@node9/proxy 2.8.4 → 2.9.0

package/dist/index.mjs

@@ -133,13 +133,21 @@ function filePathFromArgs(args) {
   return void 0;
 }
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
-  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern) || /dlp|taint/i.test(String(meta?.ruleName ?? ""));
+  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || checkedBy.toLowerCase().includes("pii") || Boolean(meta?.dlpPattern) || Boolean(meta?.piiPatterns) || Boolean(meta?.canaryId) || /dlp|taint/i.test(String(meta?.ruleName ?? ""));
   const preview = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args), ...preview ? { argsPreview: preview } : {} } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
   const ruleNameField = meta?.ruleName ? { ruleName: meta.ruleName } : {};
   const agentToolNameField = meta?.agentToolName ? { agentToolName: meta.agentToolName } : {};
   const dlpFields = meta?.dlpPattern ? { dlpPattern: meta.dlpPattern, dlpSample: meta.dlpSample } : {};
+  const canaryFields = meta?.canaryId ? {
+    canaryId: meta.canaryId,
+    ...meta.canaryHash && { canaryHash: meta.canaryHash },
+    ...meta.canaryKind && { canaryKind: meta.canaryKind },
+    ...meta.canaryPath && { canaryPath: meta.canaryPath },
+    ...meta.canaryView && { canaryView: meta.canaryView },
+    ...meta.canaryRetired && { canaryRetired: true }
+  } : {};
   const cloudLinkField = meta?.cloudRequestId ? { cloudRequestId: meta.cloudRequestId } : {};
   const workingDirField = meta?.workingDir ? { workingDir: meta.workingDir } : {};
   const shell = process.env.SHELL ? path.basename(process.env.SHELL) : void 0;
@@ -165,6 +173,7 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     checkedBy,
     ...ruleNameField,
     ...dlpFields,
+    ...canaryFields,
     ...cloudLinkField,
     ...workingDirField,
     ...shellTypeField,
@@ -342,7 +351,11 @@ var ConfigFileSchema = z.object({
       mode: z.enum(["off", "review", "block"]).optional(),
       allow: z.array(z.string()).optional(),
       deny: z.array(z.string()).optional(),
-      allowPrivate: z.boolean().optional()
+      allowPrivate: z.boolean().optional(),
+      // SSRF floor. `ssrfAllow` exempts OVERRIDABLE tiers only; a tier-1
+      // entry is dropped with a warning at load, never silently honoured.
+      ssrfAllow: z.array(z.string()).optional(),
+      ssrfStrict: z.boolean().optional()
     }).optional(),
     loopDetection: z.object({
       enabled: z.boolean().optional(),
@@ -379,8 +392,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path14 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path14}: ${issue.message}`;
+    const path15 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path15}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -396,11 +409,178 @@ import os2 from "os";
 
 // packages/policy-engine/dist/index.mjs
 import safeRegex from "safe-regex2";
+import { createHash as createHash2 } from "crypto";
 import mvdanSh from "mvdan-sh";
 import pm from "picomatch";
 import safeRegex2 from "safe-regex2";
 import safeRegex3 from "safe-regex2";
 import crypto2 from "crypto";
+function validateLuhn(digits) {
+  if (!/^\d+$/.test(digits)) return false;
+  if (digits.length < 12) return false;
+  if (!/[1-9]/.test(digits)) return false;
+  let sum = 0;
+  let double = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (double) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var IBAN_LENGTH = {
+  AD: 24,
+  AE: 23,
+  AL: 28,
+  AT: 20,
+  AZ: 28,
+  BA: 20,
+  BE: 16,
+  BG: 22,
+  BH: 22,
+  BI: 27,
+  BR: 29,
+  BY: 28,
+  CH: 21,
+  CR: 22,
+  CY: 28,
+  CZ: 24,
+  DE: 22,
+  DJ: 27,
+  DK: 18,
+  DO: 28,
+  EE: 20,
+  EG: 29,
+  ES: 24,
+  FI: 18,
+  FK: 18,
+  FO: 18,
+  FR: 27,
+  GB: 22,
+  GE: 22,
+  GI: 23,
+  GL: 18,
+  GR: 27,
+  GT: 28,
+  HN: 28,
+  HR: 21,
+  HU: 28,
+  IE: 22,
+  IL: 23,
+  IQ: 23,
+  IS: 26,
+  IT: 27,
+  JO: 30,
+  KW: 30,
+  KZ: 20,
+  LB: 28,
+  LC: 32,
+  LI: 21,
+  LT: 20,
+  LU: 20,
+  LV: 21,
+  LY: 25,
+  MC: 27,
+  MD: 24,
+  ME: 22,
+  MK: 19,
+  MN: 20,
+  MR: 27,
+  MT: 31,
+  MU: 30,
+  NI: 28,
+  NL: 18,
+  NO: 15,
+  OM: 23,
+  PK: 24,
+  PL: 28,
+  PS: 29,
+  PT: 25,
+  QA: 29,
+  RO: 24,
+  RS: 22,
+  RU: 33,
+  SA: 24,
+  SC: 31,
+  SD: 18,
+  SE: 24,
+  SI: 19,
+  SK: 24,
+  SM: 27,
+  SN: 28,
+  SO: 23,
+  ST: 25,
+  SV: 28,
+  TL: 23,
+  TN: 24,
+  TR: 26,
+  UA: 29,
+  VA: 22,
+  VG: 24,
+  XK: 20,
+  YE: 30
+};
+function validateIban(raw) {
+  const s = raw.replace(/[ -]/g, "").toUpperCase();
+  if (!/^[A-Z]{2}\d{2}/.test(s)) return false;
+  const want = IBAN_LENGTH[s.slice(0, 2)];
+  if (want === void 0 || s.length < want) return false;
+  const iban = s.slice(0, want);
+  if (!/^[A-Z0-9]+$/.test(iban)) return false;
+  const rearranged = iban.slice(4) + iban.slice(0, 4);
+  let mod = 0;
+  for (const ch of rearranged) {
+    const code = ch.charCodeAt(0);
+    const digits = code >= 65 ? String(code - 55) : ch;
+    for (const d of digits) mod = (mod * 10 + (d.charCodeAt(0) - 48)) % 97;
+  }
+  return mod === 1;
+}
+var B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var B58_INDEX = Object.fromEntries(
+  [...B58].map((c, i) => [c, i])
+);
+function validateBase58Check(s) {
+  if (!s) return null;
+  let n = 0n;
+  for (const c of s) {
+    const v = B58_INDEX[c];
+    if (v === void 0) return null;
+    n = n * 58n + BigInt(v);
+  }
+  let hex = n.toString(16);
+  if (hex.length % 2) hex = "0" + hex;
+  let zeros = 0;
+  for (const c of s) {
+    if (c !== "1") break;
+    zeros++;
+  }
+  const bytes = Buffer.concat([
+    Buffer.alloc(zeros),
+    n === 0n ? Buffer.alloc(0) : Buffer.from(hex, "hex")
+  ]);
+  if (bytes.length < 5) return null;
+  const body = bytes.subarray(0, bytes.length - 4);
+  const check = bytes.subarray(bytes.length - 4);
+  const h = createHash2("sha256").update(createHash2("sha256").update(body).digest()).digest();
+  return h.subarray(0, 4).equals(check) ? body : null;
+}
+function validateWif(s) {
+  const p = validateBase58Check(s);
+  if (!p || p[0] !== 128) return false;
+  return p.length === 33 || p.length === 34 && p[33] === 1;
+}
+var XPRV_VERSIONS = /* @__PURE__ */ new Set([76066276, 77428856, 78791436]);
+function validateXprv(s) {
+  const p = validateBase58Check(s);
+  if (!p || p.length !== 78) return false;
+  const version = p.readUInt32BE(0);
+  return XPRV_VERSIONS.has(version) && p[45] === 0;
+}
 var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(?:_key|_token)?|credential|private[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*/i;
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
@@ -593,6 +773,27 @@ var DLP_PATTERNS = [
     severity: "block",
     keywords: ["sg."]
   },
+  // ── Cryptocurrency private keys (base58check-validated) ───────────────────
+  // Both are anchored with \b on each side: unanchored, `[KL][base58]{51}`
+  // matches INSIDE any longer base58 blob (an xprv, a Solana keypair, a
+  // Monero address). Lookbehind fails safe-regex2; \b is the house style
+  // (see the card regexes). Mainnet only, matching validateWif / validateXprv;
+  // testnet (WIF 0xEF, tprv) is deferred. Cost was measured: the WIF regex
+  // runs on every string (first keyword-less pattern) at 0.024 ms per 100 KB
+  // of prose, so no prefilter is warranted.
+  {
+    name: "Bitcoin WIF Private Key",
+    regex: /\b(?:5[1-9A-HJ-NP-Za-km-z]{50}|[KL][1-9A-HJ-NP-Za-km-z]{51})\b/,
+    severity: "block",
+    validate: validateWif
+  },
+  {
+    name: "Extended Private Key",
+    regex: /\b[xyz]prv[1-9A-HJ-NP-Za-km-z]{107}\b/,
+    severity: "block",
+    keywords: ["xprv", "yprv", "zprv"],
+    validate: validateXprv
+  },
   // ── Private keys (PEM) ────────────────────────────────────────────────────
   {
     name: "Private Key (PEM)",
@@ -949,6 +1150,33 @@ function maskSecret(raw, pattern) {
 var MAX_DEPTH = 5;
 var MAX_STRING_BYTES = 1e5;
 var MAX_JSON_PARSE_BYTES = 1e4;
+function suppressed(pattern, raw) {
+  if (pattern.validate) {
+    let ok;
+    try {
+      ok = pattern.validate(raw);
+    } catch {
+      ok = true;
+    }
+    return !ok;
+  }
+  if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) return true;
+  if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) return true;
+  return false;
+}
+function firstAcceptedMatch(pattern, text) {
+  const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : pattern.regex.flags + "g";
+  const re = new RegExp(pattern.regex.source, flags);
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (m[0].length === 0) {
+      re.lastIndex = m.index + 1;
+      continue;
+    }
+    if (!suppressed(pattern, m[0])) return m[0];
+  }
+  return null;
+}
 function scanArgs(args, depth = 0, fieldPath = "args") {
   if (depth > MAX_DEPTH || args === null || args === void 0) return null;
   if (Array.isArray(args)) {
@@ -973,18 +1201,16 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
       if (pattern.keywords && !pattern.keywords.some((kw) => textLower.includes(kw.toLowerCase()))) {
         continue;
       }
-      if (pattern.regex.test(text)) {
-        const raw = text.match(pattern.regex)?.[0] ?? "";
-        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
-        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
-        const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
-        return {
-          patternName: pattern.name,
-          fieldPath,
-          redactedSample: maskSecret(text, pattern.regex),
-          severity
-        };
-      }
+      const raw = firstAcceptedMatch(pattern, text);
+      if (raw === null) continue;
+      const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
+      return {
+        patternName: pattern.name,
+        fieldPath,
+        // Mask the ACCEPTED token, not the first regex hit in the field.
+        redactedSample: maskSecret(raw, pattern.regex),
+        severity
+      };
     }
     if (text.length < MAX_JSON_PARSE_BYTES) {
       const trimmed = text.trim();
@@ -1048,13 +1274,13 @@ function matchesPattern(text, patterns) {
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
 var FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function getNestedValue(obj, path14) {
+function getNestedValue(obj, path15) {
   if (!obj || typeof obj !== "object") return null;
-  const segments = path14.split(".");
-  for (const seg of segments) {
+  const segments2 = path15.split(".");
+  for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
-  return segments.reduce((prev, curr) => prev?.[curr], obj);
+  return segments2.reduce((prev, curr) => prev?.[curr], obj);
 }
 function evaluateSmartConditions(args, rule) {
   if (!rule.conditions || rule.conditions.length === 0) return true;
@@ -2022,6 +2248,50 @@ function extractShellDestinations(command) {
   }
   return out;
 }
+function extractShellDestTokens(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const callArgs = n.Args || [];
+      if (callArgs.length === 0) return true;
+      const name = (resolveWordLiteral(callArgs[0]) || "").toLowerCase();
+      if (!NET_BINARIES.has(name)) return true;
+      const rest = callArgs.slice(1).map((a) => resolveWordLiteral(a));
+      for (const raw of destTokensForBinary(name, rest)) {
+        if (!raw) continue;
+        let tok = raw.trim();
+        const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(tok);
+        const hasScheme = scheme !== null;
+        if (hasScheme) tok = tok.slice(scheme[0].length);
+        tok = tok.split(/[/?#]/)[0];
+        const at = tok.lastIndexOf("@");
+        if (at >= 0) tok = tok.slice(at + 1);
+        if (tok.startsWith("[")) {
+          const close = tok.indexOf("]");
+          if (close > 0) tok = tok.slice(0, close + 1);
+        } else {
+          tok = tok.split(":")[0];
+        }
+        if (!tok) continue;
+        if (!hasScheme && /^\d+$/.test(tok) && Number(tok) < 16777216) continue;
+        const key = `${name}:${tok}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ token: tok, binary: name });
+      }
+      return true;
+    });
+  } catch {
+    return out;
+  }
+  return out;
+}
 var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
@@ -2226,8 +2496,8 @@ function analyzeShellCommand(command) {
   if (allTokens.length === 0) {
     const normalized = command.replace(/\\(.)/g, "$1");
     const sanitized = normalized.replace(/["'<>]/g, " ");
-    const segments = sanitized.split(/[|;&]|\$\(|\)|`/);
-    segments.forEach((segment) => {
+    const segments2 = sanitized.split(/[|;&]|\$\(|\)|`/);
+    segments2.forEach((segment) => {
       const tokens = segment.trim().split(/\s+/).filter(Boolean);
       if (tokens.length > 0) {
         const action = tokens[0].toLowerCase();
@@ -2244,6 +2514,10 @@ function analyzeShellCommand(command) {
   return { actions, paths, allTokens };
 }
 var DEFAULT_EGRESS_ALLOWLIST = [
+  // node9's own control plane (api, app, dev-api, staging and the apex).
+  // Without it, turning egress on asks the user to approve node9 itself.
+  // A user `deny` entry still wins over this list, see evaluateEgress.
+  "*.node9.ai",
   "*.github.com",
   "*.githubusercontent.com",
   "*.npmjs.org",
@@ -2386,7 +2660,7 @@ function isSensitivePath(p) {
   return SENSITIVE_PATTERNS.some((re) => re.test(p));
 }
 function splitOnPipe(cmd) {
-  const segments = [];
+  const segments2 = [];
   let current = "";
   let inSingle = false;
   let inDouble = false;
@@ -2399,21 +2673,21 @@ function splitOnPipe(cmd) {
       inDouble = !inDouble;
       current += ch;
     } else if (ch === "|" && !inSingle && !inDouble && cmd[i + 1] !== "|" && (i === 0 || cmd[i - 1] !== "|")) {
-      segments.push(current.trim());
+      segments2.push(current.trim());
       current = "";
     } else {
       current += ch;
     }
   }
-  if (current.trim()) segments.push(current.trim());
-  return segments.filter(Boolean);
+  if (current.trim()) segments2.push(current.trim());
+  return segments2.filter(Boolean);
 }
 function positionalTokens(segment) {
   return segment.split(/\s+/).slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
 }
 function analyzePipeChain(command) {
-  const segments = splitOnPipe(command);
-  if (segments.length < 2) {
+  const segments2 = splitOnPipe(command);
+  if (segments2.length < 2) {
     return {
       isPipeline: false,
       hasSensitiveSource: false,
@@ -2429,7 +2703,7 @@ function analyzePipeChain(command) {
   let hasSensitiveSource = false;
   let hasExternalSink = false;
   let hasObfuscation = false;
-  for (const segment of segments) {
+  for (const segment of segments2) {
     const tokens = segment.split(/\s+/).filter(Boolean);
     if (tokens.length === 0) continue;
     const binary = tokens[0].toLowerCase();
@@ -2467,8 +2741,8 @@ function analyzePipeChain(command) {
   };
 }
 function basename(p) {
-  const segments = p.split(/[\\/]/);
-  return segments[segments.length - 1] || "";
+  const segments2 = p.split(/[\\/]/);
+  return segments2[segments2.length - 1] || "";
 }
 var FLAGS_WITH_VALUES = {
   curl: /* @__PURE__ */ new Set([
@@ -2631,6 +2905,204 @@ function extractAllSshHosts(tokens) {
   }
   return [...hosts].filter(Boolean);
 }
+var SSRF_MAX_HOST = 253;
+function parseComponent(s) {
+  if (!s) return null;
+  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
+  if (s === "0") return 0;
+  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
+  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
+  return null;
+}
+function parseIpv4(input) {
+  let s = input;
+  if (s.endsWith(".")) s = s.slice(0, -1);
+  if (!s) return null;
+  const parts = s.split(".");
+  if (parts.length > 4) return null;
+  const vals = [];
+  for (const p of parts) {
+    const v = parseComponent(p);
+    if (v === null || !Number.isFinite(v) || v < 0) return null;
+    vals.push(v);
+  }
+  const n = vals.length;
+  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
+  const last = vals[n - 1];
+  const remainingBytes = 4 - (n - 1);
+  const limit = Math.pow(256, remainingBytes);
+  if (last >= limit) return null;
+  let value = last;
+  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
+  if (value > 4294967295) return null;
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function expandIpv6(input) {
+  const s = input.toLowerCase();
+  if (!/^[0-9a-f:.]+$/.test(s)) return null;
+  if ((s.match(/::/g) ?? []).length > 1) return null;
+  let head = s;
+  let tailV4 = null;
+  const lastColon = s.lastIndexOf(":");
+  const afterLast = s.slice(lastColon + 1);
+  if (afterLast.includes(".")) {
+    const dotted = parseIpv4(afterLast);
+    if (!dotted) return null;
+    const o = dotted.split(".").map(Number);
+    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
+    head = s.slice(0, lastColon + 1) + "0";
+  }
+  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
+  const toGroups = (part) => {
+    if (!part) return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const left = toGroups(lhs);
+  if (left === null) return null;
+  let right = [];
+  if (rhs !== null) {
+    const r = toGroups(rhs);
+    if (r === null) return null;
+    right = r;
+  }
+  if (tailV4) {
+    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
+    else left.splice(left.length - 1, 1, ...tailV4);
+  }
+  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
+  if (rhs === null && groups.length !== 8) return null;
+  if (rhs !== null && left.length + right.length > 8) return null;
+  if (groups.length !== 8) return null;
+  return groups;
+}
+function compressIpv6(g) {
+  let bestStart = -1;
+  let bestLen = 0;
+  let i = 0;
+  while (i < 8) {
+    if (g[i] !== 0) {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && g[j] === 0) j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  const hex = g.map((x) => x.toString(16));
+  if (bestLen < 2) return hex.join(":");
+  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
+}
+function normalizeIpLiteral(host) {
+  try {
+    if (typeof host !== "string") return null;
+    let s = host.trim();
+    if (!s || s.length > SSRF_MAX_HOST) return null;
+    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+    const zone = s.indexOf("%");
+    if (zone >= 0) s = s.slice(0, zone);
+    if (!s) return null;
+    if (s.includes(":")) {
+      const g = expandIpv6(s);
+      if (!g) return null;
+      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
+      if (mapped) {
+        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
+      }
+      return compressIpv6(g);
+    }
+    return parseIpv4(s);
+  } catch {
+    return null;
+  }
+}
+var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
+  "169.254.169.254",
+  // AWS / Azure / DigitalOcean / OpenStack IMDS
+  "169.254.170.2",
+  // AWS ECS task role
+  "168.63.129.16",
+  // Azure WireServer
+  "fd00:ec2::254"
+  // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+]);
+var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+var v4Octets = (a) => {
+  const p = a.split(".");
+  return p.length === 4 ? p.map(Number) : null;
+};
+function classifySsrf(host) {
+  try {
+    if (typeof host !== "string" || !host) return null;
+    const lower = host.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host);
+    if (ip === null) {
+      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
+    }
+    const hit = (tier, overridable) => ({
+      tier,
+      overridable,
+      kind: "address",
+      normalized: ip
+    });
+    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
+    const o = v4Octets(ip);
+    if (o) {
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
+      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
+      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
+      if (o[0] === 127) return hit("private", true);
+      if (o[0] === 10) return hit("private", true);
+      if (o[0] === 192 && o[1] === 168) return hit("private", true);
+      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
+      return null;
+    }
+    const g = expandIpv6(ip);
+    if (!g) return null;
+    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if ((g[0] & 65472) === 65152) return hit("link-local", false);
+    if ((g[0] & 65280) === 65280) return hit("multicast", false);
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
+    return null;
+  } catch {
+    return null;
+  }
+}
+var TIER_REASON = {
+  metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
+  "link-local": "a link-local address",
+  multicast: "a multicast address",
+  unspecified: "the unspecified address",
+  cgnat: "a carrier-grade NAT address",
+  private: "a loopback or private address"
+};
+function ssrfFloor(tokens, opts = {}) {
+  const exempt = new Set(
+    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
+  );
+  for (const { token, binary } of tokens) {
+    const m = classifySsrf(token);
+    if (!m) continue;
+    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+    return {
+      ...m,
+      host: token,
+      binary,
+      reason: `Blocked: ${token} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== token ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.")
+    };
+  }
+  return null;
+}
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
 }
@@ -2863,6 +3335,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     const builtin = strictestVerdict(candidates);
     if (builtin) return builtin;
+    {
+      const ssrf = ssrfFloor(extractShellDestTokens(shellCommand), {
+        ssrfAllow: config.policy.egress?.ssrfAllow,
+        ssrfStrict: config.policy.egress?.ssrfStrict
+      });
+      if (ssrf) {
+        return {
+          decision: "block",
+          blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+          reason: ssrf.reason,
+          ruleName: `ssrf:${ssrf.tier}:${ssrf.binary}:${ssrf.host}`,
+          ruleDescription: ssrf.reason,
+          tier: 3
+        };
+      }
+    }
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
@@ -3804,28 +4292,236 @@ function evaluateLoopWindow(records, tool, args, threshold, windowMs, now) {
 var PII_EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/;
 var PII_SSN_RE = /\b\d{3}-\d{2}-\d{4}\b/;
 var PII_PHONE_RE = /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/;
-var PII_CC_RE = /\b(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2}|6\d{3})[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/;
+var PII_CC16_RE = /\b(?:4\d{3}|5[1-5]\d{2}|6\d{3})[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/;
+var PII_CC15_RE = /\b3[47]\d{2}[-\s]?\d{6}[-\s]?\d{5}\b/;
+var PII_IBAN_RE = /\b[A-Z]{2}\d{2}(?:[A-Z0-9]|[ -][A-Z0-9]){11,30}\b/;
+function hasValidCard(text) {
+  for (const base of [PII_CC16_RE, PII_CC15_RE]) {
+    const re = new RegExp(base.source, "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      if (validateLuhn(m[0].replace(/\D/g, ""))) return true;
+      re.lastIndex = m.index + 1;
+    }
+  }
+  return false;
+}
+function hasValidIban(text) {
+  const re = new RegExp(PII_IBAN_RE.source, "g");
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (validateIban(m[0])) return true;
+    re.lastIndex = m.index + 1;
+  }
+  return false;
+}
 function detectPii(text) {
   const found = /* @__PURE__ */ new Set();
   if (/@/.test(text) && PII_EMAIL_RE.test(text)) found.add("Email");
   if (/-/.test(text) && PII_SSN_RE.test(text)) found.add("SSN");
   if (PII_PHONE_RE.test(text)) found.add("Phone");
-  if (PII_CC_RE.test(text)) found.add("Credit Card");
+  if (hasValidCard(text)) found.add("Credit Card");
+  if (hasValidIban(text)) found.add("IBAN");
   return [...found];
 }
-var REALTIME_PII_PATTERNS = ["SSN", "Credit Card"];
+var REALTIME_PII_PATTERNS = ["SSN", "Credit Card", "IBAN"];
 var MAX_PII_SCAN_BYTES = 1e5;
+function* stringLeaves(v, depth = 0) {
+  if (depth > 6) return;
+  if (typeof v === "string") {
+    if (v.length > 0) yield v;
+    return;
+  }
+  if (typeof v === "number") {
+    if (Number.isFinite(v)) yield String(v);
+    return;
+  }
+  if (!v || typeof v !== "object") return;
+  if (Array.isArray(v)) {
+    for (const x of v) yield* stringLeaves(x, depth + 1);
+    return;
+  }
+  for (const x of Object.values(v)) yield* stringLeaves(x, depth + 1);
+}
 function detectArgsPii(args) {
   if (args === null || args === void 0) return [];
-  let text;
+  const found = /* @__PURE__ */ new Set();
+  let budget = MAX_PII_SCAN_BYTES;
   try {
-    text = typeof args === "string" ? args : JSON.stringify(args);
+    for (const leaf of stringLeaves(args)) {
+      if (budget <= 0) break;
+      const t = leaf.length > budget ? leaf.slice(0, budget) : leaf;
+      budget -= t.length;
+      for (const p of detectPii(t)) {
+        if (REALTIME_PII_PATTERNS.includes(p)) found.add(p);
+      }
+    }
   } catch {
     return [];
   }
-  if (typeof text !== "string") return [];
-  if (text.length > MAX_PII_SCAN_BYTES) text = text.slice(0, MAX_PII_SCAN_BYTES);
-  return detectPii(text).filter((p) => REALTIME_PII_PATTERNS.includes(p));
+  return [...found];
+}
+var CANARY_MIN_LENGTH = 16;
+var MAX_TEXT = 1e5;
+var MAX_DEPTH2 = 6;
+var MAX_JSON_PARSE = 1e4;
+var URL_DEPTH = 4;
+var B64_DEPTH = 3;
+var MIN_SEGMENT = 16;
+var SEPARATORS = /[./\\?&= \t\n\r:;,\-_@%+#]/g;
+var stripSeparators = (s) => s.replace(SEPARATORS, "");
+function percentDecodeOnce(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s.replace(/%([0-9A-Fa-f]{2})/g, (_, h) => String.fromCharCode(parseInt(h, 16)));
+  }
+}
+function segments(s, alphabet) {
+  const out = /* @__PURE__ */ new Set();
+  if (alphabet.test(s)) out.add(s);
+  for (const seg of s.split(/[?&\s"'<>]+/)) {
+    if (seg.length >= MIN_SEGMENT && alphabet.test(seg)) out.add(seg);
+    for (const part of seg.split("=")) {
+      if (part.length >= MIN_SEGMENT && alphabet.test(part)) out.add(part);
+    }
+  }
+  return [...out];
+}
+var looksText = (s) => s.length > 0 && !/[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(s);
+var CANARY_DECODERS = {
+  url: (s) => {
+    const out = [];
+    let cur = s;
+    for (let i = 0; i < URL_DEPTH; i++) {
+      const d = percentDecodeOnce(cur);
+      if (d === cur) break;
+      out.push(d);
+      cur = d;
+    }
+    return out;
+  },
+  base64: (s) => {
+    const out = [];
+    let frontier = segments(s, /^[A-Za-z0-9+/\-_=]+$/);
+    for (let depth = 0; depth < B64_DEPTH && frontier.length; depth++) {
+      const next = [];
+      for (const c of frontier) {
+        const d = Buffer.from(c, "base64").toString("utf8");
+        if (!looksText(d) || d.length < CANARY_MIN_LENGTH) continue;
+        out.push(d);
+        next.push(...segments(d, /^[A-Za-z0-9+/\-_=]+$/));
+      }
+      frontier = next;
+    }
+    return out;
+  },
+  hex: (s) => {
+    const out = [];
+    for (const c of segments(s, /^[0-9A-Fa-f]+$/)) {
+      if (c.length % 2 !== 0 || c.length < CANARY_MIN_LENGTH * 2) continue;
+      const d = Buffer.from(c, "hex").toString("utf8");
+      if (looksText(d)) out.push(d);
+    }
+    return out;
+  },
+  separators: (s) => [stripSeparators(s)]
+};
+function lowestOffset(cands, needles, stripped) {
+  let best = null;
+  for (const c of cands) {
+    for (const n of needles) {
+      const off = c.indexOf(stripped ? n.stripped : n.raw);
+      if (off >= 0 && (best === null || off < best.off)) best = { off, v: n.v };
+    }
+  }
+  return best?.v ?? null;
+}
+var VIEWS = [
+  { view: "url-decoded", decoder: "url", stripped: false },
+  { view: "base64-decoded", decoder: "base64", stripped: false },
+  { view: "hex-decoded", decoder: "hex", stripped: false },
+  { view: "separators-stripped", decoder: "separators", stripped: true }
+];
+function prepare(values) {
+  const out = [];
+  for (const v of values) {
+    if (typeof v.value !== "string" || v.value.length < CANARY_MIN_LENGTH) {
+      console.error(
+        `[node9 engine] canary ${v.id}: value shorter than ${CANARY_MIN_LENGTH}, skipped`
+      );
+      continue;
+    }
+    out.push({ v, raw: v.value, stripped: stripSeparators(v.value) });
+  }
+  return out;
+}
+function matchPrepared(text, needles) {
+  if (!text || needles.length === 0) return null;
+  const t = text.length > MAX_TEXT ? text.slice(0, MAX_TEXT) : text;
+  const raw = lowestOffset([t], needles, false);
+  if (raw) return { v: raw, view: "raw" };
+  for (const { view, decoder, stripped } of VIEWS) {
+    let cands;
+    try {
+      cands = CANARY_DECODERS[decoder](t);
+    } catch (e) {
+      console.error(
+        `[node9 engine] canary view ${view} failed, skipped:`,
+        e instanceof Error ? e.message : String(e)
+      );
+      continue;
+    }
+    const hit = lowestOffset(cands, needles, stripped);
+    if (hit) return { v: hit, view };
+  }
+  return null;
+}
+function matchCanaryArgs(args, values) {
+  if (values.length === 0) return null;
+  const needles = prepare(values);
+  if (needles.length === 0) return null;
+  const walk = (v, depth, fieldPath) => {
+    if (depth > MAX_DEPTH2) return null;
+    if (typeof v === "string") {
+      const hit = matchPrepared(v, needles);
+      if (hit) return { id: hit.v.id, view: hit.view, fieldPath, retired: Boolean(hit.v.retired) };
+      if (v.length < MAX_JSON_PARSE) {
+        const trimmed = v.trim();
+        if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+          try {
+            return walk(JSON.parse(v), depth + 1, fieldPath);
+          } catch {
+          }
+        }
+      }
+      return null;
+    }
+    if (typeof v === "number" && Number.isFinite(v)) return walk(String(v), depth, fieldPath);
+    if (Array.isArray(v)) {
+      for (let i = 0; i < v.length; i++) {
+        const h = walk(v[i], depth + 1, `${fieldPath}[${i}]`);
+        if (h) return h;
+      }
+      return null;
+    }
+    if (v && typeof v === "object") {
+      for (const [k, child] of Object.entries(v)) {
+        const h = walk(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
+        if (h) return h;
+      }
+    }
+    return null;
+  };
+  try {
+    return walk(args, 0, "");
+  } catch (e) {
+    console.error(
+      "[node9 engine] canary args walk failed:",
+      e instanceof Error ? e.message : String(e)
+    );
+    return null;
+  }
 }
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 
@@ -3955,6 +4651,12 @@ function applyManagedEgress(local, managed, locked, localModeUserSet = true) {
   if (Array.isArray(managed.deny) && managed.deny.length > 0) {
     next.deny = [.../* @__PURE__ */ new Set([...local.deny ?? [], ...managed.deny])];
   }
+  if (typeof managed.ssrfStrict === "boolean") {
+    next.ssrfStrict = managed.ssrfStrict;
+  }
+  if (Array.isArray(managed.ssrfAllow)) {
+    next.ssrfAllow = [...managed.ssrfAllow];
+  }
   if (typeof managed.allowPrivate === "boolean") {
     next.allowPrivate = locked.includes("egressAllowPrivate") ? managed.allowPrivate : (local.allowPrivate ?? true) && managed.allowPrivate;
   }
@@ -4036,9 +4738,9 @@ var B = "[\\s/\\\\]";
 var SEP = "[/\\\\]";
 function pathToRegexFragment(rawPath) {
   const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
-  const segments = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
-  if (segments.length === 0) return "";
-  return `(^|${B})${segments.join(SEP)}(${B}|$)`;
+  const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
+  if (segments2.length === 0) return "";
+  return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
 }
 function pathMatchesFragment(candidate, rawPath) {
   const value = pathToRegexFragment(rawPath);
@@ -4143,6 +4845,20 @@ function isTrustedHost(host) {
 }
 
 // src/config/index.ts
+function sanitizeSsrfAllow(entries, source) {
+  const kept = [];
+  for (const entry of entries) {
+    const m = classifySsrf(entry);
+    if (m && !m.overridable) {
+      process.emitWarning(
+        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+      );
+      continue;
+    }
+    kept.push(entry);
+  }
+  return kept;
+}
 var DANGEROUS_WORDS = [
   "mkfs",
   // formats/wipes a filesystem partition
@@ -4152,6 +4868,7 @@ var DANGEROUS_WORDS = [
 var DEFAULT_CONFIG = {
   version: "1.0",
   policySource: "local",
+  ssrfStrictSource: "default",
   settings: {
     mode: "standard",
     autoStartDaemon: true,
@@ -4335,7 +5052,17 @@ var DEFAULT_CONFIG = {
       }
     ],
     dlp: { enabled: true, scanIgnoredTools: true, pii: "off" },
-    egress: { enabled: false, mode: "review", allow: [], deny: [], allowPrivate: true },
+    egress: {
+      enabled: false,
+      mode: "review",
+      allow: [],
+      deny: [],
+      allowPrivate: true,
+      // The SSRF floor is always on and needs no default; these two only
+      // widen or narrow it. See doc/roadmap/active/ssrf-floor-design.md.
+      ssrfAllow: [],
+      ssrfStrict: false
+    },
     loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
     injectionScan: { enabled: false, minConfidence: "medium", allow: [] },
     skillPinning: { enabled: false, mode: "warn", roots: [] },
@@ -4518,7 +5245,8 @@ function getConfig(cwd) {
     egress: {
       ...DEFAULT_CONFIG.policy.egress,
       allow: [...DEFAULT_CONFIG.policy.egress.allow],
-      deny: [...DEFAULT_CONFIG.policy.egress.deny]
+      deny: [...DEFAULT_CONFIG.policy.egress.deny],
+      ssrfAllow: [...DEFAULT_CONFIG.policy.egress.ssrfAllow ?? []]
     },
     loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection },
     injectionScan: {
@@ -4544,6 +5272,7 @@ function getConfig(cwd) {
   };
   const pr2Creds = getCredentials();
   const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
+  let ssrfStrictSource = "default";
   const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
@@ -4626,6 +5355,15 @@ function getConfig(cwd) {
       if (Array.isArray(e.deny)) mergedPolicy.egress.deny.push(...e.deny);
       if (e.allowPrivate !== void 0 && !(isProject && e.allowPrivate === true))
         mergedPolicy.egress.allowPrivate = e.allowPrivate;
+      if (!isProject) {
+        if (Array.isArray(e.ssrfAllow)) {
+          mergedPolicy.egress.ssrfAllow = sanitizeSsrfAllow(e.ssrfAllow, "egress.");
+        }
+        if (e.ssrfStrict !== void 0) {
+          mergedPolicy.egress.ssrfStrict = e.ssrfStrict;
+          ssrfStrictSource = "local";
+        }
+      }
     }
     if (p.loopDetection) {
       const ld = p.loopDetection;
@@ -4732,6 +5470,13 @@ function getConfig(cwd) {
             if (deny) mergedPolicy.egress.deny = deny;
             if (typeof e.allowPrivate === "boolean")
               mergedPolicy.egress.allowPrivate = e.allowPrivate;
+            if (typeof e.ssrfStrict === "boolean") {
+              mergedPolicy.egress.ssrfStrict = e.ssrfStrict;
+              ssrfStrictSource = "workspace";
+            }
+            const ssrfAllow = hosts(e.ssrfAllow);
+            if (ssrfAllow)
+              mergedPolicy.egress.ssrfAllow = sanitizeSsrfAllow(ssrfAllow, "managed egress.");
           } else {
             mergedPolicy.egress = applyManagedEgress(
               mergedPolicy.egress,
@@ -4740,7 +5485,16 @@ function getConfig(cwd) {
                 mode: typeof mc.egress.mode === "string" ? mc.egress.mode : void 0,
                 allow: hosts(mc.egress.allow),
                 deny: hosts(mc.egress.deny),
-                allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0
+                allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0,
+                ssrfStrict: (() => {
+                  if (typeof mc.egress.ssrfStrict !== "boolean") return void 0;
+                  ssrfStrictSource = "workspace";
+                  return mc.egress.ssrfStrict;
+                })(),
+                ssrfAllow: (() => {
+                  const list = hosts(mc.egress.ssrfAllow);
+                  return list ? sanitizeSsrfAllow(list, "managed egress.") : void 0;
+                })()
               },
               locked,
               egressModeUserSet
@@ -4835,13 +5589,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path14 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path14) continue;
+            const path15 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path15) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path14, verdict, "org-managed jail")) {
+            for (const r of pathRules(path15, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path14, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path15, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -4970,6 +5724,7 @@ function getConfig(cwd) {
   mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
   mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
+  const resolvedSsrfStrictSource = keyed && ssrfStrictSource === "local" ? "default" : ssrfStrictSource;
   const result = {
     settings: mergedSettings,
     policy: mergedPolicy,
@@ -4977,7 +5732,10 @@ function getConfig(cwd) {
     // PR-2 — the one truth introspection reads: which of the two working
     // modes this machine is in. 'workspace' = keyed, policy from the cloud;
     // 'local' = the local stack (incl. --local / named-profile keys).
-    policySource: keyed ? "workspace" : "local"
+    policySource: keyed ? "workspace" : "local",
+    // A keyed machine drops the local policy layers wholesale, so a 'local'
+    // provenance recorded before the fork cannot survive into the result.
+    ssrfStrictSource: resolvedSsrfStrictSource
   };
   if (!cwd) cachedConfig = result;
   return result;
@@ -5843,14 +6601,92 @@ end run`;
   });
 }
 
+// src/canary/registry.ts
+import fs10 from "fs";
+import os9 from "os";
+import path12 from "path";
+
+// src/shields/jail.ts
+import fs9 from "fs";
+import os8 from "os";
+import path11 from "path";
+var USER_JAIL_SHIELD = "user-jail";
+function jailStorePath() {
+  return path11.join(os8.homedir(), ".node9", "jail-paths.json");
+}
+function readJailPaths() {
+  let text;
+  try {
+    text = fs9.readFileSync(jailStorePath(), "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`${jailStorePath()} is not valid JSON \u2014 fix it before changing the jail.`);
+  }
+  if (!Array.isArray(parsed.paths)) return [];
+  return parsed.paths.filter(
+    (p) => !!p && typeof p.path === "string" && (p.verdict === "block" || p.verdict === "review")
+  );
+}
+function findJailedPath(candidate) {
+  return findJailedPathIn(candidate, readJailPaths());
+}
+function findJailedPathIn(candidate, paths) {
+  if (!candidate) return null;
+  for (const entry of paths) {
+    if (pathMatchesFragment(candidate, entry.path)) return entry;
+  }
+  return null;
+}
+
+// src/canary/registry.ts
+function canaryStorePath() {
+  return path12.join(os9.homedir(), ".node9", "canaries.json");
+}
+function isRecord(x) {
+  if (!x || typeof x !== "object") return false;
+  const r = x;
+  return typeof r.id === "string" && typeof r.value === "string" && typeof r.valueHash === "string";
+}
+function loadCanaries(opts) {
+  const p = canaryStorePath();
+  let raw;
+  try {
+    raw = fs10.readFileSync(p, "utf-8");
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new Error(
+      `[node9] ${p} is not valid JSON; refusing to touch it (${e instanceof Error ? e.message : String(e)})`
+    );
+  }
+  const recs = parsed?.records;
+  if (!Array.isArray(recs)) return [];
+  const out = recs.filter(isRecord);
+  return opts?.includeRetired === false ? out.filter((r) => !r.retiredAt) : out;
+}
+function canaryValues() {
+  return loadCanaries().map((r) => ({ id: r.id, value: r.value, retired: Boolean(r.retiredAt) }));
+}
+
 // src/auth/orchestrator.ts
 init_audit();
 
 // src/auth/cloud.ts
 init_audit();
-import fs9 from "fs";
-import os8 from "os";
-import path11 from "path";
+import fs11 from "fs";
+import os10 from "os";
+import path13 from "path";
 async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPolicy, forceReview) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1e4);
@@ -5858,10 +6694,10 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = path11.join(os8.homedir(), ".node9", "ci-context.json");
-      const stats = fs9.statSync(ciContextPath);
+      const ciContextPath = path13.join(os10.homedir(), ".node9", "ci-context.json");
+      const stats = fs11.statSync(ciContextPath);
       if (stats.size > 1e4) throw new Error("ci-context.json exceeds 10 KB");
-      const raw = fs9.readFileSync(ciContextPath, "utf8");
+      const raw = fs11.readFileSync(ciContextPath, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
         throw new Error("ci-context.json is not a plain object");
@@ -5894,9 +6730,9 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
         context: {
           agent: meta?.agent,
           mcpServer: meta?.mcpServer,
-          hostname: os8.hostname(),
+          hostname: os10.hostname(),
           cwd: process.cwd(),
-          platform: os8.platform()
+          platform: os10.platform()
         },
         ...riskMetadata && { riskMetadata },
         ...ciContext && { ciContext },
@@ -5960,14 +6796,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      fs9.appendFileSync(
+      fs11.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    fs9.appendFileSync(
+    fs11.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${requestId}: ${err.message}
 `
@@ -5976,16 +6812,16 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 }
 
 // src/loop-detector.ts
-import fs10 from "fs";
-import path12 from "path";
-import os9 from "os";
+import fs12 from "fs";
+import path14 from "path";
+import os11 from "os";
 function loopStateFile() {
-  return path12.join(os9.homedir(), ".node9", "loop-state.json");
+  return path14.join(os11.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
-    if (!fs10.existsSync(loopStateFile())) return [];
-    const raw = fs10.readFileSync(loopStateFile(), "utf-8");
+    if (!fs12.existsSync(loopStateFile())) return [];
+    const raw = fs12.readFileSync(loopStateFile(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return [];
     return parsed;
@@ -5994,11 +6830,11 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir = path12.dirname(loopStateFile());
-  if (!fs10.existsSync(dir)) fs10.mkdirSync(dir, { recursive: true });
-  const tmpPath = `${loopStateFile()}.${os9.hostname()}.${process.pid}.tmp`;
-  fs10.writeFileSync(tmpPath, JSON.stringify(records));
-  fs10.renameSync(tmpPath, loopStateFile());
+  const dir = path14.dirname(loopStateFile());
+  if (!fs12.existsSync(dir)) fs12.mkdirSync(dir, { recursive: true });
+  const tmpPath = `${loopStateFile()}.${os11.hostname()}.${process.pid}.tmp`;
+  fs12.writeFileSync(tmpPath, JSON.stringify(records));
+  fs12.renameSync(tmpPath, loopStateFile());
 }
 function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   try {
@@ -6010,44 +6846,6 @@ function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   }
 }
 
-// src/shields/jail.ts
-import fs11 from "fs";
-import os10 from "os";
-import path13 from "path";
-var USER_JAIL_SHIELD = "user-jail";
-function jailStorePath() {
-  return path13.join(os10.homedir(), ".node9", "jail-paths.json");
-}
-function readJailPaths() {
-  let text;
-  try {
-    text = fs11.readFileSync(jailStorePath(), "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    throw new Error(`${jailStorePath()} is not valid JSON \u2014 fix it before changing the jail.`);
-  }
-  if (!Array.isArray(parsed.paths)) return [];
-  return parsed.paths.filter(
-    (p) => !!p && typeof p.path === "string" && (p.verdict === "block" || p.verdict === "review")
-  );
-}
-function findJailedPath(candidate) {
-  return findJailedPathIn(candidate, readJailPaths());
-}
-function findJailedPathIn(candidate, paths) {
-  if (!candidate) return null;
-  for (const entry of paths) {
-    if (pathMatchesFragment(candidate, entry.path)) return entry;
-  }
-  return null;
-}
-
 // src/auth/orchestrator.ts
 var WRITE_TOOLS = /* @__PURE__ */ new Set([
   "write",
@@ -6233,6 +7031,53 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       taintWarning = `\u26A0\uFE0F node9 flagged this session \u2014 earlier tool output contained ${sessionTaint.record.source}. Approve this ${isWriteTool(toolName) ? "write" : "network"} action before it proceeds.`;
     }
   }
+  const canaryVals = safeCanaryValues();
+  if (canaryVals.length > 0) {
+    const canaryHit = matchCanaryArgs(args, canaryVals);
+    if (canaryHit) {
+      const rec = canaryRecordById(canaryHit.id);
+      const shape = scanArgs(args);
+      const canaryReason = `\u{1F6A8} DECOY CREDENTIAL: the fake ${rec?.kind ?? "credential"} node9 planted at ${rec?.path ?? "a decoy file"} appeared in field "${canaryHit.fieldPath || "args"}". Something read that file; nothing legitimate does.`;
+      if (!isManual)
+        appendLocalAudit(
+          toolName,
+          args,
+          "deny",
+          isObserveMode ? "observe-mode-dlp-canary-would-block" : "dlp-canary-block",
+          {
+            ...meta,
+            canaryId: canaryHit.id,
+            canaryHash: rec?.valueHash,
+            canaryKind: rec?.kind,
+            canaryPath: rec?.path,
+            canaryView: canaryHit.view,
+            canaryRetired: canaryHit.retired,
+            ...shape ? { dlpPattern: shape.patternName, dlpSample: shape.redactedSample } : {}
+          },
+          true
+        );
+      if (isObserveMode) {
+        return {
+          approved: true,
+          checkedBy: "audit",
+          observeWouldBlock: true,
+          blockedByLabel: "\u{1F6A8} Node9 DLP (Decoy Credential)"
+        };
+      }
+      return {
+        approved: false,
+        reason: canaryReason,
+        blockedBy: "local-config",
+        blockedByLabel: "\u{1F6A8} Node9 DLP (Decoy Credential)",
+        // The /dev/tty banner renders ruleDescription under "Triggered by".
+        // Without it the terminal said only "Decoy Credential" and never named
+        // the file, while `node9 canary plant` promises node9 tells you which
+        // file was read. Witnessed by canary-block-message.spec.ts, which calls
+        // the orchestrator directly: this field never reaches the hook stdout.
+        ruleDescription: `The fake credential node9 planted in ${rec?.path ?? "a decoy file"} just left that file. Nothing legitimate reads it.`
+      };
+    }
+  }
   if (config.policy.dlp.enabled && (!isIgnoredTool2(toolName) || config.policy.dlp.scanIgnoredTools)) {
     const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
     const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");
@@ -6888,6 +7733,20 @@ async function authorizeAction(toolName, args) {
   const result = await authorizeHeadless(toolName, args);
   return result.approved;
 }
+function safeCanaryValues() {
+  try {
+    return canaryValues();
+  } catch {
+    return [];
+  }
+}
+function canaryRecordById(id) {
+  try {
+    return loadCanaries().find((r) => r.id === id) ?? null;
+  } catch {
+    return null;
+  }
+}
 
 // src/index.ts
 function protect(toolName, fn) {