@node9/proxy 1.3.2 → 1.5.0

package/dist/index.js

@@ -191,8 +191,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path13 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path13}: ${issue.message}`;
+    const path14 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path14}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -922,7 +922,7 @@ function getCompiledRegex(pattern, flags = "") {
 }
 
 // src/policy/index.ts
-var import_path7 = __toESM(require("path"));
+var import_path8 = __toESM(require("path"));
 var import_picomatch = __toESM(require("picomatch"));
 var import_sh_syntax = require("sh-syntax");
 
@@ -1476,6 +1476,56 @@ function extractAllSshHosts(tokens) {
   return [...hosts].filter(Boolean);
 }
 
+// src/auth/trusted-hosts.ts
+var import_fs6 = __toESM(require("fs"));
+var import_path7 = __toESM(require("path"));
+var import_os5 = __toESM(require("os"));
+function getTrustedHostsPath() {
+  return import_path7.default.join(import_os5.default.homedir(), ".node9", "trusted-hosts.json");
+}
+function readTrustedHosts() {
+  try {
+    const raw = import_fs6.default.readFileSync(getTrustedHostsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed.hosts) ? parsed.hosts : [];
+  } catch {
+    return [];
+  }
+}
+var _cache = null;
+var CACHE_TTL_MS = 5e3;
+function getFileMtime() {
+  try {
+    return import_fs6.default.statSync(getTrustedHostsPath()).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function getCachedHosts() {
+  const now = Date.now();
+  if (_cache && now < _cache.expiry) {
+    const mtime = getFileMtime();
+    if (mtime === _cache.mtime) return _cache.hosts;
+  }
+  const hosts = readTrustedHosts();
+  _cache = { hosts, expiry: now + CACHE_TTL_MS, mtime: getFileMtime() };
+  return hosts;
+}
+function normalizeHost(raw) {
+  return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
+}
+function isTrustedHost(host) {
+  const normalized = normalizeHost(host);
+  return getCachedHosts().some((entry) => {
+    const entryHost = entry.host.toLowerCase();
+    if (entryHost.startsWith("*.")) {
+      const domain = entryHost.slice(2);
+      return normalized.endsWith("." + domain);
+    }
+    return normalized === entryHost;
+  });
+}
+
 // src/policy/index.ts
 function tokenize2(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
@@ -1490,9 +1540,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path13) {
+function getNestedValue(obj, path14) {
   if (!obj || typeof obj !== "object") return null;
-  return path13.split(".").reduce((prev, curr) => prev?.[curr], obj);
+  return path14.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
 function evaluateSmartConditions(args, rule) {
   if (!rule.conditions || rule.conditions.length === 0) return true;
@@ -1647,23 +1697,39 @@ async function evaluatePolicy(toolName, args, agent, cwd) {
       return { decision: "review", blockedByLabel: "Node9 Standard (Inline Execution)", tier: 3 };
     }
     const pipeAnalysis = analyzePipeChain(shellCommand);
-    if (pipeAnalysis.isPipeline) {
+    if (pipeAnalysis.isPipeline && (pipeAnalysis.risk === "critical" || pipeAnalysis.risk === "high")) {
+      const sinks = pipeAnalysis.sinkTargets;
+      const allTrusted = sinks.length > 0 && sinks.every(isTrustedHost);
       if (pipeAnalysis.risk === "critical") {
+        if (allTrusted) {
+          return {
+            decision: "review",
+            blockedByLabel: "Node9: Pipe-Chain to Trusted Host (obfuscated)",
+            reason: `Obfuscated pipe to trusted host(s): ${sinks.join(", ")} \u2014 requires approval`,
+            tier: 3
+          };
+        }
         return {
           decision: "block",
           blockedByLabel: "Node9: Pipe-Chain Exfiltration (critical)",
-          reason: `Sensitive file piped through obfuscator to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${pipeAnalysis.sinkTargets.join(", ")}`,
+          reason: `Sensitive file piped through obfuscator to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
           tier: 3
         };
       }
-      if (pipeAnalysis.risk === "high") {
+      if (allTrusted) {
         return {
-          decision: "review",
-          blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
-          reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${pipeAnalysis.sinkTargets.join(", ")}`,
+          decision: "allow",
+          blockedByLabel: "Node9: Pipe-Chain to Trusted Host",
+          reason: `Sensitive file piped to trusted host(s): ${sinks.join(", ")}`,
           tier: 3
         };
       }
+      return {
+        decision: "review",
+        blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
+        reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
+        tier: 3
+      };
     }
     const firstToken = analyzed.actions[0] ?? "";
     if (["ssh", "scp", "rsync"].includes(firstToken)) {
@@ -1671,7 +1737,7 @@ async function evaluatePolicy(toolName, args, agent, cwd) {
       const sshHosts = extractAllSshHosts(rawTokens.slice(1));
       allTokens.push(...sshHosts);
     }
-    if (firstToken && import_path7.default.posix.isAbsolute(firstToken)) {
+    if (firstToken && import_path8.default.posix.isAbsolute(firstToken)) {
       const prov = checkProvenance(firstToken, cwd);
       if (prov.trustLevel === "suspect") {
         return {
@@ -1772,18 +1838,18 @@ function isIgnoredTool(toolName) {
 }
 
 // src/auth/state.ts
-var import_fs6 = __toESM(require("fs"));
-var import_path8 = __toESM(require("path"));
-var import_os5 = __toESM(require("os"));
-var PAUSED_FILE = import_path8.default.join(import_os5.default.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = import_path8.default.join(import_os5.default.homedir(), ".node9", "trust.json");
+var import_fs7 = __toESM(require("fs"));
+var import_path9 = __toESM(require("path"));
+var import_os6 = __toESM(require("os"));
+var PAUSED_FILE = import_path9.default.join(import_os6.default.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = import_path9.default.join(import_os6.default.homedir(), ".node9", "trust.json");
 function checkPause() {
   try {
-    if (!import_fs6.default.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(import_fs6.default.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!import_fs7.default.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(import_fs7.default.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        import_fs6.default.unlinkSync(PAUSED_FILE);
+        import_fs7.default.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -1794,20 +1860,20 @@ function checkPause() {
   }
 }
 function atomicWriteSync(filePath, data, options) {
-  const dir = import_path8.default.dirname(filePath);
-  if (!import_fs6.default.existsSync(dir)) import_fs6.default.mkdirSync(dir, { recursive: true });
-  const tmpPath = `${filePath}.${import_os5.default.hostname()}.${process.pid}.tmp`;
-  import_fs6.default.writeFileSync(tmpPath, data, options);
-  import_fs6.default.renameSync(tmpPath, filePath);
+  const dir = import_path9.default.dirname(filePath);
+  if (!import_fs7.default.existsSync(dir)) import_fs7.default.mkdirSync(dir, { recursive: true });
+  const tmpPath = `${filePath}.${import_os6.default.hostname()}.${process.pid}.tmp`;
+  import_fs7.default.writeFileSync(tmpPath, data, options);
+  import_fs7.default.renameSync(tmpPath, filePath);
 }
 function getActiveTrustSession(toolName) {
   try {
-    if (!import_fs6.default.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(import_fs6.default.readFileSync(TRUST_FILE, "utf-8"));
+    if (!import_fs7.default.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(import_fs7.default.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
-      import_fs6.default.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
+      import_fs7.default.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
     return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
   } catch {
@@ -1818,8 +1884,8 @@ function writeTrustSession(toolName, durationMs) {
   try {
     let trust = { entries: [] };
     try {
-      if (import_fs6.default.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(import_fs6.default.readFileSync(TRUST_FILE, "utf-8"));
+      if (import_fs7.default.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(import_fs7.default.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -1835,9 +1901,9 @@ function writeTrustSession(toolName, durationMs) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file = import_path8.default.join(import_os5.default.homedir(), ".node9", "decisions.json");
-    if (!import_fs6.default.existsSync(file)) return null;
-    const decisions = JSON.parse(import_fs6.default.readFileSync(file, "utf-8"));
+    const file = import_path9.default.join(import_os6.default.homedir(), ".node9", "decisions.json");
+    if (!import_fs7.default.existsSync(file)) return null;
+    const decisions = JSON.parse(import_fs7.default.readFileSync(file, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
@@ -1846,17 +1912,17 @@ function getPersistentDecision(toolName) {
 }
 
 // src/auth/daemon.ts
-var import_fs7 = __toESM(require("fs"));
-var import_path9 = __toESM(require("path"));
-var import_os6 = __toESM(require("os"));
+var import_fs8 = __toESM(require("fs"));
+var import_path10 = __toESM(require("path"));
+var import_os7 = __toESM(require("os"));
 var import_child_process = require("child_process");
 var DAEMON_PORT = 7391;
 var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   try {
-    const pidFile = import_path9.default.join(import_os6.default.homedir(), ".node9", "daemon.pid");
-    if (!import_fs7.default.existsSync(pidFile)) return null;
-    const data = JSON.parse(import_fs7.default.readFileSync(pidFile, "utf-8"));
+    const pidFile = import_path10.default.join(import_os7.default.homedir(), ".node9", "daemon.pid");
+    if (!import_fs8.default.existsSync(pidFile)) return null;
+    const data = JSON.parse(import_fs8.default.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -1864,10 +1930,10 @@ function getInternalToken() {
   }
 }
 function isDaemonRunning() {
-  const pidFile = import_path9.default.join(import_os6.default.homedir(), ".node9", "daemon.pid");
-  if (import_fs7.default.existsSync(pidFile)) {
+  const pidFile = import_path10.default.join(import_os7.default.homedir(), ".node9", "daemon.pid");
+  if (import_fs8.default.existsSync(pidFile)) {
     try {
-      const { pid, port } = JSON.parse(import_fs7.default.readFileSync(pidFile, "utf-8"));
+      const { pid, port } = JSON.parse(import_fs8.default.readFileSync(pidFile, "utf-8"));
       if (port !== DAEMON_PORT) return false;
       process.kill(pid, 0);
       return true;
@@ -1908,8 +1974,8 @@ async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityI
       signal: ctrl.signal
     });
     if (!res.ok) throw new Error("Daemon fail");
-    const { id } = await res.json();
-    return id;
+    const { id, allowCount } = await res.json();
+    return { id, allowCount: allowCount ?? 1 };
   } finally {
     clearTimeout(timer);
   }
@@ -1948,31 +2014,31 @@ async function notifyDaemonViewer(toolName, args, meta, riskMetadata) {
     signal: AbortSignal.timeout(3e3)
   });
   if (!res.ok) throw new Error("Daemon unreachable");
-  const { id } = await res.json();
-  return id;
+  const { id, allowCount } = await res.json();
+  return { id, allowCount: allowCount ?? 1 };
 }
-async function resolveViaDaemon(id, decision, internalToken) {
+async function resolveViaDaemon(id, decision, internalToken, source) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   await fetch(`${base}/resolve/${id}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Node9-Internal": internalToken },
-    body: JSON.stringify({ decision }),
+    body: JSON.stringify({ decision, ...source && { source } }),
     signal: AbortSignal.timeout(3e3)
   });
 }
 
 // src/auth/orchestrator.ts
 var import_net = __toESM(require("net"));
-var import_path12 = __toESM(require("path"));
-var import_os8 = __toESM(require("os"));
+var import_path13 = __toESM(require("path"));
+var import_os9 = __toESM(require("os"));
 var import_crypto = require("crypto");
 
 // src/ui/native.ts
 var import_child_process2 = require("child_process");
-var import_path11 = __toESM(require("path"));
+var import_path12 = __toESM(require("path"));
 
 // src/context-sniper.ts
-var import_path10 = __toESM(require("path"));
+var import_path11 = __toESM(require("path"));
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -2040,7 +2106,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = import_path10.default.basename(editFilePath);
+        editFileName = import_path11.default.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -2095,7 +2161,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file = obj.file_path ? import_path11.default.basename(String(obj.file_path)) : "file";
+      const file = obj.file_path ? import_path12.default.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -2158,20 +2224,24 @@ ${smartTruncate(str, 500)}`
 function escapePango(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
   lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   lines.push("");
   lines.push(formattedArgs);
+  if (allowCount >= 3) {
+    lines.push("");
+    lines.push(`\u{1F4A1} Approved ${allowCount - 1}\xD7 before \u2014 "Always Allow" creates a permanent rule`);
+  }
   if (!locked) {
     lines.push("");
     lines.push('\u21B5 Enter = Allow \u21B5   |   \u238B Esc = Block \u238B   |   "Always Allow" = never ask again');
   }
   return lines.join("\n");
 }
-function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
   const lines = [];
   if (locked) {
     lines.push('<span foreground="red" weight="bold">\u26A0\uFE0F  LOCKED BY ADMIN POLICY</span>');
@@ -2183,6 +2253,12 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   lines.push(`<i>\u{1F6E1}\uFE0F  ${escapePango(explainableLabel || "Security Policy")}</i>`);
   lines.push("");
   lines.push(`<tt>${escapePango(formattedArgs)}</tt>`);
+  if (allowCount >= 3) {
+    lines.push("");
+    lines.push(
+      `<span foreground="#f0c040">\u{1F4A1} Approved ${allowCount - 1}\xD7 before \u2014 "Always Allow" creates a permanent rule</span>`
+    );
+  }
   if (!locked) {
     lines.push("");
     lines.push(
@@ -2191,12 +2267,19 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   }
   return lines.join("\n");
 }
-async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord) {
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord, allowCount = 1) {
   if (isTestEnv()) return "deny";
   const { message: formattedArgs, intent } = formatArgs(args, matchedField, matchedWord);
   const intentLabel = intent === "EDIT" ? "Code Edit" : "Action Approval";
   const title = locked ? `\u26A1 Node9 \u2014 Locked` : `\u{1F6E1}\uFE0F Node9 \u2014 ${intentLabel}`;
-  const message = buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked);
+  const message = buildPlainMessage(
+    toolName,
+    formattedArgs,
+    agent,
+    explainableLabel,
+    locked,
+    allowCount
+  );
   return new Promise((resolve) => {
     let childProcess = null;
     const onAbort = () => {
@@ -2228,7 +2311,8 @@ end run`;
           formattedArgs,
           agent,
           explainableLabel,
-          locked
+          locked,
+          allowCount
         );
         const argsList = [
           locked ? "--info" : "--question",
@@ -2270,8 +2354,8 @@ end run`;
 }
 
 // src/auth/cloud.ts
-var import_fs8 = __toESM(require("fs"));
-var import_os7 = __toESM(require("os"));
+var import_fs9 = __toESM(require("fs"));
+var import_os8 = __toESM(require("os"));
 function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
   return fetch(`${creds.apiUrl}/audit`, {
     method: "POST",
@@ -2283,9 +2367,9 @@ function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
       context: {
         agent: meta?.agent,
         mcpServer: meta?.mcpServer,
-        hostname: import_os7.default.hostname(),
+        hostname: import_os8.default.hostname(),
         cwd: process.cwd(),
-        platform: import_os7.default.platform()
+        platform: import_os8.default.platform()
       }
     }),
     signal: AbortSignal.timeout(5e3)
@@ -2306,9 +2390,9 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata) {
         context: {
           agent: meta?.agent,
           mcpServer: meta?.mcpServer,
-          hostname: import_os7.default.hostname(),
+          hostname: import_os8.default.hostname(),
           cwd: process.cwd(),
-          platform: import_os7.default.platform()
+          platform: import_os8.default.platform()
         },
         ...riskMetadata && { riskMetadata }
       }),
@@ -2364,14 +2448,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      import_fs8.default.appendFileSync(
+      import_fs9.default.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    import_fs8.default.appendFileSync(
+    import_fs9.default.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${requestId}: ${err.message}
 `
@@ -2380,7 +2464,7 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 }
 
 // src/auth/orchestrator.ts
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path12.default.join(import_os8.default.tmpdir(), "node9-activity.sock");
+var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path13.default.join(import_os9.default.tmpdir(), "node9-activity.sock");
 function notifyActivity(data) {
   return new Promise((resolve) => {
     try {
@@ -2573,13 +2657,16 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
   let viewerId = null;
   const internalToken = getInternalToken();
   let daemonEntryId = null;
+  let daemonAllowCount = 1;
   if ((approvers.browser || approvers.terminal) && isDaemonRunning() && !options?.calledFromDaemon) {
     if (cloudEnforced && cloudRequestId) {
-      viewerId = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      const viewer = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      viewerId = viewer?.id ?? null;
       daemonEntryId = viewerId;
+      if (viewer) daemonAllowCount = viewer.allowCount;
     } else {
       try {
-        daemonEntryId = await registerDaemonEntry(
+        const entry = await registerDaemonEntry(
           toolName,
           args,
           meta,
@@ -2587,6 +2674,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           options?.activityId,
           options?.cwd
         );
+        daemonEntryId = entry.id;
+        daemonAllowCount = entry.allowCount;
       } catch {
       }
     }
@@ -2622,7 +2711,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           false,
           signal,
           policyMatchedField,
-          policyMatchedWord
+          policyMatchedWord,
+          daemonAllowCount
         );
         if (decision === "always_allow") {
           writeTrustSession(toolName, 36e5);
@@ -2680,10 +2770,13 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
       if (!resolved) {
         resolved = true;
         abortController.abort();
-        if (viewerId && internalToken) {
-          resolveViaDaemon(viewerId, res.approved ? "allow" : "deny", internalToken).catch(
-            () => null
-          );
+        if (daemonEntryId && internalToken) {
+          resolveViaDaemon(
+            daemonEntryId,
+            res.approved ? "allow" : "deny",
+            internalToken,
+            res.decisionSource
+          ).catch(() => null);
         }
         resolve(res);
       }