@node9/proxy 2.38.0 → 2.39.0

package/dist/index.js

@@ -449,6 +449,32 @@ function ssrfFloorDecision(m, asWritten, opts) {
   }
   return "block";
 }
+function isModeValue(v) {
+  return typeof v === "string" && MODE_VALUES.includes(v);
+}
+function levelOf(mode) {
+  if (mode === "observe") return "audit";
+  return LEVELS.includes(mode ?? "") ? mode : "standard";
+}
+function isRecordOnly(mode) {
+  return levelOf(mode) === "audit";
+}
+function reviewsEveryInline(mode) {
+  const level = levelOf(mode);
+  return level === "strict" || level === "block-all";
+}
+function isBlockAll(mode) {
+  return levelOf(mode) === "block-all";
+}
+function levelCheckValue(mode, id) {
+  return LEVEL_CHECKS[levelOf(mode)][id];
+}
+function levelChecks(mode) {
+  return LEVEL_CHECKS[levelOf(mode)];
+}
+function levelPackageSignals(mode) {
+  return levelOf(mode) === "soft" ? { newPackage: "off", installScript: "off" } : void 0;
+}
 function isVerdict(v) {
   return v === "off" || v === "log" || v === "review" || v === "block";
 }
@@ -594,19 +620,21 @@ function resolveCheck(settings, id) {
   if (!def) return void 0;
   if (isLockedCheck(def)) return { id, value: "block", source: "locked" };
   const floor = def.floor ? CHECK_VERDICT_RANK[def.floor] : 0;
+  const levelDefault = levelCheckValue(settings.mode, id) ?? def.defaultValue;
+  const sourceOf = (value2) => value2 === levelDefault ? "default" : "configured";
   const explicit = settings.checks?.[id];
   if (isVerdict(explicit)) {
     const value2 = CHECK_VERDICT_RANK[explicit] < floor ? def.floor : explicit;
-    return { id, value: value2, source: value2 === def.defaultValue ? "default" : "configured" };
+    return { id, value: value2, source: sourceOf(value2) };
   }
   if (def.pack) {
     const on = settings.appliedShields?.includes(def.pack) ?? false;
     return { id, value: on ? def.defaultValue : "off", source: "default" };
   }
   const read2 = LEGACY_READERS[id]?.(settings);
-  if (read2 === void 0) return { id, value: def.defaultValue, source: "default" };
+  if (read2 === void 0) return { id, value: levelDefault, source: "default" };
   const value = CHECK_VERDICT_RANK[read2] < floor ? def.floor : read2;
-  return { id, value, source: value === def.defaultValue ? "default" : "configured" };
+  return { id, value, source: sourceOf(value) };
 }
 function checkValue(settings, id) {
   return resolveCheck(settings, id)?.value ?? "off";
@@ -5356,6 +5384,20 @@ function extractPackageInstalls(command) {
     return true;
   });
 }
+function tuningFromLegacyPolicy(policy) {
+  const out = {};
+  const p = policy;
+  if (policy.packageCheck?.registrySignals === false) {
+    out["loading.malicious-package"] = { newPackage: "off", installScript: "off" };
+  }
+  for (const f of TUNING_FIELDS) {
+    const [block, key] = f.legacy;
+    const value = p[block]?.[key];
+    if (value === void 0) continue;
+    (out[f.checkId] ??= {})[f.name] = value;
+  }
+  return out;
+}
 function tuningToLegacyPolicy(policy, tuning) {
   const unknown = [];
   for (const [id, fields] of Object.entries(tuning)) {
@@ -5470,6 +5512,25 @@ function checkToLegacyPolicy(policy, id, v) {
       return false;
   }
 }
+function knobStatedChecks(policy) {
+  const out = /* @__PURE__ */ new Set();
+  const has = (o, key) => !!o && typeof o === "object" && o[key] !== void 0;
+  const { dlp, egress, loopDetection, injectionScan, skillPinning, packageCheck } = policy;
+  const uc = policy.untrustedContent;
+  if (has(dlp, "enabled")) out.add("data.secrets");
+  if (has(dlp, "reviewAction") || dlp?.enabled === false) out.add("data.secrets-weak");
+  if (has(dlp, "pii")) out.add("data.pii");
+  if (has(egress, "enabled") || has(egress, "mode")) out.add("network.unknown-host");
+  if (has(egress, "ssrfStrict")) out.add("network.internal-addresses");
+  if (has(loopDetection, "enabled")) out.add("behavior.loops");
+  if (has(injectionScan, "enabled")) out.add("behavior.prompt-injection");
+  if (has(skillPinning, "enabled") || has(skillPinning, "mode")) out.add("loading.skill-tamper");
+  if (has(packageCheck, "enabled") || has(packageCheck, "onMalicious"))
+    out.add("loading.malicious-package");
+  if (uc && typeof uc === "object" && (uc.enabled === false || has(uc, "afterExposure")))
+    out.add("behavior.untrusted-content");
+  return out;
+}
 function isKnobGoverned(id) {
   return id in KNOB_GOVERNED;
 }
@@ -6280,7 +6341,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       if (v?.logged) noteLogged(v);
       else if (v) candidates.push(v);
     };
-    const inline = config.settings.mode === "strict" ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
+    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
     if (inline !== null) {
       consider("commands.inline-exec", {
         decision: "review",
@@ -6340,21 +6401,17 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     if (firstToken && firstToken.startsWith("/") && checkProvenance2) {
       const prov = checkProvenance2(firstToken, cwd);
       if (prov.trustLevel === "suspect") {
-        const value = cv("commands.temp-binary");
-        const v = applyCheckValue(
-          value === "review" && config.settings.mode === "strict" ? "block" : value,
-          {
-            decision: "review",
-            blockedByLabel: "Node9: Suspect Binary",
-            reason: `Binary "${firstToken}" resolved to ${prov.resolvedPath} \u2014 ${prov.reason}`,
-            tier: 3,
-            checkId: "commands.temp-binary"
-          }
-        );
+        const v = applyCheckValue(cv("commands.temp-binary"), {
+          decision: "review",
+          blockedByLabel: "Node9: Suspect Binary",
+          reason: `Binary "${firstToken}" resolved to ${prov.resolvedPath} \u2014 ${prov.reason}`,
+          tier: 3,
+          checkId: "commands.temp-binary"
+        });
         if (v?.logged) noteLogged(v);
         else if (v) return v;
       }
-      if (prov.trustLevel === "unknown" && config.settings.mode === "strict") {
+      if (prov.trustLevel === "unknown" && isBlockAll(config.settings.mode)) {
         return {
           decision: "review",
           blockedByLabel: "Node9: Unknown Binary (strict mode)",
@@ -6445,7 +6502,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     if (v?.logged) noteLogged(v);
     else if (v) return v;
   }
-  if (config.settings.mode === "strict") {
+  if (isBlockAll(config.settings.mode)) {
     if (activeEnvironment?.requireApproval === false) return allowed();
     return {
       decision: "review",
@@ -7376,7 +7433,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var import_picomatch, import_safe_regex2, import_picomatch2, import_mvdan_sh, import_mvdan_sh2, import_safe_regex22, import_crypto2, import_crypto3, import_mvdan_sh3, import_crypto4, import_mvdan_sh4, import_crypto5, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, MAX, UNTRUSTED_TOOLS, SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var import_picomatch, import_safe_regex2, import_picomatch2, import_mvdan_sh, import_mvdan_sh2, import_safe_regex22, import_crypto2, import_crypto3, import_mvdan_sh3, import_crypto4, import_mvdan_sh4, import_crypto5, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, MAX, UNTRUSTED_TOOLS, SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -9196,6 +9253,52 @@ var init_dist = __esm({
         advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
       }
     };
+    LEVELS = ["audit", "soft", "standard", "strict", "block-all"];
+    MODE_VALUES = ["observe", ...LEVELS];
+    SOFT = {
+      "commands.inline-exec": "log",
+      "commands.eval-dynamic": "log",
+      "commands.rm": "log",
+      "commands.chmod": "log",
+      "commands.sudo": "log",
+      "commands.git-destructive": "log",
+      "commands.sql-ddl": "log",
+      "commands.sql-no-where": "log",
+      "commands.temp-binary": "log",
+      "commands.disk-destroy": "log",
+      "commands.dangerous-word": "log",
+      "files.system-dirs": "log",
+      "files.shell-startup": "log",
+      "files.password-hashes": "log",
+      "data.pipe-chain": "log",
+      "behavior.untrusted-content": "log"
+    };
+    STRICT = {
+      "commands.sql-ddl": "block",
+      "commands.disk-destroy": "block",
+      "commands.node9-disarm": "block",
+      "files.system-dirs": "block",
+      "files.shell-startup": "block",
+      "files.password-hashes": "block",
+      "data.secrets-weak": "block",
+      "data.pipe-chain": "block",
+      "network.unknown-host": "review",
+      "network.internal-addresses": "block",
+      "behavior.prompt-injection": "log",
+      "loading.skill-tamper": "block"
+    };
+    BLOCK_ALL = {
+      ...STRICT,
+      "commands.unknown": "review",
+      "commands.temp-binary": "block"
+    };
+    LEVEL_CHECKS = {
+      audit: {},
+      soft: SOFT,
+      standard: {},
+      strict: STRICT,
+      "block-all": BLOCK_ALL
+    };
     VERDICTS = ["off", "log", "review", "block"];
     CHECK_VERDICT_RANK = { off: 0, log: 1, review: 2, block: 3 };
     ALL = VERDICTS;
@@ -9652,7 +9755,7 @@ var init_dist = __esm({
       "commands.rm": (s) => knob(s.commandChecks?.rmAdvisory),
       "commands.chmod": (s) => knob(s.commandChecks?.chmod),
       "commands.sql-ddl": (s) => knob(s.commandChecks?.sqlDdl),
-      "commands.unknown": (s) => s.mode === void 0 ? void 0 : s.mode === "strict" ? "review" : "off",
+      "commands.unknown": (s) => s.mode === void 0 ? void 0 : isBlockAll(s.mode) ? "review" : "off",
       "data.secrets": (s) => enabledOr(s.dlp?.enabled, "block"),
       "data.secrets-weak": (s) => {
         if (s.dlp?.enabled === false) return "off";
@@ -15288,7 +15391,8 @@ var SmartRuleSchema = import_zod.z.object({
 var ConfigFileSchema = import_zod.z.object({
   version: import_zod.z.string().optional(),
   settings: import_zod.z.object({
-    mode: import_zod.z.enum(["standard", "strict", "audit", "observe"]).optional(),
+    // The protection level (levels.ts in the engine); `observe` is Audit's older name.
+    mode: import_zod.z.enum(["observe", "audit", "soft", "standard", "strict", "block-all"]).optional(),
     autoStartDaemon: import_zod.z.boolean().optional(),
     // enableUndo / policy.snapshot: removed with the undo feature. The
     // schema strips undeclared keys silently (plain zod object — no
@@ -15663,7 +15767,7 @@ function readShieldOverrides() {
 }
 
 // src/config/managed.ts
-var MODE_ORDER = ["observe", "audit", "standard", "strict"];
+var MODE_ORDER = ["observe", "audit", "soft", "standard", "strict", "block-all"];
 var EGRESS_MODE_ORDER = ["off", "review", "block"];
 function rankIn(order, value) {
   return value === void 0 ? -1 : order.indexOf(value);
@@ -15926,7 +16030,7 @@ function v2ToLegacy(raw, options = {}) {
       continue;
     }
     if (id === "commands.unknown") {
-      warnings.push(`checks.${id}: set "mode": "strict" instead`);
+      warnings.push(`checks.${id}: set "mode": "block-all" instead`);
       continue;
     }
     const allowed = configurableValues(id);
@@ -16465,6 +16569,11 @@ var KNOB_TO_CHECK = {
   evalDynamic: "commands.eval-dynamic",
   pipeChainHigh: "data.pipe-chain"
 };
+function statedSignalFields(policy) {
+  return Object.keys(tuningFromLegacyPolicy(policy)["loading.malicious-package"] ?? {}).filter(
+    (k) => k === "newPackage" || k === "installScript"
+  );
+}
 function catalogSettingsFrom(settings, policy) {
   return catalogSettingsFromConfig(settings, policy);
 }
@@ -16532,6 +16641,8 @@ function getConfig(cwd) {
   const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
   let ssrfStrictSource = "default";
   const workspaceChecks = {};
+  const managedStatedChecks = /* @__PURE__ */ new Set();
+  const managedStatedSignals = /* @__PURE__ */ new Set();
   const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
@@ -16739,9 +16850,11 @@ function getConfig(cwd) {
       if (raw.managedConfig && typeof raw.managedConfig === "object") {
         const mc = raw.managedConfig;
         const locked = Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : [];
+        for (const id of knobStatedChecks(mc)) managedStatedChecks.add(id);
+        for (const k of statedSignalFields(mc)) managedStatedSignals.add(k);
         if (typeof mc.mode === "string") {
           if (keyed) {
-            if (["observe", "audit", "standard", "strict"].includes(mc.mode)) {
+            if (isModeValue(mc.mode)) {
               mergedSettings.mode = mc.mode;
             }
           } else {
@@ -17023,14 +17136,15 @@ function getConfig(cwd) {
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && // PR-2: one listening point includes the env var — a keyed machine's
   // mode comes from the workspace (or the shipped default), never the shell.
-  !keyed && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+  !keyed && isModeValue(envMode)) {
     mergedSettings.mode = envMode;
   }
-  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
+  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && isRecordOnly(mergedSettings.mode)) {
     mergedSettings.mode = "standard";
   }
-  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && mergedSettings.mode === "strict";
-  if (modeCloudControlled && mergedSettings.mode === "strict") {
+  const cloudStrictLevel = levelOf(mergedSettings.mode) === "strict" || levelOf(mergedSettings.mode) === "block-all";
+  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && cloudStrictLevel;
+  if (modeCloudControlled && cloudStrictLevel) {
     for (const name of Object.keys(mergedEnvironments)) {
       if (mergedEnvironments[name]?.requireApproval === false) {
         const cleaned = { ...mergedEnvironments[name] };
@@ -17048,6 +17162,35 @@ function getConfig(cwd) {
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
   mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   const resolvedSsrfStrictSource = keyed && ssrfStrictSource === "local" ? "default" : ssrfStrictSource;
+  const level = levelOf(mergedSettings.mode);
+  const levelKnobChecks = Object.entries(levelChecks(level)).filter(([id]) => isKnobGoverned(id));
+  const signals = levelPackageSignals(level);
+  if (levelKnobChecks.length > 0 || signals) {
+    const policyOf = (layer) => layer?.policy ?? {};
+    const trusted = /* @__PURE__ */ new Set([...managedStatedChecks, ...Object.keys(workspaceChecks)]);
+    const trustedSignals = new Set(managedStatedSignals);
+    const project = /* @__PURE__ */ new Set();
+    const projectSignals = /* @__PURE__ */ new Set();
+    if (!keyed) {
+      for (const id of knobStatedChecks(policyOf(globalConfig))) trusted.add(id);
+      for (const k of statedSignalFields(policyOf(globalConfig))) trustedSignals.add(k);
+      for (const id of knobStatedChecks(policyOf(projectConfig))) project.add(id);
+      for (const k of statedSignalFields(policyOf(projectConfig))) projectSignals.add(k);
+    }
+    const before = resolveCheckMap(catalogSettingsFromConfig({}, mergedPolicy));
+    for (const [id, v] of levelKnobChecks) {
+      if (trusted.has(id)) continue;
+      if (project.has(id) && CHECK_VERDICT_RANK[v] <= CHECK_VERDICT_RANK[before[id] ?? "off"])
+        continue;
+      checkToLegacyPolicy(mergedPolicy, id, v);
+    }
+    if (signals) {
+      for (const key of ["newPackage", "installScript"]) {
+        if (trustedSignals.has(key) || projectSignals.has(key)) continue;
+        mergedPolicy.packageCheck[key] = signals[key];
+      }
+    }
+  }
   const explicit = {};
   const checkSources = {};
   if (keyed) {
@@ -17219,6 +17362,9 @@ function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false
 // src/utils/regex.ts
 init_dist();
 
+// src/policy/index.ts
+init_dist();
+
 // src/dlp.ts
 var import_fs5 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
@@ -20147,11 +20293,11 @@ async function checkOne(p, cfg, misses, networkCapped, cwd) {
   }
   return findings;
 }
-var SOFT = /* @__PURE__ */ new Set(["new", "install-script"]);
+var SOFT2 = /* @__PURE__ */ new Set(["new", "install-script"]);
 async function byHistory(p, version, info, findings, misses) {
   let out = findings;
   let h = info.history;
-  if (!h && p.ecosystem === "PyPI" && out.some((f) => SOFT.has(f.kind))) {
+  if (!h && p.ecosystem === "PyPI" && out.some((f) => SOFT2.has(f.kind))) {
     try {
       h = await pypiHistory(p.name, version) ?? void 0;
     } catch (err) {
@@ -20171,7 +20317,7 @@ async function byHistory(p, version, info, findings, misses) {
   });
   if (p.ecosystem === "npm") {
     if (h.previousProvenance && h.provenance === false) return [...out, drop()];
-    if (!out.some((f) => SOFT.has(f.kind)) || !h.provenance || !h.previousProvenance) return out;
+    if (!out.some((f) => SOFT2.has(f.kind)) || !h.provenance || !h.previousProvenance) return out;
     const [now, before] = await Promise.all([
       npmSourceRepo(p.name, version),
       npmSourceRepo(p.name, previous)
@@ -20179,7 +20325,7 @@ async function byHistory(p, version, info, findings, misses) {
     return vouched(p, version, now, before, out, misses);
   }
   if (p.ecosystem === "PyPI") {
-    if (!out.some((f) => SOFT.has(f.kind)) || !info.file || !h.previousFile) return out;
+    if (!out.some((f) => SOFT2.has(f.kind)) || !info.file || !h.previousFile) return out;
     const [now, before] = await Promise.all([
       pypiSourceRepo(p.name, version, info.file),
       pypiSourceRepo(p.name, previous, h.previousFile)
@@ -20195,7 +20341,7 @@ function vouched(p, version, now, before, findings, misses) {
     return findings;
   }
   if (now === "none" || before === "none" || now !== before) return findings;
-  return findings.filter((f) => !SOFT.has(f.kind));
+  return findings.filter((f) => !SOFT2.has(f.kind));
 }
 async function runPackageCheck(toolName, args, cfg, cwd) {
   if (!cfg.enabled) return ALLOW;
@@ -20515,7 +20661,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     appendHookDebug(toolName, args, meta, hashAuditArgs);
   }
   const isManual = meta?.agent === "Terminal";
-  const isObserveMode = config.settings.mode === "observe";
+  const isObserveMode = isRecordOnly(config.settings.mode);
   let explainableLabel = "Local Config";
   let dlpReviewFlagged = false;
   let packageReview = null;
@@ -20573,7 +20719,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     explainableLabel = "Shell inspection incomplete";
     policyRuleDescription = "The executable command could not be inspected. Approve this call explicitly.";
   }
-  const fileReview = !isObserveMode && config.settings.mode !== "audit" && fileFinding?.decision === "review";
+  const fileReview = !isObserveMode && fileFinding?.decision === "review";
   const evaluateCurrentPolicy = async (skipIgnoredFastPath = false) => {
     const own = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd, {
       fileAccess,
@@ -20600,7 +20746,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   if (fileFinding) {
     meta = { ...meta, ruleName: fileFinding.ruleName };
     hashAuditArgs = true;
-    const observing = isObserveMode || config.settings.mode === "audit";
+    const observing = isObserveMode;
     const blocked = !observing && (fileFinding.decision === "block" || fileReview && config.settings.panicMode);
     appendLocalAudit(
       toolName,
@@ -21082,15 +21228,6 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     }
     return { approved: true, checkedBy: "audit" };
   }
-  if (config.settings.mode === "audit") {
-    if (judge) {
-      const policyResult = await evaluateCurrentPolicy();
-      if (policyResult.decision === "review") {
-        appendLocalAudit(toolName, args, "allow", "audit-mode", ownRowMeta(true), hashAuditArgs);
-      }
-    }
-    return { approved: true, checkedBy: "audit" };
-  }
   let appPermReview = null;
   let appPermReviewTool = null;
   const callSpecificReview = () => fileReview || shellReview || dlpReviewFlagged || !!appPermReview || !!taintWarning || !!exposureReview || !!packageReview;