@node9/proxy 1.0.9 → 1.0.11

package/dist/cli.js

@@ -850,7 +850,7 @@ var DEFAULT_CONFIG = {
       {
         name: "review-git-push",
         tool: "bash",
-        conditions: [{ field: "command", op: "matches", value: "^\\s*git push\\b", flags: "i" }],
+        conditions: [{ field: "command", op: "matches", value: "^\\s*git\\s+push\\b", flags: "i" }],
         conditionMode: "all",
         verdict: "review",
         reason: "git push sends changes to a shared remote"
@@ -1855,6 +1855,7 @@ function getConfig() {
       ignorePaths: [...DEFAULT_CONFIG.policy.snapshot.ignorePaths]
     }
   };
+  const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
     if (!source) return;
     const s = source.settings || {};
@@ -1880,6 +1881,17 @@ function getConfig() {
       if (s2.onlyPaths) mergedPolicy.snapshot.onlyPaths.push(...s2.onlyPaths);
       if (s2.ignorePaths) mergedPolicy.snapshot.ignorePaths.push(...s2.ignorePaths);
     }
+    const envs = source.environments || {};
+    for (const [envName, envConfig] of Object.entries(envs)) {
+      if (envConfig && typeof envConfig === "object") {
+        const ec = envConfig;
+        mergedEnvironments[envName] = {
+          ...mergedEnvironments[envName],
+          // Validate field types before merging — do not blindly spread user input
+          ...typeof ec.requireApproval === "boolean" ? { requireApproval: ec.requireApproval } : {}
+        };
+      }
+    }
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
@@ -1893,7 +1905,7 @@ function getConfig() {
   cachedConfig = {
     settings: mergedSettings,
     policy: mergedPolicy,
-    environments: {}
+    environments: mergedEnvironments
   };
   return cachedConfig;
 }
@@ -1914,6 +1926,29 @@ function tryLoadConfig(filePath) {
     );
     return null;
   }
+  const SUPPORTED_VERSION = "1.0";
+  const SUPPORTED_MAJOR = SUPPORTED_VERSION.split(".")[0];
+  const fileVersion = raw?.version;
+  if (fileVersion !== void 0) {
+    const vStr = String(fileVersion);
+    const fileMajor = vStr.split(".")[0];
+    if (fileMajor !== SUPPORTED_MAJOR) {
+      process.stderr.write(
+        `
+\u274C  Node9: Config at ${filePath} has version "${vStr}" \u2014 major version is incompatible with this release (expected "${SUPPORTED_VERSION}"). Config will not be loaded.
+
+`
+      );
+      return null;
+    } else if (vStr !== SUPPORTED_VERSION) {
+      process.stderr.write(
+        `
+\u26A0\uFE0F  Node9: Config at ${filePath} declares version "${vStr}" \u2014 expected "${SUPPORTED_VERSION}". Continuing with best-effort parsing.
+
+`
+      );
+    }
+  }
   const { sanitized, error } = sanitizeConfig(raw);
   if (error) {
     process.stderr.write(

package/dist/cli.mjs

@@ -827,7 +827,7 @@ var DEFAULT_CONFIG = {
       {
         name: "review-git-push",
         tool: "bash",
-        conditions: [{ field: "command", op: "matches", value: "^\\s*git push\\b", flags: "i" }],
+        conditions: [{ field: "command", op: "matches", value: "^\\s*git\\s+push\\b", flags: "i" }],
         conditionMode: "all",
         verdict: "review",
         reason: "git push sends changes to a shared remote"
@@ -1832,6 +1832,7 @@ function getConfig() {
       ignorePaths: [...DEFAULT_CONFIG.policy.snapshot.ignorePaths]
     }
   };
+  const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
     if (!source) return;
     const s = source.settings || {};
@@ -1857,6 +1858,17 @@ function getConfig() {
       if (s2.onlyPaths) mergedPolicy.snapshot.onlyPaths.push(...s2.onlyPaths);
       if (s2.ignorePaths) mergedPolicy.snapshot.ignorePaths.push(...s2.ignorePaths);
     }
+    const envs = source.environments || {};
+    for (const [envName, envConfig] of Object.entries(envs)) {
+      if (envConfig && typeof envConfig === "object") {
+        const ec = envConfig;
+        mergedEnvironments[envName] = {
+          ...mergedEnvironments[envName],
+          // Validate field types before merging — do not blindly spread user input
+          ...typeof ec.requireApproval === "boolean" ? { requireApproval: ec.requireApproval } : {}
+        };
+      }
+    }
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
@@ -1870,7 +1882,7 @@ function getConfig() {
   cachedConfig = {
     settings: mergedSettings,
     policy: mergedPolicy,
-    environments: {}
+    environments: mergedEnvironments
   };
   return cachedConfig;
 }
@@ -1891,6 +1903,29 @@ function tryLoadConfig(filePath) {
     );
     return null;
   }
+  const SUPPORTED_VERSION = "1.0";
+  const SUPPORTED_MAJOR = SUPPORTED_VERSION.split(".")[0];
+  const fileVersion = raw?.version;
+  if (fileVersion !== void 0) {
+    const vStr = String(fileVersion);
+    const fileMajor = vStr.split(".")[0];
+    if (fileMajor !== SUPPORTED_MAJOR) {
+      process.stderr.write(
+        `
+\u274C  Node9: Config at ${filePath} has version "${vStr}" \u2014 major version is incompatible with this release (expected "${SUPPORTED_VERSION}"). Config will not be loaded.
+
+`
+      );
+      return null;
+    } else if (vStr !== SUPPORTED_VERSION) {
+      process.stderr.write(
+        `
+\u26A0\uFE0F  Node9: Config at ${filePath} declares version "${vStr}" \u2014 expected "${SUPPORTED_VERSION}". Continuing with best-effort parsing.
+
+`
+      );
+    }
+  }
   const { sanitized, error } = sanitizeConfig(raw);
   if (error) {
     process.stderr.write(

package/dist/index.js

@@ -836,7 +836,7 @@ var DEFAULT_CONFIG = {
       {
         name: "review-git-push",
         tool: "bash",
-        conditions: [{ field: "command", op: "matches", value: "^\\s*git push\\b", flags: "i" }],
+        conditions: [{ field: "command", op: "matches", value: "^\\s*git\\s+push\\b", flags: "i" }],
         conditionMode: "all",
         verdict: "review",
         reason: "git push sends changes to a shared remote"
@@ -1514,6 +1514,7 @@ function getConfig() {
       ignorePaths: [...DEFAULT_CONFIG.policy.snapshot.ignorePaths]
     }
   };
+  const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
     if (!source) return;
     const s = source.settings || {};
@@ -1539,6 +1540,17 @@ function getConfig() {
       if (s2.onlyPaths) mergedPolicy.snapshot.onlyPaths.push(...s2.onlyPaths);
       if (s2.ignorePaths) mergedPolicy.snapshot.ignorePaths.push(...s2.ignorePaths);
     }
+    const envs = source.environments || {};
+    for (const [envName, envConfig] of Object.entries(envs)) {
+      if (envConfig && typeof envConfig === "object") {
+        const ec = envConfig;
+        mergedEnvironments[envName] = {
+          ...mergedEnvironments[envName],
+          // Validate field types before merging — do not blindly spread user input
+          ...typeof ec.requireApproval === "boolean" ? { requireApproval: ec.requireApproval } : {}
+        };
+      }
+    }
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
@@ -1552,7 +1564,7 @@ function getConfig() {
   cachedConfig = {
     settings: mergedSettings,
     policy: mergedPolicy,
-    environments: {}
+    environments: mergedEnvironments
   };
   return cachedConfig;
 }
@@ -1573,6 +1585,29 @@ function tryLoadConfig(filePath) {
     );
     return null;
   }
+  const SUPPORTED_VERSION = "1.0";
+  const SUPPORTED_MAJOR = SUPPORTED_VERSION.split(".")[0];
+  const fileVersion = raw?.version;
+  if (fileVersion !== void 0) {
+    const vStr = String(fileVersion);
+    const fileMajor = vStr.split(".")[0];
+    if (fileMajor !== SUPPORTED_MAJOR) {
+      process.stderr.write(
+        `
+\u274C  Node9: Config at ${filePath} has version "${vStr}" \u2014 major version is incompatible with this release (expected "${SUPPORTED_VERSION}"). Config will not be loaded.
+
+`
+      );
+      return null;
+    } else if (vStr !== SUPPORTED_VERSION) {
+      process.stderr.write(
+        `
+\u26A0\uFE0F  Node9: Config at ${filePath} declares version "${vStr}" \u2014 expected "${SUPPORTED_VERSION}". Continuing with best-effort parsing.
+
+`
+      );
+    }
+  }
   const { sanitized, error } = sanitizeConfig(raw);
   if (error) {
     process.stderr.write(

package/dist/index.mjs

@@ -800,7 +800,7 @@ var DEFAULT_CONFIG = {
       {
         name: "review-git-push",
         tool: "bash",
-        conditions: [{ field: "command", op: "matches", value: "^\\s*git push\\b", flags: "i" }],
+        conditions: [{ field: "command", op: "matches", value: "^\\s*git\\s+push\\b", flags: "i" }],
         conditionMode: "all",
         verdict: "review",
         reason: "git push sends changes to a shared remote"
@@ -1478,6 +1478,7 @@ function getConfig() {
       ignorePaths: [...DEFAULT_CONFIG.policy.snapshot.ignorePaths]
     }
   };
+  const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
     if (!source) return;
     const s = source.settings || {};
@@ -1503,6 +1504,17 @@ function getConfig() {
       if (s2.onlyPaths) mergedPolicy.snapshot.onlyPaths.push(...s2.onlyPaths);
       if (s2.ignorePaths) mergedPolicy.snapshot.ignorePaths.push(...s2.ignorePaths);
     }
+    const envs = source.environments || {};
+    for (const [envName, envConfig] of Object.entries(envs)) {
+      if (envConfig && typeof envConfig === "object") {
+        const ec = envConfig;
+        mergedEnvironments[envName] = {
+          ...mergedEnvironments[envName],
+          // Validate field types before merging — do not blindly spread user input
+          ...typeof ec.requireApproval === "boolean" ? { requireApproval: ec.requireApproval } : {}
+        };
+      }
+    }
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
@@ -1516,7 +1528,7 @@ function getConfig() {
   cachedConfig = {
     settings: mergedSettings,
     policy: mergedPolicy,
-    environments: {}
+    environments: mergedEnvironments
   };
   return cachedConfig;
 }
@@ -1537,6 +1549,29 @@ function tryLoadConfig(filePath) {
     );
     return null;
   }
+  const SUPPORTED_VERSION = "1.0";
+  const SUPPORTED_MAJOR = SUPPORTED_VERSION.split(".")[0];
+  const fileVersion = raw?.version;
+  if (fileVersion !== void 0) {
+    const vStr = String(fileVersion);
+    const fileMajor = vStr.split(".")[0];
+    if (fileMajor !== SUPPORTED_MAJOR) {
+      process.stderr.write(
+        `
+\u274C  Node9: Config at ${filePath} has version "${vStr}" \u2014 major version is incompatible with this release (expected "${SUPPORTED_VERSION}"). Config will not be loaded.
+
+`
+      );
+      return null;
+    } else if (vStr !== SUPPORTED_VERSION) {
+      process.stderr.write(
+        `
+\u26A0\uFE0F  Node9: Config at ${filePath} declares version "${vStr}" \u2014 expected "${SUPPORTED_VERSION}". Continuing with best-effort parsing.
+
+`
+      );
+    }
+  }
   const { sanitized, error } = sanitizeConfig(raw);
   if (error) {
     process.stderr.write(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",