@node9/proxy 1.56.0 → 1.57.0

package/dist/cli.js

@@ -16908,7 +16908,7 @@ function deriveHeadline(allFindings) {
   }
   let action;
   if (notWired) {
-    action = "Run `node9 init` \u2014 node9 is not in-path yet, so nothing here is enforced.";
+    action = "Install node9 and put it in-path: `npm i -g node9-ai && node9 init` \u2014 nothing here is enforced until you do.";
   } else if (observeOnly) {
     action = "Switch node9 to enforcing mode \u2014 right now it is only watching, not blocking.";
   } else if (egressOpen) {
@@ -17039,7 +17039,10 @@ async function runPosture(opts = {}) {
     passedCategories,
     erroredCategories
   } = await runChecks(POSTURE_CHECKS, ctx);
-  await annotateCoverage(rawFindings, ctx);
+  try {
+    await annotateCoverage(rawFindings, ctx);
+  } catch {
+  }
   const findings = dropEnforcementRedundant(rawFindings);
   const { score, tier } = scorePosture(findings, POSTURE_CHECKS.length);
   return {
@@ -17493,8 +17496,21 @@ function resolveEntryStatus(e, tools, env, now) {
   if (e.state === "node9-self") return { ...base, connection: "node9-self" };
   if (e.state === "remote") return { ...base, connection: "remote" };
   if (e.state === "ungoverned") return { ...base, connection: "ungoverned" };
+  const connectedRow = (serverKey2, connected2) => {
+    const lastSeenAt = connected2.lastSeenAt;
+    const stale = typeof lastSeenAt === "number" && now - lastSeenAt > STALE_MS;
+    return {
+      ...base,
+      connection: stale ? "stale" : "connected",
+      lastSeenAt,
+      connectedTools: connected2.tools.length,
+      serverKey: serverKey2
+    };
+  };
   const upstream = upstreamOf(e);
   if (!upstream) return { ...base, connection: "pending-launch" };
+  const stamped = Object.entries(tools).find(([, cfg]) => cfg.name === e.name);
+  if (stamped) return connectedRow(stamped[0], stamped[1]);
   const { resolved, missing } = substituteEnv(upstream, env);
   if (missing.length > 0) {
     return { ...base, connection: "unlaunchable", missingEnv: missing };
@@ -17502,15 +17518,7 @@ function resolveEntryStatus(e, tools, env, now) {
   const serverKey = getServerKey(resolved);
   const connected = tools[serverKey];
   if (!connected) return { ...base, connection: "pending-launch", serverKey };
-  const lastSeenAt = connected.lastSeenAt;
-  const stale = typeof lastSeenAt === "number" && now - lastSeenAt > STALE_MS;
-  return {
-    ...base,
-    connection: stale ? "stale" : "connected",
-    lastSeenAt,
-    connectedTools: connected.tools.length,
-    serverKey
-  };
+  return connectedRow(serverKey, connected);
 }
 function resolveMcpStatus(home, env = process.env, now = Date.now()) {
   const tools = readMcpToolsConfig();
@@ -18585,9 +18593,30 @@ function reportToCloud(e, autoWrapped, creds) {
 }
 function runMcpReconcile() {
   const autoWrap = getConfig().settings.mcpAutoWrap === true;
+  const inv = inventoryMcp();
+  for (const e of inv) {
+    if (e.state !== "gatewayed" || e.format === "toml") continue;
+    if (e.args.includes("--config-name")) continue;
+    const orig = fromGateway(e.raw);
+    if (!orig) continue;
+    try {
+      writeMcpEntry(e.mcpFile, e.format, e.name, toGateway(orig, e.name));
+      appendToLog(HOOK_DEBUG_LOG, {
+        event: "mcp-config-name-refreshed",
+        agent: e.agent,
+        name: e.name
+      });
+    } catch (err2) {
+      appendToLog(HOOK_DEBUG_LOG, {
+        event: "mcp-config-name-refresh-failed",
+        name: e.name,
+        error: err2?.message
+      });
+    }
+  }
   const baseline = loadBaseline();
   const creds = getCredentials();
-  const fresh = inventoryMcp().filter((e) => e.state === "ungoverned" && !baseline.has(idKey(e)));
+  const fresh = inv.filter((e) => e.state === "ungoverned" && !baseline.has(idKey(e)));
   if (fresh.length === 0) return;
   const wrappedAgents = /* @__PURE__ */ new Set();
   let wrappedCount = 0;
@@ -18659,6 +18688,7 @@ var init_mcp_reconciler = __esm({
     init_native();
     init_config();
     init_cloud();
+    init_audit();
     BASELINE_FILE2 = import_path36.default.join(import_os35.default.homedir(), ".node9", "mcp-baseline.json");
     BASELINE_CAP = 500;
     DEFAULT_INTERVAL_MIN = 60;
@@ -21571,6 +21601,7 @@ var import_child_process7 = require("child_process");
 var import_path43 = __toESM(require("path"));
 var import_os41 = __toESM(require("os"));
 init_orchestrator();
+init_state();
 init_daemon();
 init_config();
 init_policy();
@@ -22289,6 +22320,7 @@ RAW: ${raw}
             }
           }
           if (!prompt) process.exit(0);
+          if (process.env.NODE9_PAUSED === "1" || checkPause().paused) process.exit(0);
           const dlpMatch = scanArgs({ prompt });
           if (!dlpMatch) process.exit(0);
           const agent2 = agentOverride ?? detectAiAgent(payload);

package/dist/cli.mjs

@@ -16880,7 +16880,7 @@ function deriveHeadline(allFindings) {
   }
   let action;
   if (notWired) {
-    action = "Run `node9 init` \u2014 node9 is not in-path yet, so nothing here is enforced.";
+    action = "Install node9 and put it in-path: `npm i -g node9-ai && node9 init` \u2014 nothing here is enforced until you do.";
   } else if (observeOnly) {
     action = "Switch node9 to enforcing mode \u2014 right now it is only watching, not blocking.";
   } else if (egressOpen) {
@@ -17012,7 +17012,10 @@ async function runPosture(opts = {}) {
     passedCategories,
     erroredCategories
   } = await runChecks(POSTURE_CHECKS, ctx);
-  await annotateCoverage(rawFindings, ctx);
+  try {
+    await annotateCoverage(rawFindings, ctx);
+  } catch {
+  }
   const findings = dropEnforcementRedundant(rawFindings);
   const { score, tier } = scorePosture(findings, POSTURE_CHECKS.length);
   return {
@@ -17462,8 +17465,21 @@ function resolveEntryStatus(e, tools, env, now) {
   if (e.state === "node9-self") return { ...base, connection: "node9-self" };
   if (e.state === "remote") return { ...base, connection: "remote" };
   if (e.state === "ungoverned") return { ...base, connection: "ungoverned" };
+  const connectedRow = (serverKey2, connected2) => {
+    const lastSeenAt = connected2.lastSeenAt;
+    const stale = typeof lastSeenAt === "number" && now - lastSeenAt > STALE_MS;
+    return {
+      ...base,
+      connection: stale ? "stale" : "connected",
+      lastSeenAt,
+      connectedTools: connected2.tools.length,
+      serverKey: serverKey2
+    };
+  };
   const upstream = upstreamOf(e);
   if (!upstream) return { ...base, connection: "pending-launch" };
+  const stamped = Object.entries(tools).find(([, cfg]) => cfg.name === e.name);
+  if (stamped) return connectedRow(stamped[0], stamped[1]);
   const { resolved, missing } = substituteEnv(upstream, env);
   if (missing.length > 0) {
     return { ...base, connection: "unlaunchable", missingEnv: missing };
@@ -17471,15 +17487,7 @@ function resolveEntryStatus(e, tools, env, now) {
   const serverKey = getServerKey(resolved);
   const connected = tools[serverKey];
   if (!connected) return { ...base, connection: "pending-launch", serverKey };
-  const lastSeenAt = connected.lastSeenAt;
-  const stale = typeof lastSeenAt === "number" && now - lastSeenAt > STALE_MS;
-  return {
-    ...base,
-    connection: stale ? "stale" : "connected",
-    lastSeenAt,
-    connectedTools: connected.tools.length,
-    serverKey
-  };
+  return connectedRow(serverKey, connected);
 }
 function resolveMcpStatus(home, env = process.env, now = Date.now()) {
   const tools = readMcpToolsConfig();
@@ -18557,9 +18565,30 @@ function reportToCloud(e, autoWrapped, creds) {
 }
 function runMcpReconcile() {
   const autoWrap = getConfig().settings.mcpAutoWrap === true;
+  const inv = inventoryMcp();
+  for (const e of inv) {
+    if (e.state !== "gatewayed" || e.format === "toml") continue;
+    if (e.args.includes("--config-name")) continue;
+    const orig = fromGateway(e.raw);
+    if (!orig) continue;
+    try {
+      writeMcpEntry(e.mcpFile, e.format, e.name, toGateway(orig, e.name));
+      appendToLog(HOOK_DEBUG_LOG, {
+        event: "mcp-config-name-refreshed",
+        agent: e.agent,
+        name: e.name
+      });
+    } catch (err2) {
+      appendToLog(HOOK_DEBUG_LOG, {
+        event: "mcp-config-name-refresh-failed",
+        name: e.name,
+        error: err2?.message
+      });
+    }
+  }
   const baseline = loadBaseline();
   const creds = getCredentials();
-  const fresh = inventoryMcp().filter((e) => e.state === "ungoverned" && !baseline.has(idKey(e)));
+  const fresh = inv.filter((e) => e.state === "ungoverned" && !baseline.has(idKey(e)));
   if (fresh.length === 0) return;
   const wrappedAgents = /* @__PURE__ */ new Set();
   let wrappedCount = 0;
@@ -18627,6 +18656,7 @@ var init_mcp_reconciler = __esm({
     init_native();
     init_config();
     init_cloud();
+    init_audit();
     BASELINE_FILE2 = path37.join(os36.homedir(), ".node9", "mcp-baseline.json");
     BASELINE_CAP = 500;
     DEFAULT_INTERVAL_MIN = 60;
@@ -21533,6 +21563,7 @@ async function autoStartDaemonAndWait() {
 
 // src/cli/commands/check.ts
 init_orchestrator();
+init_state();
 init_daemon();
 init_config();
 init_policy();
@@ -22256,6 +22287,7 @@ RAW: ${raw}
             }
           }
           if (!prompt) process.exit(0);
+          if (process.env.NODE9_PAUSED === "1" || checkPause().paused) process.exit(0);
           const dlpMatch = scanArgs({ prompt });
           if (!dlpMatch) process.exit(0);
           const agent2 = agentOverride ?? detectAiAgent(payload);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.56.0",
+  "version": "1.57.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",