@node9/proxy 1.47.0 → 1.49.0

package/dist/cli.js

@@ -4216,6 +4216,23 @@ var init_shields = __esm({
   }
 });
 
+// src/config/managed.ts
+function modeRank(mode) {
+  return MODE_ORDER.indexOf(mode);
+}
+function resolveManagedMode(local, cloud, locked) {
+  if (modeRank(cloud) === -1) return local;
+  if (locked) return cloud;
+  return modeRank(local) > modeRank(cloud) ? local : cloud;
+}
+var MODE_ORDER;
+var init_managed = __esm({
+  "src/config/managed.ts"() {
+    "use strict";
+    MODE_ORDER = ["observe", "audit", "standard", "strict"];
+  }
+});
+
 // src/config/index.ts
 function _resetConfigCache() {
   cachedConfig = null;
@@ -4415,6 +4432,7 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  let cloudManagedShields = [];
   {
     const cacheFile = import_path3.default.join(import_os3.default.homedir(), ".node9", "rules-cache.json");
     try {
@@ -4422,6 +4440,16 @@ function getConfig(cwd) {
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
+      if (Array.isArray(raw.shields)) {
+        cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
+      }
+      if (raw.managedConfig && typeof raw.managedConfig === "object") {
+        const mc = raw.managedConfig;
+        if (typeof mc.mode === "string") {
+          const locked = Array.isArray(mc.locked) && mc.locked.includes("mode");
+          mergedSettings.mode = resolveManagedMode(mergedSettings.mode, mc.mode, locked);
+        }
+      }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
       }
@@ -4432,7 +4460,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  for (const shieldName of readActiveShields()) {
+  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  for (const shieldName of activeShieldNames) {
     const shield = getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
@@ -4532,6 +4561,7 @@ var init_config = __esm({
     import_os3 = __toESM(require("os"));
     init_config_schema();
     init_shields();
+    init_managed();
     DANGEROUS_WORDS = [
       "mkfs",
       // formats/wipes a filesystem partition
@@ -16882,6 +16912,18 @@ function extractRules(body) {
   if (Array.isArray(body.rules)) return body.rules;
   return [];
 }
+function extractShields(body) {
+  return Array.isArray(body.shields) ? body.shields.filter((s) => typeof s === "string") : [];
+}
+function extractManagedConfig(body) {
+  const mc = body.managedConfig;
+  if (!mc || typeof mc !== "object") return void 0;
+  const out = {
+    locked: Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : []
+  };
+  if (typeof mc.mode === "string") out.mode = mc.mode;
+  return out.mode !== void 0 ? out : void 0;
+}
 function writeCache2(cache) {
   const dir = import_path31.default.dirname(rulesCacheFile());
   if (!import_fs32.default.existsSync(dir)) import_fs32.default.mkdirSync(dir, { recursive: true });
@@ -16901,7 +16943,9 @@ async function syncOnce() {
         panicMode: result.body.panicMode,
         shadowMode: result.body.shadowMode,
         syncIntervalHours: result.body.syncIntervalHours,
-        workspaceId: result.body.workspaceId
+        workspaceId: result.body.workspaceId,
+        shields: extractShields(result.body),
+        managedConfig: extractManagedConfig(result.body)
       };
       writeCache2(cache);
     }
@@ -17073,7 +17117,9 @@ async function runCloudSync() {
       panicMode: result.body.panicMode,
       shadowMode: result.body.shadowMode,
       syncIntervalHours: result.body.syncIntervalHours,
-      workspaceId: result.body.workspaceId
+      workspaceId: result.body.workspaceId,
+      shields: extractShields(result.body),
+      managedConfig: extractManagedConfig(result.body)
     };
     writeCache2(cache);
     maybePushBlast();

package/dist/cli.mjs

@@ -4194,6 +4194,23 @@ var init_shields = __esm({
   }
 });
 
+// src/config/managed.ts
+function modeRank(mode) {
+  return MODE_ORDER.indexOf(mode);
+}
+function resolveManagedMode(local, cloud, locked) {
+  if (modeRank(cloud) === -1) return local;
+  if (locked) return cloud;
+  return modeRank(local) > modeRank(cloud) ? local : cloud;
+}
+var MODE_ORDER;
+var init_managed = __esm({
+  "src/config/managed.ts"() {
+    "use strict";
+    MODE_ORDER = ["observe", "audit", "standard", "strict"];
+  }
+});
+
 // src/config/index.ts
 import fs3 from "fs";
 import path3 from "path";
@@ -4396,6 +4413,7 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  let cloudManagedShields = [];
   {
     const cacheFile = path3.join(os3.homedir(), ".node9", "rules-cache.json");
     try {
@@ -4403,6 +4421,16 @@ function getConfig(cwd) {
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
+      if (Array.isArray(raw.shields)) {
+        cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
+      }
+      if (raw.managedConfig && typeof raw.managedConfig === "object") {
+        const mc = raw.managedConfig;
+        if (typeof mc.mode === "string") {
+          const locked = Array.isArray(mc.locked) && mc.locked.includes("mode");
+          mergedSettings.mode = resolveManagedMode(mergedSettings.mode, mc.mode, locked);
+        }
+      }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
       }
@@ -4413,7 +4441,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  for (const shieldName of readActiveShields()) {
+  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  for (const shieldName of activeShieldNames) {
     const shield = getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
@@ -4510,6 +4539,7 @@ var init_config = __esm({
     "use strict";
     init_config_schema();
     init_shields();
+    init_managed();
     DANGEROUS_WORDS = [
       "mkfs",
       // formats/wipes a filesystem partition
@@ -16856,6 +16886,18 @@ function extractRules(body) {
   if (Array.isArray(body.rules)) return body.rules;
   return [];
 }
+function extractShields(body) {
+  return Array.isArray(body.shields) ? body.shields.filter((s) => typeof s === "string") : [];
+}
+function extractManagedConfig(body) {
+  const mc = body.managedConfig;
+  if (!mc || typeof mc !== "object") return void 0;
+  const out = {
+    locked: Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : []
+  };
+  if (typeof mc.mode === "string") out.mode = mc.mode;
+  return out.mode !== void 0 ? out : void 0;
+}
 function writeCache2(cache) {
   const dir = path31.dirname(rulesCacheFile());
   if (!fs32.existsSync(dir)) fs32.mkdirSync(dir, { recursive: true });
@@ -16875,7 +16917,9 @@ async function syncOnce() {
         panicMode: result.body.panicMode,
         shadowMode: result.body.shadowMode,
         syncIntervalHours: result.body.syncIntervalHours,
-        workspaceId: result.body.workspaceId
+        workspaceId: result.body.workspaceId,
+        shields: extractShields(result.body),
+        managedConfig: extractManagedConfig(result.body)
       };
       writeCache2(cache);
     }
@@ -17047,7 +17091,9 @@ async function runCloudSync() {
       panicMode: result.body.panicMode,
       shadowMode: result.body.shadowMode,
       syncIntervalHours: result.body.syncIntervalHours,
-      workspaceId: result.body.workspaceId
+      workspaceId: result.body.workspaceId,
+      shields: extractShields(result.body),
+      managedConfig: extractManagedConfig(result.body)
     };
     writeCache2(cache);
     maybePushBlast();

package/dist/dashboard.mjs

@@ -2412,6 +2412,13 @@ var init_shields = __esm({
   }
 });
 
+// src/config/managed.ts
+var init_managed = __esm({
+  "src/config/managed.ts"() {
+    "use strict";
+  }
+});
+
 // src/config/index.ts
 var DANGEROUS_WORDS, DEFAULT_CONFIG;
 var init_config = __esm({
@@ -2419,6 +2426,7 @@ var init_config = __esm({
     "use strict";
     init_config_schema();
     init_shields();
+    init_managed();
     DANGEROUS_WORDS = [
       "mkfs",
       // formats/wipes a filesystem partition

package/dist/index.js

@@ -3501,6 +3501,17 @@ function readShieldOverrides() {
   return readShieldsFile().overrides ?? {};
 }
 
+// src/config/managed.ts
+var MODE_ORDER = ["observe", "audit", "standard", "strict"];
+function modeRank(mode) {
+  return MODE_ORDER.indexOf(mode);
+}
+function resolveManagedMode(local, cloud, locked) {
+  if (modeRank(cloud) === -1) return local;
+  if (locked) return cloud;
+  return modeRank(local) > modeRank(cloud) ? local : cloud;
+}
+
 // src/config/index.ts
 var DANGEROUS_WORDS = [
   "mkfs",
@@ -3947,6 +3958,7 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  let cloudManagedShields = [];
   {
     const cacheFile = import_path3.default.join(import_os3.default.homedir(), ".node9", "rules-cache.json");
     try {
@@ -3954,6 +3966,16 @@ function getConfig(cwd) {
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
+      if (Array.isArray(raw.shields)) {
+        cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
+      }
+      if (raw.managedConfig && typeof raw.managedConfig === "object") {
+        const mc = raw.managedConfig;
+        if (typeof mc.mode === "string") {
+          const locked = Array.isArray(mc.locked) && mc.locked.includes("mode");
+          mergedSettings.mode = resolveManagedMode(mergedSettings.mode, mc.mode, locked);
+        }
+      }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
       }
@@ -3964,7 +3986,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  for (const shieldName of readActiveShields()) {
+  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  for (const shieldName of activeShieldNames) {
     const shield = getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));

package/dist/index.mjs

@@ -3471,6 +3471,17 @@ function readShieldOverrides() {
   return readShieldsFile().overrides ?? {};
 }
 
+// src/config/managed.ts
+var MODE_ORDER = ["observe", "audit", "standard", "strict"];
+function modeRank(mode) {
+  return MODE_ORDER.indexOf(mode);
+}
+function resolveManagedMode(local, cloud, locked) {
+  if (modeRank(cloud) === -1) return local;
+  if (locked) return cloud;
+  return modeRank(local) > modeRank(cloud) ? local : cloud;
+}
+
 // src/config/index.ts
 var DANGEROUS_WORDS = [
   "mkfs",
@@ -3917,6 +3928,7 @@ function getConfig(cwd) {
   };
   applyLayer(globalConfig);
   applyLayer(projectConfig);
+  let cloudManagedShields = [];
   {
     const cacheFile = path3.join(os3.homedir(), ".node9", "rules-cache.json");
     try {
@@ -3924,6 +3936,16 @@ function getConfig(cwd) {
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
+      if (Array.isArray(raw.shields)) {
+        cloudManagedShields = raw.shields.filter((s) => typeof s === "string");
+      }
+      if (raw.managedConfig && typeof raw.managedConfig === "object") {
+        const mc = raw.managedConfig;
+        if (typeof mc.mode === "string") {
+          const locked = Array.isArray(mc.locked) && mc.locked.includes("mode");
+          mergedSettings.mode = resolveManagedMode(mergedSettings.mode, mc.mode, locked);
+        }
+      }
       if (raw.panicMode === true) {
         mergedSettings.panicMode = true;
       }
@@ -3934,7 +3956,8 @@ function getConfig(cwd) {
     }
   }
   const shieldOverrides = readShieldOverrides();
-  for (const shieldName of readActiveShields()) {
+  const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  for (const shieldName of activeShieldNames) {
     const shield = getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.47.0",
+  "version": "1.49.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",