@node9/proxy 1.12.11 → 1.13.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +22 -19
  2. package/dist/cli.js +543 -208
  3. package/dist/cli.mjs +541 -206
  4. package/dist/index.js +15 -3
  5. package/dist/index.mjs +15 -3
  6. package/package.json +1 -1
package/README.md CHANGED
@@ -18,7 +18,7 @@ Node9 sits between your AI agent and your system. Every shell command, file writ
18
18
 
19
19
  - 🛑 **Block** dangerous actions (`git push --force`, `rm -rf /`, `curl|bash`, `DROP TABLE`, ...) before they run
20
20
  - 👁 **Review** anything worth a human glance — OS-native popup, Slack, or browser approval
21
- - 🔑 **Catch credential leaks** in tool arguments and Claude response text
21
+ - 🔑 **Catch credential leaks** in tool arguments, file contents Claude reads back, and shell config files
22
22
  - 🔁 **Stop agent loops** that burn tokens and money
23
23
  - 🔌 **Gate MCP tools** and detect rug-pull attacks on server definitions
24
24
  - 📊 **Dashboard + scan report** in your browser — see what your agents actually did
@@ -43,7 +43,7 @@ Reads your existing Claude / Gemini / Codex session history, runs the full Node9
43
43
 
44
44
  🛑 Would have blocked 3 operations stopped before execution
45
45
  👁 Would have flagged 162 sent to you for approval
46
- 🔑 Credential leak 3 secret detected in tool call
46
+ 🔑 Credential leak 3 secret detected in history or shell config
47
47
  🔁 Loop detected 117 repeated tool call patterns found
48
48
 
49
49
  ──────────────────────────────────────────────────────────────────────
@@ -113,7 +113,7 @@ node9 shield list # show all shields + status
113
113
  - **Git** — blocks `git push --force`, `git reset --hard`, `git clean -fd`
114
114
  - **SQL** — blocks `DELETE` / `UPDATE` without `WHERE`, `DROP TABLE`, `TRUNCATE`
115
115
  - **Shell** — blocks `curl | bash`, unauthorized `sudo`
116
- - **DLP** — blocks AWS keys, GitHub tokens, Stripe keys, PEM private keys in any tool argument
116
+ - **DLP** — blocks AWS keys, GitHub tokens, Stripe keys, PEM private keys in any tool argument, file Claude reads, or shell config (`~/.zshrc`, `~/.bashrc`)
117
117
  - **Response DLP** — background scanner reads Claude's conversation history and alerts you if Claude _wrote_ a secret in its response text (not just executed one). Gemini / Codex coverage coming.
118
118
  - **Auto-undo** — git snapshot before every AI file edit → `node9 undo` to revert
119
119
  - **Skills pinning** — SHA-256 verification of installed Claude skills / plugins between sessions
@@ -171,13 +171,14 @@ When an MCP server returns a 500KB+ response, it sits in the context window for
171
171
 
172
172
  Every tool call is recorded — command, arguments, decision, cost. See what your agent did, five ways:
173
173
 
174
- | Command | What it shows | When to use |
175
- | ---------------- | -------------------------------------------------------- | ----------------------------------------- |
176
- | `node9 scan` | Retrospective audit of existing agent history | Before installing, or to review past risk |
177
- | `node9 tail` | Live stream of every tool call | Watching an agent work in real time |
178
- | `node9 report` | Per-period summary: allowed/blocked/DLP/cost + top tools | Reviewing what happened after a session |
179
- | `node9 sessions` | Session history with prompt, tool trace, cost, snapshot | Reviewing a handoff or past work |
180
- | `node9 dlp` | Credential-leak findings in Claude response text | Any time a DLP desktop alert fires |
174
+ | Command | What it shows | When to use |
175
+ | ---------------- | --------------------------------------------------------- | ----------------------------------------- |
176
+ | `node9 scan` | Retrospective audit of existing agent history | Before installing, or to review past risk |
177
+ | `node9 mask` | Redact plaintext secrets from local session history files | After a DLP finding — cleans local disk |
178
+ | `node9 tail` | Live stream of every tool call | Watching an agent work in real time |
179
+ | `node9 report` | Per-period summary: allowed/blocked/DLP/cost + top tools | Reviewing what happened after a session |
180
+ | `node9 sessions` | Session history with prompt, tool trace, cost, snapshot | Reviewing a handoff or past work |
181
+ | `node9 dlp` | Credential-leak findings in Claude response text | Any time a DLP desktop alert fires |
181
182
 
182
183
  Plus a **live HUD** in your Claude Code statusline:
183
184
 
@@ -195,15 +196,17 @@ And a **browser dashboard** that auto-opens after `node9 scan` — History Audit
195
196
 
196
197
  Node9 surfaces the signal. Here are the patterns worth knowing:
197
198
 
198
- | Signal | Likely meaning |
199
- | ----------------------------------------------------------- | ---------------------------------------------------------------------------- |
200
- | `Would have blocked` ≥ 5 in a week | Agent is attempting destructive ops; shields need review |
201
- | Single `review-git-push` rule accounts for >50% of findings | Your own rule is firing as intended — not a risk, just supervision |
202
- | DLP finding in `user-prompt` tool | You pasted a secret into your own prompt — rotate the key |
203
- | Agent Loop ×50+ on same file | Agent stuck in edit/test/fix cycle — check context or slow down |
204
- | MCP tool pin mismatch | Server changed its tools — review before re-trusting |
205
- | Large MCP response warning | That server is inflating your context window for every subsequent turn |
206
- | `Response DLP` alert | Claude wrote a secret in its response text — not blocked, rotate immediately |
199
+ | Signal | Likely meaning |
200
+ | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
201
+ | `Would have blocked` ≥ 5 in a week | Agent is attempting destructive ops; shields need review |
202
+ | Single `review-git-push` rule accounts for >50% of findings | Your own rule is firing as intended — not a risk, just supervision |
203
+ | DLP finding in `user-prompt` tool | You pasted a secret into your own prompt — rotate the key |
204
+ | Agent Loop ×50+ on same file | Agent stuck in edit/test/fix cycle — check context or slow down |
205
+ | MCP tool pin mismatch | Server changed its tools — review before re-trusting |
206
+ | Large MCP response warning | That server is inflating your context window for every subsequent turn |
207
+ | `Response DLP` alert | Claude wrote a secret in its response text — not blocked, rotate immediately |
208
+ | DLP finding in `tool-result` | Claude read a file containing a secret (`.env`, credentials) — rotate the key and run `node9 mask` |
209
+ | DLP finding in `[Shell]` | Plaintext secret in `~/.zshrc` or `~/.bashrc` — every AI session can see it |
207
210
 
208
211
  These are starting points, not verdicts. One-off signals are normal; persistent patterns are what you act on.
209
212