@node9/proxy 2.38.0 → 2.39.0

package/dist/index.mjs

@@ -438,6 +438,32 @@ function ssrfFloorDecision(m, asWritten, opts) {
   }
   return "block";
 }
+function isModeValue(v) {
+  return typeof v === "string" && MODE_VALUES.includes(v);
+}
+function levelOf(mode) {
+  if (mode === "observe") return "audit";
+  return LEVELS.includes(mode ?? "") ? mode : "standard";
+}
+function isRecordOnly(mode) {
+  return levelOf(mode) === "audit";
+}
+function reviewsEveryInline(mode) {
+  const level = levelOf(mode);
+  return level === "strict" || level === "block-all";
+}
+function isBlockAll(mode) {
+  return levelOf(mode) === "block-all";
+}
+function levelCheckValue(mode, id) {
+  return LEVEL_CHECKS[levelOf(mode)][id];
+}
+function levelChecks(mode) {
+  return LEVEL_CHECKS[levelOf(mode)];
+}
+function levelPackageSignals(mode) {
+  return levelOf(mode) === "soft" ? { newPackage: "off", installScript: "off" } : void 0;
+}
 function isVerdict(v) {
   return v === "off" || v === "log" || v === "review" || v === "block";
 }
@@ -583,19 +609,21 @@ function resolveCheck(settings, id) {
   if (!def) return void 0;
   if (isLockedCheck(def)) return { id, value: "block", source: "locked" };
   const floor = def.floor ? CHECK_VERDICT_RANK[def.floor] : 0;
+  const levelDefault = levelCheckValue(settings.mode, id) ?? def.defaultValue;
+  const sourceOf = (value2) => value2 === levelDefault ? "default" : "configured";
   const explicit = settings.checks?.[id];
   if (isVerdict(explicit)) {
     const value2 = CHECK_VERDICT_RANK[explicit] < floor ? def.floor : explicit;
-    return { id, value: value2, source: value2 === def.defaultValue ? "default" : "configured" };
+    return { id, value: value2, source: sourceOf(value2) };
   }
   if (def.pack) {
     const on = settings.appliedShields?.includes(def.pack) ?? false;
     return { id, value: on ? def.defaultValue : "off", source: "default" };
   }
   const read2 = LEGACY_READERS[id]?.(settings);
-  if (read2 === void 0) return { id, value: def.defaultValue, source: "default" };
+  if (read2 === void 0) return { id, value: levelDefault, source: "default" };
   const value = CHECK_VERDICT_RANK[read2] < floor ? def.floor : read2;
-  return { id, value, source: value === def.defaultValue ? "default" : "configured" };
+  return { id, value, source: sourceOf(value) };
 }
 function checkValue(settings, id) {
   return resolveCheck(settings, id)?.value ?? "off";
@@ -5345,6 +5373,20 @@ function extractPackageInstalls(command) {
     return true;
   });
 }
+function tuningFromLegacyPolicy(policy) {
+  const out = {};
+  const p = policy;
+  if (policy.packageCheck?.registrySignals === false) {
+    out["loading.malicious-package"] = { newPackage: "off", installScript: "off" };
+  }
+  for (const f of TUNING_FIELDS) {
+    const [block, key] = f.legacy;
+    const value = p[block]?.[key];
+    if (value === void 0) continue;
+    (out[f.checkId] ??= {})[f.name] = value;
+  }
+  return out;
+}
 function tuningToLegacyPolicy(policy, tuning) {
   const unknown = [];
   for (const [id, fields] of Object.entries(tuning)) {
@@ -5459,6 +5501,25 @@ function checkToLegacyPolicy(policy, id, v) {
       return false;
   }
 }
+function knobStatedChecks(policy) {
+  const out = /* @__PURE__ */ new Set();
+  const has = (o, key) => !!o && typeof o === "object" && o[key] !== void 0;
+  const { dlp, egress, loopDetection, injectionScan, skillPinning, packageCheck } = policy;
+  const uc = policy.untrustedContent;
+  if (has(dlp, "enabled")) out.add("data.secrets");
+  if (has(dlp, "reviewAction") || dlp?.enabled === false) out.add("data.secrets-weak");
+  if (has(dlp, "pii")) out.add("data.pii");
+  if (has(egress, "enabled") || has(egress, "mode")) out.add("network.unknown-host");
+  if (has(egress, "ssrfStrict")) out.add("network.internal-addresses");
+  if (has(loopDetection, "enabled")) out.add("behavior.loops");
+  if (has(injectionScan, "enabled")) out.add("behavior.prompt-injection");
+  if (has(skillPinning, "enabled") || has(skillPinning, "mode")) out.add("loading.skill-tamper");
+  if (has(packageCheck, "enabled") || has(packageCheck, "onMalicious"))
+    out.add("loading.malicious-package");
+  if (uc && typeof uc === "object" && (uc.enabled === false || has(uc, "afterExposure")))
+    out.add("behavior.untrusted-content");
+  return out;
+}
 function isKnobGoverned(id) {
   return id in KNOB_GOVERNED;
 }
@@ -6269,7 +6330,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       if (v?.logged) noteLogged(v);
       else if (v) candidates.push(v);
     };
-    const inline = config.settings.mode === "strict" ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
+    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
     if (inline !== null) {
       consider("commands.inline-exec", {
         decision: "review",
@@ -6329,21 +6390,17 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     if (firstToken && firstToken.startsWith("/") && checkProvenance2) {
       const prov = checkProvenance2(firstToken, cwd);
       if (prov.trustLevel === "suspect") {
-        const value = cv("commands.temp-binary");
-        const v = applyCheckValue(
-          value === "review" && config.settings.mode === "strict" ? "block" : value,
-          {
-            decision: "review",
-            blockedByLabel: "Node9: Suspect Binary",
-            reason: `Binary "${firstToken}" resolved to ${prov.resolvedPath} \u2014 ${prov.reason}`,
-            tier: 3,
-            checkId: "commands.temp-binary"
-          }
-        );
+        const v = applyCheckValue(cv("commands.temp-binary"), {
+          decision: "review",
+          blockedByLabel: "Node9: Suspect Binary",
+          reason: `Binary "${firstToken}" resolved to ${prov.resolvedPath} \u2014 ${prov.reason}`,
+          tier: 3,
+          checkId: "commands.temp-binary"
+        });
         if (v?.logged) noteLogged(v);
         else if (v) return v;
       }
-      if (prov.trustLevel === "unknown" && config.settings.mode === "strict") {
+      if (prov.trustLevel === "unknown" && isBlockAll(config.settings.mode)) {
         return {
           decision: "review",
           blockedByLabel: "Node9: Unknown Binary (strict mode)",
@@ -6434,7 +6491,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     if (v?.logged) noteLogged(v);
     else if (v) return v;
   }
-  if (config.settings.mode === "strict") {
+  if (isBlockAll(config.settings.mode)) {
     if (activeEnvironment?.requireApproval === false) return allowed();
     return {
       decision: "review",
@@ -7365,7 +7422,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, MAX, UNTRUSTED_TOOLS, SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, MAX, UNTRUSTED_TOOLS, SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -9173,6 +9230,52 @@ var init_dist = __esm({
         advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
       }
     };
+    LEVELS = ["audit", "soft", "standard", "strict", "block-all"];
+    MODE_VALUES = ["observe", ...LEVELS];
+    SOFT = {
+      "commands.inline-exec": "log",
+      "commands.eval-dynamic": "log",
+      "commands.rm": "log",
+      "commands.chmod": "log",
+      "commands.sudo": "log",
+      "commands.git-destructive": "log",
+      "commands.sql-ddl": "log",
+      "commands.sql-no-where": "log",
+      "commands.temp-binary": "log",
+      "commands.disk-destroy": "log",
+      "commands.dangerous-word": "log",
+      "files.system-dirs": "log",
+      "files.shell-startup": "log",
+      "files.password-hashes": "log",
+      "data.pipe-chain": "log",
+      "behavior.untrusted-content": "log"
+    };
+    STRICT = {
+      "commands.sql-ddl": "block",
+      "commands.disk-destroy": "block",
+      "commands.node9-disarm": "block",
+      "files.system-dirs": "block",
+      "files.shell-startup": "block",
+      "files.password-hashes": "block",
+      "data.secrets-weak": "block",
+      "data.pipe-chain": "block",
+      "network.unknown-host": "review",
+      "network.internal-addresses": "block",
+      "behavior.prompt-injection": "log",
+      "loading.skill-tamper": "block"
+    };
+    BLOCK_ALL = {
+      ...STRICT,
+      "commands.unknown": "review",
+      "commands.temp-binary": "block"
+    };
+    LEVEL_CHECKS = {
+      audit: {},
+      soft: SOFT,
+      standard: {},
+      strict: STRICT,
+      "block-all": BLOCK_ALL
+    };
     VERDICTS = ["off", "log", "review", "block"];
     CHECK_VERDICT_RANK = { off: 0, log: 1, review: 2, block: 3 };
     ALL = VERDICTS;
@@ -9629,7 +9732,7 @@ var init_dist = __esm({
       "commands.rm": (s) => knob(s.commandChecks?.rmAdvisory),
       "commands.chmod": (s) => knob(s.commandChecks?.chmod),
       "commands.sql-ddl": (s) => knob(s.commandChecks?.sqlDdl),
-      "commands.unknown": (s) => s.mode === void 0 ? void 0 : s.mode === "strict" ? "review" : "off",
+      "commands.unknown": (s) => s.mode === void 0 ? void 0 : isBlockAll(s.mode) ? "review" : "off",
       "data.secrets": (s) => enabledOr(s.dlp?.enabled, "block"),
       "data.secrets-weak": (s) => {
         if (s.dlp?.enabled === false) return "off";
@@ -15258,7 +15361,8 @@ var SmartRuleSchema = z.object({
 var ConfigFileSchema = z.object({
   version: z.string().optional(),
   settings: z.object({
-    mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
+    // The protection level (levels.ts in the engine); `observe` is Audit's older name.
+    mode: z.enum(["observe", "audit", "soft", "standard", "strict", "block-all"]).optional(),
     autoStartDaemon: z.boolean().optional(),
     // enableUndo / policy.snapshot: removed with the undo feature. The
     // schema strips undeclared keys silently (plain zod object — no
@@ -15633,7 +15737,7 @@ function readShieldOverrides() {
 }
 
 // src/config/managed.ts
-var MODE_ORDER = ["observe", "audit", "standard", "strict"];
+var MODE_ORDER = ["observe", "audit", "soft", "standard", "strict", "block-all"];
 var EGRESS_MODE_ORDER = ["off", "review", "block"];
 function rankIn(order, value) {
   return value === void 0 ? -1 : order.indexOf(value);
@@ -15896,7 +16000,7 @@ function v2ToLegacy(raw, options = {}) {
       continue;
     }
     if (id === "commands.unknown") {
-      warnings.push(`checks.${id}: set "mode": "strict" instead`);
+      warnings.push(`checks.${id}: set "mode": "block-all" instead`);
       continue;
     }
     const allowed = configurableValues(id);
@@ -16435,6 +16539,11 @@ var KNOB_TO_CHECK = {
   evalDynamic: "commands.eval-dynamic",
   pipeChainHigh: "data.pipe-chain"
 };
+function statedSignalFields(policy) {
+  return Object.keys(tuningFromLegacyPolicy(policy)["loading.malicious-package"] ?? {}).filter(
+    (k) => k === "newPackage" || k === "installScript"
+  );
+}
 function catalogSettingsFrom(settings, policy) {
   return catalogSettingsFromConfig(settings, policy);
 }
@@ -16502,6 +16611,8 @@ function getConfig(cwd) {
   const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
   let ssrfStrictSource = "default";
   const workspaceChecks = {};
+  const managedStatedChecks = /* @__PURE__ */ new Set();
+  const managedStatedSignals = /* @__PURE__ */ new Set();
   const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
@@ -16709,9 +16820,11 @@ function getConfig(cwd) {
       if (raw.managedConfig && typeof raw.managedConfig === "object") {
         const mc = raw.managedConfig;
         const locked = Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : [];
+        for (const id of knobStatedChecks(mc)) managedStatedChecks.add(id);
+        for (const k of statedSignalFields(mc)) managedStatedSignals.add(k);
         if (typeof mc.mode === "string") {
           if (keyed) {
-            if (["observe", "audit", "standard", "strict"].includes(mc.mode)) {
+            if (isModeValue(mc.mode)) {
               mergedSettings.mode = mc.mode;
             }
           } else {
@@ -16993,14 +17106,15 @@ function getConfig(cwd) {
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && // PR-2: one listening point includes the env var — a keyed machine's
   // mode comes from the workspace (or the shipped default), never the shell.
-  !keyed && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+  !keyed && isModeValue(envMode)) {
     mergedSettings.mode = envMode;
   }
-  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
+  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && isRecordOnly(mergedSettings.mode)) {
     mergedSettings.mode = "standard";
   }
-  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && mergedSettings.mode === "strict";
-  if (modeCloudControlled && mergedSettings.mode === "strict") {
+  const cloudStrictLevel = levelOf(mergedSettings.mode) === "strict" || levelOf(mergedSettings.mode) === "block-all";
+  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && cloudStrictLevel;
+  if (modeCloudControlled && cloudStrictLevel) {
     for (const name of Object.keys(mergedEnvironments)) {
       if (mergedEnvironments[name]?.requireApproval === false) {
         const cleaned = { ...mergedEnvironments[name] };
@@ -17018,6 +17132,35 @@ function getConfig(cwd) {
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
   mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   const resolvedSsrfStrictSource = keyed && ssrfStrictSource === "local" ? "default" : ssrfStrictSource;
+  const level = levelOf(mergedSettings.mode);
+  const levelKnobChecks = Object.entries(levelChecks(level)).filter(([id]) => isKnobGoverned(id));
+  const signals = levelPackageSignals(level);
+  if (levelKnobChecks.length > 0 || signals) {
+    const policyOf = (layer) => layer?.policy ?? {};
+    const trusted = /* @__PURE__ */ new Set([...managedStatedChecks, ...Object.keys(workspaceChecks)]);
+    const trustedSignals = new Set(managedStatedSignals);
+    const project = /* @__PURE__ */ new Set();
+    const projectSignals = /* @__PURE__ */ new Set();
+    if (!keyed) {
+      for (const id of knobStatedChecks(policyOf(globalConfig))) trusted.add(id);
+      for (const k of statedSignalFields(policyOf(globalConfig))) trustedSignals.add(k);
+      for (const id of knobStatedChecks(policyOf(projectConfig))) project.add(id);
+      for (const k of statedSignalFields(policyOf(projectConfig))) projectSignals.add(k);
+    }
+    const before = resolveCheckMap(catalogSettingsFromConfig({}, mergedPolicy));
+    for (const [id, v] of levelKnobChecks) {
+      if (trusted.has(id)) continue;
+      if (project.has(id) && CHECK_VERDICT_RANK[v] <= CHECK_VERDICT_RANK[before[id] ?? "off"])
+        continue;
+      checkToLegacyPolicy(mergedPolicy, id, v);
+    }
+    if (signals) {
+      for (const key of ["newPackage", "installScript"]) {
+        if (trustedSignals.has(key) || projectSignals.has(key)) continue;
+        mergedPolicy.packageCheck[key] = signals[key];
+      }
+    }
+  }
   const explicit = {};
   const checkSources = {};
   if (keyed) {
@@ -17189,6 +17332,9 @@ function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false
 // src/utils/regex.ts
 init_dist();
 
+// src/policy/index.ts
+init_dist();
+
 // src/dlp.ts
 init_dist();
 init_dist();
@@ -20117,11 +20263,11 @@ async function checkOne(p, cfg, misses, networkCapped, cwd) {
   }
   return findings;
 }
-var SOFT = /* @__PURE__ */ new Set(["new", "install-script"]);
+var SOFT2 = /* @__PURE__ */ new Set(["new", "install-script"]);
 async function byHistory(p, version, info, findings, misses) {
   let out = findings;
   let h = info.history;
-  if (!h && p.ecosystem === "PyPI" && out.some((f) => SOFT.has(f.kind))) {
+  if (!h && p.ecosystem === "PyPI" && out.some((f) => SOFT2.has(f.kind))) {
     try {
       h = await pypiHistory(p.name, version) ?? void 0;
     } catch (err) {
@@ -20141,7 +20287,7 @@ async function byHistory(p, version, info, findings, misses) {
   });
   if (p.ecosystem === "npm") {
     if (h.previousProvenance && h.provenance === false) return [...out, drop()];
-    if (!out.some((f) => SOFT.has(f.kind)) || !h.provenance || !h.previousProvenance) return out;
+    if (!out.some((f) => SOFT2.has(f.kind)) || !h.provenance || !h.previousProvenance) return out;
     const [now, before] = await Promise.all([
       npmSourceRepo(p.name, version),
       npmSourceRepo(p.name, previous)
@@ -20149,7 +20295,7 @@ async function byHistory(p, version, info, findings, misses) {
     return vouched(p, version, now, before, out, misses);
   }
   if (p.ecosystem === "PyPI") {
-    if (!out.some((f) => SOFT.has(f.kind)) || !info.file || !h.previousFile) return out;
+    if (!out.some((f) => SOFT2.has(f.kind)) || !info.file || !h.previousFile) return out;
     const [now, before] = await Promise.all([
       pypiSourceRepo(p.name, version, info.file),
       pypiSourceRepo(p.name, previous, h.previousFile)
@@ -20165,7 +20311,7 @@ function vouched(p, version, now, before, findings, misses) {
     return findings;
   }
   if (now === "none" || before === "none" || now !== before) return findings;
-  return findings.filter((f) => !SOFT.has(f.kind));
+  return findings.filter((f) => !SOFT2.has(f.kind));
 }
 async function runPackageCheck(toolName, args, cfg, cwd) {
   if (!cfg.enabled) return ALLOW;
@@ -20485,7 +20631,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     appendHookDebug(toolName, args, meta, hashAuditArgs);
   }
   const isManual = meta?.agent === "Terminal";
-  const isObserveMode = config.settings.mode === "observe";
+  const isObserveMode = isRecordOnly(config.settings.mode);
   let explainableLabel = "Local Config";
   let dlpReviewFlagged = false;
   let packageReview = null;
@@ -20543,7 +20689,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     explainableLabel = "Shell inspection incomplete";
     policyRuleDescription = "The executable command could not be inspected. Approve this call explicitly.";
   }
-  const fileReview = !isObserveMode && config.settings.mode !== "audit" && fileFinding?.decision === "review";
+  const fileReview = !isObserveMode && fileFinding?.decision === "review";
   const evaluateCurrentPolicy = async (skipIgnoredFastPath = false) => {
     const own = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd, {
       fileAccess,
@@ -20570,7 +20716,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   if (fileFinding) {
     meta = { ...meta, ruleName: fileFinding.ruleName };
     hashAuditArgs = true;
-    const observing = isObserveMode || config.settings.mode === "audit";
+    const observing = isObserveMode;
     const blocked = !observing && (fileFinding.decision === "block" || fileReview && config.settings.panicMode);
     appendLocalAudit(
       toolName,
@@ -21052,15 +21198,6 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     }
     return { approved: true, checkedBy: "audit" };
   }
-  if (config.settings.mode === "audit") {
-    if (judge) {
-      const policyResult = await evaluateCurrentPolicy();
-      if (policyResult.decision === "review") {
-        appendLocalAudit(toolName, args, "allow", "audit-mode", ownRowMeta(true), hashAuditArgs);
-      }
-    }
-    return { approved: true, checkedBy: "audit" };
-  }
   let appPermReview = null;
   let appPermReviewTool = null;
   const callSpecificReview = () => fileReview || shellReview || dlpReviewFlagged || !!appPermReview || !!taintWarning || !!exposureReview || !!packageReview;

package/dist/scan-ink.mjs

@@ -102,7 +102,8 @@ var SmartRuleSchema = z.object({
 var ConfigFileSchema = z.object({
   version: z.string().optional(),
   settings: z.object({
-    mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
+    // The protection level (levels.ts in the engine); `observe` is Audit's older name.
+    mode: z.enum(["observe", "audit", "soft", "standard", "strict", "block-all"]).optional(),
     autoStartDaemon: z.boolean().optional(),
     // enableUndo / policy.snapshot: removed with the undo feature. The
     // schema strips undeclared keys silently (plain zod object — no
@@ -2121,6 +2122,27 @@ var CHECK_TEXT = {
     advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
   }
 };
+var LEVELS = ["audit", "soft", "standard", "strict", "block-all"];
+var MODE_VALUES = ["observe", ...LEVELS];
+var STRICT = {
+  "commands.sql-ddl": "block",
+  "commands.disk-destroy": "block",
+  "commands.node9-disarm": "block",
+  "files.system-dirs": "block",
+  "files.shell-startup": "block",
+  "files.password-hashes": "block",
+  "data.secrets-weak": "block",
+  "data.pipe-chain": "block",
+  "network.unknown-host": "review",
+  "network.internal-addresses": "block",
+  "behavior.prompt-injection": "log",
+  "loading.skill-tamper": "block"
+};
+var BLOCK_ALL = {
+  ...STRICT,
+  "commands.unknown": "review",
+  "commands.temp-binary": "block"
+};
 var VERDICTS = ["off", "log", "review", "block"];
 var ALL = VERDICTS;
 var BUILTIN_DANGEROUS_WORDS = ["mkfs", "shred"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.38.0",
+  "version": "2.39.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",