@node9/proxy 1.13.1 → 1.14.1

package/dist/index.js

@@ -126,6 +126,7 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     ...testRun,
     agent: meta?.agent,
     mcpServer: meta?.mcpServer,
+    sessionId: meta?.sessionId,
     hostname: import_os.default.hostname()
   });
 }
@@ -3101,14 +3102,61 @@ var import_fs9 = __toESM(require("fs"));
 var import_os8 = __toESM(require("os"));
 var import_path13 = __toESM(require("path"));
 init_audit();
-function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
-  return fetch(`${creds.apiUrl}/audit`, {
+var DLP_SAMPLE_MAX_LEN = 200;
+var DLP_PATTERN_MAX_LEN = 100;
+var KNOWN_CHECKED_BY = /* @__PURE__ */ new Set([
+  "dlp-block",
+  "observe-mode-dlp-would-block",
+  "dlp-review-flagged",
+  "loop-detected",
+  "audit-mode",
+  "local-policy",
+  "smart-rule-block",
+  "persistent",
+  "trust",
+  "observe-mode",
+  "observe-mode-would-block"
+]);
+function validateApiUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (u.username || u.password) return null;
+  if (u.protocol === "https:") return u;
+  if (u.protocol === "http:") {
+    const h = u.hostname;
+    if (h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]") return u;
+  }
+  return null;
+}
+function auditLocalAllow(toolName, args, checkedBy, creds, meta, dlpInfo, containsSensitiveArgs = false) {
+  const validated = validateApiUrl(creds.apiUrl);
+  if (!validated) {
+    try {
+      import_fs9.default.appendFileSync(
+        HOOK_DEBUG_LOG,
+        `[audit] refused to send: invalid apiUrl scheme/host (got "${String(creds.apiUrl).slice(0, 200)}")
+`
+      );
+    } catch {
+    }
+    return Promise.resolve();
+  }
+  const safeArgs = containsSensitiveArgs ? { tool: toolName, redacted: true } : args;
+  const dlpSample = dlpInfo && typeof dlpInfo.redactedSample === "string" ? dlpInfo.redactedSample.slice(0, DLP_SAMPLE_MAX_LEN) : void 0;
+  const dlpPattern = dlpInfo && typeof dlpInfo.pattern === "string" ? dlpInfo.pattern.slice(0, DLP_PATTERN_MAX_LEN) : void 0;
+  const safeCheckedBy = KNOWN_CHECKED_BY.has(checkedBy) ? checkedBy : "unknown";
+  return fetch(`${validated.toString().replace(/\/$/, "")}/audit`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
     body: JSON.stringify({
       toolName,
-      args,
-      checkedBy,
+      args: safeArgs,
+      checkedBy: safeCheckedBy,
+      ...dlpInfo && { dlpPattern, dlpSample },
       context: {
         agent: meta?.agent,
         mcpServer: meta?.mcpServer,
@@ -3432,6 +3480,16 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
             meta,
             true
           );
+        if (approvers.cloud && creds?.apiKey)
+          auditLocalAllow(
+            toolName,
+            args,
+            isObserveMode ? "observe-mode-dlp-would-block" : "dlp-block",
+            creds,
+            meta,
+            { pattern: dlpMatch.patternName, redactedSample: dlpMatch.redactedSample },
+            true
+          );
         if (isWriteTool(toolName) && filePath) {
           await notifyTaint(filePath, `DLP:${dlpMatch.patternName}`);
         }
@@ -3500,6 +3558,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;
         if (!isManual)
           appendLocalAudit(toolName, args, "deny", "loop-detected", meta, hashAuditArgs);
+        if (approvers.cloud && creds?.apiKey)
+          auditLocalAllow(toolName, args, "loop-detected", creds, meta, void 0, true);
         return {
           approved: false,
           reason,
@@ -3586,8 +3646,22 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
       };
     }
   } else if (!taintWarning) {
-    if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
-    return { approved: true };
+    const toolLower = toolName.toLowerCase();
+    const isFileTool = toolLower === "read" || toolLower === "grep" || toolLower === "glob" || toolLower === "read_file" || toolLower === "grep_search" || toolLower === "list_files";
+    if (isFileTool && readActiveShields().includes("project-jail")) {
+      const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+      const filePath = String(
+        argsObj.file_path ?? argsObj.path ?? argsObj.pattern ?? argsObj.filename ?? ""
+      );
+      if (filePath && scanFilePath(filePath)) {
+      } else {
+        if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
+        return { approved: true };
+      }
+    } else {
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
+      return { approved: true };
+    }
   }
   if (!taintWarning && getActiveTrustSession(toolName, args)) {
     if (approvers.cloud && creds?.apiKey)

package/dist/index.mjs

@@ -106,6 +106,7 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     ...testRun,
     agent: meta?.agent,
     mcpServer: meta?.mcpServer,
+    sessionId: meta?.sessionId,
     hostname: os.hostname()
   });
 }
@@ -3071,14 +3072,61 @@ init_audit();
 import fs9 from "fs";
 import os8 from "os";
 import path13 from "path";
-function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
-  return fetch(`${creds.apiUrl}/audit`, {
+var DLP_SAMPLE_MAX_LEN = 200;
+var DLP_PATTERN_MAX_LEN = 100;
+var KNOWN_CHECKED_BY = /* @__PURE__ */ new Set([
+  "dlp-block",
+  "observe-mode-dlp-would-block",
+  "dlp-review-flagged",
+  "loop-detected",
+  "audit-mode",
+  "local-policy",
+  "smart-rule-block",
+  "persistent",
+  "trust",
+  "observe-mode",
+  "observe-mode-would-block"
+]);
+function validateApiUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (u.username || u.password) return null;
+  if (u.protocol === "https:") return u;
+  if (u.protocol === "http:") {
+    const h = u.hostname;
+    if (h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]") return u;
+  }
+  return null;
+}
+function auditLocalAllow(toolName, args, checkedBy, creds, meta, dlpInfo, containsSensitiveArgs = false) {
+  const validated = validateApiUrl(creds.apiUrl);
+  if (!validated) {
+    try {
+      fs9.appendFileSync(
+        HOOK_DEBUG_LOG,
+        `[audit] refused to send: invalid apiUrl scheme/host (got "${String(creds.apiUrl).slice(0, 200)}")
+`
+      );
+    } catch {
+    }
+    return Promise.resolve();
+  }
+  const safeArgs = containsSensitiveArgs ? { tool: toolName, redacted: true } : args;
+  const dlpSample = dlpInfo && typeof dlpInfo.redactedSample === "string" ? dlpInfo.redactedSample.slice(0, DLP_SAMPLE_MAX_LEN) : void 0;
+  const dlpPattern = dlpInfo && typeof dlpInfo.pattern === "string" ? dlpInfo.pattern.slice(0, DLP_PATTERN_MAX_LEN) : void 0;
+  const safeCheckedBy = KNOWN_CHECKED_BY.has(checkedBy) ? checkedBy : "unknown";
+  return fetch(`${validated.toString().replace(/\/$/, "")}/audit`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
     body: JSON.stringify({
       toolName,
-      args,
-      checkedBy,
+      args: safeArgs,
+      checkedBy: safeCheckedBy,
+      ...dlpInfo && { dlpPattern, dlpSample },
       context: {
         agent: meta?.agent,
         mcpServer: meta?.mcpServer,
@@ -3402,6 +3450,16 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
             meta,
             true
           );
+        if (approvers.cloud && creds?.apiKey)
+          auditLocalAllow(
+            toolName,
+            args,
+            isObserveMode ? "observe-mode-dlp-would-block" : "dlp-block",
+            creds,
+            meta,
+            { pattern: dlpMatch.patternName, redactedSample: dlpMatch.redactedSample },
+            true
+          );
         if (isWriteTool(toolName) && filePath) {
           await notifyTaint(filePath, `DLP:${dlpMatch.patternName}`);
         }
@@ -3470,6 +3528,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;
         if (!isManual)
           appendLocalAudit(toolName, args, "deny", "loop-detected", meta, hashAuditArgs);
+        if (approvers.cloud && creds?.apiKey)
+          auditLocalAllow(toolName, args, "loop-detected", creds, meta, void 0, true);
         return {
           approved: false,
           reason,
@@ -3556,8 +3616,22 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
       };
     }
   } else if (!taintWarning) {
-    if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
-    return { approved: true };
+    const toolLower = toolName.toLowerCase();
+    const isFileTool = toolLower === "read" || toolLower === "grep" || toolLower === "glob" || toolLower === "read_file" || toolLower === "grep_search" || toolLower === "list_files";
+    if (isFileTool && readActiveShields().includes("project-jail")) {
+      const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+      const filePath = String(
+        argsObj.file_path ?? argsObj.path ?? argsObj.pattern ?? argsObj.filename ?? ""
+      );
+      if (filePath && scanFilePath(filePath)) {
+      } else {
+        if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
+        return { approved: true };
+      }
+    } else {
+      if (!isManual) appendLocalAudit(toolName, args, "allow", "ignored", meta, hashAuditArgs);
+      return { approved: true };
+    }
   }
   if (!taintWarning && getActiveTrustSession(toolName, args)) {
     if (approvers.cloud && creds?.apiKey)

package/dist/shields/builtin/project-jail.json

@@ -0,0 +1,64 @@
+{
+  "name": "project-jail",
+  "description": "Restricts AI agents from reading sensitive credential files outside the current project",
+  "aliases": ["jail"],
+  "smartRules": [
+    {
+      "name": "shield:project-jail:block-read-ssh",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*[\\/\\\\]\\.ssh[\\/\\\\]",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "Reading SSH private keys is blocked by project-jail shield"
+    },
+    {
+      "name": "shield:project-jail:block-read-aws",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*[\\/\\\\]\\.aws[\\/\\\\]",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "Reading AWS credentials is blocked by project-jail shield"
+    },
+    {
+      "name": "shield:project-jail:block-read-env",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*\\.env(\\.local|\\.production|\\.staging)?\\b",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "Reading .env files is blocked by project-jail shield"
+    },
+    {
+      "name": "shield:project-jail:block-read-credentials",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "Reading credential files is blocked by project-jail shield"
+    }
+  ],
+  "dangerousWords": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.13.1",
+  "version": "1.14.1",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",