@node9/proxy 1.11.11 → 1.11.13

package/dist/index.js

@@ -991,6 +991,10 @@ var import_mvdan_sh = __toESM(require("mvdan-sh"));
 // src/dlp.ts
 var import_fs4 = __toESM(require("fs"));
 var import_path4 = __toESM(require("path"));
+var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(?:_key|_token)?|credential|private[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*/i;
+function isAssignmentContext(text) {
+  return ASSIGNMENT_CONTEXT_RE.test(text);
+}
 var DLP_STOPWORDS = [
   "example",
   "placeholder",
@@ -1173,11 +1177,13 @@ var DLP_PATTERNS = [
   },
   // ── JWT ───────────────────────────────────────────────────────────────────
   // review (not block): JWTs appear legitimately in API calls; flag for human approval
+  // contextBoost: promoted to block when assigned (e.g. TOKEN=eyJ...)
   {
     name: "JWT",
     regex: /\bey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9\/_-]{17,}\.[a-zA-Z0-9\/_-]{10,}={0,2}\b/,
     severity: "review",
-    keywords: ["eyj"]
+    keywords: ["eyj"],
+    contextBoost: true
   },
   // ── Stripe (extended — adds restricted key rk_ prefix) ──────────────────
   {
@@ -1288,11 +1294,13 @@ var DLP_PATTERNS = [
     keywords: ["pypi-"]
   },
   // ── Bearer Token ─────────────────────────────────────────────────────────
+  // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
   {
     name: "Bearer Token",
     regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
     severity: "review",
-    keywords: ["bearer"]
+    keywords: ["bearer"],
+    contextBoost: true
   }
 ];
 var SENSITIVE_PATH_PATTERNS = [
@@ -1383,6 +1391,7 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
   if (typeof args === "string") {
     const text = args.length > MAX_STRING_BYTES ? args.slice(0, MAX_STRING_BYTES) : args;
     const textLower = text.toLowerCase();
+    const assignmentCtx = isAssignmentContext(text);
     for (const pattern of DLP_PATTERNS) {
       if (pattern.keywords && !pattern.keywords.some((kw) => textLower.includes(kw.toLowerCase()))) {
         continue;
@@ -1390,11 +1399,12 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
       if (pattern.regex.test(text)) {
         const matchedValue = (text.match(pattern.regex)?.[0] ?? "").toLowerCase();
         if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+        const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
         return {
           patternName: pattern.name,
           fieldPath,
           redactedSample: maskSecret(text, pattern.regex),
-          severity: pattern.severity
+          severity
         };
       }
     }

package/dist/index.mjs

@@ -961,6 +961,10 @@ import mvdanSh from "mvdan-sh";
 // src/dlp.ts
 import fs4 from "fs";
 import path4 from "path";
+var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(?:_key|_token)?|credential|private[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*/i;
+function isAssignmentContext(text) {
+  return ASSIGNMENT_CONTEXT_RE.test(text);
+}
 var DLP_STOPWORDS = [
   "example",
   "placeholder",
@@ -1143,11 +1147,13 @@ var DLP_PATTERNS = [
   },
   // ── JWT ───────────────────────────────────────────────────────────────────
   // review (not block): JWTs appear legitimately in API calls; flag for human approval
+  // contextBoost: promoted to block when assigned (e.g. TOKEN=eyJ...)
   {
     name: "JWT",
     regex: /\bey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9\/_-]{17,}\.[a-zA-Z0-9\/_-]{10,}={0,2}\b/,
     severity: "review",
-    keywords: ["eyj"]
+    keywords: ["eyj"],
+    contextBoost: true
   },
   // ── Stripe (extended — adds restricted key rk_ prefix) ──────────────────
   {
@@ -1258,11 +1264,13 @@ var DLP_PATTERNS = [
     keywords: ["pypi-"]
   },
   // ── Bearer Token ─────────────────────────────────────────────────────────
+  // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
   {
     name: "Bearer Token",
     regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
     severity: "review",
-    keywords: ["bearer"]
+    keywords: ["bearer"],
+    contextBoost: true
   }
 ];
 var SENSITIVE_PATH_PATTERNS = [
@@ -1353,6 +1361,7 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
   if (typeof args === "string") {
     const text = args.length > MAX_STRING_BYTES ? args.slice(0, MAX_STRING_BYTES) : args;
     const textLower = text.toLowerCase();
+    const assignmentCtx = isAssignmentContext(text);
     for (const pattern of DLP_PATTERNS) {
       if (pattern.keywords && !pattern.keywords.some((kw) => textLower.includes(kw.toLowerCase()))) {
         continue;
@@ -1360,11 +1369,12 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
       if (pattern.regex.test(text)) {
         const matchedValue = (text.match(pattern.regex)?.[0] ?? "").toLowerCase();
         if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+        const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
         return {
           patternName: pattern.name,
           fieldPath,
           redactedSample: maskSecret(text, pattern.regex),
-          severity: pattern.severity
+          severity
         };
       }
     }

package/dist/shields/builtin/mcp-tool-gating.json

@@ -0,0 +1,7 @@
+{
+  "name": "mcp-tool-gating",
+  "description": "Intercept MCP tool lists and require user approval before the agent can use any tools from a new server",
+  "aliases": ["mcp-gating", "mcp-tools"],
+  "smartRules": [],
+  "dangerousWords": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.11.11",
+  "version": "1.11.13",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",