@node9/proxy 1.10.2 → 1.11.0

package/dist/index.js

@@ -239,7 +239,8 @@ var ConfigFileSchema = import_zod.z.object({
     enableTrustSessions: import_zod.z.boolean().optional(),
     allowGlobalPause: import_zod.z.boolean().optional(),
     auditHashArgs: import_zod.z.boolean().optional(),
-    agentPolicy: import_zod.z.enum(["require_approval", "block_on_rules"]).optional()
+    agentPolicy: import_zod.z.enum(["require_approval", "block_on_rules"]).optional(),
+    cloudSyncIntervalHours: import_zod.z.number().positive().optional()
   }).optional(),
   policy: import_zod.z.object({
     sandboxPaths: import_zod.z.array(import_zod.z.string()).optional(),
@@ -260,6 +261,11 @@ var ConfigFileSchema = import_zod.z.object({
       enabled: import_zod.z.boolean().optional(),
       threshold: import_zod.z.number().min(2).optional(),
       windowSeconds: import_zod.z.number().min(10).optional()
+    }).optional(),
+    skillPinning: import_zod.z.object({
+      enabled: import_zod.z.boolean().optional(),
+      mode: import_zod.z.enum(["warn", "block"]).optional(),
+      roots: import_zod.z.array(import_zod.z.string()).optional()
     }).optional()
   }).optional(),
   environments: import_zod.z.record(import_zod.z.object({ requireApproval: import_zod.z.boolean().optional() })).optional()
@@ -441,7 +447,8 @@ var DEFAULT_CONFIG = {
     // 120-second auto-deny timeout
     flightRecorder: true,
     auditHashArgs: true,
-    approvers: { native: true, browser: true, cloud: false, terminal: true }
+    approvers: { native: true, browser: true, cloud: false, terminal: true },
+    cloudSyncIntervalHours: 5
   },
   policy: {
     sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
@@ -616,7 +623,8 @@ var DEFAULT_CONFIG = {
       }
     ],
     dlp: { enabled: true, scanIgnoredTools: true },
-    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 }
+    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
+    skillPinning: { enabled: false, mode: "warn", roots: [] }
   },
   environments: {}
 };
@@ -739,7 +747,11 @@ function getConfig(cwd) {
       ignorePaths: [...DEFAULT_CONFIG.policy.snapshot.ignorePaths]
     },
     dlp: { ...DEFAULT_CONFIG.policy.dlp },
-    loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection }
+    loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection },
+    skillPinning: {
+      ...DEFAULT_CONFIG.policy.skillPinning,
+      roots: [...DEFAULT_CONFIG.policy.skillPinning.roots]
+    }
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
@@ -756,6 +768,8 @@ function getConfig(cwd) {
     if (s.approvalTimeoutSeconds !== void 0 && s.approvalTimeoutMs === void 0)
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
+    if (s.cloudSyncIntervalHours !== void 0)
+      mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
@@ -765,7 +779,12 @@ function getConfig(cwd) {
     if (p.smartRules) {
       const defaultBlocks = mergedPolicy.smartRules.filter((r) => r.verdict === "block");
       const defaultNonBlocks = mergedPolicy.smartRules.filter((r) => r.verdict !== "block");
-      mergedPolicy.smartRules = [...defaultBlocks, ...p.smartRules, ...defaultNonBlocks];
+      const userRuleNames = new Set(p.smartRules.filter((r) => r.name).map((r) => r.name));
+      const filteredBlocks = defaultBlocks.filter((r) => !r.name || !userRuleNames.has(r.name));
+      const filteredNonBlocks = defaultNonBlocks.filter(
+        (r) => !r.name || !userRuleNames.has(r.name)
+      );
+      mergedPolicy.smartRules = [...filteredBlocks, ...p.smartRules, ...filteredNonBlocks];
     }
     if (p.snapshot) {
       const s2 = p.snapshot;
@@ -785,6 +804,16 @@ function getConfig(cwd) {
       if (ld.windowSeconds !== void 0)
         mergedPolicy.loopDetection.windowSeconds = ld.windowSeconds;
     }
+    if (p.skillPinning && typeof p.skillPinning === "object") {
+      const sp = p.skillPinning;
+      if (sp.enabled !== void 0) mergedPolicy.skillPinning.enabled = sp.enabled;
+      if (sp.mode !== void 0) mergedPolicy.skillPinning.mode = sp.mode;
+      if (Array.isArray(sp.roots)) {
+        for (const r of sp.roots) {
+          if (typeof r === "string" && r.length > 0) mergedPolicy.skillPinning.roots.push(r);
+        }
+      }
+    }
     const envs = source.environments || {};
     for (const [envName, envConfig] of Object.entries(envs)) {
       if (envConfig && typeof envConfig === "object") {
@@ -799,6 +828,16 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  {
+    const cacheFile = import_path3.default.join(import_os3.default.homedir(), ".node9", "rules-cache.json");
+    try {
+      const raw = JSON.parse(import_fs3.default.readFileSync(cacheFile, "utf-8"));
+      if (Array.isArray(raw.rules) && raw.rules.length > 0) {
+        applyLayer({ policy: { smartRules: raw.rules } });
+      }
+    } catch {
+    }
+  }
   const shieldOverrides = readShieldOverrides();
   for (const shieldName of readActiveShields()) {
     const shield = getShield(shieldName);
@@ -826,6 +865,7 @@ function getConfig(cwd) {
   mergedPolicy.sandboxPaths = [...new Set(mergedPolicy.sandboxPaths)];
   mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
+  mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   mergedPolicy.snapshot.tools = [...new Set(mergedPolicy.snapshot.tools)];
   mergedPolicy.snapshot.onlyPaths = [...new Set(mergedPolicy.snapshot.onlyPaths)];
   mergedPolicy.snapshot.ignorePaths = [...new Set(mergedPolicy.snapshot.ignorePaths)];
@@ -1871,6 +1911,15 @@ var import_path9 = __toESM(require("path"));
 var import_os6 = __toESM(require("os"));
 var PAUSED_FILE = import_path9.default.join(import_os6.default.homedir(), ".node9", "PAUSED");
 var TRUST_FILE = import_path9.default.join(import_os6.default.homedir(), ".node9", "trust.json");
+function extractCommandPattern(toolName, args) {
+  const lower = toolName.toLowerCase();
+  if (lower !== "bash" && lower !== "execute_bash" && lower !== "shell") return void 0;
+  const a = args;
+  const cmd = typeof a?.["command"] === "string" ? a["command"].trim() : "";
+  if (!cmd) return void 0;
+  const words = cmd.split(/\s+/);
+  return words.slice(0, 2).join(" ");
+}
 function checkPause() {
   try {
     if (!import_fs7.default.existsSync(PAUSED_FILE)) return { paused: false };
@@ -1894,7 +1943,7 @@ function atomicWriteSync(filePath, data, options) {
   import_fs7.default.writeFileSync(tmpPath, data, options);
   import_fs7.default.renameSync(tmpPath, filePath);
 }
-function getActiveTrustSession(toolName) {
+function getActiveTrustSession(toolName, args) {
   try {
     if (!import_fs7.default.existsSync(TRUST_FILE)) return false;
     const trust = JSON.parse(import_fs7.default.readFileSync(TRUST_FILE, "utf-8"));
@@ -1903,12 +1952,20 @@ function getActiveTrustSession(toolName) {
     if (active.length !== trust.entries.length) {
       import_fs7.default.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
-    return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
+    return active.some((e) => {
+      if (!(e.tool === toolName || matchesPattern(toolName, e.tool))) return false;
+      if (e.commandPattern) {
+        const actual = extractCommandPattern(toolName, args) ?? "";
+        return actual === e.commandPattern || actual.startsWith(e.commandPattern + " ");
+      }
+      return true;
+    });
   } catch {
     return false;
   }
 }
-function writeTrustSession(toolName, durationMs) {
+function writeTrustSession(toolName, durationMs, args) {
+  const commandPattern = extractCommandPattern(toolName, args);
   try {
     let trust = { entries: [] };
     try {
@@ -1918,8 +1975,14 @@ function writeTrustSession(toolName, durationMs) {
     } catch {
     }
     const now = Date.now();
-    trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > now);
-    trust.entries.push({ tool: toolName, expiry: now + durationMs });
+    trust.entries = trust.entries.filter(
+      (e) => !(e.tool === toolName && e.commandPattern === commandPattern) && e.expiry > now
+    );
+    trust.entries.push({
+      tool: toolName,
+      ...commandPattern && { commandPattern },
+      expiry: now + durationMs
+    });
     atomicWriteSync(TRUST_FILE, JSON.stringify(trust, null, 2));
   } catch (err) {
     if (process.env.NODE9_DEBUG === "1") {
@@ -2881,12 +2944,6 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
         };
       }
     }
-    if (getActiveTrustSession(toolName)) {
-      if (approvers.cloud && creds?.apiKey)
-        await auditLocalAllow(toolName, args, "trust", creds, meta);
-      if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
-      return { approved: true, checkedBy: "trust" };
-    }
     const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
     if (policyResult.decision === "allow") {
       if (approvers.cloud && creds?.apiKey)
@@ -2968,6 +3025,12 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
     return { approved: true };
   }
+  if (!taintWarning && getActiveTrustSession(toolName, args)) {
+    if (approvers.cloud && creds?.apiKey)
+      await auditLocalAllow(toolName, args, "trust", creds, meta);
+    if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
+    return { approved: true, checkedBy: "trust" };
+  }
   if (taintWarning) {
     explainableLabel = "\u{1F534} Node9 Taint (Exfiltration Prevention)";
     riskMetadata = computeRiskMetadata(
@@ -3100,7 +3163,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           riskMetadata?.ruleDescription
         );
         if (decision === "always_allow") {
-          writeTrustSession(toolName, 36e5);
+          writeTrustSession(toolName, 36e5, args);
           return { approved: true, checkedBy: "trust" };
         }
         const isApproved = decision === "allow";

package/dist/index.mjs

@@ -209,7 +209,8 @@ var ConfigFileSchema = z.object({
     enableTrustSessions: z.boolean().optional(),
     allowGlobalPause: z.boolean().optional(),
     auditHashArgs: z.boolean().optional(),
-    agentPolicy: z.enum(["require_approval", "block_on_rules"]).optional()
+    agentPolicy: z.enum(["require_approval", "block_on_rules"]).optional(),
+    cloudSyncIntervalHours: z.number().positive().optional()
   }).optional(),
   policy: z.object({
     sandboxPaths: z.array(z.string()).optional(),
@@ -230,6 +231,11 @@ var ConfigFileSchema = z.object({
       enabled: z.boolean().optional(),
       threshold: z.number().min(2).optional(),
       windowSeconds: z.number().min(10).optional()
+    }).optional(),
+    skillPinning: z.object({
+      enabled: z.boolean().optional(),
+      mode: z.enum(["warn", "block"]).optional(),
+      roots: z.array(z.string()).optional()
     }).optional()
   }).optional(),
   environments: z.record(z.object({ requireApproval: z.boolean().optional() })).optional()
@@ -411,7 +417,8 @@ var DEFAULT_CONFIG = {
     // 120-second auto-deny timeout
     flightRecorder: true,
     auditHashArgs: true,
-    approvers: { native: true, browser: true, cloud: false, terminal: true }
+    approvers: { native: true, browser: true, cloud: false, terminal: true },
+    cloudSyncIntervalHours: 5
   },
   policy: {
     sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
@@ -586,7 +593,8 @@ var DEFAULT_CONFIG = {
       }
     ],
     dlp: { enabled: true, scanIgnoredTools: true },
-    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 }
+    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
+    skillPinning: { enabled: false, mode: "warn", roots: [] }
   },
   environments: {}
 };
@@ -709,7 +717,11 @@ function getConfig(cwd) {
       ignorePaths: [...DEFAULT_CONFIG.policy.snapshot.ignorePaths]
     },
     dlp: { ...DEFAULT_CONFIG.policy.dlp },
-    loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection }
+    loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection },
+    skillPinning: {
+      ...DEFAULT_CONFIG.policy.skillPinning,
+      roots: [...DEFAULT_CONFIG.policy.skillPinning.roots]
+    }
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
@@ -726,6 +738,8 @@ function getConfig(cwd) {
     if (s.approvalTimeoutSeconds !== void 0 && s.approvalTimeoutMs === void 0)
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
+    if (s.cloudSyncIntervalHours !== void 0)
+      mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
@@ -735,7 +749,12 @@ function getConfig(cwd) {
     if (p.smartRules) {
       const defaultBlocks = mergedPolicy.smartRules.filter((r) => r.verdict === "block");
       const defaultNonBlocks = mergedPolicy.smartRules.filter((r) => r.verdict !== "block");
-      mergedPolicy.smartRules = [...defaultBlocks, ...p.smartRules, ...defaultNonBlocks];
+      const userRuleNames = new Set(p.smartRules.filter((r) => r.name).map((r) => r.name));
+      const filteredBlocks = defaultBlocks.filter((r) => !r.name || !userRuleNames.has(r.name));
+      const filteredNonBlocks = defaultNonBlocks.filter(
+        (r) => !r.name || !userRuleNames.has(r.name)
+      );
+      mergedPolicy.smartRules = [...filteredBlocks, ...p.smartRules, ...filteredNonBlocks];
     }
     if (p.snapshot) {
       const s2 = p.snapshot;
@@ -755,6 +774,16 @@ function getConfig(cwd) {
       if (ld.windowSeconds !== void 0)
         mergedPolicy.loopDetection.windowSeconds = ld.windowSeconds;
     }
+    if (p.skillPinning && typeof p.skillPinning === "object") {
+      const sp = p.skillPinning;
+      if (sp.enabled !== void 0) mergedPolicy.skillPinning.enabled = sp.enabled;
+      if (sp.mode !== void 0) mergedPolicy.skillPinning.mode = sp.mode;
+      if (Array.isArray(sp.roots)) {
+        for (const r of sp.roots) {
+          if (typeof r === "string" && r.length > 0) mergedPolicy.skillPinning.roots.push(r);
+        }
+      }
+    }
     const envs = source.environments || {};
     for (const [envName, envConfig] of Object.entries(envs)) {
       if (envConfig && typeof envConfig === "object") {
@@ -769,6 +798,16 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  {
+    const cacheFile = path3.join(os3.homedir(), ".node9", "rules-cache.json");
+    try {
+      const raw = JSON.parse(fs3.readFileSync(cacheFile, "utf-8"));
+      if (Array.isArray(raw.rules) && raw.rules.length > 0) {
+        applyLayer({ policy: { smartRules: raw.rules } });
+      }
+    } catch {
+    }
+  }
   const shieldOverrides = readShieldOverrides();
   for (const shieldName of readActiveShields()) {
     const shield = getShield(shieldName);
@@ -796,6 +835,7 @@ function getConfig(cwd) {
   mergedPolicy.sandboxPaths = [...new Set(mergedPolicy.sandboxPaths)];
   mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
+  mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   mergedPolicy.snapshot.tools = [...new Set(mergedPolicy.snapshot.tools)];
   mergedPolicy.snapshot.onlyPaths = [...new Set(mergedPolicy.snapshot.onlyPaths)];
   mergedPolicy.snapshot.ignorePaths = [...new Set(mergedPolicy.snapshot.ignorePaths)];
@@ -1841,6 +1881,15 @@ import path9 from "path";
 import os6 from "os";
 var PAUSED_FILE = path9.join(os6.homedir(), ".node9", "PAUSED");
 var TRUST_FILE = path9.join(os6.homedir(), ".node9", "trust.json");
+function extractCommandPattern(toolName, args) {
+  const lower = toolName.toLowerCase();
+  if (lower !== "bash" && lower !== "execute_bash" && lower !== "shell") return void 0;
+  const a = args;
+  const cmd = typeof a?.["command"] === "string" ? a["command"].trim() : "";
+  if (!cmd) return void 0;
+  const words = cmd.split(/\s+/);
+  return words.slice(0, 2).join(" ");
+}
 function checkPause() {
   try {
     if (!fs7.existsSync(PAUSED_FILE)) return { paused: false };
@@ -1864,7 +1913,7 @@ function atomicWriteSync(filePath, data, options) {
   fs7.writeFileSync(tmpPath, data, options);
   fs7.renameSync(tmpPath, filePath);
 }
-function getActiveTrustSession(toolName) {
+function getActiveTrustSession(toolName, args) {
   try {
     if (!fs7.existsSync(TRUST_FILE)) return false;
     const trust = JSON.parse(fs7.readFileSync(TRUST_FILE, "utf-8"));
@@ -1873,12 +1922,20 @@ function getActiveTrustSession(toolName) {
     if (active.length !== trust.entries.length) {
       fs7.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
-    return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
+    return active.some((e) => {
+      if (!(e.tool === toolName || matchesPattern(toolName, e.tool))) return false;
+      if (e.commandPattern) {
+        const actual = extractCommandPattern(toolName, args) ?? "";
+        return actual === e.commandPattern || actual.startsWith(e.commandPattern + " ");
+      }
+      return true;
+    });
   } catch {
     return false;
   }
 }
-function writeTrustSession(toolName, durationMs) {
+function writeTrustSession(toolName, durationMs, args) {
+  const commandPattern = extractCommandPattern(toolName, args);
   try {
     let trust = { entries: [] };
     try {
@@ -1888,8 +1945,14 @@ function writeTrustSession(toolName, durationMs) {
     } catch {
     }
     const now = Date.now();
-    trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > now);
-    trust.entries.push({ tool: toolName, expiry: now + durationMs });
+    trust.entries = trust.entries.filter(
+      (e) => !(e.tool === toolName && e.commandPattern === commandPattern) && e.expiry > now
+    );
+    trust.entries.push({
+      tool: toolName,
+      ...commandPattern && { commandPattern },
+      expiry: now + durationMs
+    });
     atomicWriteSync(TRUST_FILE, JSON.stringify(trust, null, 2));
   } catch (err) {
     if (process.env.NODE9_DEBUG === "1") {
@@ -2851,12 +2914,6 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
         };
       }
     }
-    if (getActiveTrustSession(toolName)) {
-      if (approvers.cloud && creds?.apiKey)
-        await auditLocalAllow(toolName, args, "trust", creds, meta);
-      if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
-      return { approved: true, checkedBy: "trust" };
-    }
     const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
     if (policyResult.decision === "allow") {
       if (approvers.cloud && creds?.apiKey)
@@ -2938,6 +2995,12 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
     return { approved: true };
   }
+  if (!taintWarning && getActiveTrustSession(toolName, args)) {
+    if (approvers.cloud && creds?.apiKey)
+      await auditLocalAllow(toolName, args, "trust", creds, meta);
+    if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
+    return { approved: true, checkedBy: "trust" };
+  }
   if (taintWarning) {
     explainableLabel = "\u{1F534} Node9 Taint (Exfiltration Prevention)";
     riskMetadata = computeRiskMetadata(
@@ -3070,7 +3133,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           riskMetadata?.ruleDescription
         );
         if (decision === "always_allow") {
-          writeTrustSession(toolName, 36e5);
+          writeTrustSession(toolName, 36e5, args);
           return { approved: true, checkedBy: "trust" };
         }
         const isApproved = decision === "allow";

package/dist/shields/builtin/bash-safe.json

@@ -10,7 +10,7 @@
         {
           "field": "command",
           "op": "matches",
-          "value": "(curl|wget)\\s+[^|]*\\|\\s*(bash|sh|zsh|fish|python3?|ruby|perl|node)",
+          "value": "(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
           "flags": "i"
         }
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.10.2",
+  "version": "1.11.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",