@node9/proxy 1.41.0 → 1.42.0

package/README.md

@@ -141,6 +141,23 @@ node9 shield list    # show all shields + status
 - **Auto-undo** — git snapshot before every AI file edit → `node9 undo` to revert
 - **Skills pinning** — SHA-256 verification of installed Claude skills / plugins between sessions
 
+## Review prompts — approve inline, in your agent
+
+When node9 flags an action for **review** (e.g. `git push --force`, a `DROP TABLE`), the approve/deny prompt renders **inline in the agent conversation** — no frozen session, no separate terminal, no hook-timeout race. node9 still runs the full evaluator and makes the decision; only the prompt _surface_ moves to the agent.
+
+- **On by default** for **Claude Code** and **GitHub Copilot CLI** — the agents whose hook contract honors a native `ask`. Every other agent (Codex, Gemini, Antigravity, Hermes, Cursor, OpenCode, Pi) uses node9's own approver.
+- **Control it** with `reviewChannel` in `~/.node9/config.json` (or `--no-ask` on the hook):
+
+```jsonc
+{
+  "settings": {
+    "reviewChannel": "ask", // "ask" = inline agent prompt (default) | "approver" = node9's own approver
+  },
+}
+```
+
+- **Team setups:** when a cloud/team approver is configured (`approvers.cloud: true`), reviews route to that approver instead — node9 won't let an inline self-approval bypass routed/second-party approval.
+
 ## Sandbox — run an agent in a jail
 
 When watching isn't enough, **`node9 sandbox`** runs the agent inside a disposable container with a **kernel-enforced egress allowlist** and **scoped mounts** — while node9's hooks govern and audit every tool call _inside_ the box. The hard version of protection: the agent can only touch the folder you mount and reach the hosts you allow; everything else is dropped at the kernel.

package/dist/cli.js

@@ -23429,6 +23429,38 @@ var TOOLS = [
       required: []
     }
   },
+  {
+    name: "node9_posture",
+    description: "Run the node9 security posture scorecard for the agent on this host \u2014 grades how exposed the machine is to a compromised agent across isolation, egress, secrets-on-disk, supply chain, and privilege, with the #1 risk and a concrete fix for each finding. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        agent: {
+          type: "string",
+          description: "Optional label / policy scope for the agent being graded."
+        }
+      },
+      required: []
+    }
+  },
+  {
+    name: "node9_explain",
+    description: 'Preview exactly how node9 would evaluate a tool call BEFORE running it \u2014 the full allow / review / block waterfall and step-by-step policy trace. Use this to self-check a command (e.g. "git push --force") and see whether it would be allowed, sent for human review, or blocked, and why. Read-only \u2014 nothing executes.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        tool: {
+          type: "string",
+          description: 'Tool name to evaluate. Defaults to "bash" for plain shell commands.'
+        },
+        args: {
+          type: "string",
+          description: 'Tool arguments as JSON, or a plain shell command string (e.g. "git push --force").'
+        }
+      },
+      required: []
+    }
+  },
   {
     name: "node9_rule_add",
     description: 'Add a new protective smart rule to the global node9 config (~/.node9/config.json). Rules can block or send dangerous commands for human review based on regex conditions. IMPORTANT: only "block" and "review" verdicts are permitted \u2014 "allow" rules are never accepted because they would weaken node9 security. Rules can only be added, never removed.',
@@ -23735,6 +23767,17 @@ function handleSessionMcp(args) {
   if (typeof args.detail === "string" && args.detail) cliArgs.push("--detail", args.detail);
   return runCliCommand(cliArgs);
 }
+function handlePostureMcp(args) {
+  const cliArgs = ["posture"];
+  if (typeof args.agent === "string" && args.agent) cliArgs.push("--agent", args.agent);
+  return runCliCommand(cliArgs);
+}
+function handleExplainMcp(args) {
+  const tool = typeof args.tool === "string" && args.tool ? args.tool : "bash";
+  const cliArgs = ["explain", tool];
+  if (typeof args.args === "string" && args.args) cliArgs.push(args.args);
+  return runCliCommand(cliArgs);
+}
 function handleUndoList(args) {
   const cwdFilter = typeof args.cwd === "string" && args.cwd ? args.cwd : null;
   let history = getSnapshotHistory();
@@ -23869,6 +23912,10 @@ function runMcpServer() {
           text = handleReportMcp(toolArgs);
         } else if (toolName === "node9_session") {
           text = handleSessionMcp(toolArgs);
+        } else if (toolName === "node9_posture") {
+          text = handlePostureMcp(toolArgs);
+        } else if (toolName === "node9_explain") {
+          text = handleExplainMcp(toolArgs);
         } else {
           process.stdout.write(err(id, -32601, `Unknown tool: ${toolName}`) + "\n");
           return;

package/dist/cli.mjs

@@ -23401,6 +23401,38 @@ var TOOLS = [
       required: []
     }
   },
+  {
+    name: "node9_posture",
+    description: "Run the node9 security posture scorecard for the agent on this host \u2014 grades how exposed the machine is to a compromised agent across isolation, egress, secrets-on-disk, supply chain, and privilege, with the #1 risk and a concrete fix for each finding. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        agent: {
+          type: "string",
+          description: "Optional label / policy scope for the agent being graded."
+        }
+      },
+      required: []
+    }
+  },
+  {
+    name: "node9_explain",
+    description: 'Preview exactly how node9 would evaluate a tool call BEFORE running it \u2014 the full allow / review / block waterfall and step-by-step policy trace. Use this to self-check a command (e.g. "git push --force") and see whether it would be allowed, sent for human review, or blocked, and why. Read-only \u2014 nothing executes.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        tool: {
+          type: "string",
+          description: 'Tool name to evaluate. Defaults to "bash" for plain shell commands.'
+        },
+        args: {
+          type: "string",
+          description: 'Tool arguments as JSON, or a plain shell command string (e.g. "git push --force").'
+        }
+      },
+      required: []
+    }
+  },
   {
     name: "node9_rule_add",
     description: 'Add a new protective smart rule to the global node9 config (~/.node9/config.json). Rules can block or send dangerous commands for human review based on regex conditions. IMPORTANT: only "block" and "review" verdicts are permitted \u2014 "allow" rules are never accepted because they would weaken node9 security. Rules can only be added, never removed.',
@@ -23707,6 +23739,17 @@ function handleSessionMcp(args) {
   if (typeof args.detail === "string" && args.detail) cliArgs.push("--detail", args.detail);
   return runCliCommand(cliArgs);
 }
+function handlePostureMcp(args) {
+  const cliArgs = ["posture"];
+  if (typeof args.agent === "string" && args.agent) cliArgs.push("--agent", args.agent);
+  return runCliCommand(cliArgs);
+}
+function handleExplainMcp(args) {
+  const tool = typeof args.tool === "string" && args.tool ? args.tool : "bash";
+  const cliArgs = ["explain", tool];
+  if (typeof args.args === "string" && args.args) cliArgs.push(args.args);
+  return runCliCommand(cliArgs);
+}
 function handleUndoList(args) {
   const cwdFilter = typeof args.cwd === "string" && args.cwd ? args.cwd : null;
   let history = getSnapshotHistory();
@@ -23841,6 +23884,10 @@ function runMcpServer() {
           text = handleReportMcp(toolArgs);
         } else if (toolName === "node9_session") {
           text = handleSessionMcp(toolArgs);
+        } else if (toolName === "node9_posture") {
+          text = handlePostureMcp(toolArgs);
+        } else if (toolName === "node9_explain") {
+          text = handleExplainMcp(toolArgs);
         } else {
           process.stdout.write(err(id, -32601, `Unknown tool: ${toolName}`) + "\n");
           return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.41.0",
+  "version": "1.42.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",