@node9/proxy 1.31.0 → 1.33.0

package/dist/dashboard.mjs

@@ -244,6 +244,8 @@ function normalizeCommandForPolicyImpl(command) {
   if (f === PARSE_FAIL) return command;
   try {
     const strips = [];
+    const rewrites = [];
+    const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
       const n = node;
@@ -259,25 +261,46 @@ function normalizeCommandForPolicyImpl(command) {
         if (nextParts.length !== 1) continue;
         const quotedNode = nextParts[0];
         const nt = syntax.NodeType(quotedNode);
+        const markStrip = () => {
+          const s = next.Pos().Offset();
+          const e = next.End().Offset();
+          strips.push([s, e]);
+          msgSpans.add(`${s}:${e}`);
+        };
         if (nt === "SglQuoted") {
-          strips.push([next.Pos().Offset(), next.End().Offset()]);
+          markStrip();
         } else if (nt === "DblQuoted") {
           const innerParts = quotedNode.Parts || [];
           const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
           if (allLit) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           } else if (innerParts.every((p) => isCatHeredocOrLit(p))) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           }
         }
       }
+      for (const arg of args) {
+        const s = arg.Pos().Offset();
+        const e = arg.End().Offset();
+        if (msgSpans.has(`${s}:${e}`)) continue;
+        const resolved = resolveWordLiteral(arg);
+        if (resolved === null) continue;
+        const source = command.slice(s, e);
+        if (resolved === source) continue;
+        if (resolved === "" || /\s/.test(resolved)) continue;
+        rewrites.push([s, e, resolved]);
+      }
       return true;
     });
-    if (strips.length === 0) return command;
-    strips.sort((a, b) => b[0] - a[0]);
+    const edits = [
+      ...strips.map(([s, e]) => [s, e, '""']),
+      ...rewrites
+    ];
+    if (edits.length === 0) return command;
+    edits.sort((a, b) => b[0] - a[0]);
     let result = command;
-    for (const [start, end] of strips) {
-      result = result.slice(0, start) + '""' + result.slice(end);
+    for (const [s, e, rep] of edits) {
+      result = result.slice(0, s) + rep + result.slice(e);
     }
     return result;
   } catch {
@@ -386,20 +409,38 @@ function extractLiteralArgs(callExpr) {
   }
   return { name, flags, paths };
 }
+function resolveWordLiteral(w) {
+  const parts = w?.Parts || [];
+  let s = "";
+  for (const p of parts) {
+    const t = syntax.NodeType(p);
+    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
+    else if (t === "SglQuoted") s += p.Value ?? "";
+    else if (t === "DblQuoted") {
+      const inner = p.Parts || [];
+      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
+      s += inner.map((ip) => ip.Value ?? "").join("");
+    } else {
+      return null;
+    }
+  }
+  return s;
+}
 function analyzeFsOperation(command) {
-  if (!FS_OP_PRESCREEN_RE.test(command)) return null;
-  if (fsOpCache.has(command)) {
-    const hit = fsOpCache.get(command) ?? null;
-    fsOpCache.delete(command);
-    fsOpCache.set(command, hit);
+  const normalized = normalizeCommandForPolicy(command);
+  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
+  if (fsOpCache.has(normalized)) {
+    const hit = fsOpCache.get(normalized) ?? null;
+    fsOpCache.delete(normalized);
+    fsOpCache.set(normalized, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(command);
+  const computed = analyzeFsOperationImpl(normalized);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(command, computed);
+  fsOpCache.set(normalized, computed);
   return computed;
 }
 function analyzeFsOperationImpl(command) {
@@ -1219,7 +1260,11 @@ var init_dist = __esm({
       "shield:project-jail:block-read-ssh",
       "shield:project-jail:block-read-aws",
       "shield:project-jail:block-read-env",
-      "shield:project-jail:review-read-credentials"
+      "shield:project-jail:review-read-credentials",
+      // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
+      // raw-regex smart rule is suppressed for bash — its cond1 read a grep
+      // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
+      "review-drop-truncate-shell"
     ]);
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
@@ -2659,6 +2704,22 @@ var init_cost_codex = __esm({
   }
 });
 
+// src/cost-gemini.ts
+var init_cost_gemini = __esm({
+  "src/cost-gemini.ts"() {
+    "use strict";
+    init_litellm();
+  }
+});
+
+// src/cost-copilot.ts
+var init_cost_copilot = __esm({
+  "src/cost-copilot.ts"() {
+    "use strict";
+    init_litellm();
+  }
+});
+
 // src/costSync.ts
 function decodeProjectDirName(dirName) {
   return dirName.replace(/-/g, "/");
@@ -2671,6 +2732,8 @@ var init_costSync = __esm({
     init_audit();
     init_litellm();
     init_cost_codex();
+    init_cost_gemini();
+    init_cost_copilot();
     SYNC_INTERVAL_MS = 10 * 60 * 1e3;
   }
 });

package/dist/index.js

@@ -140,6 +140,9 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   const agentToolNameField = meta?.agentToolName ? { agentToolName: meta.agentToolName } : {};
   const dlpFields = meta?.dlpPattern ? { dlpPattern: meta.dlpPattern, dlpSample: meta.dlpSample } : {};
   const cloudLinkField = meta?.cloudRequestId ? { cloudRequestId: meta.cloudRequestId } : {};
+  const workingDirField = meta?.workingDir ? { workingDir: meta.workingDir } : {};
+  const shell = process.env.SHELL ? import_path.default.basename(process.env.SHELL) : void 0;
+  const shellTypeField = shell ? { shellType: shell } : {};
   appendToLog(LOCAL_AUDIT_LOG, {
     // eid first: the outbox shipper dedups on it, and a fixed leading field
     // makes the JSONL easy to eyeball.
@@ -153,11 +156,14 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     ...ruleNameField,
     ...dlpFields,
     ...cloudLinkField,
+    ...workingDirField,
+    ...shellTypeField,
     ...testRun,
     agent: meta?.agent,
     mcpServer: meta?.mcpServer,
     sessionId: meta?.sessionId,
-    hostname: import_os.default.hostname()
+    hostname: import_os.default.hostname(),
+    platform: import_os.default.platform()
   });
 }
 function appendConfigAudit(entry) {
@@ -1033,6 +1039,8 @@ function normalizeCommandForPolicyImpl(command) {
   if (f === PARSE_FAIL) return command;
   try {
     const strips = [];
+    const rewrites = [];
+    const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
       const n = node;
@@ -1048,25 +1056,46 @@ function normalizeCommandForPolicyImpl(command) {
         if (nextParts.length !== 1) continue;
         const quotedNode = nextParts[0];
         const nt = syntax.NodeType(quotedNode);
+        const markStrip = () => {
+          const s = next.Pos().Offset();
+          const e = next.End().Offset();
+          strips.push([s, e]);
+          msgSpans.add(`${s}:${e}`);
+        };
         if (nt === "SglQuoted") {
-          strips.push([next.Pos().Offset(), next.End().Offset()]);
+          markStrip();
         } else if (nt === "DblQuoted") {
           const innerParts = quotedNode.Parts || [];
           const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
           if (allLit) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           } else if (innerParts.every((p) => isCatHeredocOrLit(p))) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           }
         }
       }
+      for (const arg of args) {
+        const s = arg.Pos().Offset();
+        const e = arg.End().Offset();
+        if (msgSpans.has(`${s}:${e}`)) continue;
+        const resolved = resolveWordLiteral(arg);
+        if (resolved === null) continue;
+        const source = command.slice(s, e);
+        if (resolved === source) continue;
+        if (resolved === "" || /\s/.test(resolved)) continue;
+        rewrites.push([s, e, resolved]);
+      }
       return true;
     });
-    if (strips.length === 0) return command;
-    strips.sort((a, b) => b[0] - a[0]);
+    const edits = [
+      ...strips.map(([s, e]) => [s, e, '""']),
+      ...rewrites
+    ];
+    if (edits.length === 0) return command;
+    edits.sort((a, b) => b[0] - a[0]);
     let result = command;
-    for (const [start, end] of strips) {
-      result = result.slice(0, start) + '""' + result.slice(end);
+    for (const [s, e, rep] of edits) {
+      result = result.slice(0, s) + rep + result.slice(e);
     }
     return result;
   } catch {
@@ -1231,8 +1260,35 @@ var AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
   "shield:project-jail:block-read-ssh",
   "shield:project-jail:block-read-aws",
   "shield:project-jail:block-read-env",
-  "shield:project-jail:review-read-credentials"
+  "shield:project-jail:review-read-credentials",
+  // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
+  // raw-regex smart rule is suppressed for bash — its cond1 read a grep
+  // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
+  "review-drop-truncate-shell"
+]);
+var SQL_DB_CLIS = /* @__PURE__ */ new Set([
+  "psql",
+  "mysql",
+  "mariadb",
+  "sqlite3",
+  "sqlplus",
+  "cockroach",
+  "clickhouse-client",
+  "mongo",
+  "mongosh"
 ]);
+var SQL_DDL_RE = /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i;
+function analyzeSqlDestructive(command) {
+  if (!SQL_DDL_RE.test(command)) return null;
+  const { actions } = analyzeShellCommand(command);
+  if (!actions.some((a) => SQL_DB_CLIS.has(a))) return null;
+  return {
+    ruleName: "review-drop-truncate-shell",
+    verdict: "review",
+    reason: "SQL DDL destructive statement inside a shell command",
+    description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
+  };
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -1481,19 +1537,20 @@ function extractShellDestinations(command) {
 var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
-  if (!FS_OP_PRESCREEN_RE.test(command)) return null;
-  if (fsOpCache.has(command)) {
-    const hit = fsOpCache.get(command) ?? null;
-    fsOpCache.delete(command);
-    fsOpCache.set(command, hit);
+  const normalized = normalizeCommandForPolicy(command);
+  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
+  if (fsOpCache.has(normalized)) {
+    const hit = fsOpCache.get(normalized) ?? null;
+    fsOpCache.delete(normalized);
+    fsOpCache.set(normalized, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(command);
+  const computed = analyzeFsOperationImpl(normalized);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(command, computed);
+  fsOpCache.set(normalized, computed);
   return computed;
 }
 function analyzeFsOperationImpl(command) {
@@ -2186,6 +2243,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
+    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    if (sqlVerdict) {
+      return {
+        decision: sqlVerdict.verdict,
+        blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
+        reason: sqlVerdict.reason,
+        tier: 2,
+        ruleName: sqlVerdict.ruleName,
+        ruleDescription: sqlVerdict.description
+      };
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(
@@ -4915,7 +4983,8 @@ async function authorizeHeadless(toolName, args, meta, options) {
   }
   return _authorizeHeadlessCore(toolName, args, meta, options);
 }
-async function _authorizeHeadlessCore(toolName, args, meta, options) {
+async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
+  const meta = options?.cwd && !metaArg?.workingDir ? { ...metaArg, workingDir: options.cwd } : metaArg;
   if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
   const pauseState = checkPause();
   if (pauseState.paused) return { approved: true, checkedBy: "paused" };

package/dist/index.mjs

@@ -121,6 +121,9 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   const agentToolNameField = meta?.agentToolName ? { agentToolName: meta.agentToolName } : {};
   const dlpFields = meta?.dlpPattern ? { dlpPattern: meta.dlpPattern, dlpSample: meta.dlpSample } : {};
   const cloudLinkField = meta?.cloudRequestId ? { cloudRequestId: meta.cloudRequestId } : {};
+  const workingDirField = meta?.workingDir ? { workingDir: meta.workingDir } : {};
+  const shell = process.env.SHELL ? path.basename(process.env.SHELL) : void 0;
+  const shellTypeField = shell ? { shellType: shell } : {};
   appendToLog(LOCAL_AUDIT_LOG, {
     // eid first: the outbox shipper dedups on it, and a fixed leading field
     // makes the JSONL easy to eyeball.
@@ -134,11 +137,14 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     ...ruleNameField,
     ...dlpFields,
     ...cloudLinkField,
+    ...workingDirField,
+    ...shellTypeField,
     ...testRun,
     agent: meta?.agent,
     mcpServer: meta?.mcpServer,
     sessionId: meta?.sessionId,
-    hostname: os.hostname()
+    hostname: os.hostname(),
+    platform: os.platform()
   });
 }
 function appendConfigAudit(entry) {
@@ -1003,6 +1009,8 @@ function normalizeCommandForPolicyImpl(command) {
   if (f === PARSE_FAIL) return command;
   try {
     const strips = [];
+    const rewrites = [];
+    const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
       const n = node;
@@ -1018,25 +1026,46 @@ function normalizeCommandForPolicyImpl(command) {
         if (nextParts.length !== 1) continue;
         const quotedNode = nextParts[0];
         const nt = syntax.NodeType(quotedNode);
+        const markStrip = () => {
+          const s = next.Pos().Offset();
+          const e = next.End().Offset();
+          strips.push([s, e]);
+          msgSpans.add(`${s}:${e}`);
+        };
         if (nt === "SglQuoted") {
-          strips.push([next.Pos().Offset(), next.End().Offset()]);
+          markStrip();
         } else if (nt === "DblQuoted") {
           const innerParts = quotedNode.Parts || [];
           const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
           if (allLit) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           } else if (innerParts.every((p) => isCatHeredocOrLit(p))) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           }
         }
       }
+      for (const arg of args) {
+        const s = arg.Pos().Offset();
+        const e = arg.End().Offset();
+        if (msgSpans.has(`${s}:${e}`)) continue;
+        const resolved = resolveWordLiteral(arg);
+        if (resolved === null) continue;
+        const source = command.slice(s, e);
+        if (resolved === source) continue;
+        if (resolved === "" || /\s/.test(resolved)) continue;
+        rewrites.push([s, e, resolved]);
+      }
       return true;
     });
-    if (strips.length === 0) return command;
-    strips.sort((a, b) => b[0] - a[0]);
+    const edits = [
+      ...strips.map(([s, e]) => [s, e, '""']),
+      ...rewrites
+    ];
+    if (edits.length === 0) return command;
+    edits.sort((a, b) => b[0] - a[0]);
     let result = command;
-    for (const [start, end] of strips) {
-      result = result.slice(0, start) + '""' + result.slice(end);
+    for (const [s, e, rep] of edits) {
+      result = result.slice(0, s) + rep + result.slice(e);
     }
     return result;
   } catch {
@@ -1201,8 +1230,35 @@ var AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
   "shield:project-jail:block-read-ssh",
   "shield:project-jail:block-read-aws",
   "shield:project-jail:block-read-env",
-  "shield:project-jail:review-read-credentials"
+  "shield:project-jail:review-read-credentials",
+  // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
+  // raw-regex smart rule is suppressed for bash — its cond1 read a grep
+  // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
+  "review-drop-truncate-shell"
+]);
+var SQL_DB_CLIS = /* @__PURE__ */ new Set([
+  "psql",
+  "mysql",
+  "mariadb",
+  "sqlite3",
+  "sqlplus",
+  "cockroach",
+  "clickhouse-client",
+  "mongo",
+  "mongosh"
 ]);
+var SQL_DDL_RE = /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i;
+function analyzeSqlDestructive(command) {
+  if (!SQL_DDL_RE.test(command)) return null;
+  const { actions } = analyzeShellCommand(command);
+  if (!actions.some((a) => SQL_DB_CLIS.has(a))) return null;
+  return {
+    ruleName: "review-drop-truncate-shell",
+    verdict: "review",
+    reason: "SQL DDL destructive statement inside a shell command",
+    description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
+  };
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -1451,19 +1507,20 @@ function extractShellDestinations(command) {
 var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
-  if (!FS_OP_PRESCREEN_RE.test(command)) return null;
-  if (fsOpCache.has(command)) {
-    const hit = fsOpCache.get(command) ?? null;
-    fsOpCache.delete(command);
-    fsOpCache.set(command, hit);
+  const normalized = normalizeCommandForPolicy(command);
+  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
+  if (fsOpCache.has(normalized)) {
+    const hit = fsOpCache.get(normalized) ?? null;
+    fsOpCache.delete(normalized);
+    fsOpCache.set(normalized, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(command);
+  const computed = analyzeFsOperationImpl(normalized);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(command, computed);
+  fsOpCache.set(normalized, computed);
   return computed;
 }
 function analyzeFsOperationImpl(command) {
@@ -2156,6 +2213,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
+    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    if (sqlVerdict) {
+      return {
+        decision: sqlVerdict.verdict,
+        blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
+        reason: sqlVerdict.reason,
+        tier: 2,
+        ruleName: sqlVerdict.ruleName,
+        ruleDescription: sqlVerdict.description
+      };
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(
@@ -4885,7 +4953,8 @@ async function authorizeHeadless(toolName, args, meta, options) {
   }
   return _authorizeHeadlessCore(toolName, args, meta, options);
 }
-async function _authorizeHeadlessCore(toolName, args, meta, options) {
+async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
+  const meta = options?.cwd && !metaArg?.workingDir ? { ...metaArg, workingDir: options.cwd } : metaArg;
   if (process.env.NODE9_PAUSED === "1") return { approved: true, checkedBy: "paused" };
   const pauseState = checkPause();
   if (pauseState.paused) return { approved: true, checkedBy: "paused" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",