-]*:\/\/|www\.)[^\s<>"'`){}]+/gi;
+    IBAN_RE = /\b[A-Z]{2}\d{2}(?:[ -]?[A-Z0-9]{4}){2,7}(?:[ -]?[A-Z0-9]{1,4})?\b/g;
+    RECIPIENT_KEYS = /* @__PURE__ */ new Set([
+      "to",
+      "cc",
+      "bcc",
+      "recipient",
+      "recipients",
+      "email",
+      "participants",
+      "attendees",
+      "destination",
+      "iban",
+      "account",
+      // Where a request goes, when the value is a bare host or a scheme-less URL.
+      "url",
+      "uri",
+      "host",
+      "hostname",
+      "endpoint",
+      "server",
+      "domain",
+      "address",
+      "webhook",
+      "webhook_url",
+      "callback",
+      "callback_url",
+      "target"
+    ]);
     ({ syntax: syntax4 } = mvdanSh4);
     PUBLISH = {
       npm: { verbs: /* @__PURE__ */ new Set(["publish"]), registry: "registry.npmjs.org", flag: ["--registry"] },
@@ -7560,18 +7861,18 @@ function statAndFirstLine(file) {
 }
 function listCodexSessionFiles(base = codexSessionsDir()) {
   const files = [];
-  const walk = (dir) => {
+  const walk2 = (dir) => {
     try {
       for (const entry of fs2.readdirSync(dir, { withFileTypes: true })) {
         const file = path3.join(dir, entry.name);
-        if (entry.isDirectory()) walk(file);
+        if (entry.isDirectory()) walk2(file);
         else if (entry.isFile() && entry.name.endsWith(".jsonl")) files.push(file);
       }
     } catch {
     }
   };
-  walk(base);
-  if (path3.basename(base) === "sessions") walk(path3.join(path3.dirname(base), "archived_sessions"));
+  walk2(base);
+  if (path3.basename(base) === "sessions") walk2(path3.join(path3.dirname(base), "archived_sessions"));
   const sessions = /* @__PURE__ */ new Map();
   for (const file of files.sort()) {
     try {
@@ -7894,6 +8195,26 @@ var init_daemon = __esm({
   }
 });
 
+// src/auth/trusted-recipients.ts
+function normalizeRecipient(raw) {
+  const v = raw.trim();
+  if (!v) return null;
+  if (/^(email|host|iban):/i.test(v)) {
+    const i = v.indexOf(":");
+    const kind = v.slice(0, i).toLowerCase();
+    const inner = normalizeRecipient(v.slice(i + 1));
+    return inner && inner.startsWith(`${kind}:`) ? inner : null;
+  }
+  const found = extractArgDestinations({ to: v });
+  return found.length === 1 ? found[0] : null;
+}
+var init_trusted_recipients = __esm({
+  "src/auth/trusted-recipients.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
 // src/config-schema.ts
 import { z } from "zod";
 function formatIssues(issues) {
@@ -8447,7 +8768,7 @@ var init_build = __esm({
 });
 
 // src/auth/trusted-hosts.ts
-function normalizeHost(raw) {
+function normalizeHost2(raw) {
   return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
 }
 var init_trusted_hosts = __esm({
@@ -8768,6 +9089,7 @@ function getConfig(cwd) {
     dangerousWords: [...DEFAULT_CONFIG.policy.dangerousWords],
     ignoredTools: [...DEFAULT_CONFIG.policy.ignoredTools],
     toolInspection: { ...DEFAULT_CONFIG.policy.toolInspection },
+    projectToolInspection: {},
     // Shipped rules carry `builtin`: the catalog's per-check value governs
     // them and only them (a user rule that reuses a name keeps its verdict).
     smartRules: DEFAULT_CONFIG.policy.smartRules.map((r) => ({ ...r, builtin: true })),
@@ -8794,7 +9116,8 @@ function getConfig(cwd) {
     untrustedContent: {
       ...DEFAULT_CONFIG.policy.untrustedContent,
       orgDomains: [...DEFAULT_CONFIG.policy.untrustedContent.orgDomains],
-      roles: {}
+      roles: {},
+      trustedRecipients: []
     },
     // Left empty on purpose: the local file is read fresh at policy-eval time
     // (getCachedHosts via isTrustedHost), NOT snapshotted into the frozen config
@@ -8840,8 +9163,14 @@ function getConfig(cwd) {
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
     if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
-    if (p.toolInspection)
-      mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
+    if (p.toolInspection) {
+      if (isProject)
+        mergedPolicy.projectToolInspection = {
+          ...mergedPolicy.projectToolInspection,
+          ...p.toolInspection
+        };
+      else mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
+    }
     if (p.smartRules) {
       const defaultBlocks = mergedPolicy.smartRules.filter((r) => r.verdict === "block");
       const defaultNonBlocks = mergedPolicy.smartRules.filter((r) => r.verdict !== "block");
@@ -9191,7 +9520,7 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.trustedHosts)) {
           mergedPolicy.trustedHostsManaged = true;
-          mergedPolicy.trustedHosts = mc.trustedHosts.filter((h) => typeof h === "string").map((h) => normalizeHost(h));
+          mergedPolicy.trustedHosts = mc.trustedHosts.filter((h) => typeof h === "string").map((h) => normalizeHost2(h));
         }
         if (mc.appPermissions && typeof mc.appPermissions === "object" && !Array.isArray(mc.appPermissions)) {
           const coerced = {};
@@ -9460,6 +9789,13 @@ function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false
     if (replaceLists) cur.orgDomains = domains;
     else for (const d of domains) if (!cur.orgDomains.includes(d)) cur.orgDomains.push(d);
   }
+  if (replaceLists && Array.isArray(uc.trustedRecipients)) {
+    cur.trustedRecipients = [
+      ...new Set(
+        uc.trustedRecipients.filter((v) => typeof v === "string").map((v) => normalizeRecipient(v)).filter((v) => v !== null)
+      )
+    ].slice(0, 200);
+  }
   if (uc.roles && typeof uc.roles === "object" && !Array.isArray(uc.roles)) {
     const next = replaceLists ? {} : cur.roles;
     for (const [server, tools] of Object.entries(uc.roles)) {
@@ -9480,6 +9816,7 @@ var DANGEROUS_WORDS, RUNTIME_ONLY_CONFIG_KEYS, DEFAULT_CONFIG, RM_SAFE_PATH_PATT
 var init_config = __esm({
   "src/config/index.ts"() {
     "use strict";
+    init_trusted_recipients();
     init_config_schema();
     init_shields();
     init_managed();
@@ -9734,7 +10071,8 @@ var init_config = __esm({
           spotlight: true,
           afterExposure: "ask-once",
           orgDomains: [],
-          roles: {}
+          roles: {},
+          trustedRecipients: []
         },
         trustedHosts: [],
         trustedHostsManaged: false,
@@ -9852,7 +10190,7 @@ import * as fs7 from "fs";
 import * as path8 from "path";
 function listSessionFiles(dir, maxDepth = 6) {
   const out = [];
-  const walk = (d, rel, depth) => {
+  const walk2 = (d, rel, depth) => {
     if (depth > maxDepth) return;
     let entries;
     try {
@@ -9862,11 +10200,11 @@ function listSessionFiles(dir, maxDepth = 6) {
     }
     for (const e of entries) {
       const childRel = rel ? path8.join(rel, e.name) : e.name;
-      if (e.isDirectory()) walk(path8.join(d, e.name), childRel, depth + 1);
+      if (e.isDirectory()) walk2(path8.join(d, e.name), childRel, depth + 1);
       else if (e.name.endsWith(".jsonl")) out.push(childRel);
     }
   };
-  walk(dir, "", 0);
+  walk2(dir, "", 0);
   return out;
 }
 function sessionIdOf(relPath) {
@@ -10464,7 +10802,9 @@ function dimensionOfBlock(checkedBy, ruleName) {
   if (checkedBy.includes("egress")) return "network";
   if (ruleName.startsWith("ssrf:")) return "network";
   if (checkedBy.includes("pii") || checkedBy.includes("dlp")) return "data";
-  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection"))
+  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection") || // fw#318: a send held after the session read outside content, and the
+  // read rows themselves. Mirrors node9Firewall canon-taxonomy.ts.
+  ruleName.startsWith("exposure") || checkedBy.startsWith("exposure"))
     return "detection";
   if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "apps";
   if (ruleName.startsWith("shield:project-jail")) return "files";
@@ -11143,19 +11483,19 @@ function scrubDecoys(subject, values) {
     for (const v of values) if (v) out = out.split(v).join("[node9-decoy]");
     return out;
   };
-  const walk = (v, depth) => {
+  const walk2 = (v, depth) => {
     if (depth > 6) return v;
     if (typeof v === "string") return scrubText(v);
-    if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+    if (Array.isArray(v)) return v.map((x) => walk2(x, depth + 1));
     if (v && typeof v === "object") {
       const out = {};
       for (const [k, child] of Object.entries(v))
-        out[k] = walk(child, depth + 1);
+        out[k] = walk2(child, depth + 1);
       return out;
     }
     return v;
   };
-  return walk(subject, 0);
+  return walk2(subject, 0);
 }
 function pushFsOpAstFinding(command, toolName, input, timestamp2, projLabel, sessionId, agent, result, dedup) {
   const fsVerdict = analyzeFsOperation(command);