@node9/proxy 1.3.2 → 1.5.0

package/dist/index.mjs

@@ -155,8 +155,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path13 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path13}: ${issue.message}`;
+    const path14 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path14}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -886,7 +886,7 @@ function getCompiledRegex(pattern, flags = "") {
 }
 
 // src/policy/index.ts
-import path7 from "path";
+import path8 from "path";
 import pm from "picomatch";
 import { parse } from "sh-syntax";
 
@@ -1440,6 +1440,56 @@ function extractAllSshHosts(tokens) {
   return [...hosts].filter(Boolean);
 }
 
+// src/auth/trusted-hosts.ts
+import fs6 from "fs";
+import path7 from "path";
+import os5 from "os";
+function getTrustedHostsPath() {
+  return path7.join(os5.homedir(), ".node9", "trusted-hosts.json");
+}
+function readTrustedHosts() {
+  try {
+    const raw = fs6.readFileSync(getTrustedHostsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed.hosts) ? parsed.hosts : [];
+  } catch {
+    return [];
+  }
+}
+var _cache = null;
+var CACHE_TTL_MS = 5e3;
+function getFileMtime() {
+  try {
+    return fs6.statSync(getTrustedHostsPath()).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function getCachedHosts() {
+  const now = Date.now();
+  if (_cache && now < _cache.expiry) {
+    const mtime = getFileMtime();
+    if (mtime === _cache.mtime) return _cache.hosts;
+  }
+  const hosts = readTrustedHosts();
+  _cache = { hosts, expiry: now + CACHE_TTL_MS, mtime: getFileMtime() };
+  return hosts;
+}
+function normalizeHost(raw) {
+  return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
+}
+function isTrustedHost(host) {
+  const normalized = normalizeHost(host);
+  return getCachedHosts().some((entry) => {
+    const entryHost = entry.host.toLowerCase();
+    if (entryHost.startsWith("*.")) {
+      const domain = entryHost.slice(2);
+      return normalized.endsWith("." + domain);
+    }
+    return normalized === entryHost;
+  });
+}
+
 // src/policy/index.ts
 function tokenize2(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
@@ -1454,9 +1504,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path13) {
+function getNestedValue(obj, path14) {
   if (!obj || typeof obj !== "object") return null;
-  return path13.split(".").reduce((prev, curr) => prev?.[curr], obj);
+  return path14.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
 function evaluateSmartConditions(args, rule) {
   if (!rule.conditions || rule.conditions.length === 0) return true;
@@ -1611,23 +1661,39 @@ async function evaluatePolicy(toolName, args, agent, cwd) {
       return { decision: "review", blockedByLabel: "Node9 Standard (Inline Execution)", tier: 3 };
     }
     const pipeAnalysis = analyzePipeChain(shellCommand);
-    if (pipeAnalysis.isPipeline) {
+    if (pipeAnalysis.isPipeline && (pipeAnalysis.risk === "critical" || pipeAnalysis.risk === "high")) {
+      const sinks = pipeAnalysis.sinkTargets;
+      const allTrusted = sinks.length > 0 && sinks.every(isTrustedHost);
       if (pipeAnalysis.risk === "critical") {
+        if (allTrusted) {
+          return {
+            decision: "review",
+            blockedByLabel: "Node9: Pipe-Chain to Trusted Host (obfuscated)",
+            reason: `Obfuscated pipe to trusted host(s): ${sinks.join(", ")} \u2014 requires approval`,
+            tier: 3
+          };
+        }
         return {
           decision: "block",
           blockedByLabel: "Node9: Pipe-Chain Exfiltration (critical)",
-          reason: `Sensitive file piped through obfuscator to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${pipeAnalysis.sinkTargets.join(", ")}`,
+          reason: `Sensitive file piped through obfuscator to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
           tier: 3
         };
       }
-      if (pipeAnalysis.risk === "high") {
+      if (allTrusted) {
         return {
-          decision: "review",
-          blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
-          reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${pipeAnalysis.sinkTargets.join(", ")}`,
+          decision: "allow",
+          blockedByLabel: "Node9: Pipe-Chain to Trusted Host",
+          reason: `Sensitive file piped to trusted host(s): ${sinks.join(", ")}`,
           tier: 3
         };
       }
+      return {
+        decision: "review",
+        blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
+        reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
+        tier: 3
+      };
     }
     const firstToken = analyzed.actions[0] ?? "";
     if (["ssh", "scp", "rsync"].includes(firstToken)) {
@@ -1635,7 +1701,7 @@ async function evaluatePolicy(toolName, args, agent, cwd) {
       const sshHosts = extractAllSshHosts(rawTokens.slice(1));
       allTokens.push(...sshHosts);
     }
-    if (firstToken && path7.posix.isAbsolute(firstToken)) {
+    if (firstToken && path8.posix.isAbsolute(firstToken)) {
       const prov = checkProvenance(firstToken, cwd);
       if (prov.trustLevel === "suspect") {
         return {
@@ -1736,18 +1802,18 @@ function isIgnoredTool(toolName) {
 }
 
 // src/auth/state.ts
-import fs6 from "fs";
-import path8 from "path";
-import os5 from "os";
-var PAUSED_FILE = path8.join(os5.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = path8.join(os5.homedir(), ".node9", "trust.json");
+import fs7 from "fs";
+import path9 from "path";
+import os6 from "os";
+var PAUSED_FILE = path9.join(os6.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = path9.join(os6.homedir(), ".node9", "trust.json");
 function checkPause() {
   try {
-    if (!fs6.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(fs6.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!fs7.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(fs7.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        fs6.unlinkSync(PAUSED_FILE);
+        fs7.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -1758,20 +1824,20 @@ function checkPause() {
   }
 }
 function atomicWriteSync(filePath, data, options) {
-  const dir = path8.dirname(filePath);
-  if (!fs6.existsSync(dir)) fs6.mkdirSync(dir, { recursive: true });
-  const tmpPath = `${filePath}.${os5.hostname()}.${process.pid}.tmp`;
-  fs6.writeFileSync(tmpPath, data, options);
-  fs6.renameSync(tmpPath, filePath);
+  const dir = path9.dirname(filePath);
+  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
+  const tmpPath = `${filePath}.${os6.hostname()}.${process.pid}.tmp`;
+  fs7.writeFileSync(tmpPath, data, options);
+  fs7.renameSync(tmpPath, filePath);
 }
 function getActiveTrustSession(toolName) {
   try {
-    if (!fs6.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(fs6.readFileSync(TRUST_FILE, "utf-8"));
+    if (!fs7.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(fs7.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
-      fs6.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
+      fs7.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
     return active.some((e) => e.tool === toolName || matchesPattern(toolName, e.tool));
   } catch {
@@ -1782,8 +1848,8 @@ function writeTrustSession(toolName, durationMs) {
   try {
     let trust = { entries: [] };
     try {
-      if (fs6.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(fs6.readFileSync(TRUST_FILE, "utf-8"));
+      if (fs7.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(fs7.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -1799,9 +1865,9 @@ function writeTrustSession(toolName, durationMs) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file = path8.join(os5.homedir(), ".node9", "decisions.json");
-    if (!fs6.existsSync(file)) return null;
-    const decisions = JSON.parse(fs6.readFileSync(file, "utf-8"));
+    const file = path9.join(os6.homedir(), ".node9", "decisions.json");
+    if (!fs7.existsSync(file)) return null;
+    const decisions = JSON.parse(fs7.readFileSync(file, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
@@ -1810,17 +1876,17 @@ function getPersistentDecision(toolName) {
 }
 
 // src/auth/daemon.ts
-import fs7 from "fs";
-import path9 from "path";
-import os6 from "os";
+import fs8 from "fs";
+import path10 from "path";
+import os7 from "os";
 import { spawnSync } from "child_process";
 var DAEMON_PORT = 7391;
 var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   try {
-    const pidFile = path9.join(os6.homedir(), ".node9", "daemon.pid");
-    if (!fs7.existsSync(pidFile)) return null;
-    const data = JSON.parse(fs7.readFileSync(pidFile, "utf-8"));
+    const pidFile = path10.join(os7.homedir(), ".node9", "daemon.pid");
+    if (!fs8.existsSync(pidFile)) return null;
+    const data = JSON.parse(fs8.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -1828,10 +1894,10 @@ function getInternalToken() {
   }
 }
 function isDaemonRunning() {
-  const pidFile = path9.join(os6.homedir(), ".node9", "daemon.pid");
-  if (fs7.existsSync(pidFile)) {
+  const pidFile = path10.join(os7.homedir(), ".node9", "daemon.pid");
+  if (fs8.existsSync(pidFile)) {
     try {
-      const { pid, port } = JSON.parse(fs7.readFileSync(pidFile, "utf-8"));
+      const { pid, port } = JSON.parse(fs8.readFileSync(pidFile, "utf-8"));
       if (port !== DAEMON_PORT) return false;
       process.kill(pid, 0);
       return true;
@@ -1872,8 +1938,8 @@ async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityI
       signal: ctrl.signal
     });
     if (!res.ok) throw new Error("Daemon fail");
-    const { id } = await res.json();
-    return id;
+    const { id, allowCount } = await res.json();
+    return { id, allowCount: allowCount ?? 1 };
   } finally {
     clearTimeout(timer);
   }
@@ -1912,31 +1978,31 @@ async function notifyDaemonViewer(toolName, args, meta, riskMetadata) {
     signal: AbortSignal.timeout(3e3)
   });
   if (!res.ok) throw new Error("Daemon unreachable");
-  const { id } = await res.json();
-  return id;
+  const { id, allowCount } = await res.json();
+  return { id, allowCount: allowCount ?? 1 };
 }
-async function resolveViaDaemon(id, decision, internalToken) {
+async function resolveViaDaemon(id, decision, internalToken, source) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   await fetch(`${base}/resolve/${id}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Node9-Internal": internalToken },
-    body: JSON.stringify({ decision }),
+    body: JSON.stringify({ decision, ...source && { source } }),
     signal: AbortSignal.timeout(3e3)
   });
 }
 
 // src/auth/orchestrator.ts
 import net from "net";
-import path12 from "path";
-import os8 from "os";
+import path13 from "path";
+import os9 from "os";
 import { randomUUID } from "crypto";
 
 // src/ui/native.ts
 import { spawn } from "child_process";
-import path11 from "path";
+import path12 from "path";
 
 // src/context-sniper.ts
-import path10 from "path";
+import path11 from "path";
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -2004,7 +2070,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = path10.basename(editFilePath);
+        editFileName = path11.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -2059,7 +2125,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file = obj.file_path ? path11.basename(String(obj.file_path)) : "file";
+      const file = obj.file_path ? path12.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -2122,20 +2188,24 @@ ${smartTruncate(str, 500)}`
 function escapePango(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
   lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   lines.push("");
   lines.push(formattedArgs);
+  if (allowCount >= 3) {
+    lines.push("");
+    lines.push(`\u{1F4A1} Approved ${allowCount - 1}\xD7 before \u2014 "Always Allow" creates a permanent rule`);
+  }
   if (!locked) {
     lines.push("");
     lines.push('\u21B5 Enter = Allow \u21B5   |   \u238B Esc = Block \u238B   |   "Always Allow" = never ask again');
   }
   return lines.join("\n");
 }
-function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
   const lines = [];
   if (locked) {
     lines.push('<span foreground="red" weight="bold">\u26A0\uFE0F  LOCKED BY ADMIN POLICY</span>');
@@ -2147,6 +2217,12 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   lines.push(`<i>\u{1F6E1}\uFE0F  ${escapePango(explainableLabel || "Security Policy")}</i>`);
   lines.push("");
   lines.push(`<tt>${escapePango(formattedArgs)}</tt>`);
+  if (allowCount >= 3) {
+    lines.push("");
+    lines.push(
+      `<span foreground="#f0c040">\u{1F4A1} Approved ${allowCount - 1}\xD7 before \u2014 "Always Allow" creates a permanent rule</span>`
+    );
+  }
   if (!locked) {
     lines.push("");
     lines.push(
@@ -2155,12 +2231,19 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   }
   return lines.join("\n");
 }
-async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord) {
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord, allowCount = 1) {
   if (isTestEnv()) return "deny";
   const { message: formattedArgs, intent } = formatArgs(args, matchedField, matchedWord);
   const intentLabel = intent === "EDIT" ? "Code Edit" : "Action Approval";
   const title = locked ? `\u26A1 Node9 \u2014 Locked` : `\u{1F6E1}\uFE0F Node9 \u2014 ${intentLabel}`;
-  const message = buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked);
+  const message = buildPlainMessage(
+    toolName,
+    formattedArgs,
+    agent,
+    explainableLabel,
+    locked,
+    allowCount
+  );
   return new Promise((resolve) => {
     let childProcess = null;
     const onAbort = () => {
@@ -2192,7 +2275,8 @@ end run`;
           formattedArgs,
           agent,
           explainableLabel,
-          locked
+          locked,
+          allowCount
         );
         const argsList = [
           locked ? "--info" : "--question",
@@ -2234,8 +2318,8 @@ end run`;
 }
 
 // src/auth/cloud.ts
-import fs8 from "fs";
-import os7 from "os";
+import fs9 from "fs";
+import os8 from "os";
 function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
   return fetch(`${creds.apiUrl}/audit`, {
     method: "POST",
@@ -2247,9 +2331,9 @@ function auditLocalAllow(toolName, args, checkedBy, creds, meta) {
       context: {
         agent: meta?.agent,
         mcpServer: meta?.mcpServer,
-        hostname: os7.hostname(),
+        hostname: os8.hostname(),
         cwd: process.cwd(),
-        platform: os7.platform()
+        platform: os8.platform()
       }
     }),
     signal: AbortSignal.timeout(5e3)
@@ -2270,9 +2354,9 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata) {
         context: {
           agent: meta?.agent,
           mcpServer: meta?.mcpServer,
-          hostname: os7.hostname(),
+          hostname: os8.hostname(),
           cwd: process.cwd(),
-          platform: os7.platform()
+          platform: os8.platform()
         },
         ...riskMetadata && { riskMetadata }
       }),
@@ -2328,14 +2412,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      fs8.appendFileSync(
+      fs9.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    fs8.appendFileSync(
+    fs9.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${requestId}: ${err.message}
 `
@@ -2344,7 +2428,7 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 }
 
 // src/auth/orchestrator.ts
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path12.join(os8.tmpdir(), "node9-activity.sock");
+var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path13.join(os9.tmpdir(), "node9-activity.sock");
 function notifyActivity(data) {
   return new Promise((resolve) => {
     try {
@@ -2537,13 +2621,16 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
   let viewerId = null;
   const internalToken = getInternalToken();
   let daemonEntryId = null;
+  let daemonAllowCount = 1;
   if ((approvers.browser || approvers.terminal) && isDaemonRunning() && !options?.calledFromDaemon) {
     if (cloudEnforced && cloudRequestId) {
-      viewerId = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      const viewer = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      viewerId = viewer?.id ?? null;
       daemonEntryId = viewerId;
+      if (viewer) daemonAllowCount = viewer.allowCount;
     } else {
       try {
-        daemonEntryId = await registerDaemonEntry(
+        const entry = await registerDaemonEntry(
           toolName,
           args,
           meta,
@@ -2551,6 +2638,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           options?.activityId,
           options?.cwd
         );
+        daemonEntryId = entry.id;
+        daemonAllowCount = entry.allowCount;
       } catch {
       }
     }
@@ -2586,7 +2675,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           false,
           signal,
           policyMatchedField,
-          policyMatchedWord
+          policyMatchedWord,
+          daemonAllowCount
         );
         if (decision === "always_allow") {
           writeTrustSession(toolName, 36e5);
@@ -2644,10 +2734,13 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
       if (!resolved) {
         resolved = true;
         abortController.abort();
-        if (viewerId && internalToken) {
-          resolveViaDaemon(viewerId, res.approved ? "allow" : "deny", internalToken).catch(
-            () => null
-          );
+        if (daemonEntryId && internalToken) {
+          resolveViaDaemon(
+            daemonEntryId,
+            res.approved ? "allow" : "deny",
+            internalToken,
+            res.decisionSource
+          ).catch(() => null);
         }
         resolve(res);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.3.2",
+  "version": "1.5.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",