@node9/proxy 1.36.0 → 1.38.0

package/dist/dashboard.mjs

@@ -2301,6 +2301,11 @@ var init_config_schema = __esm({
           threshold: z.number().min(2).optional(),
           windowSeconds: z.number().min(10).optional()
         }).optional(),
+        injectionScan: z.object({
+          enabled: z.boolean().optional(),
+          minConfidence: z.enum(["medium", "high"]).optional(),
+          allow: z.array(z.string()).optional()
+        }).optional(),
         skillPinning: z.object({
           enabled: z.boolean().optional(),
           mode: z.enum(["warn", "block"]).optional(),
@@ -2602,6 +2607,7 @@ var init_config = __esm({
         dlp: { enabled: true, scanIgnoredTools: true, pii: "off" },
         egress: { enabled: false, mode: "review", allow: [], deny: [], allowPrivate: true },
         loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
+        injectionScan: { enabled: false, minConfidence: "medium", allow: [] },
         skillPinning: { enabled: false, mode: "warn", roots: [] }
       },
       environments: {}

package/dist/index.js

@@ -314,6 +314,11 @@ var ConfigFileSchema = import_zod.z.object({
       threshold: import_zod.z.number().min(2).optional(),
       windowSeconds: import_zod.z.number().min(10).optional()
     }).optional(),
+    injectionScan: import_zod.z.object({
+      enabled: import_zod.z.boolean().optional(),
+      minConfidence: import_zod.z.enum(["medium", "high"]).optional(),
+      allow: import_zod.z.array(import_zod.z.string()).optional()
+    }).optional(),
     skillPinning: import_zod.z.object({
       enabled: import_zod.z.boolean().optional(),
       mode: import_zod.z.enum(["warn", "block"]).optional(),
@@ -3570,6 +3575,7 @@ var DEFAULT_CONFIG = {
     dlp: { enabled: true, scanIgnoredTools: true, pii: "off" },
     egress: { enabled: false, mode: "review", allow: [], deny: [], allowPrivate: true },
     loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
+    injectionScan: { enabled: false, minConfidence: "medium", allow: [] },
     skillPinning: { enabled: false, mode: "warn", roots: [] }
   },
   environments: {}
@@ -3700,6 +3706,10 @@ function getConfig(cwd) {
       deny: [...DEFAULT_CONFIG.policy.egress.deny]
     },
     loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection },
+    injectionScan: {
+      ...DEFAULT_CONFIG.policy.injectionScan,
+      allow: [...DEFAULT_CONFIG.policy.injectionScan.allow]
+    },
     skillPinning: {
       ...DEFAULT_CONFIG.policy.skillPinning,
       roots: [...DEFAULT_CONFIG.policy.skillPinning.roots]
@@ -3766,6 +3776,17 @@ function getConfig(cwd) {
       if (ld.windowSeconds !== void 0)
         mergedPolicy.loopDetection.windowSeconds = ld.windowSeconds;
     }
+    if (p.injectionScan && typeof p.injectionScan === "object") {
+      const is = p.injectionScan;
+      if (is.enabled !== void 0) mergedPolicy.injectionScan.enabled = is.enabled;
+      if (is.minConfidence !== void 0)
+        mergedPolicy.injectionScan.minConfidence = is.minConfidence;
+      if (Array.isArray(is.allow)) {
+        for (const t of is.allow) {
+          if (typeof t === "string" && t.length > 0) mergedPolicy.injectionScan.allow.push(t);
+        }
+      }
+    }
     if (p.skillPinning && typeof p.skillPinning === "object") {
       const sp = p.skillPinning;
       if (sp.enabled !== void 0) mergedPolicy.skillPinning.enabled = sp.enabled;
@@ -4377,6 +4398,21 @@ async function checkTaint(paths) {
     return { tainted: false, daemonUnavailable: true };
   }
 }
+async function checkSessionTaint(sessionId) {
+  if (!sessionId || !isDaemonRunning()) return { tainted: false };
+  const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  try {
+    const res = await fetch(`${base}/session-taint/check`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sessionId }),
+      signal: AbortSignal.timeout(2e3)
+    });
+    return await res.json();
+  } catch {
+    return { tainted: false, daemonUnavailable: true };
+  }
+}
 async function resolveViaDaemon(id, decision, internalToken, source) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   await fetch(`${base}/resolve/${id}`, {
@@ -5056,6 +5092,12 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       }
     }
   }
+  if (!taintWarning && meta?.sessionId && (isNetworkTool(toolName, args) || isWriteTool(toolName))) {
+    const sessionTaint = await checkSessionTaint(meta.sessionId);
+    if (sessionTaint.tainted && sessionTaint.record) {
+      taintWarning = `\u26A0\uFE0F node9 flagged this session \u2014 earlier tool output contained ${sessionTaint.record.source}. Approve this ${isWriteTool(toolName) ? "write" : "network"} action before it proceeds.`;
+    }
+  }
   if (config.policy.dlp.enabled && (!isIgnoredTool2(toolName) || config.policy.dlp.scanIgnoredTools)) {
     const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
     const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");

package/dist/index.mjs

@@ -284,6 +284,11 @@ var ConfigFileSchema = z.object({
       threshold: z.number().min(2).optional(),
       windowSeconds: z.number().min(10).optional()
     }).optional(),
+    injectionScan: z.object({
+      enabled: z.boolean().optional(),
+      minConfidence: z.enum(["medium", "high"]).optional(),
+      allow: z.array(z.string()).optional()
+    }).optional(),
     skillPinning: z.object({
       enabled: z.boolean().optional(),
       mode: z.enum(["warn", "block"]).optional(),
@@ -3540,6 +3545,7 @@ var DEFAULT_CONFIG = {
     dlp: { enabled: true, scanIgnoredTools: true, pii: "off" },
     egress: { enabled: false, mode: "review", allow: [], deny: [], allowPrivate: true },
     loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
+    injectionScan: { enabled: false, minConfidence: "medium", allow: [] },
     skillPinning: { enabled: false, mode: "warn", roots: [] }
   },
   environments: {}
@@ -3670,6 +3676,10 @@ function getConfig(cwd) {
       deny: [...DEFAULT_CONFIG.policy.egress.deny]
     },
     loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection },
+    injectionScan: {
+      ...DEFAULT_CONFIG.policy.injectionScan,
+      allow: [...DEFAULT_CONFIG.policy.injectionScan.allow]
+    },
     skillPinning: {
       ...DEFAULT_CONFIG.policy.skillPinning,
       roots: [...DEFAULT_CONFIG.policy.skillPinning.roots]
@@ -3736,6 +3746,17 @@ function getConfig(cwd) {
       if (ld.windowSeconds !== void 0)
         mergedPolicy.loopDetection.windowSeconds = ld.windowSeconds;
     }
+    if (p.injectionScan && typeof p.injectionScan === "object") {
+      const is = p.injectionScan;
+      if (is.enabled !== void 0) mergedPolicy.injectionScan.enabled = is.enabled;
+      if (is.minConfidence !== void 0)
+        mergedPolicy.injectionScan.minConfidence = is.minConfidence;
+      if (Array.isArray(is.allow)) {
+        for (const t of is.allow) {
+          if (typeof t === "string" && t.length > 0) mergedPolicy.injectionScan.allow.push(t);
+        }
+      }
+    }
     if (p.skillPinning && typeof p.skillPinning === "object") {
       const sp = p.skillPinning;
       if (sp.enabled !== void 0) mergedPolicy.skillPinning.enabled = sp.enabled;
@@ -4347,6 +4368,21 @@ async function checkTaint(paths) {
     return { tainted: false, daemonUnavailable: true };
   }
 }
+async function checkSessionTaint(sessionId) {
+  if (!sessionId || !isDaemonRunning()) return { tainted: false };
+  const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  try {
+    const res = await fetch(`${base}/session-taint/check`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sessionId }),
+      signal: AbortSignal.timeout(2e3)
+    });
+    return await res.json();
+  } catch {
+    return { tainted: false, daemonUnavailable: true };
+  }
+}
 async function resolveViaDaemon(id, decision, internalToken, source) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   await fetch(`${base}/resolve/${id}`, {
@@ -5026,6 +5062,12 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       }
     }
   }
+  if (!taintWarning && meta?.sessionId && (isNetworkTool(toolName, args) || isWriteTool(toolName))) {
+    const sessionTaint = await checkSessionTaint(meta.sessionId);
+    if (sessionTaint.tainted && sessionTaint.record) {
+      taintWarning = `\u26A0\uFE0F node9 flagged this session \u2014 earlier tool output contained ${sessionTaint.record.source}. Approve this ${isWriteTool(toolName) ? "write" : "network"} action before it proceeds.`;
+    }
+  }
   if (config.policy.dlp.enabled && (!isIgnoredTool2(toolName) || config.policy.dlp.scanIgnoredTools)) {
     const argsObj = args && typeof args === "object" && !Array.isArray(args) ? args : {};
     const filePath = String(argsObj.file_path ?? argsObj.path ?? argsObj.filename ?? "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.36.0",
+  "version": "1.38.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -120,7 +120,8 @@
     "vitest": "4.1.2"
   },
   "overrides": {
-    "undici": "^7.24.0"
+    "undici": "^7.24.0",
+    "ws": "^8.21.0"
   },
   "publishConfig": {
     "access": "public"