@node9/proxy 2.5.0 → 2.6.2

package/dist/index.js

@@ -4027,6 +4027,10 @@ var COMMAND_CHECK_KEYS = [
   "evalDynamic",
   "pipeChainHigh"
 ];
+var CLASS_B_COMMAND_CHECKS = /* @__PURE__ */ new Set([
+  "evalDynamic",
+  "pipeChainHigh"
+]);
 function applyManagedCommandChecks(local, managed, locked) {
   const next = { ...local };
   for (const key of COMMAND_CHECK_KEYS) {
@@ -4036,7 +4040,7 @@ function applyManagedCommandChecks(local, managed, locked) {
     const resolved = floorValue(COMMAND_CHECK_ORDER, local[key], m, {
       locked: locked.includes(lockKey)
     });
-    if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
+    if (CLASS_B_COMMAND_CHECKS.has(key) && resolved === "off") continue;
     next[key] = resolved;
   }
   return next;
@@ -4177,10 +4181,18 @@ var DANGEROUS_WORDS = [
 ];
 var DEFAULT_CONFIG = {
   version: "1.0",
+  policySource: "local",
   settings: {
     mode: "standard",
     autoStartDaemon: true,
-    enableHookLogDebug: true,
+    // Off by default: this is a DEBUG facility, not part of the product's job.
+    // When on, every tool call appends a row to ~/.node9/hook-debug.log, which
+    // has no production reader and no size ceiling. Turn it on deliberately
+    // (this setting, or NODE9_DEBUG=1) while investigating something.
+    // Error breadcrumbs written from catch blocks are NOT gated by this and
+    // keep working when it is off — see CLAUDE.md "Always write to
+    // hook-debug.log in catch blocks that guard audit trail".
+    enableHookLogDebug: false,
     approvalTimeoutMs: 12e4,
     // 120-second auto-deny timeout
     flightRecorder: true,
@@ -4440,13 +4452,15 @@ function getCredentials() {
       if (profile?.apiKey) {
         return {
           apiKey: profile.apiKey,
-          apiUrl: profile.apiUrl || DEFAULT_API_URL
+          apiUrl: profile.apiUrl || DEFAULT_API_URL,
+          localOnly: profile.localOnly === true || profileName !== "default"
         };
       }
       if (creds.apiKey) {
         return {
           apiKey: creds.apiKey,
-          apiUrl: creds.apiUrl || DEFAULT_API_URL
+          apiUrl: creds.apiUrl || DEFAULT_API_URL,
+          localOnly: creds.localOnly === true
         };
       }
     }
@@ -4558,22 +4572,16 @@ function getConfig(cwd) {
     const i = COMMAND_CHECK_ORDER.indexOf(v ?? "");
     return i === -1 ? 1 : i;
   };
-  const applyLayer = (source, isProject = false) => {
+  const pr2Creds = getCredentials();
+  const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
+  const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
     const p = source.policy || {};
-    if (s.mode !== void 0) mergedSettings.mode = s.mode;
     if (s.autoStartDaemon !== void 0) mergedSettings.autoStartDaemon = s.autoStartDaemon;
     if (s.enableHookLogDebug !== void 0)
       mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
-    if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
     if (s.shipper) mergedSettings.shipper = { ...mergedSettings.shipper, ...s.shipper };
-    if (s.approvalTimeoutMs !== void 0) mergedSettings.approvalTimeoutMs = s.approvalTimeoutMs;
-    if (s.approvalTimeoutSeconds !== void 0 && s.approvalTimeoutMs === void 0)
-      mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
-    if (s.environment !== void 0) mergedSettings.environment = s.environment;
-    if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
-    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.mcpAutoWrap !== void 0) mergedSettings.mcpAutoWrap = s.mcpAutoWrap === true;
@@ -4581,6 +4589,15 @@ function getConfig(cwd) {
       mergedSettings.mcpReconcileIntervalMinutes = s.mcpReconcileIntervalMinutes;
     if (s.mcpStaleAfterDays !== void 0) mergedSettings.mcpStaleAfterDays = s.mcpStaleAfterDays;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
+    if (keyed && !isCloud) return;
+    if (s.mode !== void 0) mergedSettings.mode = s.mode;
+    if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
+    if (s.approvalTimeoutMs !== void 0) mergedSettings.approvalTimeoutMs = s.approvalTimeoutMs;
+    if (s.approvalTimeoutSeconds !== void 0 && s.approvalTimeoutMs === void 0)
+      mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
+    if (s.environment !== void 0) mergedSettings.environment = s.environment;
+    if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
     if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
@@ -4688,6 +4705,9 @@ function getConfig(cwd) {
     /* isProject */
     true
   );
+  if (keyed) {
+    mergedSettings.approvers = { ...mergedSettings.approvers, cloud: true };
+  }
   let cloudManagedShields = [];
   const managedCommandCheckKeys = /* @__PURE__ */ new Set();
   const lockedCommandCheckKeys = /* @__PURE__ */ new Set();
@@ -4700,7 +4720,12 @@ function getConfig(cwd) {
     try {
       const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
-        applyLayer({ policy: { smartRules: raw.rules } });
+        applyLayer(
+          { policy: { smartRules: raw.rules } },
+          false,
+          /* isCloud */
+          true
+        );
       }
       if (Array.isArray(raw.shields)) {
         cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
@@ -4709,47 +4734,85 @@ function getConfig(cwd) {
         const mc = raw.managedConfig;
         const locked = Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : [];
         if (typeof mc.mode === "string") {
-          mergedSettings.mode = resolveManagedMode(
-            mergedSettings.mode,
-            mc.mode,
-            locked.includes("mode")
-          );
+          if (keyed) {
+            if (["observe", "audit", "standard", "strict"].includes(mc.mode)) {
+              mergedSettings.mode = mc.mode;
+            }
+          } else {
+            mergedSettings.mode = resolveManagedMode(
+              mergedSettings.mode,
+              mc.mode,
+              locked.includes("mode")
+            );
+          }
         }
         if (typeof mc.mode === "string" || locked.includes("mode")) {
           modeCloudControlled = true;
         }
         if (mc.egress && typeof mc.egress === "object") {
           const hosts = (v) => Array.isArray(v) ? v.filter((h) => typeof h === "string") : void 0;
-          mergedPolicy.egress = applyManagedEgress(
-            mergedPolicy.egress,
-            {
-              enabled: typeof mc.egress.enabled === "boolean" ? mc.egress.enabled : void 0,
-              mode: typeof mc.egress.mode === "string" ? mc.egress.mode : void 0,
-              allow: hosts(mc.egress.allow),
-              deny: hosts(mc.egress.deny),
-              allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0
-            },
-            locked,
-            egressModeUserSet
-          );
+          if (keyed) {
+            const e = mc.egress;
+            if (typeof e.enabled === "boolean") mergedPolicy.egress.enabled = e.enabled;
+            if (e.mode === "off" || e.mode === "review" || e.mode === "block")
+              mergedPolicy.egress.mode = e.mode;
+            const allow = hosts(e.allow);
+            if (allow) mergedPolicy.egress.allow = allow;
+            const deny = hosts(e.deny);
+            if (deny) mergedPolicy.egress.deny = deny;
+            if (typeof e.allowPrivate === "boolean")
+              mergedPolicy.egress.allowPrivate = e.allowPrivate;
+          } else {
+            mergedPolicy.egress = applyManagedEgress(
+              mergedPolicy.egress,
+              {
+                enabled: typeof mc.egress.enabled === "boolean" ? mc.egress.enabled : void 0,
+                mode: typeof mc.egress.mode === "string" ? mc.egress.mode : void 0,
+                allow: hosts(mc.egress.allow),
+                deny: hosts(mc.egress.deny),
+                allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0
+              },
+              locked,
+              egressModeUserSet
+            );
+          }
         }
         if (mc.dlp && typeof mc.dlp === "object") {
-          mergedPolicy.dlp = applyManagedDlp(
-            mergedPolicy.dlp,
-            {
-              enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
-              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
-              reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
-            },
-            locked
-          );
+          if (keyed) {
+            if (typeof mc.dlp.enabled === "boolean") mergedPolicy.dlp.enabled = mc.dlp.enabled;
+            if (mc.dlp.pii === "off" || mc.dlp.pii === "block") mergedPolicy.dlp.pii = mc.dlp.pii;
+            if (mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block")
+              mergedPolicy.dlp.reviewAction = mc.dlp.reviewAction;
+          } else {
+            mergedPolicy.dlp = applyManagedDlp(
+              mergedPolicy.dlp,
+              {
+                enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
+                pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
+                reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
+              },
+              locked
+            );
+          }
         }
         if (mc.commandChecks && typeof mc.commandChecks === "object") {
-          mergedPolicy.commandChecks = applyManagedCommandChecks(
-            mergedPolicy.commandChecks ?? {},
-            mc.commandChecks,
-            locked
-          );
+          if (keyed) {
+            const src = mc.commandChecks;
+            const next = { ...mergedPolicy.commandChecks ?? {} };
+            for (const key of COMMAND_CHECK_KEYS) {
+              const val = src[key];
+              if (val !== "off" && val !== "review" && val !== "block") continue;
+              if (val === "off" && CLASS_B_COMMAND_CHECKS.has(key)) continue;
+              next[key] = val;
+            }
+            mergedPolicy.commandChecks = next;
+          } else {
+            mergedPolicy.commandChecks = applyManagedCommandChecks(
+              mergedPolicy.commandChecks ?? {},
+              mc.commandChecks,
+              locked
+            );
+          }
           for (const [key, val] of Object.entries(mc.commandChecks)) {
             if (typeof val !== "string") continue;
             managedCommandCheckKeys.add(key);
@@ -4846,7 +4909,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  if (keyed) mergedPolicy.trustedHostsManaged = true;
+  const activeShieldNames = keyed ? [...new Set(cloudManagedShields)] : [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
   const appliedShields = [];
   const cloudManagedSet = new Set(cloudManagedShields);
   for (const shieldName of activeShieldNames) {
@@ -4910,7 +4974,9 @@ function getConfig(cwd) {
     mergedPolicy.smartRules.push(injected);
   }
   const envMode = process.env.NODE9_MODE;
-  if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+  if (envMode && !modeCloudControlled && // PR-2: one listening point includes the env var — a keyed machine's
+  // mode comes from the workspace (or the shipped default), never the shell.
+  !keyed && ["observe", "audit", "standard", "strict"].includes(envMode)) {
     mergedSettings.mode = envMode;
   }
   if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
@@ -4937,7 +5003,11 @@ function getConfig(cwd) {
   const result = {
     settings: mergedSettings,
     policy: mergedPolicy,
-    environments: mergedEnvironments
+    environments: mergedEnvironments,
+    // PR-2 — the one truth introspection reads: which of the two working
+    // modes this machine is in. 'workspace' = keyed, policy from the cloud;
+    // 'local' = the local stack (incl. --local / named-profile keys).
+    policySource: keyed ? "workspace" : "local"
   };
   if (!cwd) cachedConfig = result;
   return result;
@@ -6483,7 +6553,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   } else if (!taintWarning && !appPermReview) {
     const toolLower = toolName.toLowerCase();
     const isFileTool = toolLower === "read" || toolLower === "grep" || toolLower === "glob" || toolLower === "read_file" || toolLower === "grep_search" || toolLower === "list_files";
-    const activeShields = isFileTool ? readActiveShields() : [];
+    const activeShields = isFileTool ? config.policy.appliedShields ?? readActiveShields() : [];
     const managedJail = isFileTool ? config.policy.managedJailPaths ?? [] : [];
     if (isFileTool && (activeShields.includes("project-jail") || activeShields.includes(USER_JAIL_SHIELD) || managedJail.length > 0)) {
       const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
@@ -6580,6 +6650,7 @@ ${appPermReview}`
   // not an approval of an exfiltration risk. Measured against the live BE:
   // {approved:true} without this flag, {pending:true} with it.
   !!taintWarning || void 0;
+  const cloudMayVote = !hardBlockDowngraded;
   if (cloudEnforced) {
     try {
       const initResult = await initNode9SaaS(
@@ -6595,7 +6666,7 @@ ${appPermReview}`
         if (initResult.shadowMode && !localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview && !taintWarning) {
           return { approved: true, checkedBy: "cloud" };
         }
-        if (!localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview && !taintWarning) {
+        if (!forceReview) {
           return {
             approved: !!initResult.approved,
             reason: initResult.reason || (initResult.approved ? void 0 : "Action rejected by organization policy."),
@@ -6676,7 +6747,7 @@ ${appPermReview}`
       }
     }
   }
-  if (cloudEnforced && cloudRequestId) {
+  if (cloudEnforced && cloudRequestId && cloudMayVote) {
     racePromises.push(
       (async () => {
         try {

package/dist/index.mjs

@@ -3997,6 +3997,10 @@ var COMMAND_CHECK_KEYS = [
   "evalDynamic",
   "pipeChainHigh"
 ];
+var CLASS_B_COMMAND_CHECKS = /* @__PURE__ */ new Set([
+  "evalDynamic",
+  "pipeChainHigh"
+]);
 function applyManagedCommandChecks(local, managed, locked) {
   const next = { ...local };
   for (const key of COMMAND_CHECK_KEYS) {
@@ -4006,7 +4010,7 @@ function applyManagedCommandChecks(local, managed, locked) {
     const resolved = floorValue(COMMAND_CHECK_ORDER, local[key], m, {
       locked: locked.includes(lockKey)
     });
-    if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
+    if (CLASS_B_COMMAND_CHECKS.has(key) && resolved === "off") continue;
     next[key] = resolved;
   }
   return next;
@@ -4147,10 +4151,18 @@ var DANGEROUS_WORDS = [
 ];
 var DEFAULT_CONFIG = {
   version: "1.0",
+  policySource: "local",
   settings: {
     mode: "standard",
     autoStartDaemon: true,
-    enableHookLogDebug: true,
+    // Off by default: this is a DEBUG facility, not part of the product's job.
+    // When on, every tool call appends a row to ~/.node9/hook-debug.log, which
+    // has no production reader and no size ceiling. Turn it on deliberately
+    // (this setting, or NODE9_DEBUG=1) while investigating something.
+    // Error breadcrumbs written from catch blocks are NOT gated by this and
+    // keep working when it is off — see CLAUDE.md "Always write to
+    // hook-debug.log in catch blocks that guard audit trail".
+    enableHookLogDebug: false,
     approvalTimeoutMs: 12e4,
     // 120-second auto-deny timeout
     flightRecorder: true,
@@ -4410,13 +4422,15 @@ function getCredentials() {
       if (profile?.apiKey) {
         return {
           apiKey: profile.apiKey,
-          apiUrl: profile.apiUrl || DEFAULT_API_URL
+          apiUrl: profile.apiUrl || DEFAULT_API_URL,
+          localOnly: profile.localOnly === true || profileName !== "default"
         };
       }
       if (creds.apiKey) {
         return {
           apiKey: creds.apiKey,
-          apiUrl: creds.apiUrl || DEFAULT_API_URL
+          apiUrl: creds.apiUrl || DEFAULT_API_URL,
+          localOnly: creds.localOnly === true
         };
       }
     }
@@ -4528,22 +4542,16 @@ function getConfig(cwd) {
     const i = COMMAND_CHECK_ORDER.indexOf(v ?? "");
     return i === -1 ? 1 : i;
   };
-  const applyLayer = (source, isProject = false) => {
+  const pr2Creds = getCredentials();
+  const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
+  const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
     const p = source.policy || {};
-    if (s.mode !== void 0) mergedSettings.mode = s.mode;
     if (s.autoStartDaemon !== void 0) mergedSettings.autoStartDaemon = s.autoStartDaemon;
     if (s.enableHookLogDebug !== void 0)
       mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
-    if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
     if (s.shipper) mergedSettings.shipper = { ...mergedSettings.shipper, ...s.shipper };
-    if (s.approvalTimeoutMs !== void 0) mergedSettings.approvalTimeoutMs = s.approvalTimeoutMs;
-    if (s.approvalTimeoutSeconds !== void 0 && s.approvalTimeoutMs === void 0)
-      mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
-    if (s.environment !== void 0) mergedSettings.environment = s.environment;
-    if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
-    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.mcpAutoWrap !== void 0) mergedSettings.mcpAutoWrap = s.mcpAutoWrap === true;
@@ -4551,6 +4559,15 @@ function getConfig(cwd) {
       mergedSettings.mcpReconcileIntervalMinutes = s.mcpReconcileIntervalMinutes;
     if (s.mcpStaleAfterDays !== void 0) mergedSettings.mcpStaleAfterDays = s.mcpStaleAfterDays;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
+    if (keyed && !isCloud) return;
+    if (s.mode !== void 0) mergedSettings.mode = s.mode;
+    if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
+    if (s.approvalTimeoutMs !== void 0) mergedSettings.approvalTimeoutMs = s.approvalTimeoutMs;
+    if (s.approvalTimeoutSeconds !== void 0 && s.approvalTimeoutMs === void 0)
+      mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
+    if (s.environment !== void 0) mergedSettings.environment = s.environment;
+    if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
     if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
@@ -4658,6 +4675,9 @@ function getConfig(cwd) {
     /* isProject */
     true
   );
+  if (keyed) {
+    mergedSettings.approvers = { ...mergedSettings.approvers, cloud: true };
+  }
   let cloudManagedShields = [];
   const managedCommandCheckKeys = /* @__PURE__ */ new Set();
   const lockedCommandCheckKeys = /* @__PURE__ */ new Set();
@@ -4670,7 +4690,12 @@ function getConfig(cwd) {
     try {
       const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
-        applyLayer({ policy: { smartRules: raw.rules } });
+        applyLayer(
+          { policy: { smartRules: raw.rules } },
+          false,
+          /* isCloud */
+          true
+        );
       }
       if (Array.isArray(raw.shields)) {
         cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
@@ -4679,47 +4704,85 @@ function getConfig(cwd) {
         const mc = raw.managedConfig;
         const locked = Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : [];
         if (typeof mc.mode === "string") {
-          mergedSettings.mode = resolveManagedMode(
-            mergedSettings.mode,
-            mc.mode,
-            locked.includes("mode")
-          );
+          if (keyed) {
+            if (["observe", "audit", "standard", "strict"].includes(mc.mode)) {
+              mergedSettings.mode = mc.mode;
+            }
+          } else {
+            mergedSettings.mode = resolveManagedMode(
+              mergedSettings.mode,
+              mc.mode,
+              locked.includes("mode")
+            );
+          }
         }
         if (typeof mc.mode === "string" || locked.includes("mode")) {
           modeCloudControlled = true;
         }
         if (mc.egress && typeof mc.egress === "object") {
           const hosts = (v) => Array.isArray(v) ? v.filter((h) => typeof h === "string") : void 0;
-          mergedPolicy.egress = applyManagedEgress(
-            mergedPolicy.egress,
-            {
-              enabled: typeof mc.egress.enabled === "boolean" ? mc.egress.enabled : void 0,
-              mode: typeof mc.egress.mode === "string" ? mc.egress.mode : void 0,
-              allow: hosts(mc.egress.allow),
-              deny: hosts(mc.egress.deny),
-              allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0
-            },
-            locked,
-            egressModeUserSet
-          );
+          if (keyed) {
+            const e = mc.egress;
+            if (typeof e.enabled === "boolean") mergedPolicy.egress.enabled = e.enabled;
+            if (e.mode === "off" || e.mode === "review" || e.mode === "block")
+              mergedPolicy.egress.mode = e.mode;
+            const allow = hosts(e.allow);
+            if (allow) mergedPolicy.egress.allow = allow;
+            const deny = hosts(e.deny);
+            if (deny) mergedPolicy.egress.deny = deny;
+            if (typeof e.allowPrivate === "boolean")
+              mergedPolicy.egress.allowPrivate = e.allowPrivate;
+          } else {
+            mergedPolicy.egress = applyManagedEgress(
+              mergedPolicy.egress,
+              {
+                enabled: typeof mc.egress.enabled === "boolean" ? mc.egress.enabled : void 0,
+                mode: typeof mc.egress.mode === "string" ? mc.egress.mode : void 0,
+                allow: hosts(mc.egress.allow),
+                deny: hosts(mc.egress.deny),
+                allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0
+              },
+              locked,
+              egressModeUserSet
+            );
+          }
         }
         if (mc.dlp && typeof mc.dlp === "object") {
-          mergedPolicy.dlp = applyManagedDlp(
-            mergedPolicy.dlp,
-            {
-              enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
-              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
-              reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
-            },
-            locked
-          );
+          if (keyed) {
+            if (typeof mc.dlp.enabled === "boolean") mergedPolicy.dlp.enabled = mc.dlp.enabled;
+            if (mc.dlp.pii === "off" || mc.dlp.pii === "block") mergedPolicy.dlp.pii = mc.dlp.pii;
+            if (mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block")
+              mergedPolicy.dlp.reviewAction = mc.dlp.reviewAction;
+          } else {
+            mergedPolicy.dlp = applyManagedDlp(
+              mergedPolicy.dlp,
+              {
+                enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
+                pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
+                reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
+              },
+              locked
+            );
+          }
         }
         if (mc.commandChecks && typeof mc.commandChecks === "object") {
-          mergedPolicy.commandChecks = applyManagedCommandChecks(
-            mergedPolicy.commandChecks ?? {},
-            mc.commandChecks,
-            locked
-          );
+          if (keyed) {
+            const src = mc.commandChecks;
+            const next = { ...mergedPolicy.commandChecks ?? {} };
+            for (const key of COMMAND_CHECK_KEYS) {
+              const val = src[key];
+              if (val !== "off" && val !== "review" && val !== "block") continue;
+              if (val === "off" && CLASS_B_COMMAND_CHECKS.has(key)) continue;
+              next[key] = val;
+            }
+            mergedPolicy.commandChecks = next;
+          } else {
+            mergedPolicy.commandChecks = applyManagedCommandChecks(
+              mergedPolicy.commandChecks ?? {},
+              mc.commandChecks,
+              locked
+            );
+          }
           for (const [key, val] of Object.entries(mc.commandChecks)) {
             if (typeof val !== "string") continue;
             managedCommandCheckKeys.add(key);
@@ -4816,7 +4879,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  if (keyed) mergedPolicy.trustedHostsManaged = true;
+  const activeShieldNames = keyed ? [...new Set(cloudManagedShields)] : [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
   const appliedShields = [];
   const cloudManagedSet = new Set(cloudManagedShields);
   for (const shieldName of activeShieldNames) {
@@ -4880,7 +4944,9 @@ function getConfig(cwd) {
     mergedPolicy.smartRules.push(injected);
   }
   const envMode = process.env.NODE9_MODE;
-  if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+  if (envMode && !modeCloudControlled && // PR-2: one listening point includes the env var — a keyed machine's
+  // mode comes from the workspace (or the shipped default), never the shell.
+  !keyed && ["observe", "audit", "standard", "strict"].includes(envMode)) {
     mergedSettings.mode = envMode;
   }
   if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
@@ -4907,7 +4973,11 @@ function getConfig(cwd) {
   const result = {
     settings: mergedSettings,
     policy: mergedPolicy,
-    environments: mergedEnvironments
+    environments: mergedEnvironments,
+    // PR-2 — the one truth introspection reads: which of the two working
+    // modes this machine is in. 'workspace' = keyed, policy from the cloud;
+    // 'local' = the local stack (incl. --local / named-profile keys).
+    policySource: keyed ? "workspace" : "local"
   };
   if (!cwd) cachedConfig = result;
   return result;
@@ -6453,7 +6523,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   } else if (!taintWarning && !appPermReview) {
     const toolLower = toolName.toLowerCase();
     const isFileTool = toolLower === "read" || toolLower === "grep" || toolLower === "glob" || toolLower === "read_file" || toolLower === "grep_search" || toolLower === "list_files";
-    const activeShields = isFileTool ? readActiveShields() : [];
+    const activeShields = isFileTool ? config.policy.appliedShields ?? readActiveShields() : [];
     const managedJail = isFileTool ? config.policy.managedJailPaths ?? [] : [];
     if (isFileTool && (activeShields.includes("project-jail") || activeShields.includes(USER_JAIL_SHIELD) || managedJail.length > 0)) {
       const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
@@ -6550,6 +6620,7 @@ ${appPermReview}`
   // not an approval of an exfiltration risk. Measured against the live BE:
   // {approved:true} without this flag, {pending:true} with it.
   !!taintWarning || void 0;
+  const cloudMayVote = !hardBlockDowngraded;
   if (cloudEnforced) {
     try {
       const initResult = await initNode9SaaS(
@@ -6565,7 +6636,7 @@ ${appPermReview}`
         if (initResult.shadowMode && !localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview && !taintWarning) {
           return { approved: true, checkedBy: "cloud" };
         }
-        if (!localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview && !taintWarning) {
+        if (!forceReview) {
           return {
             approved: !!initResult.approved,
             reason: initResult.reason || (initResult.approved ? void 0 : "Action rejected by organization policy."),
@@ -6646,7 +6717,7 @@ ${appPermReview}`
       }
     }
   }
-  if (cloudEnforced && cloudRequestId) {
+  if (cloudEnforced && cloudRequestId && cloudMayVote) {
     racePromises.push(
       (async () => {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.5.0",
+  "version": "2.6.2",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -70,7 +70,9 @@
     "bump-extractor-version": "node scripts/check-extractor-version.mjs --bump",
     "fix": "npm run format && npm run lint:fix",
     "validate": "npm run format && npm run lint && npm run typecheck && npm run test && npm run test:e2e && npm run build",
+    "pretest:e2e": "npm run build",
     "test:e2e": "cross-env NODE9_TESTING=1 bash scripts/e2e.sh",
+    "pretest": "npm run build",
     "test": "cross-env NODE9_TESTING=1 vitest --run",
     "test:coverage": "cross-env NODE9_TESTING=1 vitest --run --coverage",
     "test:watch": "cross-env NODE9_TESTING=1 vitest",