@node9/proxy 1.4.0 → 1.5.0

package/dist/index.js

@@ -1492,16 +1492,35 @@ function readTrustedHosts() {
     return [];
   }
 }
+var _cache = null;
+var CACHE_TTL_MS = 5e3;
+function getFileMtime() {
+  try {
+    return import_fs6.default.statSync(getTrustedHostsPath()).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function getCachedHosts() {
+  const now = Date.now();
+  if (_cache && now < _cache.expiry) {
+    const mtime = getFileMtime();
+    if (mtime === _cache.mtime) return _cache.hosts;
+  }
+  const hosts = readTrustedHosts();
+  _cache = { hosts, expiry: now + CACHE_TTL_MS, mtime: getFileMtime() };
+  return hosts;
+}
 function normalizeHost(raw) {
   return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
 }
 function isTrustedHost(host) {
   const normalized = normalizeHost(host);
-  return readTrustedHosts().some((entry) => {
+  return getCachedHosts().some((entry) => {
     const entryHost = entry.host.toLowerCase();
     if (entryHost.startsWith("*.")) {
       const domain = entryHost.slice(2);
-      return normalized === domain || normalized.endsWith("." + domain);
+      return normalized.endsWith("." + domain);
     }
     return normalized === entryHost;
   });
@@ -1698,7 +1717,12 @@ async function evaluatePolicy(toolName, args, agent, cwd) {
         };
       }
       if (allTrusted) {
-        return { decision: "allow" };
+        return {
+          decision: "allow",
+          blockedByLabel: "Node9: Pipe-Chain to Trusted Host",
+          reason: `Sensitive file piped to trusted host(s): ${sinks.join(", ")}`,
+          tier: 3
+        };
       }
       return {
         decision: "review",
@@ -1950,8 +1974,8 @@ async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityI
       signal: ctrl.signal
     });
     if (!res.ok) throw new Error("Daemon fail");
-    const { id } = await res.json();
-    return id;
+    const { id, allowCount } = await res.json();
+    return { id, allowCount: allowCount ?? 1 };
   } finally {
     clearTimeout(timer);
   }
@@ -1990,15 +2014,15 @@ async function notifyDaemonViewer(toolName, args, meta, riskMetadata) {
     signal: AbortSignal.timeout(3e3)
   });
   if (!res.ok) throw new Error("Daemon unreachable");
-  const { id } = await res.json();
-  return id;
+  const { id, allowCount } = await res.json();
+  return { id, allowCount: allowCount ?? 1 };
 }
-async function resolveViaDaemon(id, decision, internalToken) {
+async function resolveViaDaemon(id, decision, internalToken, source) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   await fetch(`${base}/resolve/${id}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Node9-Internal": internalToken },
-    body: JSON.stringify({ decision }),
+    body: JSON.stringify({ decision, ...source && { source } }),
     signal: AbortSignal.timeout(3e3)
   });
 }
@@ -2200,20 +2224,24 @@ ${smartTruncate(str, 500)}`
 function escapePango(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
   lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   lines.push("");
   lines.push(formattedArgs);
+  if (allowCount >= 3) {
+    lines.push("");
+    lines.push(`\u{1F4A1} Approved ${allowCount - 1}\xD7 before \u2014 "Always Allow" creates a permanent rule`);
+  }
   if (!locked) {
     lines.push("");
     lines.push('\u21B5 Enter = Allow \u21B5   |   \u238B Esc = Block \u238B   |   "Always Allow" = never ask again');
   }
   return lines.join("\n");
 }
-function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
   const lines = [];
   if (locked) {
     lines.push('<span foreground="red" weight="bold">\u26A0\uFE0F  LOCKED BY ADMIN POLICY</span>');
@@ -2225,6 +2253,12 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   lines.push(`<i>\u{1F6E1}\uFE0F  ${escapePango(explainableLabel || "Security Policy")}</i>`);
   lines.push("");
   lines.push(`<tt>${escapePango(formattedArgs)}</tt>`);
+  if (allowCount >= 3) {
+    lines.push("");
+    lines.push(
+      `<span foreground="#f0c040">\u{1F4A1} Approved ${allowCount - 1}\xD7 before \u2014 "Always Allow" creates a permanent rule</span>`
+    );
+  }
   if (!locked) {
     lines.push("");
     lines.push(
@@ -2233,12 +2267,19 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   }
   return lines.join("\n");
 }
-async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord) {
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord, allowCount = 1) {
   if (isTestEnv()) return "deny";
   const { message: formattedArgs, intent } = formatArgs(args, matchedField, matchedWord);
   const intentLabel = intent === "EDIT" ? "Code Edit" : "Action Approval";
   const title = locked ? `\u26A1 Node9 \u2014 Locked` : `\u{1F6E1}\uFE0F Node9 \u2014 ${intentLabel}`;
-  const message = buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked);
+  const message = buildPlainMessage(
+    toolName,
+    formattedArgs,
+    agent,
+    explainableLabel,
+    locked,
+    allowCount
+  );
   return new Promise((resolve) => {
     let childProcess = null;
     const onAbort = () => {
@@ -2270,7 +2311,8 @@ end run`;
           formattedArgs,
           agent,
           explainableLabel,
-          locked
+          locked,
+          allowCount
         );
         const argsList = [
           locked ? "--info" : "--question",
@@ -2615,13 +2657,16 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
   let viewerId = null;
   const internalToken = getInternalToken();
   let daemonEntryId = null;
+  let daemonAllowCount = 1;
   if ((approvers.browser || approvers.terminal) && isDaemonRunning() && !options?.calledFromDaemon) {
     if (cloudEnforced && cloudRequestId) {
-      viewerId = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      const viewer = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      viewerId = viewer?.id ?? null;
       daemonEntryId = viewerId;
+      if (viewer) daemonAllowCount = viewer.allowCount;
     } else {
       try {
-        daemonEntryId = await registerDaemonEntry(
+        const entry = await registerDaemonEntry(
           toolName,
           args,
           meta,
@@ -2629,6 +2674,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           options?.activityId,
           options?.cwd
         );
+        daemonEntryId = entry.id;
+        daemonAllowCount = entry.allowCount;
       } catch {
       }
     }
@@ -2664,7 +2711,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           false,
           signal,
           policyMatchedField,
-          policyMatchedWord
+          policyMatchedWord,
+          daemonAllowCount
         );
         if (decision === "always_allow") {
           writeTrustSession(toolName, 36e5);
@@ -2722,10 +2770,13 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
       if (!resolved) {
         resolved = true;
         abortController.abort();
-        if (viewerId && internalToken) {
-          resolveViaDaemon(viewerId, res.approved ? "allow" : "deny", internalToken).catch(
-            () => null
-          );
+        if (daemonEntryId && internalToken) {
+          resolveViaDaemon(
+            daemonEntryId,
+            res.approved ? "allow" : "deny",
+            internalToken,
+            res.decisionSource
+          ).catch(() => null);
         }
         resolve(res);
       }

package/dist/index.mjs

@@ -1456,16 +1456,35 @@ function readTrustedHosts() {
     return [];
   }
 }
+var _cache = null;
+var CACHE_TTL_MS = 5e3;
+function getFileMtime() {
+  try {
+    return fs6.statSync(getTrustedHostsPath()).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function getCachedHosts() {
+  const now = Date.now();
+  if (_cache && now < _cache.expiry) {
+    const mtime = getFileMtime();
+    if (mtime === _cache.mtime) return _cache.hosts;
+  }
+  const hosts = readTrustedHosts();
+  _cache = { hosts, expiry: now + CACHE_TTL_MS, mtime: getFileMtime() };
+  return hosts;
+}
 function normalizeHost(raw) {
   return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
 }
 function isTrustedHost(host) {
   const normalized = normalizeHost(host);
-  return readTrustedHosts().some((entry) => {
+  return getCachedHosts().some((entry) => {
     const entryHost = entry.host.toLowerCase();
     if (entryHost.startsWith("*.")) {
       const domain = entryHost.slice(2);
-      return normalized === domain || normalized.endsWith("." + domain);
+      return normalized.endsWith("." + domain);
     }
     return normalized === entryHost;
   });
@@ -1662,7 +1681,12 @@ async function evaluatePolicy(toolName, args, agent, cwd) {
         };
       }
       if (allTrusted) {
-        return { decision: "allow" };
+        return {
+          decision: "allow",
+          blockedByLabel: "Node9: Pipe-Chain to Trusted Host",
+          reason: `Sensitive file piped to trusted host(s): ${sinks.join(", ")}`,
+          tier: 3
+        };
       }
       return {
         decision: "review",
@@ -1914,8 +1938,8 @@ async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityI
       signal: ctrl.signal
     });
     if (!res.ok) throw new Error("Daemon fail");
-    const { id } = await res.json();
-    return id;
+    const { id, allowCount } = await res.json();
+    return { id, allowCount: allowCount ?? 1 };
   } finally {
     clearTimeout(timer);
   }
@@ -1954,15 +1978,15 @@ async function notifyDaemonViewer(toolName, args, meta, riskMetadata) {
     signal: AbortSignal.timeout(3e3)
   });
   if (!res.ok) throw new Error("Daemon unreachable");
-  const { id } = await res.json();
-  return id;
+  const { id, allowCount } = await res.json();
+  return { id, allowCount: allowCount ?? 1 };
 }
-async function resolveViaDaemon(id, decision, internalToken) {
+async function resolveViaDaemon(id, decision, internalToken, source) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   await fetch(`${base}/resolve/${id}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Node9-Internal": internalToken },
-    body: JSON.stringify({ decision }),
+    body: JSON.stringify({ decision, ...source && { source } }),
     signal: AbortSignal.timeout(3e3)
   });
 }
@@ -2164,20 +2188,24 @@ ${smartTruncate(str, 500)}`
 function escapePango(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
   lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   lines.push("");
   lines.push(formattedArgs);
+  if (allowCount >= 3) {
+    lines.push("");
+    lines.push(`\u{1F4A1} Approved ${allowCount - 1}\xD7 before \u2014 "Always Allow" creates a permanent rule`);
+  }
   if (!locked) {
     lines.push("");
     lines.push('\u21B5 Enter = Allow \u21B5   |   \u238B Esc = Block \u238B   |   "Always Allow" = never ask again');
   }
   return lines.join("\n");
 }
-function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked) {
+function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1) {
   const lines = [];
   if (locked) {
     lines.push('<span foreground="red" weight="bold">\u26A0\uFE0F  LOCKED BY ADMIN POLICY</span>');
@@ -2189,6 +2217,12 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   lines.push(`<i>\u{1F6E1}\uFE0F  ${escapePango(explainableLabel || "Security Policy")}</i>`);
   lines.push("");
   lines.push(`<tt>${escapePango(formattedArgs)}</tt>`);
+  if (allowCount >= 3) {
+    lines.push("");
+    lines.push(
+      `<span foreground="#f0c040">\u{1F4A1} Approved ${allowCount - 1}\xD7 before \u2014 "Always Allow" creates a permanent rule</span>`
+    );
+  }
   if (!locked) {
     lines.push("");
     lines.push(
@@ -2197,12 +2231,19 @@ function buildPangoMessage(toolName, formattedArgs, agent, explainableLabel, loc
   }
   return lines.join("\n");
 }
-async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord) {
+async function askNativePopup(toolName, args, agent, explainableLabel, locked = false, signal, matchedField, matchedWord, allowCount = 1) {
   if (isTestEnv()) return "deny";
   const { message: formattedArgs, intent } = formatArgs(args, matchedField, matchedWord);
   const intentLabel = intent === "EDIT" ? "Code Edit" : "Action Approval";
   const title = locked ? `\u26A1 Node9 \u2014 Locked` : `\u{1F6E1}\uFE0F Node9 \u2014 ${intentLabel}`;
-  const message = buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked);
+  const message = buildPlainMessage(
+    toolName,
+    formattedArgs,
+    agent,
+    explainableLabel,
+    locked,
+    allowCount
+  );
   return new Promise((resolve) => {
     let childProcess = null;
     const onAbort = () => {
@@ -2234,7 +2275,8 @@ end run`;
           formattedArgs,
           agent,
           explainableLabel,
-          locked
+          locked,
+          allowCount
         );
         const argsList = [
           locked ? "--info" : "--question",
@@ -2579,13 +2621,16 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
   let viewerId = null;
   const internalToken = getInternalToken();
   let daemonEntryId = null;
+  let daemonAllowCount = 1;
   if ((approvers.browser || approvers.terminal) && isDaemonRunning() && !options?.calledFromDaemon) {
     if (cloudEnforced && cloudRequestId) {
-      viewerId = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      const viewer = await notifyDaemonViewer(toolName, args, meta, riskMetadata).catch(() => null);
+      viewerId = viewer?.id ?? null;
       daemonEntryId = viewerId;
+      if (viewer) daemonAllowCount = viewer.allowCount;
     } else {
       try {
-        daemonEntryId = await registerDaemonEntry(
+        const entry = await registerDaemonEntry(
           toolName,
           args,
           meta,
@@ -2593,6 +2638,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           options?.activityId,
           options?.cwd
         );
+        daemonEntryId = entry.id;
+        daemonAllowCount = entry.allowCount;
       } catch {
       }
     }
@@ -2628,7 +2675,8 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           false,
           signal,
           policyMatchedField,
-          policyMatchedWord
+          policyMatchedWord,
+          daemonAllowCount
         );
         if (decision === "always_allow") {
           writeTrustSession(toolName, 36e5);
@@ -2686,10 +2734,13 @@ REASON: Action blocked because no approval channels are available. (Native/Brows
       if (!resolved) {
         resolved = true;
         abortController.abort();
-        if (viewerId && internalToken) {
-          resolveViaDaemon(viewerId, res.approved ? "allow" : "deny", internalToken).catch(
-            () => null
-          );
+        if (daemonEntryId && internalToken) {
+          resolveViaDaemon(
+            daemonEntryId,
+            res.approved ? "allow" : "deny",
+            internalToken,
+            res.decisionSource
+          ).catch(() => null);
         }
         resolve(res);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",