@node9/proxy 2.38.0 → 2.39.0

package/dist/dashboard.mjs

@@ -415,6 +415,28 @@ function classifySsrf(host2) {
     return null;
   }
 }
+function isModeValue(v) {
+  return typeof v === "string" && MODE_VALUES.includes(v);
+}
+function levelOf(mode) {
+  if (mode === "observe") return "audit";
+  return LEVELS.includes(mode ?? "") ? mode : "standard";
+}
+function isRecordOnly(mode) {
+  return levelOf(mode) === "audit";
+}
+function isBlockAll(mode) {
+  return levelOf(mode) === "block-all";
+}
+function levelCheckValue(mode, id) {
+  return LEVEL_CHECKS[levelOf(mode)][id];
+}
+function levelChecks(mode) {
+  return LEVEL_CHECKS[levelOf(mode)];
+}
+function levelPackageSignals(mode) {
+  return levelOf(mode) === "soft" ? { newPackage: "off", installScript: "off" } : void 0;
+}
 function isVerdict(v) {
   return v === "off" || v === "log" || v === "review" || v === "block";
 }
@@ -488,19 +510,21 @@ function resolveCheck(settings, id) {
   if (!def) return void 0;
   if (isLockedCheck(def)) return { id, value: "block", source: "locked" };
   const floor = def.floor ? CHECK_VERDICT_RANK[def.floor] : 0;
+  const levelDefault = levelCheckValue(settings.mode, id) ?? def.defaultValue;
+  const sourceOf = (value2) => value2 === levelDefault ? "default" : "configured";
   const explicit = settings.checks?.[id];
   if (isVerdict(explicit)) {
     const value2 = CHECK_VERDICT_RANK[explicit] < floor ? def.floor : explicit;
-    return { id, value: value2, source: value2 === def.defaultValue ? "default" : "configured" };
+    return { id, value: value2, source: sourceOf(value2) };
   }
   if (def.pack) {
     const on = settings.appliedShields?.includes(def.pack) ?? false;
     return { id, value: on ? def.defaultValue : "off", source: "default" };
   }
   const read = LEGACY_READERS[id]?.(settings);
-  if (read === void 0) return { id, value: def.defaultValue, source: "default" };
+  if (read === void 0) return { id, value: levelDefault, source: "default" };
   const value = CHECK_VERDICT_RANK[read] < floor ? def.floor : read;
-  return { id, value, source: value === def.defaultValue ? "default" : "configured" };
+  return { id, value, source: sourceOf(value) };
 }
 function checkValue(settings, id) {
   return resolveCheck(settings, id)?.value ?? "off";
@@ -2432,6 +2456,20 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
   }
   return null;
 }
+function tuningFromLegacyPolicy(policy) {
+  const out = {};
+  const p = policy;
+  if (policy.packageCheck?.registrySignals === false) {
+    out["loading.malicious-package"] = { newPackage: "off", installScript: "off" };
+  }
+  for (const f of TUNING_FIELDS) {
+    const [block, key] = f.legacy;
+    const value = p[block]?.[key];
+    if (value === void 0) continue;
+    (out[f.checkId] ??= {})[f.name] = value;
+  }
+  return out;
+}
 function tuningToLegacyPolicy(policy, tuning) {
   const unknown = [];
   for (const [id, fields] of Object.entries(tuning)) {
@@ -2546,6 +2584,25 @@ function checkToLegacyPolicy(policy, id, v) {
       return false;
   }
 }
+function knobStatedChecks(policy) {
+  const out = /* @__PURE__ */ new Set();
+  const has2 = (o, key) => !!o && typeof o === "object" && o[key] !== void 0;
+  const { dlp, egress, loopDetection, injectionScan, skillPinning, packageCheck } = policy;
+  const uc = policy.untrustedContent;
+  if (has2(dlp, "enabled")) out.add("data.secrets");
+  if (has2(dlp, "reviewAction") || dlp?.enabled === false) out.add("data.secrets-weak");
+  if (has2(dlp, "pii")) out.add("data.pii");
+  if (has2(egress, "enabled") || has2(egress, "mode")) out.add("network.unknown-host");
+  if (has2(egress, "ssrfStrict")) out.add("network.internal-addresses");
+  if (has2(loopDetection, "enabled")) out.add("behavior.loops");
+  if (has2(injectionScan, "enabled")) out.add("behavior.prompt-injection");
+  if (has2(skillPinning, "enabled") || has2(skillPinning, "mode")) out.add("loading.skill-tamper");
+  if (has2(packageCheck, "enabled") || has2(packageCheck, "onMalicious"))
+    out.add("loading.malicious-package");
+  if (uc && typeof uc === "object" && (uc.enabled === false || has2(uc, "afterExposure")))
+    out.add("behavior.untrusted-content");
+  return out;
+}
 function isKnobGoverned(id) {
   return id in KNOB_GOVERNED;
 }
@@ -2804,7 +2861,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, SYSTEM_DIRS, UPLOAD_SYSTEM_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, BIP39_ENGLISH, indices, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, EDITOR_HEADS, MANAGER_HEADS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, MASKED_KINDS, ENTRY_RE, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, SYSTEM_DIRS, UPLOAD_SYSTEM_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, BIP39_ENGLISH, indices, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, EDITOR_HEADS, MANAGER_HEADS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, MASKED_KINDS, ENTRY_RE, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4603,6 +4660,52 @@ var init_dist = __esm({
         advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
       }
     };
+    LEVELS = ["audit", "soft", "standard", "strict", "block-all"];
+    MODE_VALUES = ["observe", ...LEVELS];
+    SOFT = {
+      "commands.inline-exec": "log",
+      "commands.eval-dynamic": "log",
+      "commands.rm": "log",
+      "commands.chmod": "log",
+      "commands.sudo": "log",
+      "commands.git-destructive": "log",
+      "commands.sql-ddl": "log",
+      "commands.sql-no-where": "log",
+      "commands.temp-binary": "log",
+      "commands.disk-destroy": "log",
+      "commands.dangerous-word": "log",
+      "files.system-dirs": "log",
+      "files.shell-startup": "log",
+      "files.password-hashes": "log",
+      "data.pipe-chain": "log",
+      "behavior.untrusted-content": "log"
+    };
+    STRICT = {
+      "commands.sql-ddl": "block",
+      "commands.disk-destroy": "block",
+      "commands.node9-disarm": "block",
+      "files.system-dirs": "block",
+      "files.shell-startup": "block",
+      "files.password-hashes": "block",
+      "data.secrets-weak": "block",
+      "data.pipe-chain": "block",
+      "network.unknown-host": "review",
+      "network.internal-addresses": "block",
+      "behavior.prompt-injection": "log",
+      "loading.skill-tamper": "block"
+    };
+    BLOCK_ALL = {
+      ...STRICT,
+      "commands.unknown": "review",
+      "commands.temp-binary": "block"
+    };
+    LEVEL_CHECKS = {
+      audit: {},
+      soft: SOFT,
+      standard: {},
+      strict: STRICT,
+      "block-all": BLOCK_ALL
+    };
     VERDICTS = ["off", "log", "review", "block"];
     CHECK_VERDICT_RANK = { off: 0, log: 1, review: 2, block: 3 };
     ALL = VERDICTS;
@@ -5056,7 +5159,7 @@ var init_dist = __esm({
       "commands.rm": (s) => knob(s.commandChecks?.rmAdvisory),
       "commands.chmod": (s) => knob(s.commandChecks?.chmod),
       "commands.sql-ddl": (s) => knob(s.commandChecks?.sqlDdl),
-      "commands.unknown": (s) => s.mode === void 0 ? void 0 : s.mode === "strict" ? "review" : "off",
+      "commands.unknown": (s) => s.mode === void 0 ? void 0 : isBlockAll(s.mode) ? "review" : "off",
       "data.secrets": (s) => enabledOr(s.dlp?.enabled, "block"),
       "data.secrets-weak": (s) => {
         if (s.dlp?.enabled === false) return "off";
@@ -10066,7 +10169,8 @@ var init_config_schema = __esm({
     ConfigFileSchema = z.object({
       version: z.string().optional(),
       settings: z.object({
-        mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
+        // The protection level (levels.ts in the engine); `observe` is Audit's older name.
+        mode: z.enum(["observe", "audit", "soft", "standard", "strict", "block-all"]).optional(),
         autoStartDaemon: z.boolean().optional(),
         // enableUndo / policy.snapshot: removed with the undo feature. The
         // schema strips undeclared keys silently (plain zod object — no
@@ -10472,7 +10576,7 @@ var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER, COMMA
 var init_managed = __esm({
   "src/config/managed.ts"() {
     "use strict";
-    MODE_ORDER = ["observe", "audit", "standard", "strict"];
+    MODE_ORDER = ["observe", "audit", "soft", "standard", "strict", "block-all"];
     EGRESS_MODE_ORDER = ["off", "review", "block"];
     DLP_PII_ORDER = ["off", "block"];
     DLP_REVIEW_ACTION_ORDER = ["review", "block"];
@@ -10562,7 +10666,7 @@ function v2ToLegacy(raw, options = {}) {
       continue;
     }
     if (id === "commands.unknown") {
-      warnings.push(`checks.${id}: set "mode": "strict" instead`);
+      warnings.push(`checks.${id}: set "mode": "block-all" instead`);
       continue;
     }
     const allowed = configurableValues(id);
@@ -10795,6 +10899,11 @@ function logCacheReadIssue(cacheFile, kind) {
   } catch {
   }
 }
+function statedSignalFields(policy) {
+  return Object.keys(tuningFromLegacyPolicy(policy)["loading.malicious-package"] ?? {}).filter(
+    (k) => k === "newPackage" || k === "installScript"
+  );
+}
 function catalogSettingsFrom(settings, policy) {
   return catalogSettingsFromConfig(settings, policy);
 }
@@ -10862,6 +10971,8 @@ function getConfig(cwd) {
   const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
   let ssrfStrictSource = "default";
   const workspaceChecks = {};
+  const managedStatedChecks = /* @__PURE__ */ new Set();
+  const managedStatedSignals = /* @__PURE__ */ new Set();
   const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
@@ -11069,9 +11180,11 @@ function getConfig(cwd) {
       if (raw.managedConfig && typeof raw.managedConfig === "object") {
         const mc = raw.managedConfig;
         const locked = Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : [];
+        for (const id of knobStatedChecks(mc)) managedStatedChecks.add(id);
+        for (const k of statedSignalFields(mc)) managedStatedSignals.add(k);
         if (typeof mc.mode === "string") {
           if (keyed) {
-            if (["observe", "audit", "standard", "strict"].includes(mc.mode)) {
+            if (isModeValue(mc.mode)) {
               mergedSettings.mode = mc.mode;
             }
           } else {
@@ -11353,14 +11466,15 @@ function getConfig(cwd) {
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && // PR-2: one listening point includes the env var — a keyed machine's
   // mode comes from the workspace (or the shipped default), never the shell.
-  !keyed && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+  !keyed && isModeValue(envMode)) {
     mergedSettings.mode = envMode;
   }
-  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
+  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && isRecordOnly(mergedSettings.mode)) {
     mergedSettings.mode = "standard";
   }
-  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && mergedSettings.mode === "strict";
-  if (modeCloudControlled && mergedSettings.mode === "strict") {
+  const cloudStrictLevel = levelOf(mergedSettings.mode) === "strict" || levelOf(mergedSettings.mode) === "block-all";
+  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && cloudStrictLevel;
+  if (modeCloudControlled && cloudStrictLevel) {
     for (const name of Object.keys(mergedEnvironments)) {
       if (mergedEnvironments[name]?.requireApproval === false) {
         const cleaned = { ...mergedEnvironments[name] };
@@ -11378,6 +11492,35 @@ function getConfig(cwd) {
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
   mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   const resolvedSsrfStrictSource = keyed && ssrfStrictSource === "local" ? "default" : ssrfStrictSource;
+  const level = levelOf(mergedSettings.mode);
+  const levelKnobChecks = Object.entries(levelChecks(level)).filter(([id]) => isKnobGoverned(id));
+  const signals = levelPackageSignals(level);
+  if (levelKnobChecks.length > 0 || signals) {
+    const policyOf = (layer) => layer?.policy ?? {};
+    const trusted = /* @__PURE__ */ new Set([...managedStatedChecks, ...Object.keys(workspaceChecks)]);
+    const trustedSignals = new Set(managedStatedSignals);
+    const project = /* @__PURE__ */ new Set();
+    const projectSignals = /* @__PURE__ */ new Set();
+    if (!keyed) {
+      for (const id of knobStatedChecks(policyOf(globalConfig))) trusted.add(id);
+      for (const k of statedSignalFields(policyOf(globalConfig))) trustedSignals.add(k);
+      for (const id of knobStatedChecks(policyOf(projectConfig))) project.add(id);
+      for (const k of statedSignalFields(policyOf(projectConfig))) projectSignals.add(k);
+    }
+    const before = resolveCheckMap(catalogSettingsFromConfig({}, mergedPolicy));
+    for (const [id, v] of levelKnobChecks) {
+      if (trusted.has(id)) continue;
+      if (project.has(id) && CHECK_VERDICT_RANK[v] <= CHECK_VERDICT_RANK[before[id] ?? "off"])
+        continue;
+      checkToLegacyPolicy(mergedPolicy, id, v);
+    }
+    if (signals) {
+      for (const key of ["newPackage", "installScript"]) {
+        if (trustedSignals.has(key) || projectSignals.has(key)) continue;
+        mergedPolicy.packageCheck[key] = signals[key];
+      }
+    }
+  }
   const explicit = {};
   const checkSources = {};
   if (keyed) {
@@ -12859,6 +13002,7 @@ var init_provenance = __esm({
 var init_policy = __esm({
   "src/policy/index.ts"() {
     "use strict";
+    init_dist();
     init_dlp();
     init_file_access();
     init_config();