@node9/proxy 2.9.3 → 2.11.0

package/dist/cli.js

@@ -2046,6 +2046,12 @@ function normalizeIpLiteral(host) {
     return null;
   }
 }
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
 function classifySsrf(host) {
   try {
     if (typeof host !== "string" || !host) return null;
@@ -2091,17 +2097,66 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
-    return {
-      ...m,
-      host: token,
-      binary,
-      reason: `Blocked: ${token} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== token ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.")
-    };
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
 }
+function bareToolName(toolName) {
+  const parts = toolName.split("__");
+  return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
+}
+function valuesAt(args, path77) {
+  let cursors = [args];
+  for (const rawSegment of path77.split(".")) {
+    const isArray = rawSegment.endsWith("[]");
+    const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
+    const next = [];
+    for (const cursor of cursors) {
+      if (cursor === null || typeof cursor !== "object") continue;
+      const child = cursor[key];
+      if (isArray) {
+        if (Array.isArray(child)) next.push(...child);
+      } else if (child !== void 0) {
+        next.push(child);
+      }
+    }
+    cursors = next;
+    if (cursors.length === 0) return [];
+  }
+  return cursors.filter((v) => typeof v === "string");
+}
+function hostOf(value) {
+  try {
+    const u = new URL(value);
+    const h = u.hostname;
+    return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+  } catch {
+    return null;
+  }
+}
+function ssrfDestinationFloor(toolName, args, opts = {}) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return null;
+    const exempt2 = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
+    for (const path77 of paths) {
+      for (const value of valuesAt(args, path77)) {
+        const host = hostOf(value);
+        if (!host) continue;
+        const m = classifySsrf(host);
+        if (!m) continue;
+        if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+        if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+        return { ...m, argPath: path77, host, reason: ssrfReason(m, host) };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
 }
@@ -2199,6 +2254,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest) {
+      return {
+        decision: "block",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason,
+        tier: 3
+      };
+    }
+  }
   if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
@@ -3205,7 +3276,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4382,6 +4453,13 @@ var init_dist = __esm({
       cgnat: "a carrier-grade NAT address",
       private: "a loopback or private address"
     };
+    DESTINATION_ARGS = /* @__PURE__ */ new Map([
+      ["webfetch", ["url"]],
+      ["fetch", ["url", "uri"]],
+      ["navigate", ["url"]],
+      ["preview_start", ["url"]],
+      ["browser_batch", ["actions[].input.url"]]
+    ]);
     VERDICT_RANK = {
       allow: 0,
       review: 1,
@@ -8752,6 +8830,26 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest && !isObserveMode) {
+      if (!isManual)
+        appendLocalAudit(toolName, args, "deny", "ssrf-destination", meta, hashAuditArgs);
+      return {
+        approved: false,
+        checkedBy: "local-policy",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        // AuthResult carries no ruleName; the rule identity the audit row needs
+        // travels in ruleHit, as it does for a smart-rule block.
+        ruleHit: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason
+      };
+    }
+  }
   if (config.policy.dlp.enabled && (!isIgnoredTool2(toolName) || config.policy.dlp.scanIgnoredTools)) {
     const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
     const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");
@@ -9427,6 +9525,7 @@ var init_orchestrator = __esm({
     init_dlp();
     init_registry();
     init_dist();
+    init_dist();
     init_audit();
     init_config();
     init_policy();

package/dist/cli.mjs

@@ -2057,6 +2057,12 @@ function normalizeIpLiteral(host) {
     return null;
   }
 }
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
 function classifySsrf(host) {
   try {
     if (typeof host !== "string" || !host) return null;
@@ -2102,17 +2108,66 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
-    return {
-      ...m,
-      host: token,
-      binary,
-      reason: `Blocked: ${token} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== token ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.")
-    };
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
 }
+function bareToolName(toolName) {
+  const parts = toolName.split("__");
+  return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
+}
+function valuesAt(args, path77) {
+  let cursors = [args];
+  for (const rawSegment of path77.split(".")) {
+    const isArray = rawSegment.endsWith("[]");
+    const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
+    const next = [];
+    for (const cursor of cursors) {
+      if (cursor === null || typeof cursor !== "object") continue;
+      const child = cursor[key];
+      if (isArray) {
+        if (Array.isArray(child)) next.push(...child);
+      } else if (child !== void 0) {
+        next.push(child);
+      }
+    }
+    cursors = next;
+    if (cursors.length === 0) return [];
+  }
+  return cursors.filter((v) => typeof v === "string");
+}
+function hostOf(value) {
+  try {
+    const u = new URL(value);
+    const h = u.hostname;
+    return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+  } catch {
+    return null;
+  }
+}
+function ssrfDestinationFloor(toolName, args, opts = {}) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return null;
+    const exempt2 = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
+    for (const path77 of paths) {
+      for (const value of valuesAt(args, path77)) {
+        const host = hostOf(value);
+        if (!host) continue;
+        const m = classifySsrf(host);
+        if (!m) continue;
+        if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+        if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
+        return { ...m, argPath: path77, host, reason: ssrfReason(m, host) };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
 }
@@ -2210,6 +2265,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest) {
+      return {
+        decision: "block",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason,
+        tier: 3
+      };
+    }
+  }
   if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
@@ -3216,7 +3287,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4386,6 +4457,13 @@ var init_dist = __esm({
       cgnat: "a carrier-grade NAT address",
       private: "a loopback or private address"
     };
+    DESTINATION_ARGS = /* @__PURE__ */ new Map([
+      ["webfetch", ["url"]],
+      ["fetch", ["url", "uri"]],
+      ["navigate", ["url"]],
+      ["preview_start", ["url"]],
+      ["browser_batch", ["actions[].input.url"]]
+    ]);
     VERDICT_RANK = {
       allow: 0,
       review: 1,
@@ -8755,6 +8833,26 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest && !isObserveMode) {
+      if (!isManual)
+        appendLocalAudit(toolName, args, "deny", "ssrf-destination", meta, hashAuditArgs);
+      return {
+        approved: false,
+        checkedBy: "local-policy",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        // AuthResult carries no ruleName; the rule identity the audit row needs
+        // travels in ruleHit, as it does for a smart-rule block.
+        ruleHit: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason
+      };
+    }
+  }
   if (config.policy.dlp.enabled && (!isIgnoredTool2(toolName) || config.policy.dlp.scanIgnoredTools)) {
     const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
     const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");
@@ -9429,6 +9527,7 @@ var init_orchestrator = __esm({
     init_dlp();
     init_registry();
     init_dist();
+    init_dist();
     init_audit();
     init_config();
     init_policy();

package/dist/index.js

@@ -3126,6 +3126,12 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   "100.100.100.200"
 ]);
 var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -3184,17 +3190,73 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-    return {
-      ...m,
-      host: token,
-      binary,
-      reason: `Blocked: ${token} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== token ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.")
-    };
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
 }
+var DESTINATION_ARGS = /* @__PURE__ */ new Map([
+  ["webfetch", ["url"]],
+  ["fetch", ["url", "uri"]],
+  ["navigate", ["url"]],
+  ["preview_start", ["url"]],
+  ["browser_batch", ["actions[].input.url"]]
+]);
+function bareToolName(toolName) {
+  const parts = toolName.split("__");
+  return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
+}
+function valuesAt(args, path15) {
+  let cursors = [args];
+  for (const rawSegment of path15.split(".")) {
+    const isArray = rawSegment.endsWith("[]");
+    const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
+    const next = [];
+    for (const cursor of cursors) {
+      if (cursor === null || typeof cursor !== "object") continue;
+      const child = cursor[key];
+      if (isArray) {
+        if (Array.isArray(child)) next.push(...child);
+      } else if (child !== void 0) {
+        next.push(child);
+      }
+    }
+    cursors = next;
+    if (cursors.length === 0) return [];
+  }
+  return cursors.filter((v) => typeof v === "string");
+}
+function hostOf(value) {
+  try {
+    const u = new URL(value);
+    const h = u.hostname;
+    return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+  } catch {
+    return null;
+  }
+}
+function ssrfDestinationFloor(toolName, args, opts = {}) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return null;
+    const exempt = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
+    for (const path15 of paths) {
+      for (const value of valuesAt(args, path15)) {
+        const host = hostOf(value);
+        if (!host) continue;
+        const m = classifySsrf(host);
+        if (!m) continue;
+        if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+        if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+        return { ...m, argPath: path15, host, reason: ssrfReason(m, host) };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
 }
@@ -3298,6 +3360,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest) {
+      return {
+        decision: "block",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason,
+        tier: 3
+      };
+    }
+  }
   if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
@@ -7170,6 +7248,26 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest && !isObserveMode) {
+      if (!isManual)
+        appendLocalAudit(toolName, args, "deny", "ssrf-destination", meta, hashAuditArgs);
+      return {
+        approved: false,
+        checkedBy: "local-policy",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        // AuthResult carries no ruleName; the rule identity the audit row needs
+        // travels in ruleHit, as it does for a smart-rule block.
+        ruleHit: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason
+      };
+    }
+  }
   if (config.policy.dlp.enabled && (!isIgnoredTool2(toolName) || config.policy.dlp.scanIgnoredTools)) {
     const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
     const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");

package/dist/index.mjs

@@ -3096,6 +3096,12 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   "100.100.100.200"
 ]);
 var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -3154,17 +3160,73 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-    return {
-      ...m,
-      host: token,
-      binary,
-      reason: `Blocked: ${token} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== token ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.")
-    };
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
   }
   return null;
 }
+var DESTINATION_ARGS = /* @__PURE__ */ new Map([
+  ["webfetch", ["url"]],
+  ["fetch", ["url", "uri"]],
+  ["navigate", ["url"]],
+  ["preview_start", ["url"]],
+  ["browser_batch", ["actions[].input.url"]]
+]);
+function bareToolName(toolName) {
+  const parts = toolName.split("__");
+  return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
+}
+function valuesAt(args, path15) {
+  let cursors = [args];
+  for (const rawSegment of path15.split(".")) {
+    const isArray = rawSegment.endsWith("[]");
+    const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
+    const next = [];
+    for (const cursor of cursors) {
+      if (cursor === null || typeof cursor !== "object") continue;
+      const child = cursor[key];
+      if (isArray) {
+        if (Array.isArray(child)) next.push(...child);
+      } else if (child !== void 0) {
+        next.push(child);
+      }
+    }
+    cursors = next;
+    if (cursors.length === 0) return [];
+  }
+  return cursors.filter((v) => typeof v === "string");
+}
+function hostOf(value) {
+  try {
+    const u = new URL(value);
+    const h = u.hostname;
+    return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+  } catch {
+    return null;
+  }
+}
+function ssrfDestinationFloor(toolName, args, opts = {}) {
+  try {
+    const paths = DESTINATION_ARGS.get(bareToolName(toolName));
+    if (!paths) return null;
+    const exempt = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
+    for (const path15 of paths) {
+      for (const value of valuesAt(args, path15)) {
+        const host = hostOf(value);
+        if (!host) continue;
+        const m = classifySsrf(host);
+        if (!m) continue;
+        if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+        if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+        return { ...m, argPath: path15, host, reason: ssrfReason(m, host) };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
 }
@@ -3268,6 +3330,22 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest) {
+      return {
+        decision: "block",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason,
+        tier: 3
+      };
+    }
+  }
   if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
@@ -7140,6 +7218,26 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       };
     }
   }
+  {
+    const dest = ssrfDestinationFloor(toolName, args, {
+      ssrfAllow: config.policy.egress?.ssrfAllow,
+      ssrfStrict: config.policy.egress?.ssrfStrict
+    });
+    if (dest && !isObserveMode) {
+      if (!isManual)
+        appendLocalAudit(toolName, args, "deny", "ssrf-destination", meta, hashAuditArgs);
+      return {
+        approved: false,
+        checkedBy: "local-policy",
+        blockedByLabel: "\u{1F310} Node9 Egress (Protected Address)",
+        reason: dest.reason,
+        // AuthResult carries no ruleName; the rule identity the audit row needs
+        // travels in ruleHit, as it does for a smart-rule block.
+        ruleHit: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
+        ruleDescription: dest.reason
+      };
+    }
+  }
   if (config.policy.dlp.enabled && (!isIgnoredTool2(toolName) || config.policy.dlp.scanIgnoredTools)) {
     const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
     const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");

package/docs/README.md

@@ -0,0 +1,49 @@
+# node9 documentation
+
+These pages are the source of truth for how node9 behaves. They live next to the code so the tests
+in this repository can check them: a page that names a command the CLI does not have, or a command
+with no page at all, fails CI.
+
+The site at [node9.ai/docs](https://node9.ai/docs) renders these same files.
+
+## Protections
+
+| Page                        | What it covers                                                                                                                           |
+| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| [Egress Control](egress.md) | Which hosts an agent may reach, the always-on floor around cloud metadata and private ranges, and what a destination gate does not cover |
+
+## Per agent
+
+[One page per agent](agents/README.md): how node9 is wired in, what that covers, and what it does
+not. Twelve agents, split by control model.
+
+## Reference
+
+| Page                        | What it covers                                                                                        |
+| --------------------------- | ----------------------------------------------------------------------------------------------------- |
+| [Comparison](comparison.md) | Where node9 sits among agent-security tools, on the axis of what a tool can read before an agent runs |
+| [Badges](badges.md)         | The `scanned by node9` badge for your own README                                                      |
+
+## Writing a page here
+
+Every page starts with front matter:
+
+```yaml
+---
+id: egress
+label: Egress Control
+description: One sentence. It becomes the page's search description.
+group: Protections
+order: 20
+---
+```
+
+`id` becomes the URL (`/docs/egress`), `group` places it in the site's left navigation, and `order`
+sorts it within that group. Use GitHub-flavoured Markdown plus GitHub alerts (`> [!NOTE]`,
+`> [!WARNING]`), which render in both places.
+
+Two rules the tests enforce:
+
+- Every command a page names must exist. Check with `node9 <command> --help` before you write it.
+- Every page must state what the feature does **not** do. A page that only sells is a page that
+  will be wrong within a release.