@node9/proxy 1.34.0 → 1.35.0

package/dist/cli.js

@@ -5889,6 +5889,57 @@ function validateApiUrl(raw) {
   }
   return null;
 }
+function auditLocalAllow(toolName, args, checkedBy, creds, meta, dlpInfo, containsSensitiveArgs = false, riskMetadata) {
+  const validated = validateApiUrl(creds.apiUrl);
+  if (!validated) {
+    try {
+      import_fs10.default.appendFileSync(
+        HOOK_DEBUG_LOG,
+        `[audit] refused to send: invalid apiUrl scheme/host (got "${String(creds.apiUrl).slice(0, 200)}")
+`
+      );
+    } catch {
+    }
+    return Promise.resolve();
+  }
+  const safeArgs = containsSensitiveArgs ? { tool: toolName, redacted: true } : args;
+  const dlpSample = dlpInfo && typeof dlpInfo.redactedSample === "string" ? dlpInfo.redactedSample.slice(0, DLP_SAMPLE_MAX_LEN) : void 0;
+  const dlpPattern = dlpInfo && typeof dlpInfo.pattern === "string" ? dlpInfo.pattern.slice(0, DLP_PATTERN_MAX_LEN) : void 0;
+  const safeCheckedBy = KNOWN_CHECKED_BY.has(checkedBy) ? checkedBy : "unknown";
+  const cleanedRiskMetadata = riskMetadata ? Object.fromEntries(
+    Object.entries(riskMetadata).filter(
+      ([, v]) => typeof v === "string" && v.length > 0 || typeof v === "number" && Number.isFinite(v)
+    )
+  ) : void 0;
+  const hasRiskMetadata = cleanedRiskMetadata && Object.keys(cleanedRiskMetadata).length > 0;
+  return fetch(`${validated.toString().replace(/\/$/, "")}/audit`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
+    body: JSON.stringify({
+      toolName,
+      args: safeArgs,
+      checkedBy: safeCheckedBy,
+      ...dlpInfo && { dlpPattern, dlpSample },
+      ...hasRiskMetadata && { riskMetadata: cleanedRiskMetadata },
+      // session_id (Claude Code + Gemini CLI) groups all audit rows from one
+      // agent run; transcript_path is the authoritative pointer to the
+      // session log (survives Gemini resume drift). Both optional —
+      // unsupported agents (MCP-mediated) leave them undefined.
+      ...meta?.sessionId && { runId: meta.sessionId },
+      ...meta?.transcriptPath && { transcriptPath: meta.transcriptPath },
+      context: {
+        agent: meta?.agent,
+        mcpServer: meta?.mcpServer,
+        hostname: import_os9.default.hostname(),
+        cwd: process.cwd(),
+        platform: import_os9.default.platform()
+      }
+    }),
+    signal: AbortSignal.timeout(5e3)
+  }).then(() => {
+  }).catch(() => {
+  });
+}
 async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPolicy, forceReview) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1e4);
@@ -6012,7 +6063,7 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     );
   }
 }
-var import_fs10, import_os9, import_path12;
+var import_fs10, import_os9, import_path12, DLP_SAMPLE_MAX_LEN, DLP_PATTERN_MAX_LEN, KNOWN_CHECKED_BY;
 var init_cloud = __esm({
   "src/auth/cloud.ts"() {
     "use strict";
@@ -6020,6 +6071,39 @@ var init_cloud = __esm({
     import_os9 = __toESM(require("os"));
     import_path12 = __toESM(require("path"));
     init_audit();
+    DLP_SAMPLE_MAX_LEN = 200;
+    DLP_PATTERN_MAX_LEN = 100;
+    KNOWN_CHECKED_BY = /* @__PURE__ */ new Set([
+      "dlp-block",
+      "observe-mode-dlp-would-block",
+      "dlp-review-flagged",
+      "loop-detected",
+      "audit-mode",
+      "local-policy",
+      "smart-rule-block",
+      // Smart-rule block was downgraded to review because the daemon was
+      // running and we're not in CI. The block attempt is still recorded;
+      // the user got a popup. Distinct from 'smart-rule-block' so the
+      // dashboard can show "block rule overridden" separately from a hard
+      // block that fired with no human in the loop.
+      "smart-rule-block-override",
+      "persistent",
+      "trust",
+      "observe-mode",
+      "observe-mode-would-block",
+      // MCP supply-chain: the gateway pinned a server's tool definitions and they
+      // changed since (possible tool poisoning / rug pull). Emitted as a synthetic
+      // audit row so the SaaS surfaces it as a blocked event. The firewall maps
+      // this checkedBy to AUTO_BLOCKED. See doc/roadmap/active/saas-value-first.md
+      // (workstream B-Tier2).
+      "mcp-pin-mismatch",
+      // MCP visibility (B-Tier2, informational — NOT blocks): the gateway
+      // discovered a server's tool inventory (mcp-discovered) or saw an oversized
+      // tool response that bloats the context window (mcp-large-response). Stored
+      // AUTO_ALLOWED; carries mcpToolCount / mcpResponseBytes in riskMetadata.
+      "mcp-discovered",
+      "mcp-large-response"
+    ]);
   }
 });
 
@@ -22047,6 +22131,8 @@ var import_chalk19 = __toESM(require("chalk"));
 var import_child_process10 = require("child_process");
 var import_execa3 = require("execa");
 init_orchestrator();
+init_cloud();
+init_config();
 init_provenance();
 init_mcp_pin();
 init_mcp_tools();
@@ -22075,6 +22161,60 @@ function normalizeClientName(name) {
   const sanitized = sanitize4(name).slice(0, 40);
   return sanitized.length > 0 ? sanitized : void 0;
 }
+function reportPinMismatchToCloud(serverKey, agent) {
+  try {
+    const creds = getCredentials();
+    if (!creds) return;
+    void auditLocalAllow(
+      `mcp-server:${serverKey}`,
+      { serverKey, reason: "tool-pin-mismatch" },
+      "mcp-pin-mismatch",
+      creds,
+      { mcpServer: serverKey, agent },
+      void 0,
+      false,
+      {
+        ruleName: "MCP tool definitions changed (possible rug pull)",
+        ruleDescription: `The MCP server "${serverKey}" changed its tool definitions since they were pinned. This can indicate a supply-chain attack (tool poisoning). The session was quarantined. Review with: node9 mcp pin update ${serverKey}`
+      }
+    );
+  } catch {
+  }
+}
+function reportInventoryToCloud(serverKey, toolCount, agent) {
+  try {
+    const creds = getCredentials();
+    if (!creds) return;
+    void auditLocalAllow(
+      `mcp-server:${serverKey}`,
+      { serverKey, toolCount },
+      "mcp-discovered",
+      creds,
+      { mcpServer: serverKey, agent },
+      void 0,
+      false,
+      { mcpToolCount: toolCount }
+    );
+  } catch {
+  }
+}
+function reportLargeResponseToCloud(serverKey, responseBytes, agent) {
+  try {
+    const creds = getCredentials();
+    if (!creds) return;
+    void auditLocalAllow(
+      `mcp-server:${serverKey}`,
+      { serverKey, responseBytes },
+      "mcp-large-response",
+      creds,
+      { mcpServer: serverKey, agent },
+      void 0,
+      false,
+      { mcpResponseBytes: responseBytes }
+    );
+  } catch {
+  }
+}
 function tokenize4(cmd) {
   const tokens = [];
   let current = "";
@@ -22335,6 +22475,7 @@ async function runMcpGateway(upstreamCommand) {
         const currentHash = hashToolDefinitions(tools);
         const pinStatus = checkPin(serverKey, currentHash, gatewayCwd);
         const token = getInternalToken();
+        reportInventoryToCloud(serverKey, tools.length, clientName);
         if (isDaemonRunning() && process.env.NODE9_TESTING !== "1") {
           const toolSummary = tools.map((t) => ({ name: t.name, description: t.description }));
           fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/mcp/discovered`, {
@@ -22399,6 +22540,7 @@ async function runMcpGateway(upstreamCommand) {
           console.error(import_chalk19.default.red("   Session quarantined \u2014 all tool calls blocked."));
           console.error(import_chalk19.default.yellow(`   Run: node9 mcp pin update ${serverKey}
 `));
+          reportPinMismatchToCloud(serverKey, clientName);
           const errorResponse = {
             jsonrpc: "2.0",
             id: parsed.id,
@@ -22444,6 +22586,7 @@ async function runMcpGateway(upstreamCommand) {
           `\u26A1 Node9: Large MCP response from '${toolName}' (${(line.length / 1024).toFixed(0)}KB) \u2014 context window enlarged`
         )
       );
+      reportLargeResponseToCloud(serverKey, line.length, clientName);
       if (isDaemonRunning() && process.env.NODE9_TESTING !== "1") {
         const token = getInternalToken();
         fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/mcp/large-response`, {

package/dist/cli.mjs

@@ -5869,6 +5869,57 @@ function validateApiUrl(raw) {
   }
   return null;
 }
+function auditLocalAllow(toolName, args, checkedBy, creds, meta, dlpInfo, containsSensitiveArgs = false, riskMetadata) {
+  const validated = validateApiUrl(creds.apiUrl);
+  if (!validated) {
+    try {
+      fs10.appendFileSync(
+        HOOK_DEBUG_LOG,
+        `[audit] refused to send: invalid apiUrl scheme/host (got "${String(creds.apiUrl).slice(0, 200)}")
+`
+      );
+    } catch {
+    }
+    return Promise.resolve();
+  }
+  const safeArgs = containsSensitiveArgs ? { tool: toolName, redacted: true } : args;
+  const dlpSample = dlpInfo && typeof dlpInfo.redactedSample === "string" ? dlpInfo.redactedSample.slice(0, DLP_SAMPLE_MAX_LEN) : void 0;
+  const dlpPattern = dlpInfo && typeof dlpInfo.pattern === "string" ? dlpInfo.pattern.slice(0, DLP_PATTERN_MAX_LEN) : void 0;
+  const safeCheckedBy = KNOWN_CHECKED_BY.has(checkedBy) ? checkedBy : "unknown";
+  const cleanedRiskMetadata = riskMetadata ? Object.fromEntries(
+    Object.entries(riskMetadata).filter(
+      ([, v]) => typeof v === "string" && v.length > 0 || typeof v === "number" && Number.isFinite(v)
+    )
+  ) : void 0;
+  const hasRiskMetadata = cleanedRiskMetadata && Object.keys(cleanedRiskMetadata).length > 0;
+  return fetch(`${validated.toString().replace(/\/$/, "")}/audit`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${creds.apiKey}` },
+    body: JSON.stringify({
+      toolName,
+      args: safeArgs,
+      checkedBy: safeCheckedBy,
+      ...dlpInfo && { dlpPattern, dlpSample },
+      ...hasRiskMetadata && { riskMetadata: cleanedRiskMetadata },
+      // session_id (Claude Code + Gemini CLI) groups all audit rows from one
+      // agent run; transcript_path is the authoritative pointer to the
+      // session log (survives Gemini resume drift). Both optional —
+      // unsupported agents (MCP-mediated) leave them undefined.
+      ...meta?.sessionId && { runId: meta.sessionId },
+      ...meta?.transcriptPath && { transcriptPath: meta.transcriptPath },
+      context: {
+        agent: meta?.agent,
+        mcpServer: meta?.mcpServer,
+        hostname: os9.hostname(),
+        cwd: process.cwd(),
+        platform: os9.platform()
+      }
+    }),
+    signal: AbortSignal.timeout(5e3)
+  }).then(() => {
+  }).catch(() => {
+  });
+}
 async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPolicy, forceReview) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1e4);
@@ -5992,10 +6043,44 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     );
   }
 }
+var DLP_SAMPLE_MAX_LEN, DLP_PATTERN_MAX_LEN, KNOWN_CHECKED_BY;
 var init_cloud = __esm({
   "src/auth/cloud.ts"() {
     "use strict";
     init_audit();
+    DLP_SAMPLE_MAX_LEN = 200;
+    DLP_PATTERN_MAX_LEN = 100;
+    KNOWN_CHECKED_BY = /* @__PURE__ */ new Set([
+      "dlp-block",
+      "observe-mode-dlp-would-block",
+      "dlp-review-flagged",
+      "loop-detected",
+      "audit-mode",
+      "local-policy",
+      "smart-rule-block",
+      // Smart-rule block was downgraded to review because the daemon was
+      // running and we're not in CI. The block attempt is still recorded;
+      // the user got a popup. Distinct from 'smart-rule-block' so the
+      // dashboard can show "block rule overridden" separately from a hard
+      // block that fired with no human in the loop.
+      "smart-rule-block-override",
+      "persistent",
+      "trust",
+      "observe-mode",
+      "observe-mode-would-block",
+      // MCP supply-chain: the gateway pinned a server's tool definitions and they
+      // changed since (possible tool poisoning / rug pull). Emitted as a synthetic
+      // audit row so the SaaS surfaces it as a blocked event. The firewall maps
+      // this checkedBy to AUTO_BLOCKED. See doc/roadmap/active/saas-value-first.md
+      // (workstream B-Tier2).
+      "mcp-pin-mismatch",
+      // MCP visibility (B-Tier2, informational — NOT blocks): the gateway
+      // discovered a server's tool inventory (mcp-discovered) or saw an oversized
+      // tool response that bloats the context window (mcp-large-response). Stored
+      // AUTO_ALLOWED; carries mcpToolCount / mcpResponseBytes in riskMetadata.
+      "mcp-discovered",
+      "mcp-large-response"
+    ]);
   }
 });
 
@@ -22014,6 +22099,8 @@ function registerUndoCommand(program2) {
 
 // src/mcp-gateway/index.ts
 init_orchestrator();
+init_cloud();
+init_config();
 import readline4 from "readline";
 import chalk19 from "chalk";
 import { spawn as spawn7 } from "child_process";
@@ -22046,6 +22133,60 @@ function normalizeClientName(name) {
   const sanitized = sanitize4(name).slice(0, 40);
   return sanitized.length > 0 ? sanitized : void 0;
 }
+function reportPinMismatchToCloud(serverKey, agent) {
+  try {
+    const creds = getCredentials();
+    if (!creds) return;
+    void auditLocalAllow(
+      `mcp-server:${serverKey}`,
+      { serverKey, reason: "tool-pin-mismatch" },
+      "mcp-pin-mismatch",
+      creds,
+      { mcpServer: serverKey, agent },
+      void 0,
+      false,
+      {
+        ruleName: "MCP tool definitions changed (possible rug pull)",
+        ruleDescription: `The MCP server "${serverKey}" changed its tool definitions since they were pinned. This can indicate a supply-chain attack (tool poisoning). The session was quarantined. Review with: node9 mcp pin update ${serverKey}`
+      }
+    );
+  } catch {
+  }
+}
+function reportInventoryToCloud(serverKey, toolCount, agent) {
+  try {
+    const creds = getCredentials();
+    if (!creds) return;
+    void auditLocalAllow(
+      `mcp-server:${serverKey}`,
+      { serverKey, toolCount },
+      "mcp-discovered",
+      creds,
+      { mcpServer: serverKey, agent },
+      void 0,
+      false,
+      { mcpToolCount: toolCount }
+    );
+  } catch {
+  }
+}
+function reportLargeResponseToCloud(serverKey, responseBytes, agent) {
+  try {
+    const creds = getCredentials();
+    if (!creds) return;
+    void auditLocalAllow(
+      `mcp-server:${serverKey}`,
+      { serverKey, responseBytes },
+      "mcp-large-response",
+      creds,
+      { mcpServer: serverKey, agent },
+      void 0,
+      false,
+      { mcpResponseBytes: responseBytes }
+    );
+  } catch {
+  }
+}
 function tokenize4(cmd) {
   const tokens = [];
   let current = "";
@@ -22306,6 +22447,7 @@ async function runMcpGateway(upstreamCommand) {
         const currentHash = hashToolDefinitions(tools);
         const pinStatus = checkPin(serverKey, currentHash, gatewayCwd);
         const token = getInternalToken();
+        reportInventoryToCloud(serverKey, tools.length, clientName);
         if (isDaemonRunning() && process.env.NODE9_TESTING !== "1") {
           const toolSummary = tools.map((t) => ({ name: t.name, description: t.description }));
           fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/mcp/discovered`, {
@@ -22370,6 +22512,7 @@ async function runMcpGateway(upstreamCommand) {
           console.error(chalk19.red("   Session quarantined \u2014 all tool calls blocked."));
           console.error(chalk19.yellow(`   Run: node9 mcp pin update ${serverKey}
 `));
+          reportPinMismatchToCloud(serverKey, clientName);
           const errorResponse = {
             jsonrpc: "2.0",
             id: parsed.id,
@@ -22415,6 +22558,7 @@ async function runMcpGateway(upstreamCommand) {
           `\u26A1 Node9: Large MCP response from '${toolName}' (${(line.length / 1024).toFixed(0)}KB) \u2014 context window enlarged`
         )
       );
+      reportLargeResponseToCloud(serverKey, line.length, clientName);
       if (isDaemonRunning() && process.env.NODE9_TESTING !== "1") {
         const token = getInternalToken();
         fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/mcp/large-response`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.34.0",
+  "version": "1.35.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",