@node9/proxy 2.9.1 → 2.9.3

package/dist/cli.js

@@ -235,30 +235,86 @@ var init_audit = __esm({
 });
 
 // src/config-schema.ts
+function formatIssues(issues) {
+  const lines = issues.map((issue) => {
+    const path77 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path77}: ${issue.message}`;
+  });
+  return `Invalid config:
+${lines.join("\n")}`;
+}
+function prunePaths(root, paths) {
+  let removed = false;
+  const ordered = [...paths].sort((x, y) => {
+    if (y.length !== x.length) return y.length - x.length;
+    const xi = x[x.length - 1];
+    const yi = y[y.length - 1];
+    return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
+  });
+  for (const path77 of ordered) {
+    let cur = root;
+    for (const key of path77.slice(0, -1)) {
+      if (cur === null || typeof cur !== "object") {
+        cur = void 0;
+        break;
+      }
+      cur = cur[key];
+    }
+    if (cur === null || typeof cur !== "object") continue;
+    const last = path77[path77.length - 1];
+    if (Array.isArray(cur)) {
+      const i = Number(last);
+      if (Number.isInteger(i) && i >= 0 && i < cur.length) {
+        cur.splice(i, 1);
+        removed = true;
+      }
+      continue;
+    }
+    const obj = cur;
+    if (Object.prototype.hasOwnProperty.call(obj, String(last))) {
+      delete obj[String(last)];
+      removed = true;
+    }
+  }
+  return removed;
+}
 function sanitizeConfig(raw) {
   const result = ConfigFileSchema.safeParse(raw);
   if (result.success) {
     return { sanitized: result.data, error: null };
   }
-  const invalidTopLevelKeys = new Set(
-    result.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
-  );
-  const sanitized = {};
-  if (typeof raw === "object" && raw !== null) {
-    for (const [key, value] of Object.entries(raw)) {
-      if (!invalidTopLevelKeys.has(key)) {
-        sanitized[key] = value;
-      }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { sanitized: {}, error: formatIssues(result.error.issues) };
+  }
+  const working = structuredClone(raw);
+  for (let level = 0; level < 6; level++) {
+    for (let pass = 0; pass < 5; pass++) {
+      const attempt = ConfigFileSchema.safeParse(working);
+      if (attempt.success) break;
+      const paths = attempt.error.issues.flatMap((issue) => {
+        const at = issue.path;
+        if (issue.code === "unrecognized_keys") {
+          return issue.keys.map((k) => [...at, k]);
+        }
+        return [at.slice(0, -level || void 0)];
+      }).filter((path77) => path77.length > 0);
+      if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
+    if (ConfigFileSchema.safeParse(working).success) break;
+  }
+  const after = ConfigFileSchema.safeParse(working);
+  const sanitized = {};
+  const invalidTopLevelKeys = after.success ? /* @__PURE__ */ new Set() : new Set(
+    after.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
+  );
+  for (const [key, value] of Object.entries(working)) {
+    if (!invalidTopLevelKeys.has(key)) sanitized[key] = value;
   }
-  const lines = result.error.issues.map((issue) => {
-    const path77 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path77}: ${issue.message}`;
-  });
   return {
     sanitized,
-    error: `Invalid config:
-${lines.join("\n")}`
+    // The message names what the USER should fix, so it is built from the
+    // original parse, not from whatever survived the prune.
+    error: formatIssues(result.error.issues)
   };
 }
 var import_zod, noNewlines, SmartConditionSchema, SmartRuleSchema, ConfigFileSchema;
@@ -283,9 +339,9 @@ var init_config_schema = __esm({
           "notMatchesGlob"
         ],
         {
-          errorMap: () => ({
-            message: "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
-          })
+          // zod 4 replaced errorMap with `error`. The wording is kept verbatim:
+          // it is what a user sees when their config is rejected.
+          error: () => "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
         }
       ),
       value: import_zod.z.string().optional(),
@@ -303,7 +359,7 @@ var init_config_schema = __esm({
       conditions: import_zod.z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
       conditionMode: import_zod.z.enum(["all", "any"]).optional(),
       verdict: import_zod.z.enum(["allow", "review", "block"], {
-        errorMap: () => ({ message: "verdict must be one of: allow, review, block" })
+        error: () => "verdict must be one of: allow, review, block"
       }),
       reason: import_zod.z.string().optional(),
       description: import_zod.z.string().optional(),
@@ -376,7 +432,7 @@ var init_config_schema = __esm({
         sandboxPaths: import_zod.z.array(import_zod.z.string()).optional(),
         dangerousWords: import_zod.z.array(noNewlines).optional(),
         ignoredTools: import_zod.z.array(import_zod.z.string()).optional(),
-        toolInspection: import_zod.z.record(import_zod.z.string()).optional(),
+        toolInspection: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
         smartRules: import_zod.z.array(SmartRuleSchema).optional(),
         dlp: import_zod.z.object({
           enabled: import_zod.z.boolean().optional(),
@@ -421,8 +477,8 @@ var init_config_schema = __esm({
           roots: import_zod.z.array(import_zod.z.string()).optional()
         }).optional()
       }).optional(),
-      environments: import_zod.z.record(import_zod.z.object({ requireApproval: import_zod.z.boolean().optional() })).optional()
-    }).strict({ message: "Config contains unknown top-level keys" });
+      environments: import_zod.z.record(import_zod.z.string(), import_zod.z.object({ requireApproval: import_zod.z.boolean().optional() })).optional()
+    }).strict();
   }
 });
 
@@ -2007,7 +2063,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -2019,7 +2075,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -2035,7 +2091,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
     return {
       ...m,
@@ -3149,7 +3205,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4304,9 +4360,15 @@ var init_dist = __esm({
       // AWS ECS task role
       "168.63.129.16",
       // Azure WireServer
-      "fd00:ec2::254"
+      "fd00:ec2::254",
       // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+      // live credential endpoint. It has to be named here, above the range check,
+      // and it is the reason relaxing cgnat is safe.
+      "100.100.100.200"
     ]);
+    STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
     METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
     v4Octets = (a) => {
       const p = a.split(".");
@@ -4316,7 +4378,7 @@ var init_dist = __esm({
       metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
       "link-local": "a link-local address",
       multicast: "a multicast address",
-      unspecified: "the unspecified address",
+      unspecified: "the unspecified address, which reaches this host",
       cgnat: "a carrier-grade NAT address",
       private: "a loopback or private address"
     };
@@ -54427,12 +54489,7 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
       `${num2(d.approvals.approved)} approved \xB7 ${num2(d.approvals.denied)} denied \xB7 ${num2(d.approvals.timedOut)} timed-out\u2192deny`
     );
     dimRow("\u{1F4C1}", "Files", d.files.blocked > 0, `${num2(d.files.blocked)} jail-path reads blocked`);
-    dimRow(
-      "\u{1F6E0}",
-      "Tool rules",
-      d.toolRules.blocked > 0,
-      `${num2(d.toolRules.blocked)} shields/rules`
-    );
+    dimRow("\u{1F6E0}", "Tool rules", d.toolRules.blocked > 0, `${num2(d.toolRules.blocked)} shields/rules`);
     dimRow("\u{1F9E9}", "Apps (MCP)", d.apps.blocked > 0, `${num2(d.apps.blocked)} app-permission blocks`);
     dimRow("\u{1F4B0}", "Cost", d.cost.totalUSD > 0, `${fmtCost2(d.cost.totalUSD)} this period`);
   }

package/dist/cli.mjs

@@ -240,30 +240,86 @@ var init_audit = __esm({
 
 // src/config-schema.ts
 import { z } from "zod";
+function formatIssues(issues) {
+  const lines = issues.map((issue) => {
+    const path77 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path77}: ${issue.message}`;
+  });
+  return `Invalid config:
+${lines.join("\n")}`;
+}
+function prunePaths(root, paths) {
+  let removed = false;
+  const ordered = [...paths].sort((x, y) => {
+    if (y.length !== x.length) return y.length - x.length;
+    const xi = x[x.length - 1];
+    const yi = y[y.length - 1];
+    return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
+  });
+  for (const path77 of ordered) {
+    let cur = root;
+    for (const key of path77.slice(0, -1)) {
+      if (cur === null || typeof cur !== "object") {
+        cur = void 0;
+        break;
+      }
+      cur = cur[key];
+    }
+    if (cur === null || typeof cur !== "object") continue;
+    const last = path77[path77.length - 1];
+    if (Array.isArray(cur)) {
+      const i = Number(last);
+      if (Number.isInteger(i) && i >= 0 && i < cur.length) {
+        cur.splice(i, 1);
+        removed = true;
+      }
+      continue;
+    }
+    const obj = cur;
+    if (Object.prototype.hasOwnProperty.call(obj, String(last))) {
+      delete obj[String(last)];
+      removed = true;
+    }
+  }
+  return removed;
+}
 function sanitizeConfig(raw) {
   const result = ConfigFileSchema.safeParse(raw);
   if (result.success) {
     return { sanitized: result.data, error: null };
   }
-  const invalidTopLevelKeys = new Set(
-    result.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
-  );
-  const sanitized = {};
-  if (typeof raw === "object" && raw !== null) {
-    for (const [key, value] of Object.entries(raw)) {
-      if (!invalidTopLevelKeys.has(key)) {
-        sanitized[key] = value;
-      }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { sanitized: {}, error: formatIssues(result.error.issues) };
+  }
+  const working = structuredClone(raw);
+  for (let level = 0; level < 6; level++) {
+    for (let pass = 0; pass < 5; pass++) {
+      const attempt = ConfigFileSchema.safeParse(working);
+      if (attempt.success) break;
+      const paths = attempt.error.issues.flatMap((issue) => {
+        const at = issue.path;
+        if (issue.code === "unrecognized_keys") {
+          return issue.keys.map((k) => [...at, k]);
+        }
+        return [at.slice(0, -level || void 0)];
+      }).filter((path77) => path77.length > 0);
+      if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
+    if (ConfigFileSchema.safeParse(working).success) break;
+  }
+  const after = ConfigFileSchema.safeParse(working);
+  const sanitized = {};
+  const invalidTopLevelKeys = after.success ? /* @__PURE__ */ new Set() : new Set(
+    after.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
+  );
+  for (const [key, value] of Object.entries(working)) {
+    if (!invalidTopLevelKeys.has(key)) sanitized[key] = value;
   }
-  const lines = result.error.issues.map((issue) => {
-    const path77 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path77}: ${issue.message}`;
-  });
   return {
     sanitized,
-    error: `Invalid config:
-${lines.join("\n")}`
+    // The message names what the USER should fix, so it is built from the
+    // original parse, not from whatever survived the prune.
+    error: formatIssues(result.error.issues)
   };
 }
 var noNewlines, SmartConditionSchema, SmartRuleSchema, ConfigFileSchema;
@@ -287,9 +343,9 @@ var init_config_schema = __esm({
           "notMatchesGlob"
         ],
         {
-          errorMap: () => ({
-            message: "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
-          })
+          // zod 4 replaced errorMap with `error`. The wording is kept verbatim:
+          // it is what a user sees when their config is rejected.
+          error: () => "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
         }
       ),
       value: z.string().optional(),
@@ -307,7 +363,7 @@ var init_config_schema = __esm({
       conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
       conditionMode: z.enum(["all", "any"]).optional(),
       verdict: z.enum(["allow", "review", "block"], {
-        errorMap: () => ({ message: "verdict must be one of: allow, review, block" })
+        error: () => "verdict must be one of: allow, review, block"
       }),
       reason: z.string().optional(),
       description: z.string().optional(),
@@ -380,7 +436,7 @@ var init_config_schema = __esm({
         sandboxPaths: z.array(z.string()).optional(),
         dangerousWords: z.array(noNewlines).optional(),
         ignoredTools: z.array(z.string()).optional(),
-        toolInspection: z.record(z.string()).optional(),
+        toolInspection: z.record(z.string(), z.string()).optional(),
         smartRules: z.array(SmartRuleSchema).optional(),
         dlp: z.object({
           enabled: z.boolean().optional(),
@@ -425,8 +481,8 @@ var init_config_schema = __esm({
           roots: z.array(z.string()).optional()
         }).optional()
       }).optional(),
-      environments: z.record(z.object({ requireApproval: z.boolean().optional() })).optional()
-    }).strict({ message: "Config contains unknown top-level keys" });
+      environments: z.record(z.string(), z.object({ requireApproval: z.boolean().optional() })).optional()
+    }).strict();
   }
 });
 
@@ -2018,7 +2074,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -2030,7 +2086,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -2046,7 +2102,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
     return {
       ...m,
@@ -3160,7 +3216,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4308,9 +4364,15 @@ var init_dist = __esm({
       // AWS ECS task role
       "168.63.129.16",
       // Azure WireServer
-      "fd00:ec2::254"
+      "fd00:ec2::254",
       // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+      // live credential endpoint. It has to be named here, above the range check,
+      // and it is the reason relaxing cgnat is safe.
+      "100.100.100.200"
     ]);
+    STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
     METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
     v4Octets = (a) => {
       const p = a.split(".");
@@ -4320,7 +4382,7 @@ var init_dist = __esm({
       metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
       "link-local": "a link-local address",
       multicast: "a multicast address",
-      unspecified: "the unspecified address",
+      unspecified: "the unspecified address, which reaches this host",
       cgnat: "a carrier-grade NAT address",
       private: "a loopback or private address"
     };
@@ -54419,12 +54481,7 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
       `${num2(d.approvals.approved)} approved \xB7 ${num2(d.approvals.denied)} denied \xB7 ${num2(d.approvals.timedOut)} timed-out\u2192deny`
     );
     dimRow("\u{1F4C1}", "Files", d.files.blocked > 0, `${num2(d.files.blocked)} jail-path reads blocked`);
-    dimRow(
-      "\u{1F6E0}",
-      "Tool rules",
-      d.toolRules.blocked > 0,
-      `${num2(d.toolRules.blocked)} shields/rules`
-    );
+    dimRow("\u{1F6E0}", "Tool rules", d.toolRules.blocked > 0, `${num2(d.toolRules.blocked)} shields/rules`);
     dimRow("\u{1F9E9}", "Apps (MCP)", d.apps.blocked > 0, `${num2(d.apps.blocked)} app-permission blocks`);
     dimRow("\u{1F4B0}", "Cost", d.cost.totalUSD > 0, `${fmtCost2(d.cost.totalUSD)} this period`);
   }

package/dist/dashboard.mjs

@@ -856,7 +856,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -868,7 +868,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -1759,8 +1759,13 @@ var init_dist = __esm({
       // AWS ECS task role
       "168.63.129.16",
       // Azure WireServer
-      "fd00:ec2::254"
+      "fd00:ec2::254",
       // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+      // live credential endpoint. It has to be named here, above the range check,
+      // and it is the reason relaxing cgnat is safe.
+      "100.100.100.200"
     ]);
     METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
     v4Octets = (a) => {
@@ -2737,30 +2742,86 @@ var init_daemon = __esm({
 
 // src/config-schema.ts
 import { z } from "zod";
+function formatIssues(issues) {
+  const lines = issues.map((issue) => {
+    const path14 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path14}: ${issue.message}`;
+  });
+  return `Invalid config:
+${lines.join("\n")}`;
+}
+function prunePaths(root, paths) {
+  let removed = false;
+  const ordered = [...paths].sort((x, y) => {
+    if (y.length !== x.length) return y.length - x.length;
+    const xi = x[x.length - 1];
+    const yi = y[y.length - 1];
+    return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
+  });
+  for (const path14 of ordered) {
+    let cur = root;
+    for (const key of path14.slice(0, -1)) {
+      if (cur === null || typeof cur !== "object") {
+        cur = void 0;
+        break;
+      }
+      cur = cur[key];
+    }
+    if (cur === null || typeof cur !== "object") continue;
+    const last = path14[path14.length - 1];
+    if (Array.isArray(cur)) {
+      const i = Number(last);
+      if (Number.isInteger(i) && i >= 0 && i < cur.length) {
+        cur.splice(i, 1);
+        removed = true;
+      }
+      continue;
+    }
+    const obj = cur;
+    if (Object.prototype.hasOwnProperty.call(obj, String(last))) {
+      delete obj[String(last)];
+      removed = true;
+    }
+  }
+  return removed;
+}
 function sanitizeConfig(raw) {
   const result = ConfigFileSchema.safeParse(raw);
   if (result.success) {
     return { sanitized: result.data, error: null };
   }
-  const invalidTopLevelKeys = new Set(
-    result.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
-  );
-  const sanitized = {};
-  if (typeof raw === "object" && raw !== null) {
-    for (const [key, value] of Object.entries(raw)) {
-      if (!invalidTopLevelKeys.has(key)) {
-        sanitized[key] = value;
-      }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { sanitized: {}, error: formatIssues(result.error.issues) };
+  }
+  const working = structuredClone(raw);
+  for (let level = 0; level < 6; level++) {
+    for (let pass = 0; pass < 5; pass++) {
+      const attempt = ConfigFileSchema.safeParse(working);
+      if (attempt.success) break;
+      const paths = attempt.error.issues.flatMap((issue) => {
+        const at = issue.path;
+        if (issue.code === "unrecognized_keys") {
+          return issue.keys.map((k) => [...at, k]);
+        }
+        return [at.slice(0, -level || void 0)];
+      }).filter((path14) => path14.length > 0);
+      if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
+    if (ConfigFileSchema.safeParse(working).success) break;
+  }
+  const after = ConfigFileSchema.safeParse(working);
+  const sanitized = {};
+  const invalidTopLevelKeys = after.success ? /* @__PURE__ */ new Set() : new Set(
+    after.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
+  );
+  for (const [key, value] of Object.entries(working)) {
+    if (!invalidTopLevelKeys.has(key)) sanitized[key] = value;
   }
-  const lines = result.error.issues.map((issue) => {
-    const path14 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path14}: ${issue.message}`;
-  });
   return {
     sanitized,
-    error: `Invalid config:
-${lines.join("\n")}`
+    // The message names what the USER should fix, so it is built from the
+    // original parse, not from whatever survived the prune.
+    error: formatIssues(result.error.issues)
   };
 }
 var noNewlines, SmartConditionSchema, SmartRuleSchema, ConfigFileSchema;
@@ -2784,9 +2845,9 @@ var init_config_schema = __esm({
           "notMatchesGlob"
         ],
         {
-          errorMap: () => ({
-            message: "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
-          })
+          // zod 4 replaced errorMap with `error`. The wording is kept verbatim:
+          // it is what a user sees when their config is rejected.
+          error: () => "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
         }
       ),
       value: z.string().optional(),
@@ -2804,7 +2865,7 @@ var init_config_schema = __esm({
       conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
       conditionMode: z.enum(["all", "any"]).optional(),
       verdict: z.enum(["allow", "review", "block"], {
-        errorMap: () => ({ message: "verdict must be one of: allow, review, block" })
+        error: () => "verdict must be one of: allow, review, block"
       }),
       reason: z.string().optional(),
       description: z.string().optional(),
@@ -2877,7 +2938,7 @@ var init_config_schema = __esm({
         sandboxPaths: z.array(z.string()).optional(),
         dangerousWords: z.array(noNewlines).optional(),
         ignoredTools: z.array(z.string()).optional(),
-        toolInspection: z.record(z.string()).optional(),
+        toolInspection: z.record(z.string(), z.string()).optional(),
         smartRules: z.array(SmartRuleSchema).optional(),
         dlp: z.object({
           enabled: z.boolean().optional(),
@@ -2922,8 +2983,8 @@ var init_config_schema = __esm({
           roots: z.array(z.string()).optional()
         }).optional()
       }).optional(),
-      environments: z.record(z.object({ requireApproval: z.boolean().optional() })).optional()
-    }).strict({ message: "Config contains unknown top-level keys" });
+      environments: z.record(z.string(), z.object({ requireApproval: z.boolean().optional() })).optional()
+    }).strict();
   }
 });
 

package/dist/index.js

@@ -265,9 +265,9 @@ var SmartConditionSchema = import_zod.z.object({
       "notMatchesGlob"
     ],
     {
-      errorMap: () => ({
-        message: "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
-      })
+      // zod 4 replaced errorMap with `error`. The wording is kept verbatim:
+      // it is what a user sees when their config is rejected.
+      error: () => "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
     }
   ),
   value: import_zod.z.string().optional(),
@@ -285,7 +285,7 @@ var SmartRuleSchema = import_zod.z.object({
   conditions: import_zod.z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
   conditionMode: import_zod.z.enum(["all", "any"]).optional(),
   verdict: import_zod.z.enum(["allow", "review", "block"], {
-    errorMap: () => ({ message: "verdict must be one of: allow, review, block" })
+    error: () => "verdict must be one of: allow, review, block"
   }),
   reason: import_zod.z.string().optional(),
   description: import_zod.z.string().optional(),
@@ -358,7 +358,7 @@ var ConfigFileSchema = import_zod.z.object({
     sandboxPaths: import_zod.z.array(import_zod.z.string()).optional(),
     dangerousWords: import_zod.z.array(noNewlines).optional(),
     ignoredTools: import_zod.z.array(import_zod.z.string()).optional(),
-    toolInspection: import_zod.z.record(import_zod.z.string()).optional(),
+    toolInspection: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
     smartRules: import_zod.z.array(SmartRuleSchema).optional(),
     dlp: import_zod.z.object({
       enabled: import_zod.z.boolean().optional(),
@@ -403,32 +403,88 @@ var ConfigFileSchema = import_zod.z.object({
       roots: import_zod.z.array(import_zod.z.string()).optional()
     }).optional()
   }).optional(),
-  environments: import_zod.z.record(import_zod.z.object({ requireApproval: import_zod.z.boolean().optional() })).optional()
-}).strict({ message: "Config contains unknown top-level keys" });
+  environments: import_zod.z.record(import_zod.z.string(), import_zod.z.object({ requireApproval: import_zod.z.boolean().optional() })).optional()
+}).strict();
+function formatIssues(issues) {
+  const lines = issues.map((issue) => {
+    const path15 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path15}: ${issue.message}`;
+  });
+  return `Invalid config:
+${lines.join("\n")}`;
+}
+function prunePaths(root, paths) {
+  let removed = false;
+  const ordered = [...paths].sort((x, y) => {
+    if (y.length !== x.length) return y.length - x.length;
+    const xi = x[x.length - 1];
+    const yi = y[y.length - 1];
+    return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
+  });
+  for (const path15 of ordered) {
+    let cur = root;
+    for (const key of path15.slice(0, -1)) {
+      if (cur === null || typeof cur !== "object") {
+        cur = void 0;
+        break;
+      }
+      cur = cur[key];
+    }
+    if (cur === null || typeof cur !== "object") continue;
+    const last = path15[path15.length - 1];
+    if (Array.isArray(cur)) {
+      const i = Number(last);
+      if (Number.isInteger(i) && i >= 0 && i < cur.length) {
+        cur.splice(i, 1);
+        removed = true;
+      }
+      continue;
+    }
+    const obj = cur;
+    if (Object.prototype.hasOwnProperty.call(obj, String(last))) {
+      delete obj[String(last)];
+      removed = true;
+    }
+  }
+  return removed;
+}
 function sanitizeConfig(raw) {
   const result = ConfigFileSchema.safeParse(raw);
   if (result.success) {
     return { sanitized: result.data, error: null };
   }
-  const invalidTopLevelKeys = new Set(
-    result.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
-  );
-  const sanitized = {};
-  if (typeof raw === "object" && raw !== null) {
-    for (const [key, value] of Object.entries(raw)) {
-      if (!invalidTopLevelKeys.has(key)) {
-        sanitized[key] = value;
-      }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { sanitized: {}, error: formatIssues(result.error.issues) };
+  }
+  const working = structuredClone(raw);
+  for (let level = 0; level < 6; level++) {
+    for (let pass = 0; pass < 5; pass++) {
+      const attempt = ConfigFileSchema.safeParse(working);
+      if (attempt.success) break;
+      const paths = attempt.error.issues.flatMap((issue) => {
+        const at = issue.path;
+        if (issue.code === "unrecognized_keys") {
+          return issue.keys.map((k) => [...at, k]);
+        }
+        return [at.slice(0, -level || void 0)];
+      }).filter((path15) => path15.length > 0);
+      if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
+    if (ConfigFileSchema.safeParse(working).success) break;
+  }
+  const after = ConfigFileSchema.safeParse(working);
+  const sanitized = {};
+  const invalidTopLevelKeys = after.success ? /* @__PURE__ */ new Set() : new Set(
+    after.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
+  );
+  for (const [key, value] of Object.entries(working)) {
+    if (!invalidTopLevelKeys.has(key)) sanitized[key] = value;
   }
-  const lines = result.error.issues.map((issue) => {
-    const path15 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path15}: ${issue.message}`;
-  });
   return {
     sanitized,
-    error: `Invalid config:
-${lines.join("\n")}`
+    // The message names what the USER should fix, so it is built from the
+    // original parse, not from whatever survived the prune.
+    error: formatIssues(result.error.issues)
   };
 }
 
@@ -3061,9 +3117,15 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   // AWS ECS task role
   "168.63.129.16",
   // Azure WireServer
-  "fd00:ec2::254"
+  "fd00:ec2::254",
   // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
 ]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -3086,7 +3148,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -3098,7 +3160,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -3111,7 +3173,7 @@ var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
   multicast: "a multicast address",
-  unspecified: "the unspecified address",
+  unspecified: "the unspecified address, which reaches this host",
   cgnat: "a carrier-grade NAT address",
   private: "a loopback or private address"
 };
@@ -3122,7 +3184,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
     return {
       ...m,

package/dist/index.mjs

@@ -235,9 +235,9 @@ var SmartConditionSchema = z.object({
       "notMatchesGlob"
     ],
     {
-      errorMap: () => ({
-        message: "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
-      })
+      // zod 4 replaced errorMap with `error`. The wording is kept verbatim:
+      // it is what a user sees when their config is rejected.
+      error: () => "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
     }
   ),
   value: z.string().optional(),
@@ -255,7 +255,7 @@ var SmartRuleSchema = z.object({
   conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
   conditionMode: z.enum(["all", "any"]).optional(),
   verdict: z.enum(["allow", "review", "block"], {
-    errorMap: () => ({ message: "verdict must be one of: allow, review, block" })
+    error: () => "verdict must be one of: allow, review, block"
   }),
   reason: z.string().optional(),
   description: z.string().optional(),
@@ -328,7 +328,7 @@ var ConfigFileSchema = z.object({
     sandboxPaths: z.array(z.string()).optional(),
     dangerousWords: z.array(noNewlines).optional(),
     ignoredTools: z.array(z.string()).optional(),
-    toolInspection: z.record(z.string()).optional(),
+    toolInspection: z.record(z.string(), z.string()).optional(),
     smartRules: z.array(SmartRuleSchema).optional(),
     dlp: z.object({
       enabled: z.boolean().optional(),
@@ -373,32 +373,88 @@ var ConfigFileSchema = z.object({
       roots: z.array(z.string()).optional()
     }).optional()
   }).optional(),
-  environments: z.record(z.object({ requireApproval: z.boolean().optional() })).optional()
-}).strict({ message: "Config contains unknown top-level keys" });
+  environments: z.record(z.string(), z.object({ requireApproval: z.boolean().optional() })).optional()
+}).strict();
+function formatIssues(issues) {
+  const lines = issues.map((issue) => {
+    const path15 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path15}: ${issue.message}`;
+  });
+  return `Invalid config:
+${lines.join("\n")}`;
+}
+function prunePaths(root, paths) {
+  let removed = false;
+  const ordered = [...paths].sort((x, y) => {
+    if (y.length !== x.length) return y.length - x.length;
+    const xi = x[x.length - 1];
+    const yi = y[y.length - 1];
+    return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
+  });
+  for (const path15 of ordered) {
+    let cur = root;
+    for (const key of path15.slice(0, -1)) {
+      if (cur === null || typeof cur !== "object") {
+        cur = void 0;
+        break;
+      }
+      cur = cur[key];
+    }
+    if (cur === null || typeof cur !== "object") continue;
+    const last = path15[path15.length - 1];
+    if (Array.isArray(cur)) {
+      const i = Number(last);
+      if (Number.isInteger(i) && i >= 0 && i < cur.length) {
+        cur.splice(i, 1);
+        removed = true;
+      }
+      continue;
+    }
+    const obj = cur;
+    if (Object.prototype.hasOwnProperty.call(obj, String(last))) {
+      delete obj[String(last)];
+      removed = true;
+    }
+  }
+  return removed;
+}
 function sanitizeConfig(raw) {
   const result = ConfigFileSchema.safeParse(raw);
   if (result.success) {
     return { sanitized: result.data, error: null };
   }
-  const invalidTopLevelKeys = new Set(
-    result.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
-  );
-  const sanitized = {};
-  if (typeof raw === "object" && raw !== null) {
-    for (const [key, value] of Object.entries(raw)) {
-      if (!invalidTopLevelKeys.has(key)) {
-        sanitized[key] = value;
-      }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { sanitized: {}, error: formatIssues(result.error.issues) };
+  }
+  const working = structuredClone(raw);
+  for (let level = 0; level < 6; level++) {
+    for (let pass = 0; pass < 5; pass++) {
+      const attempt = ConfigFileSchema.safeParse(working);
+      if (attempt.success) break;
+      const paths = attempt.error.issues.flatMap((issue) => {
+        const at = issue.path;
+        if (issue.code === "unrecognized_keys") {
+          return issue.keys.map((k) => [...at, k]);
+        }
+        return [at.slice(0, -level || void 0)];
+      }).filter((path15) => path15.length > 0);
+      if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
+    if (ConfigFileSchema.safeParse(working).success) break;
+  }
+  const after = ConfigFileSchema.safeParse(working);
+  const sanitized = {};
+  const invalidTopLevelKeys = after.success ? /* @__PURE__ */ new Set() : new Set(
+    after.error.issues.filter((issue) => issue.path.length > 0).map((issue) => String(issue.path[0]))
+  );
+  for (const [key, value] of Object.entries(working)) {
+    if (!invalidTopLevelKeys.has(key)) sanitized[key] = value;
   }
-  const lines = result.error.issues.map((issue) => {
-    const path15 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path15}: ${issue.message}`;
-  });
   return {
     sanitized,
-    error: `Invalid config:
-${lines.join("\n")}`
+    // The message names what the USER should fix, so it is built from the
+    // original parse, not from whatever survived the prune.
+    error: formatIssues(result.error.issues)
   };
 }
 
@@ -3031,9 +3087,15 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   // AWS ECS task role
   "168.63.129.16",
   // Azure WireServer
-  "fd00:ec2::254"
+  "fd00:ec2::254",
   // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
 ]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -3056,7 +3118,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -3068,7 +3130,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -3081,7 +3143,7 @@ var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
   multicast: "a multicast address",
-  unspecified: "the unspecified address",
+  unspecified: "the unspecified address, which reaches this host",
   cgnat: "a carrier-grade NAT address",
   private: "a loopback or private address"
 };
@@ -3092,7 +3154,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
     return {
       ...m,

package/dist/scan-ink.mjs

@@ -61,9 +61,9 @@ var SmartConditionSchema = z.object({
       "notMatchesGlob"
     ],
     {
-      errorMap: () => ({
-        message: "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
-      })
+      // zod 4 replaced errorMap with `error`. The wording is kept verbatim:
+      // it is what a user sees when their config is rejected.
+      error: () => "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
     }
   ),
   value: z.string().optional(),
@@ -81,7 +81,7 @@ var SmartRuleSchema = z.object({
   conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
   conditionMode: z.enum(["all", "any"]).optional(),
   verdict: z.enum(["allow", "review", "block"], {
-    errorMap: () => ({ message: "verdict must be one of: allow, review, block" })
+    error: () => "verdict must be one of: allow, review, block"
   }),
   reason: z.string().optional(),
   description: z.string().optional(),
@@ -154,7 +154,7 @@ var ConfigFileSchema = z.object({
     sandboxPaths: z.array(z.string()).optional(),
     dangerousWords: z.array(noNewlines).optional(),
     ignoredTools: z.array(z.string()).optional(),
-    toolInspection: z.record(z.string()).optional(),
+    toolInspection: z.record(z.string(), z.string()).optional(),
     smartRules: z.array(SmartRuleSchema).optional(),
     dlp: z.object({
       enabled: z.boolean().optional(),
@@ -199,8 +199,8 @@ var ConfigFileSchema = z.object({
       roots: z.array(z.string()).optional()
     }).optional()
   }).optional(),
-  environments: z.record(z.object({ requireApproval: z.boolean().optional() })).optional()
-}).strict({ message: "Config contains unknown top-level keys" });
+  environments: z.record(z.string(), z.object({ requireApproval: z.boolean().optional() })).optional()
+}).strict();
 
 // src/shields.ts
 import fs from "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.9.1",
+  "version": "2.9.3",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -94,23 +94,23 @@
     "smol-toml": "^1.6.1",
     "string-width": "^4.2.3",
     "yaml": "^2.9.0",
-    "zod": "^3.25.76"
+    "zod": "^4.5.4"
   },
   "bundleDependencies": [
     "mvdan-sh"
   ],
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.78.0",
+    "@anthropic-ai/sdk": "^0.124.0",
     "@octokit/rest": "^22.0.1",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/github": "^12.0.6",
     "@semantic-release/npm": "^13.1.5",
     "@semantic-release/release-notes-generator": "^14.1.0",
-    "@types/node": "^25.3.1",
+    "@types/node": "^26.4.1",
     "@types/picomatch": "^4.0.2",
     "@types/react": "^19.2.14",
-    "@vitest/coverage-v8": "4.1.2",
+    "@vitest/coverage-v8": "^5.0.0",
     "cross-env": "^10.1.0",
     "ink-testing-library": "^4.0.0",
     "prettier": "^3.4.2",
@@ -119,7 +119,7 @@
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.20.0",
-    "vitest": "4.1.2"
+    "vitest": "^5.0.0"
   },
   "overrides": {
     "undici": "^7.24.0",