@node9/proxy 1.10.3 → 1.11.0

package/dist/index.js

@@ -261,6 +261,11 @@ var ConfigFileSchema = import_zod.z.object({
       enabled: import_zod.z.boolean().optional(),
       threshold: import_zod.z.number().min(2).optional(),
       windowSeconds: import_zod.z.number().min(10).optional()
+    }).optional(),
+    skillPinning: import_zod.z.object({
+      enabled: import_zod.z.boolean().optional(),
+      mode: import_zod.z.enum(["warn", "block"]).optional(),
+      roots: import_zod.z.array(import_zod.z.string()).optional()
     }).optional()
   }).optional(),
   environments: import_zod.z.record(import_zod.z.object({ requireApproval: import_zod.z.boolean().optional() })).optional()
@@ -618,7 +623,8 @@ var DEFAULT_CONFIG = {
       }
     ],
     dlp: { enabled: true, scanIgnoredTools: true },
-    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 }
+    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
+    skillPinning: { enabled: false, mode: "warn", roots: [] }
   },
   environments: {}
 };
@@ -741,7 +747,11 @@ function getConfig(cwd) {
       ignorePaths: [...DEFAULT_CONFIG.policy.snapshot.ignorePaths]
     },
     dlp: { ...DEFAULT_CONFIG.policy.dlp },
-    loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection }
+    loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection },
+    skillPinning: {
+      ...DEFAULT_CONFIG.policy.skillPinning,
+      roots: [...DEFAULT_CONFIG.policy.skillPinning.roots]
+    }
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
@@ -794,6 +804,16 @@ function getConfig(cwd) {
       if (ld.windowSeconds !== void 0)
         mergedPolicy.loopDetection.windowSeconds = ld.windowSeconds;
     }
+    if (p.skillPinning && typeof p.skillPinning === "object") {
+      const sp = p.skillPinning;
+      if (sp.enabled !== void 0) mergedPolicy.skillPinning.enabled = sp.enabled;
+      if (sp.mode !== void 0) mergedPolicy.skillPinning.mode = sp.mode;
+      if (Array.isArray(sp.roots)) {
+        for (const r of sp.roots) {
+          if (typeof r === "string" && r.length > 0) mergedPolicy.skillPinning.roots.push(r);
+        }
+      }
+    }
     const envs = source.environments || {};
     for (const [envName, envConfig] of Object.entries(envs)) {
       if (envConfig && typeof envConfig === "object") {
@@ -845,6 +865,7 @@ function getConfig(cwd) {
   mergedPolicy.sandboxPaths = [...new Set(mergedPolicy.sandboxPaths)];
   mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
+  mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   mergedPolicy.snapshot.tools = [...new Set(mergedPolicy.snapshot.tools)];
   mergedPolicy.snapshot.onlyPaths = [...new Set(mergedPolicy.snapshot.onlyPaths)];
   mergedPolicy.snapshot.ignorePaths = [...new Set(mergedPolicy.snapshot.ignorePaths)];
@@ -1890,6 +1911,15 @@ var import_path9 = __toESM(require("path"));
 var import_os6 = __toESM(require("os"));
 var PAUSED_FILE = import_path9.default.join(import_os6.default.homedir(), ".node9", "PAUSED");
 var TRUST_FILE = import_path9.default.join(import_os6.default.homedir(), ".node9", "trust.json");
+function extractCommandPattern(toolName, args) {
+  const lower = toolName.toLowerCase();
+  if (lower !== "bash" && lower !== "execute_bash" && lower !== "shell") return void 0;
+  const a = args;
+  const cmd = typeof a?.["command"] === "string" ? a["command"].trim() : "";
+  if (!cmd) return void 0;
+  const words = cmd.split(/\s+/);
+  return words.slice(0, 2).join(" ");
+}
 function checkPause() {
   try {
     if (!import_fs7.default.existsSync(PAUSED_FILE)) return { paused: false };
@@ -1913,7 +1943,7 @@ function atomicWriteSync(filePath, data, options) {
   import_fs7.default.writeFileSync(tmpPath, data, options);
   import_fs7.default.renameSync(tmpPath, filePath);
 }
-function getActiveTrustSession(toolName) {
+function getActiveTrustSession(toolName, args) {
   try {
     if (!import_fs7.default.existsSync(TRUST_FILE)) return false;
     const trust = JSON.parse(import_fs7.default.readFileSync(TRUST_FILE, "utf-8"));
@@ -1922,12 +1952,20 @@ function getActiveTrustSession(toolName) {
     if (active.length !== trust.entries.length) {
       import_fs7.default.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
-    return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
+    return active.some((e) => {
+      if (!(e.tool === toolName || matchesPattern(toolName, e.tool))) return false;
+      if (e.commandPattern) {
+        const actual = extractCommandPattern(toolName, args) ?? "";
+        return actual === e.commandPattern || actual.startsWith(e.commandPattern + " ");
+      }
+      return true;
+    });
   } catch {
     return false;
   }
 }
-function writeTrustSession(toolName, durationMs) {
+function writeTrustSession(toolName, durationMs, args) {
+  const commandPattern = extractCommandPattern(toolName, args);
   try {
     let trust = { entries: [] };
     try {
@@ -1937,8 +1975,14 @@ function writeTrustSession(toolName, durationMs) {
     } catch {
     }
     const now = Date.now();
-    trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > now);
-    trust.entries.push({ tool: toolName, expiry: now + durationMs });
+    trust.entries = trust.entries.filter(
+      (e) => !(e.tool === toolName && e.commandPattern === commandPattern) && e.expiry > now
+    );
+    trust.entries.push({
+      tool: toolName,
+      ...commandPattern && { commandPattern },
+      expiry: now + durationMs
+    });
     atomicWriteSync(TRUST_FILE, JSON.stringify(trust, null, 2));
   } catch (err) {
     if (process.env.NODE9_DEBUG === "1") {
@@ -2900,12 +2944,6 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
         };
       }
     }
-    if (getActiveTrustSession(toolName)) {
-      if (approvers.cloud && creds?.apiKey)
-        await auditLocalAllow(toolName, args, "trust", creds, meta);
-      if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
-      return { approved: true, checkedBy: "trust" };
-    }
     const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
     if (policyResult.decision === "allow") {
       if (approvers.cloud && creds?.apiKey)
@@ -2987,6 +3025,12 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
     return { approved: true };
   }
+  if (!taintWarning && getActiveTrustSession(toolName, args)) {
+    if (approvers.cloud && creds?.apiKey)
+      await auditLocalAllow(toolName, args, "trust", creds, meta);
+    if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
+    return { approved: true, checkedBy: "trust" };
+  }
   if (taintWarning) {
     explainableLabel = "\u{1F534} Node9 Taint (Exfiltration Prevention)";
     riskMetadata = computeRiskMetadata(
@@ -3119,7 +3163,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           riskMetadata?.ruleDescription
         );
         if (decision === "always_allow") {
-          writeTrustSession(toolName, 36e5);
+          writeTrustSession(toolName, 36e5, args);
           return { approved: true, checkedBy: "trust" };
         }
         const isApproved = decision === "allow";

package/dist/index.mjs

@@ -231,6 +231,11 @@ var ConfigFileSchema = z.object({
       enabled: z.boolean().optional(),
       threshold: z.number().min(2).optional(),
       windowSeconds: z.number().min(10).optional()
+    }).optional(),
+    skillPinning: z.object({
+      enabled: z.boolean().optional(),
+      mode: z.enum(["warn", "block"]).optional(),
+      roots: z.array(z.string()).optional()
     }).optional()
   }).optional(),
   environments: z.record(z.object({ requireApproval: z.boolean().optional() })).optional()
@@ -588,7 +593,8 @@ var DEFAULT_CONFIG = {
       }
     ],
     dlp: { enabled: true, scanIgnoredTools: true },
-    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 }
+    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
+    skillPinning: { enabled: false, mode: "warn", roots: [] }
   },
   environments: {}
 };
@@ -711,7 +717,11 @@ function getConfig(cwd) {
       ignorePaths: [...DEFAULT_CONFIG.policy.snapshot.ignorePaths]
     },
     dlp: { ...DEFAULT_CONFIG.policy.dlp },
-    loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection }
+    loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection },
+    skillPinning: {
+      ...DEFAULT_CONFIG.policy.skillPinning,
+      roots: [...DEFAULT_CONFIG.policy.skillPinning.roots]
+    }
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const applyLayer = (source) => {
@@ -764,6 +774,16 @@ function getConfig(cwd) {
       if (ld.windowSeconds !== void 0)
         mergedPolicy.loopDetection.windowSeconds = ld.windowSeconds;
     }
+    if (p.skillPinning && typeof p.skillPinning === "object") {
+      const sp = p.skillPinning;
+      if (sp.enabled !== void 0) mergedPolicy.skillPinning.enabled = sp.enabled;
+      if (sp.mode !== void 0) mergedPolicy.skillPinning.mode = sp.mode;
+      if (Array.isArray(sp.roots)) {
+        for (const r of sp.roots) {
+          if (typeof r === "string" && r.length > 0) mergedPolicy.skillPinning.roots.push(r);
+        }
+      }
+    }
     const envs = source.environments || {};
     for (const [envName, envConfig] of Object.entries(envs)) {
       if (envConfig && typeof envConfig === "object") {
@@ -815,6 +835,7 @@ function getConfig(cwd) {
   mergedPolicy.sandboxPaths = [...new Set(mergedPolicy.sandboxPaths)];
   mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
+  mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   mergedPolicy.snapshot.tools = [...new Set(mergedPolicy.snapshot.tools)];
   mergedPolicy.snapshot.onlyPaths = [...new Set(mergedPolicy.snapshot.onlyPaths)];
   mergedPolicy.snapshot.ignorePaths = [...new Set(mergedPolicy.snapshot.ignorePaths)];
@@ -1860,6 +1881,15 @@ import path9 from "path";
 import os6 from "os";
 var PAUSED_FILE = path9.join(os6.homedir(), ".node9", "PAUSED");
 var TRUST_FILE = path9.join(os6.homedir(), ".node9", "trust.json");
+function extractCommandPattern(toolName, args) {
+  const lower = toolName.toLowerCase();
+  if (lower !== "bash" && lower !== "execute_bash" && lower !== "shell") return void 0;
+  const a = args;
+  const cmd = typeof a?.["command"] === "string" ? a["command"].trim() : "";
+  if (!cmd) return void 0;
+  const words = cmd.split(/\s+/);
+  return words.slice(0, 2).join(" ");
+}
 function checkPause() {
   try {
     if (!fs7.existsSync(PAUSED_FILE)) return { paused: false };
@@ -1883,7 +1913,7 @@ function atomicWriteSync(filePath, data, options) {
   fs7.writeFileSync(tmpPath, data, options);
   fs7.renameSync(tmpPath, filePath);
 }
-function getActiveTrustSession(toolName) {
+function getActiveTrustSession(toolName, args) {
   try {
     if (!fs7.existsSync(TRUST_FILE)) return false;
     const trust = JSON.parse(fs7.readFileSync(TRUST_FILE, "utf-8"));
@@ -1892,12 +1922,20 @@ function getActiveTrustSession(toolName) {
     if (active.length !== trust.entries.length) {
       fs7.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
-    return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
+    return active.some((e) => {
+      if (!(e.tool === toolName || matchesPattern(toolName, e.tool))) return false;
+      if (e.commandPattern) {
+        const actual = extractCommandPattern(toolName, args) ?? "";
+        return actual === e.commandPattern || actual.startsWith(e.commandPattern + " ");
+      }
+      return true;
+    });
   } catch {
     return false;
   }
 }
-function writeTrustSession(toolName, durationMs) {
+function writeTrustSession(toolName, durationMs, args) {
+  const commandPattern = extractCommandPattern(toolName, args);
   try {
     let trust = { entries: [] };
     try {
@@ -1907,8 +1945,14 @@ function writeTrustSession(toolName, durationMs) {
     } catch {
     }
     const now = Date.now();
-    trust.entries = trust.entries.filter((e) => e.tool !== toolName && e.expiry > now);
-    trust.entries.push({ tool: toolName, expiry: now + durationMs });
+    trust.entries = trust.entries.filter(
+      (e) => !(e.tool === toolName && e.commandPattern === commandPattern) && e.expiry > now
+    );
+    trust.entries.push({
+      tool: toolName,
+      ...commandPattern && { commandPattern },
+      expiry: now + durationMs
+    });
     atomicWriteSync(TRUST_FILE, JSON.stringify(trust, null, 2));
   } catch (err) {
     if (process.env.NODE9_DEBUG === "1") {
@@ -2870,12 +2914,6 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
         };
       }
     }
-    if (getActiveTrustSession(toolName)) {
-      if (approvers.cloud && creds?.apiKey)
-        await auditLocalAllow(toolName, args, "trust", creds, meta);
-      if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
-      return { approved: true, checkedBy: "trust" };
-    }
     const policyResult = await evaluatePolicy(toolName, args, meta?.agent);
     if (policyResult.decision === "allow") {
       if (approvers.cloud && creds?.apiKey)
@@ -2957,6 +2995,12 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
     return { approved: true };
   }
+  if (!taintWarning && getActiveTrustSession(toolName, args)) {
+    if (approvers.cloud && creds?.apiKey)
+      await auditLocalAllow(toolName, args, "trust", creds, meta);
+    if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
+    return { approved: true, checkedBy: "trust" };
+  }
   if (taintWarning) {
     explainableLabel = "\u{1F534} Node9 Taint (Exfiltration Prevention)";
     riskMetadata = computeRiskMetadata(
@@ -3089,7 +3133,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           riskMetadata?.ruleDescription
         );
         if (decision === "always_allow") {
-          writeTrustSession(toolName, 36e5);
+          writeTrustSession(toolName, 36e5, args);
           return { approved: true, checkedBy: "trust" };
         }
         const isApproved = decision === "allow";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.10.3",
+  "version": "1.11.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",