@node9/proxy 2.38.0 → 2.40.0

package/dist/index.mjs

@@ -438,6 +438,32 @@ function ssrfFloorDecision(m, asWritten, opts) {
   }
   return "block";
 }
+function isModeValue(v) {
+  return typeof v === "string" && MODE_VALUES.includes(v);
+}
+function levelOf(mode) {
+  if (mode === "observe") return "audit";
+  return LEVELS.includes(mode ?? "") ? mode : "standard";
+}
+function isRecordOnly(mode) {
+  return levelOf(mode) === "audit";
+}
+function reviewsEveryInline(mode) {
+  const level = levelOf(mode);
+  return level === "strict" || level === "block-all";
+}
+function isBlockAll(mode) {
+  return levelOf(mode) === "block-all";
+}
+function levelCheckValue(mode, id) {
+  return LEVEL_CHECKS[levelOf(mode)][id];
+}
+function levelChecks(mode) {
+  return LEVEL_CHECKS[levelOf(mode)];
+}
+function levelPackageSignals(mode) {
+  return levelOf(mode) === "soft" ? { newPackage: "off", installScript: "off" } : void 0;
+}
 function isVerdict(v) {
   return v === "off" || v === "log" || v === "review" || v === "block";
 }
@@ -583,19 +609,21 @@ function resolveCheck(settings, id) {
   if (!def) return void 0;
   if (isLockedCheck(def)) return { id, value: "block", source: "locked" };
   const floor = def.floor ? CHECK_VERDICT_RANK[def.floor] : 0;
+  const levelDefault = levelCheckValue(settings.mode, id) ?? def.defaultValue;
+  const sourceOf = (value2) => value2 === levelDefault ? "default" : "configured";
   const explicit = settings.checks?.[id];
   if (isVerdict(explicit)) {
     const value2 = CHECK_VERDICT_RANK[explicit] < floor ? def.floor : explicit;
-    return { id, value: value2, source: value2 === def.defaultValue ? "default" : "configured" };
+    return { id, value: value2, source: sourceOf(value2) };
   }
   if (def.pack) {
     const on = settings.appliedShields?.includes(def.pack) ?? false;
     return { id, value: on ? def.defaultValue : "off", source: "default" };
   }
   const read2 = LEGACY_READERS[id]?.(settings);
-  if (read2 === void 0) return { id, value: def.defaultValue, source: "default" };
+  if (read2 === void 0) return { id, value: levelDefault, source: "default" };
   const value = CHECK_VERDICT_RANK[read2] < floor ? def.floor : read2;
-  return { id, value, source: value === def.defaultValue ? "default" : "configured" };
+  return { id, value, source: sourceOf(value) };
 }
 function checkValue(settings, id) {
   return resolveCheck(settings, id)?.value ?? "off";
@@ -5345,6 +5373,20 @@ function extractPackageInstalls(command) {
     return true;
   });
 }
+function tuningFromLegacyPolicy(policy) {
+  const out = {};
+  const p = policy;
+  if (policy.packageCheck?.registrySignals === false) {
+    out["loading.malicious-package"] = { newPackage: "off", installScript: "off" };
+  }
+  for (const f of TUNING_FIELDS) {
+    const [block, key] = f.legacy;
+    const value = p[block]?.[key];
+    if (value === void 0) continue;
+    (out[f.checkId] ??= {})[f.name] = value;
+  }
+  return out;
+}
 function tuningToLegacyPolicy(policy, tuning) {
   const unknown = [];
   for (const [id, fields] of Object.entries(tuning)) {
@@ -5459,6 +5501,25 @@ function checkToLegacyPolicy(policy, id, v) {
       return false;
   }
 }
+function knobStatedChecks(policy) {
+  const out = /* @__PURE__ */ new Set();
+  const has = (o, key) => !!o && typeof o === "object" && o[key] !== void 0;
+  const { dlp, egress, loopDetection, injectionScan, skillPinning, packageCheck } = policy;
+  const uc = policy.untrustedContent;
+  if (has(dlp, "enabled")) out.add("data.secrets");
+  if (has(dlp, "reviewAction") || dlp?.enabled === false) out.add("data.secrets-weak");
+  if (has(dlp, "pii")) out.add("data.pii");
+  if (has(egress, "enabled") || has(egress, "mode")) out.add("network.unknown-host");
+  if (has(egress, "ssrfStrict")) out.add("network.internal-addresses");
+  if (has(loopDetection, "enabled")) out.add("behavior.loops");
+  if (has(injectionScan, "enabled")) out.add("behavior.prompt-injection");
+  if (has(skillPinning, "enabled") || has(skillPinning, "mode")) out.add("loading.skill-tamper");
+  if (has(packageCheck, "enabled") || has(packageCheck, "onMalicious"))
+    out.add("loading.malicious-package");
+  if (uc && typeof uc === "object" && (uc.enabled === false || has(uc, "afterExposure")))
+    out.add("behavior.untrusted-content");
+  return out;
+}
 function isKnobGoverned(id) {
   return id in KNOB_GOVERNED;
 }
@@ -6269,7 +6330,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       if (v?.logged) noteLogged(v);
       else if (v) candidates.push(v);
     };
-    const inline = config.settings.mode === "strict" ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
+    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
     if (inline !== null) {
       consider("commands.inline-exec", {
         decision: "review",
@@ -6329,21 +6390,17 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     if (firstToken && firstToken.startsWith("/") && checkProvenance2) {
       const prov = checkProvenance2(firstToken, cwd);
       if (prov.trustLevel === "suspect") {
-        const value = cv("commands.temp-binary");
-        const v = applyCheckValue(
-          value === "review" && config.settings.mode === "strict" ? "block" : value,
-          {
-            decision: "review",
-            blockedByLabel: "Node9: Suspect Binary",
-            reason: `Binary "${firstToken}" resolved to ${prov.resolvedPath} \u2014 ${prov.reason}`,
-            tier: 3,
-            checkId: "commands.temp-binary"
-          }
-        );
+        const v = applyCheckValue(cv("commands.temp-binary"), {
+          decision: "review",
+          blockedByLabel: "Node9: Suspect Binary",
+          reason: `Binary "${firstToken}" resolved to ${prov.resolvedPath} \u2014 ${prov.reason}`,
+          tier: 3,
+          checkId: "commands.temp-binary"
+        });
         if (v?.logged) noteLogged(v);
         else if (v) return v;
       }
-      if (prov.trustLevel === "unknown" && config.settings.mode === "strict") {
+      if (prov.trustLevel === "unknown" && isBlockAll(config.settings.mode)) {
         return {
           decision: "review",
           blockedByLabel: "Node9: Unknown Binary (strict mode)",
@@ -6434,7 +6491,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     if (v?.logged) noteLogged(v);
     else if (v) return v;
   }
-  if (config.settings.mode === "strict") {
+  if (isBlockAll(config.settings.mode)) {
     if (activeEnvironment?.requireApproval === false) return allowed();
     return {
       decision: "review",
@@ -7365,7 +7422,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, MAX, UNTRUSTED_TOOLS, SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, MAX, UNTRUSTED_TOOLS, SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -8996,7 +9053,7 @@ var init_dist = __esm({
       "actions.money": {
         plain: "The agent moves money (a refund, a payout, a transfer, a charge) through an app node9 has no protection for, such as an internal billing server.",
         example: "refund_order on a server called acme-billing",
-        advice: "Keep Review. When the app is Stripe or PayPal, turn on its own protection instead: it covers the CLI, the API and scripts too, and a call from it no longer comes here."
+        advice: "Standard records these and Strict asks. Set Review to be asked before every money move at any level. When the app is Stripe or PayPal, turn on its own protection instead: it covers the CLI, the API and scripts too, and a call from it no longer comes here."
       },
       "actions.access": {
         plain: "The agent changes a password, a key, a role or who belongs to a team, through an app node9 has no protection for.",
@@ -9173,6 +9230,54 @@ var init_dist = __esm({
         advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
       }
     };
+    LEVELS = ["audit", "soft", "standard", "strict", "block-all"];
+    MODE_VALUES = ["observe", ...LEVELS];
+    SOFT = {
+      "commands.inline-exec": "log",
+      "commands.eval-dynamic": "log",
+      "commands.rm": "log",
+      "commands.chmod": "log",
+      "commands.sudo": "log",
+      "commands.git-destructive": "log",
+      "commands.sql-ddl": "log",
+      "commands.sql-no-where": "log",
+      "commands.temp-binary": "log",
+      "commands.disk-destroy": "log",
+      "commands.dangerous-word": "log",
+      "files.system-dirs": "log",
+      "files.shell-startup": "log",
+      "files.password-hashes": "log",
+      "data.pipe-chain": "log",
+      "behavior.untrusted-content": "log"
+    };
+    STRICT = {
+      "commands.sql-ddl": "block",
+      "commands.disk-destroy": "block",
+      "commands.node9-disarm": "block",
+      "files.system-dirs": "block",
+      "files.shell-startup": "block",
+      "files.password-hashes": "block",
+      "data.secrets-weak": "block",
+      "data.pipe-chain": "block",
+      "network.unknown-host": "review",
+      "network.internal-addresses": "block",
+      "behavior.prompt-injection": "log",
+      "loading.skill-tamper": "block",
+      // Standard records money moves (catalog default log); Strict asks.
+      "actions.money": "review"
+    };
+    BLOCK_ALL = {
+      ...STRICT,
+      "commands.unknown": "review",
+      "commands.temp-binary": "block"
+    };
+    LEVEL_CHECKS = {
+      audit: {},
+      soft: SOFT,
+      standard: {},
+      strict: STRICT,
+      "block-all": BLOCK_ALL
+    };
     VERDICTS = ["off", "log", "review", "block"];
     CHECK_VERDICT_RANK = { off: 0, log: 1, review: 2, block: 3 };
     ALL = VERDICTS;
@@ -9589,7 +9694,10 @@ var init_dist = __esm({
         title: "Money moves",
         catches: "a refund, payout, transfer, charge or withdrawal through an app with no protection of its own",
         values: ALL,
-        defaultValue: "review",
+        // Founder decision 2026-10-25: a transfer the user asked for is ordinary
+        // work. Standard records it; Strict asks (levels.ts); a user who wants to
+        // be asked states review.
+        defaultValue: "log",
         legacy: generalActionRuleNames("finance")
       },
       {
@@ -9629,7 +9737,7 @@ var init_dist = __esm({
       "commands.rm": (s) => knob(s.commandChecks?.rmAdvisory),
       "commands.chmod": (s) => knob(s.commandChecks?.chmod),
       "commands.sql-ddl": (s) => knob(s.commandChecks?.sqlDdl),
-      "commands.unknown": (s) => s.mode === void 0 ? void 0 : s.mode === "strict" ? "review" : "off",
+      "commands.unknown": (s) => s.mode === void 0 ? void 0 : isBlockAll(s.mode) ? "review" : "off",
       "data.secrets": (s) => enabledOr(s.dlp?.enabled, "block"),
       "data.secrets-weak": (s) => {
         if (s.dlp?.enabled === false) return "off";
@@ -15258,7 +15366,8 @@ var SmartRuleSchema = z.object({
 var ConfigFileSchema = z.object({
   version: z.string().optional(),
   settings: z.object({
-    mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
+    // The protection level (levels.ts in the engine); `observe` is Audit's older name.
+    mode: z.enum(["observe", "audit", "soft", "standard", "strict", "block-all"]).optional(),
     autoStartDaemon: z.boolean().optional(),
     // enableUndo / policy.snapshot: removed with the undo feature. The
     // schema strips undeclared keys silently (plain zod object — no
@@ -15633,7 +15742,7 @@ function readShieldOverrides() {
 }
 
 // src/config/managed.ts
-var MODE_ORDER = ["observe", "audit", "standard", "strict"];
+var MODE_ORDER = ["observe", "audit", "soft", "standard", "strict", "block-all"];
 var EGRESS_MODE_ORDER = ["off", "review", "block"];
 function rankIn(order, value) {
   return value === void 0 ? -1 : order.indexOf(value);
@@ -15896,7 +16005,7 @@ function v2ToLegacy(raw, options = {}) {
       continue;
     }
     if (id === "commands.unknown") {
-      warnings.push(`checks.${id}: set "mode": "strict" instead`);
+      warnings.push(`checks.${id}: set "mode": "block-all" instead`);
       continue;
     }
     const allowed = configurableValues(id);
@@ -16217,7 +16326,8 @@ var DEFAULT_CONFIG = {
       // ── Actions in apps (node9Firewall#390) ───────────────────────────────
       // actions.money / actions.access / actions.publish: the action templates
       // on every MCP server no app shield claims, plus the shell publishing
-      // rules. Review by default; the check value governs them.
+      // rules. Review on the rule; the check value governs them (money is
+      // recorded at Standard, asked at Strict).
       ...GENERAL_ACTION_RULES
     ],
     dlp: { enabled: true, scanIgnoredTools: true, pii: "block" },
@@ -16435,6 +16545,11 @@ var KNOB_TO_CHECK = {
   evalDynamic: "commands.eval-dynamic",
   pipeChainHigh: "data.pipe-chain"
 };
+function statedSignalFields(policy) {
+  return Object.keys(tuningFromLegacyPolicy(policy)["loading.malicious-package"] ?? {}).filter(
+    (k) => k === "newPackage" || k === "installScript"
+  );
+}
 function catalogSettingsFrom(settings, policy) {
   return catalogSettingsFromConfig(settings, policy);
 }
@@ -16502,6 +16617,8 @@ function getConfig(cwd) {
   const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
   let ssrfStrictSource = "default";
   const workspaceChecks = {};
+  const managedStatedChecks = /* @__PURE__ */ new Set();
+  const managedStatedSignals = /* @__PURE__ */ new Set();
   const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
@@ -16709,9 +16826,11 @@ function getConfig(cwd) {
       if (raw.managedConfig && typeof raw.managedConfig === "object") {
         const mc = raw.managedConfig;
         const locked = Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : [];
+        for (const id of knobStatedChecks(mc)) managedStatedChecks.add(id);
+        for (const k of statedSignalFields(mc)) managedStatedSignals.add(k);
         if (typeof mc.mode === "string") {
           if (keyed) {
-            if (["observe", "audit", "standard", "strict"].includes(mc.mode)) {
+            if (isModeValue(mc.mode)) {
               mergedSettings.mode = mc.mode;
             }
           } else {
@@ -16993,14 +17112,15 @@ function getConfig(cwd) {
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && // PR-2: one listening point includes the env var — a keyed machine's
   // mode comes from the workspace (or the shipped default), never the shell.
-  !keyed && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+  !keyed && isModeValue(envMode)) {
     mergedSettings.mode = envMode;
   }
-  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
+  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && isRecordOnly(mergedSettings.mode)) {
     mergedSettings.mode = "standard";
   }
-  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && mergedSettings.mode === "strict";
-  if (modeCloudControlled && mergedSettings.mode === "strict") {
+  const cloudStrictLevel = levelOf(mergedSettings.mode) === "strict" || levelOf(mergedSettings.mode) === "block-all";
+  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && cloudStrictLevel;
+  if (modeCloudControlled && cloudStrictLevel) {
     for (const name of Object.keys(mergedEnvironments)) {
       if (mergedEnvironments[name]?.requireApproval === false) {
         const cleaned = { ...mergedEnvironments[name] };
@@ -17018,6 +17138,35 @@ function getConfig(cwd) {
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
   mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   const resolvedSsrfStrictSource = keyed && ssrfStrictSource === "local" ? "default" : ssrfStrictSource;
+  const level = levelOf(mergedSettings.mode);
+  const levelKnobChecks = Object.entries(levelChecks(level)).filter(([id]) => isKnobGoverned(id));
+  const signals = levelPackageSignals(level);
+  if (levelKnobChecks.length > 0 || signals) {
+    const policyOf = (layer) => layer?.policy ?? {};
+    const trusted = /* @__PURE__ */ new Set([...managedStatedChecks, ...Object.keys(workspaceChecks)]);
+    const trustedSignals = new Set(managedStatedSignals);
+    const project = /* @__PURE__ */ new Set();
+    const projectSignals = /* @__PURE__ */ new Set();
+    if (!keyed) {
+      for (const id of knobStatedChecks(policyOf(globalConfig))) trusted.add(id);
+      for (const k of statedSignalFields(policyOf(globalConfig))) trustedSignals.add(k);
+      for (const id of knobStatedChecks(policyOf(projectConfig))) project.add(id);
+      for (const k of statedSignalFields(policyOf(projectConfig))) projectSignals.add(k);
+    }
+    const before = resolveCheckMap(catalogSettingsFromConfig({}, mergedPolicy));
+    for (const [id, v] of levelKnobChecks) {
+      if (trusted.has(id)) continue;
+      if (project.has(id) && CHECK_VERDICT_RANK[v] <= CHECK_VERDICT_RANK[before[id] ?? "off"])
+        continue;
+      checkToLegacyPolicy(mergedPolicy, id, v);
+    }
+    if (signals) {
+      for (const key of ["newPackage", "installScript"]) {
+        if (trustedSignals.has(key) || projectSignals.has(key)) continue;
+        mergedPolicy.packageCheck[key] = signals[key];
+      }
+    }
+  }
   const explicit = {};
   const checkSources = {};
   if (keyed) {
@@ -17189,6 +17338,9 @@ function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false
 // src/utils/regex.ts
 init_dist();
 
+// src/policy/index.ts
+init_dist();
+
 // src/dlp.ts
 init_dist();
 init_dist();
@@ -20117,11 +20269,11 @@ async function checkOne(p, cfg, misses, networkCapped, cwd) {
   }
   return findings;
 }
-var SOFT = /* @__PURE__ */ new Set(["new", "install-script"]);
+var SOFT2 = /* @__PURE__ */ new Set(["new", "install-script"]);
 async function byHistory(p, version, info, findings, misses) {
   let out = findings;
   let h = info.history;
-  if (!h && p.ecosystem === "PyPI" && out.some((f) => SOFT.has(f.kind))) {
+  if (!h && p.ecosystem === "PyPI" && out.some((f) => SOFT2.has(f.kind))) {
     try {
       h = await pypiHistory(p.name, version) ?? void 0;
     } catch (err) {
@@ -20141,7 +20293,7 @@ async function byHistory(p, version, info, findings, misses) {
   });
   if (p.ecosystem === "npm") {
     if (h.previousProvenance && h.provenance === false) return [...out, drop()];
-    if (!out.some((f) => SOFT.has(f.kind)) || !h.provenance || !h.previousProvenance) return out;
+    if (!out.some((f) => SOFT2.has(f.kind)) || !h.provenance || !h.previousProvenance) return out;
     const [now, before] = await Promise.all([
       npmSourceRepo(p.name, version),
       npmSourceRepo(p.name, previous)
@@ -20149,7 +20301,7 @@ async function byHistory(p, version, info, findings, misses) {
     return vouched(p, version, now, before, out, misses);
   }
   if (p.ecosystem === "PyPI") {
-    if (!out.some((f) => SOFT.has(f.kind)) || !info.file || !h.previousFile) return out;
+    if (!out.some((f) => SOFT2.has(f.kind)) || !info.file || !h.previousFile) return out;
     const [now, before] = await Promise.all([
       pypiSourceRepo(p.name, version, info.file),
       pypiSourceRepo(p.name, previous, h.previousFile)
@@ -20165,7 +20317,7 @@ function vouched(p, version, now, before, findings, misses) {
     return findings;
   }
   if (now === "none" || before === "none" || now !== before) return findings;
-  return findings.filter((f) => !SOFT.has(f.kind));
+  return findings.filter((f) => !SOFT2.has(f.kind));
 }
 async function runPackageCheck(toolName, args, cfg, cwd) {
   if (!cfg.enabled) return ALLOW;
@@ -20485,7 +20637,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     appendHookDebug(toolName, args, meta, hashAuditArgs);
   }
   const isManual = meta?.agent === "Terminal";
-  const isObserveMode = config.settings.mode === "observe";
+  const isObserveMode = isRecordOnly(config.settings.mode);
   let explainableLabel = "Local Config";
   let dlpReviewFlagged = false;
   let packageReview = null;
@@ -20543,7 +20695,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     explainableLabel = "Shell inspection incomplete";
     policyRuleDescription = "The executable command could not be inspected. Approve this call explicitly.";
   }
-  const fileReview = !isObserveMode && config.settings.mode !== "audit" && fileFinding?.decision === "review";
+  const fileReview = !isObserveMode && fileFinding?.decision === "review";
   const evaluateCurrentPolicy = async (skipIgnoredFastPath = false) => {
     const own = await evaluatePolicy2(toolName, args, meta?.agent, options?.cwd, {
       fileAccess,
@@ -20570,7 +20722,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   if (fileFinding) {
     meta = { ...meta, ruleName: fileFinding.ruleName };
     hashAuditArgs = true;
-    const observing = isObserveMode || config.settings.mode === "audit";
+    const observing = isObserveMode;
     const blocked = !observing && (fileFinding.decision === "block" || fileReview && config.settings.panicMode);
     appendLocalAudit(
       toolName,
@@ -21052,15 +21204,6 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     }
     return { approved: true, checkedBy: "audit" };
   }
-  if (config.settings.mode === "audit") {
-    if (judge) {
-      const policyResult = await evaluateCurrentPolicy();
-      if (policyResult.decision === "review") {
-        appendLocalAudit(toolName, args, "allow", "audit-mode", ownRowMeta(true), hashAuditArgs);
-      }
-    }
-    return { approved: true, checkedBy: "audit" };
-  }
   let appPermReview = null;
   let appPermReviewTool = null;
   const callSpecificReview = () => fileReview || shellReview || dlpReviewFlagged || !!appPermReview || !!taintWarning || !!exposureReview || !!packageReview;

package/dist/scan-ink.mjs

@@ -102,7 +102,8 @@ var SmartRuleSchema = z.object({
 var ConfigFileSchema = z.object({
   version: z.string().optional(),
   settings: z.object({
-    mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
+    // The protection level (levels.ts in the engine); `observe` is Audit's older name.
+    mode: z.enum(["observe", "audit", "soft", "standard", "strict", "block-all"]).optional(),
     autoStartDaemon: z.boolean().optional(),
     // enableUndo / policy.snapshot: removed with the undo feature. The
     // schema strips undeclared keys silently (plain zod object — no
@@ -1944,7 +1945,7 @@ var CHECK_TEXT = {
   "actions.money": {
     plain: "The agent moves money (a refund, a payout, a transfer, a charge) through an app node9 has no protection for, such as an internal billing server.",
     example: "refund_order on a server called acme-billing",
-    advice: "Keep Review. When the app is Stripe or PayPal, turn on its own protection instead: it covers the CLI, the API and scripts too, and a call from it no longer comes here."
+    advice: "Standard records these and Strict asks. Set Review to be asked before every money move at any level. When the app is Stripe or PayPal, turn on its own protection instead: it covers the CLI, the API and scripts too, and a call from it no longer comes here."
   },
   "actions.access": {
     plain: "The agent changes a password, a key, a role or who belongs to a team, through an app node9 has no protection for.",
@@ -2121,6 +2122,29 @@ var CHECK_TEXT = {
     advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
   }
 };
+var LEVELS = ["audit", "soft", "standard", "strict", "block-all"];
+var MODE_VALUES = ["observe", ...LEVELS];
+var STRICT = {
+  "commands.sql-ddl": "block",
+  "commands.disk-destroy": "block",
+  "commands.node9-disarm": "block",
+  "files.system-dirs": "block",
+  "files.shell-startup": "block",
+  "files.password-hashes": "block",
+  "data.secrets-weak": "block",
+  "data.pipe-chain": "block",
+  "network.unknown-host": "review",
+  "network.internal-addresses": "block",
+  "behavior.prompt-injection": "log",
+  "loading.skill-tamper": "block",
+  // Standard records money moves (catalog default log); Strict asks.
+  "actions.money": "review"
+};
+var BLOCK_ALL = {
+  ...STRICT,
+  "commands.unknown": "review",
+  "commands.temp-binary": "block"
+};
 var VERDICTS = ["off", "log", "review", "block"];
 var ALL = VERDICTS;
 var BUILTIN_DANGEROUS_WORDS = ["mkfs", "shred"];
@@ -2536,7 +2560,10 @@ var PRODUCT_CHECKS = [
     title: "Money moves",
     catches: "a refund, payout, transfer, charge or withdrawal through an app with no protection of its own",
     values: ALL,
-    defaultValue: "review",
+    // Founder decision 2026-10-25: a transfer the user asked for is ordinary
+    // work. Standard records it; Strict asks (levels.ts); a user who wants to
+    // be asked states review.
+    defaultValue: "log",
     legacy: generalActionRuleNames("finance")
   },
   {
@@ -6917,7 +6944,8 @@ var DEFAULT_CONFIG = {
       // ── Actions in apps (node9Firewall#390) ───────────────────────────────
       // actions.money / actions.access / actions.publish: the action templates
       // on every MCP server no app shield claims, plus the shell publishing
-      // rules. Review by default; the check value governs them.
+      // rules. Review on the rule; the check value governs them (money is
+      // recorded at Standard, asked at Strict).
       ...GENERAL_ACTION_RULES
     ],
     dlp: { enabled: true, scanIgnoredTools: true, pii: "block" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.38.0",
+  "version": "2.40.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",