@node9/proxy 1.43.0 → 1.45.0

package/dist/dashboard.mjs

@@ -1264,7 +1264,12 @@ var init_dist = __esm({
       // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
       // raw-regex smart rule is suppressed for bash — its cond1 read a grep
       // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
-      "review-drop-truncate-shell"
+      "review-drop-truncate-shell",
+      // chmod 777 is now owned by the AST detector (analyzeChmod777) so the raw-
+      // regex smart rule is suppressed for bash — it matched `chmod 777` inside a
+      // `node -e` / `python -c` string literal (a detection pattern, not a run
+      // command) → false positive.
+      "shield:filesystem:review-chmod-777"
     ]);
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();

package/dist/index.js

@@ -75,6 +75,7 @@ __export(audit_exports, {
   appendLocalAudit: () => appendLocalAudit,
   appendToLog: () => appendToLog,
   buildArgsPreview: () => buildArgsPreview,
+  filePathFromArgs: () => filePathFromArgs,
   generateEventId: () => generateEventId,
   redactSecrets: () => redactSecrets
 });
@@ -131,6 +132,25 @@ function appendHookDebug(toolName, args, meta, auditHashArgsEnabled) {
     cwd: process.cwd()
   });
 }
+function filePathFromArgs(args) {
+  let obj = args;
+  if (typeof obj === "string") {
+    const t = obj.trim();
+    if (!t.startsWith("{") || !t.endsWith("}")) return void 0;
+    if (!t.includes("file_path") && !t.includes("notebook_path")) return void 0;
+    try {
+      obj = JSON.parse(t);
+    } catch {
+      return void 0;
+    }
+  }
+  if (obj && typeof obj === "object" && !Array.isArray(obj)) {
+    const o = obj;
+    const v = o.file_path ?? o.notebook_path;
+    if (typeof v === "string" && v) return v.slice(0, 1024);
+  }
+  return void 0;
+}
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
   const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern);
   const preview = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
@@ -143,10 +163,19 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   const workingDirField = meta?.workingDir ? { workingDir: meta.workingDir } : {};
   const shell = process.env.SHELL ? import_path.default.basename(process.env.SHELL) : void 0;
   const shellTypeField = shell ? { shellType: shell } : {};
+  const editFilePath = filePathFromArgs(args);
+  const editFilePathField = editFilePath ? { editFilePath } : {};
+  const loopCountField = typeof meta?.loopCount === "number" ? { loopCount: meta.loopCount } : {};
+  const transcriptPathField = meta?.transcriptPath ? { transcriptPath: meta.transcriptPath } : {};
+  const taintFields = meta?.taintFromEid ? {
+    taintFromEid: meta.taintFromEid,
+    ...meta.taintSource && { taintSource: meta.taintSource }
+  } : {};
+  const eid = generateEventId();
   appendToLog(LOCAL_AUDIT_LOG, {
     // eid first: the outbox shipper dedups on it, and a fixed leading field
     // makes the JSONL easy to eyeball.
-    eid: generateEventId(),
+    eid,
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     tool: toolName,
     ...agentToolNameField,
@@ -158,6 +187,10 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     ...cloudLinkField,
     ...workingDirField,
     ...shellTypeField,
+    ...editFilePathField,
+    ...loopCountField,
+    ...transcriptPathField,
+    ...taintFields,
     ...testRun,
     agent: meta?.agent,
     mcpServer: meta?.mcpServer,
@@ -165,6 +198,7 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     hostname: import_os.default.hostname(),
     platform: import_os.default.platform()
   });
+  return eid;
 }
 function appendConfigAudit(entry) {
   appendToLog(LOCAL_AUDIT_LOG, {
@@ -1278,7 +1312,12 @@ var AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
   // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
   // raw-regex smart rule is suppressed for bash — its cond1 read a grep
   // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
-  "review-drop-truncate-shell"
+  "review-drop-truncate-shell",
+  // chmod 777 is now owned by the AST detector (analyzeChmod777) so the raw-
+  // regex smart rule is suppressed for bash — it matched `chmod 777` inside a
+  // `node -e` / `python -c` string literal (a detection pattern, not a run
+  // command) → false positive.
+  "shield:filesystem:review-chmod-777"
 ]);
 var SQL_DB_CLIS = /* @__PURE__ */ new Set([
   "psql",
@@ -1303,6 +1342,62 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
+  "sudo",
+  "doas",
+  "env",
+  "xargs",
+  "time",
+  "nice",
+  "ionice",
+  "nohup",
+  "setsid",
+  "stdbuf",
+  "timeout",
+  "command",
+  "exec"
+]);
+function chmodHasOpenPermMode(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  let found = false;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || found) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+      if (words.length === 0) return true;
+      const name = (words[0] ?? "").toLowerCase();
+      let idx = -1;
+      if (name === "chmod") idx = 0;
+      else if (COMMAND_WRAPPERS.has(name))
+        idx = words.findIndex((w, i) => i > 0 && w?.toLowerCase() === "chmod");
+      if (idx < 0) return true;
+      for (let i = idx + 1; i < words.length; i++) {
+        const w = words[i];
+        if (w !== null && w.startsWith("-")) continue;
+        if (w !== null && CHMOD_OPEN_PERM_TOKENS.has(w.toLowerCase())) found = true;
+        break;
+      }
+      return true;
+    });
+  } catch {
+    return found;
+  }
+  return found;
+}
+function analyzeChmod777(command) {
+  if (!/chmod/i.test(command.replace(/[\\'"]/g, ""))) return null;
+  if (!chmodHasOpenPermMode(command)) return null;
+  return {
+    ruleName: "shield:filesystem:review-chmod-777",
+    verdict: "review",
+    reason: "chmod 777 requires human approval (filesystem shield)",
+    description: "The AI wants to make a file world-writable/executable (chmod 777). This removes the permission protection on the file so any user or process can modify or run it."
+  };
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -2268,6 +2363,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
+    const chmodVerdict = analyzeChmod777(bashCommand);
+    if (chmodVerdict) {
+      return {
+        decision: chmodVerdict.verdict,
+        blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
+        reason: chmodVerdict.reason,
+        tier: 2,
+        ruleName: chmodVerdict.ruleName,
+        ruleDescription: chmodVerdict.description
+      };
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(
@@ -4370,14 +4476,15 @@ async function notifyDaemonViewer(toolName, args, meta, riskMetadata, activityId
   const { id, allowCount } = await res.json();
   return { id, allowCount: allowCount ?? 1 };
 }
-async function notifyTaint(filePath, source) {
+async function notifyTaint(filePath, source, fromEid) {
   if (!isDaemonRunning()) return;
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
     await fetch(`${base}/taint`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ path: filePath, source }),
+      // Phase D2 — fromEid is the audit eid that created this taint (edge source).
+      body: JSON.stringify({ path: filePath, source, ...fromEid && { fromEid } }),
       signal: AbortSignal.timeout(1e3)
     });
   } catch {
@@ -5065,7 +5172,11 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     if (filePaths.length > 0) {
       const taintResult = await checkTaint(filePaths);
       if (taintResult.tainted && taintResult.record) {
-        const { path: taintedPath, source: taintSource } = taintResult.record;
+        const {
+          path: taintedPath,
+          source: taintSource,
+          fromEid: taintFromEid
+        } = taintResult.record;
         taintWarning = `\u26A0\uFE0F ${taintedPath} was flagged by ${taintSource} \u2014 this file may contain sensitive data`;
         if (config.policy.egress?.enabled) {
           const a = args && typeof args === "object" && !Array.isArray(args) ? args : {};
@@ -5079,7 +5190,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
                 args,
                 "deny",
                 isObserveMode ? "observe-mode-taint-egress-would-block" : "taint-egress-block",
-                { ...meta, ruleName: `taint-egress:${eg.host}` },
+                // Phase D2 — the causal taint edge: from the row that created
+                // the taint (taintFromEid) to this block row.
+                { ...meta, ruleName: `taint-egress:${eg.host}`, taintFromEid, taintSource },
                 hashAuditArgs
               );
             if (isObserveMode) {
@@ -5116,8 +5229,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
       if (dlpMatch.severity === "block") {
+        let dlpEid;
         if (!isManual)
-          appendLocalAudit(
+          dlpEid = appendLocalAudit(
             toolName,
             args,
             "deny",
@@ -5130,7 +5244,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
             true
           );
         if (isWriteTool(toolName) && filePath) {
-          await notifyTaint(filePath, `DLP:${dlpMatch.patternName}`);
+          await notifyTaint(filePath, `DLP:${dlpMatch.patternName}`, dlpEid);
         }
         if (isObserveMode) {
           return {
@@ -5222,7 +5336,15 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;
         if (!isManual)
-          appendLocalAudit(toolName, args, "deny", "loop-detected", meta, hashAuditArgs);
+          appendLocalAudit(
+            toolName,
+            args,
+            "deny",
+            "loop-detected",
+            // Phase B — carry the loop magnitude so the SaaS shows "looped Nx".
+            { ...meta, loopCount: loopResult.count },
+            hashAuditArgs
+          );
         return {
           approved: false,
           reason,

package/dist/index.mjs

@@ -52,6 +52,7 @@ __export(audit_exports, {
   appendLocalAudit: () => appendLocalAudit,
   appendToLog: () => appendToLog,
   buildArgsPreview: () => buildArgsPreview,
+  filePathFromArgs: () => filePathFromArgs,
   generateEventId: () => generateEventId,
   redactSecrets: () => redactSecrets
 });
@@ -112,6 +113,25 @@ function appendHookDebug(toolName, args, meta, auditHashArgsEnabled) {
     cwd: process.cwd()
   });
 }
+function filePathFromArgs(args) {
+  let obj = args;
+  if (typeof obj === "string") {
+    const t = obj.trim();
+    if (!t.startsWith("{") || !t.endsWith("}")) return void 0;
+    if (!t.includes("file_path") && !t.includes("notebook_path")) return void 0;
+    try {
+      obj = JSON.parse(t);
+    } catch {
+      return void 0;
+    }
+  }
+  if (obj && typeof obj === "object" && !Array.isArray(obj)) {
+    const o = obj;
+    const v = o.file_path ?? o.notebook_path;
+    if (typeof v === "string" && v) return v.slice(0, 1024);
+  }
+  return void 0;
+}
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
   const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern);
   const preview = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
@@ -124,10 +144,19 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   const workingDirField = meta?.workingDir ? { workingDir: meta.workingDir } : {};
   const shell = process.env.SHELL ? path.basename(process.env.SHELL) : void 0;
   const shellTypeField = shell ? { shellType: shell } : {};
+  const editFilePath = filePathFromArgs(args);
+  const editFilePathField = editFilePath ? { editFilePath } : {};
+  const loopCountField = typeof meta?.loopCount === "number" ? { loopCount: meta.loopCount } : {};
+  const transcriptPathField = meta?.transcriptPath ? { transcriptPath: meta.transcriptPath } : {};
+  const taintFields = meta?.taintFromEid ? {
+    taintFromEid: meta.taintFromEid,
+    ...meta.taintSource && { taintSource: meta.taintSource }
+  } : {};
+  const eid = generateEventId();
   appendToLog(LOCAL_AUDIT_LOG, {
     // eid first: the outbox shipper dedups on it, and a fixed leading field
     // makes the JSONL easy to eyeball.
-    eid: generateEventId(),
+    eid,
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     tool: toolName,
     ...agentToolNameField,
@@ -139,6 +168,10 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     ...cloudLinkField,
     ...workingDirField,
     ...shellTypeField,
+    ...editFilePathField,
+    ...loopCountField,
+    ...transcriptPathField,
+    ...taintFields,
     ...testRun,
     agent: meta?.agent,
     mcpServer: meta?.mcpServer,
@@ -146,6 +179,7 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     hostname: os.hostname(),
     platform: os.platform()
   });
+  return eid;
 }
 function appendConfigAudit(entry) {
   appendToLog(LOCAL_AUDIT_LOG, {
@@ -1248,7 +1282,12 @@ var AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
   // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
   // raw-regex smart rule is suppressed for bash — its cond1 read a grep
   // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
-  "review-drop-truncate-shell"
+  "review-drop-truncate-shell",
+  // chmod 777 is now owned by the AST detector (analyzeChmod777) so the raw-
+  // regex smart rule is suppressed for bash — it matched `chmod 777` inside a
+  // `node -e` / `python -c` string literal (a detection pattern, not a run
+  // command) → false positive.
+  "shield:filesystem:review-chmod-777"
 ]);
 var SQL_DB_CLIS = /* @__PURE__ */ new Set([
   "psql",
@@ -1273,6 +1312,62 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
+  "sudo",
+  "doas",
+  "env",
+  "xargs",
+  "time",
+  "nice",
+  "ionice",
+  "nohup",
+  "setsid",
+  "stdbuf",
+  "timeout",
+  "command",
+  "exec"
+]);
+function chmodHasOpenPermMode(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  let found = false;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || found) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+      if (words.length === 0) return true;
+      const name = (words[0] ?? "").toLowerCase();
+      let idx = -1;
+      if (name === "chmod") idx = 0;
+      else if (COMMAND_WRAPPERS.has(name))
+        idx = words.findIndex((w, i) => i > 0 && w?.toLowerCase() === "chmod");
+      if (idx < 0) return true;
+      for (let i = idx + 1; i < words.length; i++) {
+        const w = words[i];
+        if (w !== null && w.startsWith("-")) continue;
+        if (w !== null && CHMOD_OPEN_PERM_TOKENS.has(w.toLowerCase())) found = true;
+        break;
+      }
+      return true;
+    });
+  } catch {
+    return found;
+  }
+  return found;
+}
+function analyzeChmod777(command) {
+  if (!/chmod/i.test(command.replace(/[\\'"]/g, ""))) return null;
+  if (!chmodHasOpenPermMode(command)) return null;
+  return {
+    ruleName: "shield:filesystem:review-chmod-777",
+    verdict: "review",
+    reason: "chmod 777 requires human approval (filesystem shield)",
+    description: "The AI wants to make a file world-writable/executable (chmod 777). This removes the permission protection on the file so any user or process can modify or run it."
+  };
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -2238,6 +2333,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
+    const chmodVerdict = analyzeChmod777(bashCommand);
+    if (chmodVerdict) {
+      return {
+        decision: chmodVerdict.verdict,
+        blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
+        reason: chmodVerdict.reason,
+        tier: 2,
+        ruleName: chmodVerdict.ruleName,
+        ruleDescription: chmodVerdict.description
+      };
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(
@@ -4340,14 +4446,15 @@ async function notifyDaemonViewer(toolName, args, meta, riskMetadata, activityId
   const { id, allowCount } = await res.json();
   return { id, allowCount: allowCount ?? 1 };
 }
-async function notifyTaint(filePath, source) {
+async function notifyTaint(filePath, source, fromEid) {
   if (!isDaemonRunning()) return;
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
     await fetch(`${base}/taint`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ path: filePath, source }),
+      // Phase D2 — fromEid is the audit eid that created this taint (edge source).
+      body: JSON.stringify({ path: filePath, source, ...fromEid && { fromEid } }),
       signal: AbortSignal.timeout(1e3)
     });
   } catch {
@@ -5035,7 +5142,11 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     if (filePaths.length > 0) {
       const taintResult = await checkTaint(filePaths);
       if (taintResult.tainted && taintResult.record) {
-        const { path: taintedPath, source: taintSource } = taintResult.record;
+        const {
+          path: taintedPath,
+          source: taintSource,
+          fromEid: taintFromEid
+        } = taintResult.record;
         taintWarning = `\u26A0\uFE0F ${taintedPath} was flagged by ${taintSource} \u2014 this file may contain sensitive data`;
         if (config.policy.egress?.enabled) {
           const a = args && typeof args === "object" && !Array.isArray(args) ? args : {};
@@ -5049,7 +5160,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
                 args,
                 "deny",
                 isObserveMode ? "observe-mode-taint-egress-would-block" : "taint-egress-block",
-                { ...meta, ruleName: `taint-egress:${eg.host}` },
+                // Phase D2 — the causal taint edge: from the row that created
+                // the taint (taintFromEid) to this block row.
+                { ...meta, ruleName: `taint-egress:${eg.host}`, taintFromEid, taintSource },
                 hashAuditArgs
               );
             if (isObserveMode) {
@@ -5086,8 +5199,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
       if (dlpMatch.severity === "block") {
+        let dlpEid;
         if (!isManual)
-          appendLocalAudit(
+          dlpEid = appendLocalAudit(
             toolName,
             args,
             "deny",
@@ -5100,7 +5214,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
             true
           );
         if (isWriteTool(toolName) && filePath) {
-          await notifyTaint(filePath, `DLP:${dlpMatch.patternName}`);
+          await notifyTaint(filePath, `DLP:${dlpMatch.patternName}`, dlpEid);
         }
         if (isObserveMode) {
           return {
@@ -5192,7 +5306,15 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       if (loopResult.looping) {
         const reason = `It looks like you've called "${toolName}" ${loopResult.count} times with identical arguments in the last ${ld.windowSeconds}s. Are you stuck? Step back and reconsider your approach \u2014 what are you actually trying to accomplish, and is there a different way to get there?`;
         if (!isManual)
-          appendLocalAudit(toolName, args, "deny", "loop-detected", meta, hashAuditArgs);
+          appendLocalAudit(
+            toolName,
+            args,
+            "deny",
+            "loop-detected",
+            // Phase B — carry the loop magnitude so the SaaS shows "looped Nx".
+            { ...meta, loopCount: loopResult.count },
+            hashAuditArgs
+          );
         return {
           approved: false,
           reason,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",