@node9/proxy 1.42.0 → 1.43.0

package/dist/cli.js

@@ -298,6 +298,10 @@ var init_config_schema = __esm({
         // node9's own approver (terminal/native/cloud). Unset → smart default
         // (ask for ask-capable agents unless a cloud approver is configured).
         reviewChannel: import_zod.z.enum(["ask", "approver"]).optional(),
+        // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+        // approver_set). Default (unset/false): those tools refuse over MCP — a human
+        // must run them from the CLI. node9's threat model is the agent itself.
+        mcpAllowWeakening: import_zod.z.boolean().optional(),
         cloudSyncIntervalHours: import_zod.z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.
@@ -4203,6 +4207,7 @@ function getConfig(cwd) {
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
@@ -23244,6 +23249,34 @@ function ok(id, result) {
 function err(id, code, message) {
   return JSON.stringify({ jsonrpc: "2.0", id: id ?? null, error: { code, message } });
 }
+var TOOL_CAPABILITY = {
+  // weaken — gated over MCP
+  node9_shield_disable: "weaken",
+  node9_approver_set: "weaken",
+  // add / restorative — always allowed
+  node9_shield_enable: "add",
+  node9_rule_add: "add",
+  // already block/review-only — handleRuleAdd rejects "allow"
+  node9_undo_revert: "add",
+  // restorative
+  // readonly
+  node9_status: "readonly",
+  node9_config_get: "readonly",
+  node9_policy_get: "readonly",
+  node9_audit_get: "readonly",
+  node9_session: "readonly",
+  node9_scan: "readonly",
+  node9_report: "readonly",
+  node9_posture: "readonly",
+  node9_explain: "readonly",
+  node9_shield_list: "readonly",
+  node9_approver_list: "readonly",
+  node9_undo_list: "readonly",
+  node9_undo_detail: "readonly"
+};
+function capabilityOf(tool) {
+  return TOOL_CAPABILITY[tool] ?? "readonly";
+}
 var TOOLS = [
   {
     name: "node9_status",
@@ -23276,7 +23309,7 @@ var TOOLS = [
   },
   {
     name: "node9_shield_disable",
-    description: "Disable a node9 shield. Use node9_shield_list to see currently active shields.",
+    description: 'Disable a node9 shield. WEAKENING action \u2014 refused over MCP by default (a human must run "node9 shield disable <name>" from the CLI). Use node9_shield_list to see active shields.',
     inputSchema: {
       type: "object",
       properties: {
@@ -23295,7 +23328,7 @@ var TOOLS = [
   },
   {
     name: "node9_approver_set",
-    description: "Enable or disable a specific node9 approver channel in the global config (~/.node9/config.json). Use this to turn individual channels on or off without touching other settings. Channels: native, browser, cloud, terminal. WARNING: disabling all approvers means node9 cannot prompt for human approval \u2014 use with care.",
+    description: "Enable or disable a specific node9 approver channel in the global config (~/.node9/config.json). Use this to turn individual channels on or off without touching other settings. Channels: native, browser, cloud, terminal. WEAKENING action \u2014 refused over MCP by default (a human must run it from the CLI). WARNING: disabling all approvers means node9 cannot prompt for human approval \u2014 use with care.",
     inputSchema: {
       type: "object",
       properties: {
@@ -23878,6 +23911,24 @@ function runMcpServer() {
       const p = params ?? {};
       const toolName = p.name;
       const toolArgs = p.arguments ?? {};
+      if (capabilityOf(toolName ?? "") === "weaken") {
+        let allowed = false;
+        try {
+          allowed = getConfig().settings.mcpAllowWeakening === true;
+        } catch {
+          allowed = false;
+        }
+        if (!allowed) {
+          process.stdout.write(
+            err(
+              id,
+              -32e3,
+              `${toolName} weakens node9 and is disabled over MCP. A human must run it from the CLI (e.g. "node9 shield disable <name>"), or set "mcpAllowWeakening": true in ~/.node9/config.json to allow agent-driven weakening.`
+            ) + "\n"
+          );
+          return;
+        }
+      }
       try {
         let text;
         if (toolName === "node9_status") {

package/dist/cli.mjs

@@ -276,6 +276,10 @@ var init_config_schema = __esm({
         // node9's own approver (terminal/native/cloud). Unset → smart default
         // (ask for ask-capable agents unless a cloud approver is configured).
         reviewChannel: z.enum(["ask", "approver"]).optional(),
+        // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+        // approver_set). Default (unset/false): those tools refuse over MCP — a human
+        // must run them from the CLI. node9's threat model is the agent itself.
+        mcpAllowWeakening: z.boolean().optional(),
         cloudSyncIntervalHours: z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.
@@ -4184,6 +4188,7 @@ function getConfig(cwd) {
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
@@ -23216,6 +23221,34 @@ function ok(id, result) {
 function err(id, code, message) {
   return JSON.stringify({ jsonrpc: "2.0", id: id ?? null, error: { code, message } });
 }
+var TOOL_CAPABILITY = {
+  // weaken — gated over MCP
+  node9_shield_disable: "weaken",
+  node9_approver_set: "weaken",
+  // add / restorative — always allowed
+  node9_shield_enable: "add",
+  node9_rule_add: "add",
+  // already block/review-only — handleRuleAdd rejects "allow"
+  node9_undo_revert: "add",
+  // restorative
+  // readonly
+  node9_status: "readonly",
+  node9_config_get: "readonly",
+  node9_policy_get: "readonly",
+  node9_audit_get: "readonly",
+  node9_session: "readonly",
+  node9_scan: "readonly",
+  node9_report: "readonly",
+  node9_posture: "readonly",
+  node9_explain: "readonly",
+  node9_shield_list: "readonly",
+  node9_approver_list: "readonly",
+  node9_undo_list: "readonly",
+  node9_undo_detail: "readonly"
+};
+function capabilityOf(tool) {
+  return TOOL_CAPABILITY[tool] ?? "readonly";
+}
 var TOOLS = [
   {
     name: "node9_status",
@@ -23248,7 +23281,7 @@ var TOOLS = [
   },
   {
     name: "node9_shield_disable",
-    description: "Disable a node9 shield. Use node9_shield_list to see currently active shields.",
+    description: 'Disable a node9 shield. WEAKENING action \u2014 refused over MCP by default (a human must run "node9 shield disable <name>" from the CLI). Use node9_shield_list to see active shields.',
     inputSchema: {
       type: "object",
       properties: {
@@ -23267,7 +23300,7 @@ var TOOLS = [
   },
   {
     name: "node9_approver_set",
-    description: "Enable or disable a specific node9 approver channel in the global config (~/.node9/config.json). Use this to turn individual channels on or off without touching other settings. Channels: native, browser, cloud, terminal. WARNING: disabling all approvers means node9 cannot prompt for human approval \u2014 use with care.",
+    description: "Enable or disable a specific node9 approver channel in the global config (~/.node9/config.json). Use this to turn individual channels on or off without touching other settings. Channels: native, browser, cloud, terminal. WEAKENING action \u2014 refused over MCP by default (a human must run it from the CLI). WARNING: disabling all approvers means node9 cannot prompt for human approval \u2014 use with care.",
     inputSchema: {
       type: "object",
       properties: {
@@ -23850,6 +23883,24 @@ function runMcpServer() {
       const p = params ?? {};
       const toolName = p.name;
       const toolArgs = p.arguments ?? {};
+      if (capabilityOf(toolName ?? "") === "weaken") {
+        let allowed = false;
+        try {
+          allowed = getConfig().settings.mcpAllowWeakening === true;
+        } catch {
+          allowed = false;
+        }
+        if (!allowed) {
+          process.stdout.write(
+            err(
+              id,
+              -32e3,
+              `${toolName} weakens node9 and is disabled over MCP. A human must run it from the CLI (e.g. "node9 shield disable <name>"), or set "mcpAllowWeakening": true in ~/.node9/config.json to allow agent-driven weakening.`
+            ) + "\n"
+          );
+          return;
+        }
+      }
       try {
         let text;
         if (toolName === "node9_status") {

package/dist/dashboard.mjs

@@ -2270,6 +2270,10 @@ var init_config_schema = __esm({
         // node9's own approver (terminal/native/cloud). Unset → smart default
         // (ask for ask-capable agents unless a cloud approver is configured).
         reviewChannel: z.enum(["ask", "approver"]).optional(),
+        // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+        // approver_set). Default (unset/false): those tools refuse over MCP — a human
+        // must run them from the CLI. node9's threat model is the agent itself.
+        mcpAllowWeakening: z.boolean().optional(),
         cloudSyncIntervalHours: z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.

package/dist/index.js

@@ -283,6 +283,10 @@ var ConfigFileSchema = import_zod.z.object({
     // node9's own approver (terminal/native/cloud). Unset → smart default
     // (ask for ask-capable agents unless a cloud approver is configured).
     reviewChannel: import_zod.z.enum(["ask", "approver"]).optional(),
+    // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+    // approver_set). Default (unset/false): those tools refuse over MCP — a human
+    // must run them from the CLI. node9's threat model is the agent itself.
+    mcpAllowWeakening: import_zod.z.boolean().optional(),
     cloudSyncIntervalHours: import_zod.z.number().positive().optional(),
     // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
     // to true; set false to fall back to local-only auditing.
@@ -3737,6 +3741,7 @@ function getConfig(cwd) {
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };

package/dist/index.mjs

@@ -253,6 +253,10 @@ var ConfigFileSchema = z.object({
     // node9's own approver (terminal/native/cloud). Unset → smart default
     // (ask for ask-capable agents unless a cloud approver is configured).
     reviewChannel: z.enum(["ask", "approver"]).optional(),
+    // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+    // approver_set). Default (unset/false): those tools refuse over MCP — a human
+    // must run them from the CLI. node9's threat model is the agent itself.
+    mcpAllowWeakening: z.boolean().optional(),
     cloudSyncIntervalHours: z.number().positive().optional(),
     // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
     // to true; set false to fall back to local-only auditing.
@@ -3707,6 +3711,7 @@ function getConfig(cwd) {
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.42.0",
+  "version": "1.43.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",