@node9/proxy 1.46.0 → 1.48.0

package/dist/cli.js

@@ -337,6 +337,11 @@ var init_config_schema = __esm({
         // must run them from the CLI. node9's threat model is the agent itself.
         mcpAllowWeakening: import_zod.z.boolean().optional(),
         cloudSyncIntervalHours: import_zod.z.number().positive().optional(),
+        // Seconds-granular override for the cloud policy sync cadence. Wins over
+        // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
+        // for an incident; clamped to a 15s floor so it can't hammer the API.
+        // Unset → falls back to hours, then the 5h default.
+        cloudSyncIntervalSeconds: import_zod.z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.
         shipper: import_zod.z.object({
@@ -4410,6 +4415,7 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  let cloudManagedShields = [];
   {
     const cacheFile = import_path3.default.join(import_os3.default.homedir(), ".node9", "rules-cache.json");
     try {
@@ -4417,6 +4423,9 @@ function getConfig(cwd) {
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
+      if (Array.isArray(raw.shields)) {
+        cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
+      }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
       }
@@ -4427,7 +4436,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  for (const shieldName of readActiveShields()) {
+  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  for (const shieldName of activeShieldNames) {
     const shield = getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
@@ -16777,6 +16787,11 @@ function buildSessionDeltas(findings, toolCallsBySession) {
     signals
   }));
 }
+function resolveSyncIntervalMs(settings) {
+  const rawSeconds = settings.cloudSyncIntervalSeconds ?? (settings.cloudSyncIntervalHours ?? DEFAULT_INTERVAL_HOURS) * 3600;
+  const clamped = Math.min(Math.max(rawSeconds, MIN_INTERVAL_SECONDS), MAX_INTERVAL_SECONDS);
+  return clamped * 1e3;
+}
 function readCredentials() {
   if (process.env.NODE9_API_KEY) {
     return {
@@ -16872,6 +16887,9 @@ function extractRules(body) {
   if (Array.isArray(body.rules)) return body.rules;
   return [];
 }
+function extractShields(body) {
+  return Array.isArray(body.shields) ? body.shields.filter((s) => typeof s === "string") : [];
+}
 function writeCache2(cache) {
   const dir = import_path31.default.dirname(rulesCacheFile());
   if (!import_fs32.default.existsSync(dir)) import_fs32.default.mkdirSync(dir, { recursive: true });
@@ -16891,7 +16909,8 @@ async function syncOnce() {
         panicMode: result.body.panicMode,
         shadowMode: result.body.shadowMode,
         syncIntervalHours: result.body.syncIntervalHours,
-        workspaceId: result.body.workspaceId
+        workspaceId: result.body.workspaceId,
+        shields: extractShields(result.body)
       };
       writeCache2(cache);
     }
@@ -17063,7 +17082,8 @@ async function runCloudSync() {
       panicMode: result.body.panicMode,
       shadowMode: result.body.shadowMode,
       syncIntervalHours: result.body.syncIntervalHours,
-      workspaceId: result.body.workspaceId
+      workspaceId: result.body.workspaceId,
+      shields: extractShields(result.body)
     };
     writeCache2(cache);
     maybePushBlast();
@@ -17099,9 +17119,7 @@ function getCloudRules() {
   }
 }
 function startCloudSync() {
-  const rawHours = getConfig().settings.cloudSyncIntervalHours ?? DEFAULT_INTERVAL_HOURS;
-  const intervalHours = Math.max(rawHours, MIN_INTERVAL_HOURS);
-  const intervalMs = intervalHours * 60 * 60 * 1e3;
+  const intervalMs = resolveSyncIntervalMs(getConfig().settings);
   const initial = setTimeout(() => void syncOnce(), 3e4);
   initial.unref();
   const recurring = setInterval(() => void syncOnce(), intervalMs);
@@ -17126,7 +17144,7 @@ function startForensicBroadcast() {
   const recurring = setInterval(() => void tick(), FORENSIC_BROADCAST_INTERVAL_MS);
   recurring.unref();
 }
-var import_fs32, import_https4, import_os29, import_path31, FINDING_TO_SIGNAL3, rulesCacheFile, DEFAULT_API_URL, DEFAULT_INTERVAL_HOURS, MIN_INTERVAL_HOURS, FORENSIC_BROADCAST_INTERVAL_MS, FORENSIC_INITIAL_DELAY_MS, forensicBroadcastOffsets;
+var import_fs32, import_https4, import_os29, import_path31, FINDING_TO_SIGNAL3, rulesCacheFile, DEFAULT_API_URL, DEFAULT_INTERVAL_HOURS, MIN_INTERVAL_SECONDS, MAX_INTERVAL_SECONDS, FORENSIC_BROADCAST_INTERVAL_MS, FORENSIC_INITIAL_DELAY_MS, forensicBroadcastOffsets;
 var init_sync = __esm({
   "src/daemon/sync.ts"() {
     "use strict";
@@ -17160,7 +17178,8 @@ var init_sync = __esm({
     rulesCacheFile = () => import_path31.default.join(import_os29.default.homedir(), ".node9", "rules-cache.json");
     DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept/policies/sync";
     DEFAULT_INTERVAL_HOURS = 5;
-    MIN_INTERVAL_HOURS = 1;
+    MIN_INTERVAL_SECONDS = 15;
+    MAX_INTERVAL_SECONDS = 24 * 60 * 60;
     FORENSIC_BROADCAST_INTERVAL_MS = 3e4;
     FORENSIC_INITIAL_DELAY_MS = 5e3;
     forensicBroadcastOffsets = /* @__PURE__ */ new Map();

package/dist/cli.mjs

@@ -315,6 +315,11 @@ var init_config_schema = __esm({
         // must run them from the CLI. node9's threat model is the agent itself.
         mcpAllowWeakening: z.boolean().optional(),
         cloudSyncIntervalHours: z.number().positive().optional(),
+        // Seconds-granular override for the cloud policy sync cadence. Wins over
+        // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
+        // for an incident; clamped to a 15s floor so it can't hammer the API.
+        // Unset → falls back to hours, then the 5h default.
+        cloudSyncIntervalSeconds: z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.
         shipper: z.object({
@@ -4391,6 +4396,7 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  let cloudManagedShields = [];
   {
     const cacheFile = path3.join(os3.homedir(), ".node9", "rules-cache.json");
     try {
@@ -4398,6 +4404,9 @@ function getConfig(cwd) {
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
+      if (Array.isArray(raw.shields)) {
+        cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
+      }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
       }
@@ -4408,7 +4417,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  for (const shieldName of readActiveShields()) {
+  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  for (const shieldName of activeShieldNames) {
     const shield = getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
@@ -16751,6 +16761,11 @@ function buildSessionDeltas(findings, toolCallsBySession) {
     signals
   }));
 }
+function resolveSyncIntervalMs(settings) {
+  const rawSeconds = settings.cloudSyncIntervalSeconds ?? (settings.cloudSyncIntervalHours ?? DEFAULT_INTERVAL_HOURS) * 3600;
+  const clamped = Math.min(Math.max(rawSeconds, MIN_INTERVAL_SECONDS), MAX_INTERVAL_SECONDS);
+  return clamped * 1e3;
+}
 function readCredentials() {
   if (process.env.NODE9_API_KEY) {
     return {
@@ -16846,6 +16861,9 @@ function extractRules(body) {
   if (Array.isArray(body.rules)) return body.rules;
   return [];
 }
+function extractShields(body) {
+  return Array.isArray(body.shields) ? body.shields.filter((s) => typeof s === "string") : [];
+}
 function writeCache2(cache) {
   const dir = path31.dirname(rulesCacheFile());
   if (!fs32.existsSync(dir)) fs32.mkdirSync(dir, { recursive: true });
@@ -16865,7 +16883,8 @@ async function syncOnce() {
         panicMode: result.body.panicMode,
         shadowMode: result.body.shadowMode,
         syncIntervalHours: result.body.syncIntervalHours,
-        workspaceId: result.body.workspaceId
+        workspaceId: result.body.workspaceId,
+        shields: extractShields(result.body)
       };
       writeCache2(cache);
     }
@@ -17037,7 +17056,8 @@ async function runCloudSync() {
       panicMode: result.body.panicMode,
       shadowMode: result.body.shadowMode,
       syncIntervalHours: result.body.syncIntervalHours,
-      workspaceId: result.body.workspaceId
+      workspaceId: result.body.workspaceId,
+      shields: extractShields(result.body)
     };
     writeCache2(cache);
     maybePushBlast();
@@ -17073,9 +17093,7 @@ function getCloudRules() {
   }
 }
 function startCloudSync() {
-  const rawHours = getConfig().settings.cloudSyncIntervalHours ?? DEFAULT_INTERVAL_HOURS;
-  const intervalHours = Math.max(rawHours, MIN_INTERVAL_HOURS);
-  const intervalMs = intervalHours * 60 * 60 * 1e3;
+  const intervalMs = resolveSyncIntervalMs(getConfig().settings);
   const initial = setTimeout(() => void syncOnce(), 3e4);
   initial.unref();
   const recurring = setInterval(() => void syncOnce(), intervalMs);
@@ -17100,7 +17118,7 @@ function startForensicBroadcast() {
   const recurring = setInterval(() => void tick(), FORENSIC_BROADCAST_INTERVAL_MS);
   recurring.unref();
 }
-var FINDING_TO_SIGNAL3, rulesCacheFile, DEFAULT_API_URL, DEFAULT_INTERVAL_HOURS, MIN_INTERVAL_HOURS, FORENSIC_BROADCAST_INTERVAL_MS, FORENSIC_INITIAL_DELAY_MS, forensicBroadcastOffsets;
+var FINDING_TO_SIGNAL3, rulesCacheFile, DEFAULT_API_URL, DEFAULT_INTERVAL_HOURS, MIN_INTERVAL_SECONDS, MAX_INTERVAL_SECONDS, FORENSIC_BROADCAST_INTERVAL_MS, FORENSIC_INITIAL_DELAY_MS, forensicBroadcastOffsets;
 var init_sync = __esm({
   "src/daemon/sync.ts"() {
     "use strict";
@@ -17130,7 +17148,8 @@ var init_sync = __esm({
     rulesCacheFile = () => path31.join(os29.homedir(), ".node9", "rules-cache.json");
     DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept/policies/sync";
     DEFAULT_INTERVAL_HOURS = 5;
-    MIN_INTERVAL_HOURS = 1;
+    MIN_INTERVAL_SECONDS = 15;
+    MAX_INTERVAL_SECONDS = 24 * 60 * 60;
     FORENSIC_BROADCAST_INTERVAL_MS = 3e4;
     FORENSIC_INITIAL_DELAY_MS = 5e3;
     forensicBroadcastOffsets = /* @__PURE__ */ new Map();

package/dist/dashboard.mjs

@@ -2280,6 +2280,11 @@ var init_config_schema = __esm({
         // must run them from the CLI. node9's threat model is the agent itself.
         mcpAllowWeakening: z.boolean().optional(),
         cloudSyncIntervalHours: z.number().positive().optional(),
+        // Seconds-granular override for the cloud policy sync cadence. Wins over
+        // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
+        // for an incident; clamped to a 15s floor so it can't hammer the API.
+        // Unset → falls back to hours, then the 5h default.
+        cloudSyncIntervalSeconds: z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.
         shipper: z.object({

package/dist/index.js

@@ -322,6 +322,11 @@ var ConfigFileSchema = import_zod.z.object({
     // must run them from the CLI. node9's threat model is the agent itself.
     mcpAllowWeakening: import_zod.z.boolean().optional(),
     cloudSyncIntervalHours: import_zod.z.number().positive().optional(),
+    // Seconds-granular override for the cloud policy sync cadence. Wins over
+    // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
+    // for an incident; clamped to a 15s floor so it can't hammer the API.
+    // Unset → falls back to hours, then the 5h default.
+    cloudSyncIntervalSeconds: import_zod.z.number().positive().optional(),
     // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
     // to true; set false to fall back to local-only auditing.
     shipper: import_zod.z.object({
@@ -3942,6 +3947,7 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  let cloudManagedShields = [];
   {
     const cacheFile = import_path3.default.join(import_os3.default.homedir(), ".node9", "rules-cache.json");
     try {
@@ -3949,6 +3955,9 @@ function getConfig(cwd) {
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
+      if (Array.isArray(raw.shields)) {
+        cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
+      }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
       }
@@ -3959,7 +3968,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  for (const shieldName of readActiveShields()) {
+  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  for (const shieldName of activeShieldNames) {
     const shield = getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));

package/dist/index.mjs

@@ -292,6 +292,11 @@ var ConfigFileSchema = z.object({
     // must run them from the CLI. node9's threat model is the agent itself.
     mcpAllowWeakening: z.boolean().optional(),
     cloudSyncIntervalHours: z.number().positive().optional(),
+    // Seconds-granular override for the cloud policy sync cadence. Wins over
+    // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
+    // for an incident; clamped to a 15s floor so it can't hammer the API.
+    // Unset → falls back to hours, then the 5h default.
+    cloudSyncIntervalSeconds: z.number().positive().optional(),
     // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
     // to true; set false to fall back to local-only auditing.
     shipper: z.object({
@@ -3912,6 +3917,7 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  let cloudManagedShields = [];
   {
     const cacheFile = path3.join(os3.homedir(), ".node9", "rules-cache.json");
     try {
@@ -3919,6 +3925,9 @@ function getConfig(cwd) {
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
+      if (Array.isArray(raw.shields)) {
+        cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
+      }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
       }
@@ -3929,7 +3938,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  for (const shieldName of readActiveShields()) {
+  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  for (const shieldName of activeShieldNames) {
     const shield = getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.46.0",
+  "version": "1.48.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",