@node9/proxy 1.55.1 → 1.56.0

package/dist/dashboard.mjs

@@ -547,9 +547,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path10) {
+function getNestedValue(obj, path11) {
   if (!obj || typeof obj !== "object") return null;
-  const segments = path10.split(".");
+  const segments = path11.split(".");
   for (const seg of segments) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -2279,6 +2279,10 @@ var init_config_schema = __esm({
         // approver_set). Default (unset/false): those tools refuse over MCP — a human
         // must run them from the CLI. node9's threat model is the agent itself.
         mcpAllowWeakening: z.boolean().optional(),
+        // Auto-wire reconciler (P3 2.6): auto-wrap new ungoverned MCP servers vs
+        // nudge-only (default), and the scan cadence in minutes.
+        mcpAutoWrap: z.boolean().optional(),
+        mcpReconcileIntervalMinutes: z.number().positive().optional(),
         cloudSyncIntervalHours: z.number().positive().optional(),
         // Seconds-granular override for the cloud policy sync cadence. Wins over
         // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
@@ -2419,6 +2423,20 @@ var init_managed = __esm({
   }
 });
 
+// src/shields/build.ts
+var init_build = __esm({
+  "src/shields/build.ts"() {
+    "use strict";
+  }
+});
+
+// src/auth/trusted-hosts.ts
+var init_trusted_hosts = __esm({
+  "src/auth/trusted-hosts.ts"() {
+    "use strict";
+  }
+});
+
 // src/config/index.ts
 var DANGEROUS_WORDS, DEFAULT_CONFIG;
 var init_config = __esm({
@@ -2427,6 +2445,8 @@ var init_config = __esm({
     init_config_schema();
     init_shields();
     init_managed();
+    init_build();
+    init_trusted_hosts();
     DANGEROUS_WORDS = [
       "mkfs",
       // formats/wipes a filesystem partition
@@ -2635,7 +2655,10 @@ var init_config = __esm({
         egress: { enabled: false, mode: "review", allow: [], deny: [], allowPrivate: true },
         loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
         injectionScan: { enabled: false, minConfidence: "medium", allow: [] },
-        skillPinning: { enabled: false, mode: "warn", roots: [] }
+        skillPinning: { enabled: false, mode: "warn", roots: [] },
+        trustedHosts: [],
+        trustedHostsManaged: false,
+        appPermissions: {}
       },
       environments: {}
     };
@@ -3624,13 +3647,6 @@ var init_provenance = __esm({
   }
 });
 
-// src/auth/trusted-hosts.ts
-var init_trusted_hosts = __esm({
-  "src/auth/trusted-hosts.ts"() {
-    "use strict";
-  }
-});
-
 // src/policy/index.ts
 import pm2 from "picomatch";
 var init_policy = __esm({
@@ -3669,6 +3685,18 @@ var init_mcp_pin = __esm({
   }
 });
 
+// src/daemon/hook-baseline.ts
+import path8 from "path";
+import os8 from "os";
+var BASELINE_FILE, NOTIFIED_FILE;
+var init_hook_baseline = __esm({
+  "src/daemon/hook-baseline.ts"() {
+    "use strict";
+    BASELINE_FILE = path8.join(os8.homedir(), ".node9", "hooks-baseline.json");
+    NOTIFIED_FILE = path8.join(os8.homedir(), ".node9", "hook-heal-notified.json");
+  }
+});
+
 // src/setup-opencode-shim.ts
 var init_setup_opencode_shim = __esm({
   "src/setup-opencode-shim.ts"() {
@@ -3692,6 +3720,7 @@ var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
     init_mcp_pin();
+    init_hook_baseline();
     init_setup_opencode_shim();
     init_setup_pi_shim();
   }
@@ -3724,8 +3753,8 @@ var init_scan_history = __esm({
 // src/cli/commands/scan.ts
 import chalk4 from "chalk";
 import fs6 from "fs";
-import path8 from "path";
-import os8 from "os";
+import path9 from "path";
+import os9 from "os";
 import stringWidth2 from "string-width";
 function claudeModelPrice2(model) {
   const t = pricingFor(model);
@@ -3874,7 +3903,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   const sessionId = file.replace(/\.jsonl$/, "");
   let raw;
   try {
-    raw = fs6.readFileSync(path8.join(projPath, file), "utf-8");
+    raw = fs6.readFileSync(path9.join(projPath, file), "utf-8");
   } catch {
     return;
   }
@@ -3926,7 +3955,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
           if (block.type !== "tool_result") continue;
           const filePath = block.tool_use_id ? toolUseFilePaths.get(block.tool_use_id) : void 0;
           if (filePath) {
-            const ext = path8.extname(filePath).toLowerCase();
+            const ext = path9.extname(filePath).toLowerCase();
             if (CODE_EXTENSIONS.has(ext)) continue;
           }
           const resultText = typeof block.content === "string" ? block.content : Array.isArray(block.content) ? block.content.map((c) => c.text ?? "").join("\n") : null;
@@ -3983,7 +4012,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
       const rawCmd = String(input.command ?? "").trimStart();
       if (/^node9\s+(scan|explain|report|tail|dlp|status|sessions|audit)\b/.test(rawCmd)) continue;
       const inputFilePath = typeof input.file_path === "string" ? input.file_path : "";
-      const inputFileExt = inputFilePath ? path8.extname(inputFilePath).toLowerCase() : "";
+      const inputFileExt = inputFilePath ? path9.extname(inputFilePath).toLowerCase() : "";
       if (CODE_EXTENSIONS.has(inputFileExt)) continue;
       const dlpMatch = scanArgs(input);
       if (dlpMatch) {
@@ -4080,13 +4109,13 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   }
 }
 async function processClaudeProjectAsync(proj, projectsDir, ruleSources, startDate, result, dedup, onProgress, onLine) {
-  const projPath = path8.join(projectsDir, proj);
+  const projPath = path9.join(projectsDir, proj);
   try {
     if (!fs6.statSync(projPath).isDirectory()) return;
   } catch {
     return;
   }
-  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os8.homedir(), "~")).slice(
+  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os9.homedir(), "~")).slice(
     0,
     40
   );
@@ -4130,7 +4159,7 @@ function emptyClaudeScan() {
   };
 }
 async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
-  const projectsDir = path8.join(os8.homedir(), ".claude", "projects");
+  const projectsDir = path9.join(os9.homedir(), ".claude", "projects");
   const result = emptyClaudeScan();
   if (!fs6.existsSync(projectsDir)) return result;
   let projDirs;
@@ -4156,7 +4185,7 @@ async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
   return result;
 }
 function scanGeminiHistory(startDate, onProgress, onLine) {
-  const tmpDir = path8.join(os8.homedir(), ".gemini", "tmp");
+  const tmpDir = path9.join(os9.homedir(), ".gemini", "tmp");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -4180,7 +4209,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
   }
   const ruleSources = buildRuleSources();
   for (const slug of slugDirs) {
-    const slugPath = path8.join(tmpDir, slug);
+    const slugPath = path9.join(tmpDir, slug);
     try {
       if (!fs6.statSync(slugPath).isDirectory()) continue;
     } catch {
@@ -4189,11 +4218,11 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     let projLabel = stripTerminalEscapes(slug).slice(0, 40);
     try {
       projLabel = stripTerminalEscapes(
-        fs6.readFileSync(path8.join(slugPath, ".project_root"), "utf-8").trim()
-      ).replace(os8.homedir(), "~").slice(0, 40);
+        fs6.readFileSync(path9.join(slugPath, ".project_root"), "utf-8").trim()
+      ).replace(os9.homedir(), "~").slice(0, 40);
     } catch {
     }
-    const chatsDir = path8.join(slugPath, "chats");
+    const chatsDir = path9.join(slugPath, "chats");
     if (!fs6.existsSync(chatsDir)) continue;
     let chatFiles;
     try {
@@ -4210,7 +4239,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
       onProgress?.(result.filesScanned);
       let raw;
       try {
-        raw = fs6.readFileSync(path8.join(chatsDir, chatFile), "utf-8");
+        raw = fs6.readFileSync(path9.join(chatsDir, chatFile), "utf-8");
       } catch {
         continue;
       }
@@ -4383,7 +4412,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
   return result;
 }
 function scanCodexHistory(startDate, onProgress, onLine) {
-  const sessionsBase = path8.join(os8.homedir(), ".codex", "sessions");
+  const sessionsBase = path9.join(os9.homedir(), ".codex", "sessions");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -4402,28 +4431,28 @@ function scanCodexHistory(startDate, onProgress, onLine) {
   const jsonlFiles = [];
   try {
     for (const year of fs6.readdirSync(sessionsBase)) {
-      const yearPath = path8.join(sessionsBase, year);
+      const yearPath = path9.join(sessionsBase, year);
       try {
         if (!fs6.statSync(yearPath).isDirectory()) continue;
       } catch {
         continue;
       }
       for (const month of fs6.readdirSync(yearPath)) {
-        const monthPath = path8.join(yearPath, month);
+        const monthPath = path9.join(yearPath, month);
         try {
           if (!fs6.statSync(monthPath).isDirectory()) continue;
         } catch {
           continue;
         }
         for (const day of fs6.readdirSync(monthPath)) {
-          const dayPath = path8.join(monthPath, day);
+          const dayPath = path9.join(monthPath, day);
           try {
             if (!fs6.statSync(dayPath).isDirectory()) continue;
           } catch {
             continue;
           }
           for (const file of fs6.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(path8.join(dayPath, file));
+            if (file.endsWith(".jsonl")) jsonlFiles.push(path9.join(dayPath, file));
           }
         }
       }
@@ -4464,7 +4493,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         sessionId = String(payload["id"] ?? filePath);
         startTime = String(payload["timestamp"] ?? "");
         const cwd = String(payload["cwd"] ?? "");
-        projLabel = stripTerminalEscapes(cwd.replace(os8.homedir(), "~")).slice(0, 40);
+        projLabel = stripTerminalEscapes(cwd.replace(os9.homedir(), "~")).slice(0, 40);
         continue;
       }
       if (entry.type === "turn_context" && typeof payload["model"] === "string") {
@@ -4707,11 +4736,11 @@ var init_scan = __esm({
 
 // src/tui/dashboard/data.ts
 import fs7 from "fs";
-import os9 from "os";
-import path9 from "path";
+import os10 from "os";
+import path10 from "path";
 import http from "http";
 function auditLogPath() {
-  return path9.join(os9.homedir(), ".node9", "audit.log");
+  return path10.join(os10.homedir(), ".node9", "audit.log");
 }
 function readAuditEntriesAsync(chunkSize = 1e3, customPath) {
   return new Promise((resolve) => {
@@ -4851,13 +4880,13 @@ function loadBlast() {
   }
 }
 function shortenPath(p) {
-  const home = os9.homedir();
+  const home = os10.homedir();
   return p.startsWith(home) ? p.replace(home, "~") : p;
 }
 async function loadReportAuditAsync(period) {
-  const claudeProjectsDir = path9.join(os9.homedir(), ".claude", "projects");
-  const codexSessionsDir = path9.join(os9.homedir(), ".codex", "sessions");
-  const geminiTmpDir = path9.join(os9.homedir(), ".gemini", "tmp");
+  const claudeProjectsDir = path10.join(os10.homedir(), ".claude", "projects");
+  const codexSessionsDir = path10.join(os10.homedir(), ".codex", "sessions");
+  const geminiTmpDir = path10.join(os10.homedir(), ".gemini", "tmp");
   const { start, end } = getDateRange(period, /* @__PURE__ */ new Date());
   const entries = await readAuditEntriesAsync();
   void ensurePricingLoaded();
@@ -5963,8 +5992,8 @@ import { Fragment as Fragment3, jsx as jsx4, jsxs as jsxs4 } from "react/jsx-run
 function TopToolsProjects({ audit }) {
   const data = audit?.data;
   const tools = data ? [...data.toolMap.entries()].sort(([, a], [, b]) => b.calls - a.calls).slice(0, ROW_LIMIT) : [];
-  const projects = data ? [...data.cost.byProject.entries()].map(([path10, r]) => ({
-    name: basenameOf(path10),
+  const projects = data ? [...data.cost.byProject.entries()].map(([path11, r]) => ({
+    name: basenameOf(path11),
     cost: r.cost,
     tokens: r.inputTokens + r.outputTokens
   })).sort((a, b) => b.cost - a.cost).slice(0, ROW_LIMIT) : [];
@@ -6401,8 +6430,8 @@ function pickTopLoopFile(loops) {
     map.set(k, (map.get(k) ?? 0) + (l.count ?? 0));
   }
   if (map.size === 0) return void 0;
-  const [path10, count] = [...map.entries()].sort((a, b) => b[1] - a[1])[0];
-  return { path: path10, count };
+  const [path11, count] = [...map.entries()].sort((a, b) => b[1] - a[1])[0];
+  return { path: path11, count };
 }
 var EMPTY_FILTERED_SCAN;
 var init_derive = __esm({