@node9/proxy 1.63.0 → 1.65.0

package/dist/index.mjs

@@ -295,6 +295,7 @@ var ConfigFileSchema = z.object({
     // nudge-only (default), and the scan cadence in minutes.
     mcpAutoWrap: z.boolean().optional(),
     mcpReconcileIntervalMinutes: z.number().positive().optional(),
+    mcpStaleAfterDays: z.number().min(0).optional(),
     cloudSyncIntervalHours: z.number().positive().optional(),
     // Seconds-granular override for the cloud policy sync cadence. Wins over
     // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
@@ -3305,6 +3306,7 @@ var redis_default = {
   name: "redis",
   description: "Protects Redis instances from destructive AI operations",
   aliases: [],
+  _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
   smartRules: [
     {
       name: "shield:redis:block-flushall",
@@ -3313,7 +3315,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHALL\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
           flags: "i"
         }
       ],
@@ -3327,7 +3329,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHDB\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
           flags: "i"
         }
       ],
@@ -3341,7 +3343,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+RESETSTAT\\b",
+          value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
           flags: "i"
         }
       ],
@@ -3355,7 +3357,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+SET\\b",
+          value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
           flags: "i"
         }
       ],
@@ -3369,7 +3371,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
+          value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
           flags: "i"
         }
       ],
@@ -4038,6 +4040,61 @@ function getActiveEnvironment(config) {
   const env = config.settings.environment || process.env.NODE_ENV || "development";
   return config.environments[env] ?? null;
 }
+function readRulesCacheResilient(cacheFile) {
+  let existed = false;
+  let sawReadError = false;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    let content;
+    try {
+      content = fs4.readFileSync(cacheFile, "utf-8");
+      existed = true;
+    } catch (err) {
+      if (err.code === "ENOENT") return {};
+      sawReadError = true;
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(content);
+      lastParsedRulesCache = parsed;
+      return parsed;
+    } catch {
+    }
+  }
+  if (existed || sawReadError) {
+    const backup = path4.join(path4.dirname(cacheFile), "rules-cache.last-good.json");
+    if (backup !== cacheFile) {
+      try {
+        const raw = JSON.parse(fs4.readFileSync(backup, "utf-8"));
+        logCacheReadIssue(cacheFile, "RULES_CACHE_CORRUPT_USED_BACKUP");
+        lastParsedRulesCache = raw;
+        return raw;
+      } catch {
+      }
+    }
+    if (lastParsedRulesCache) {
+      logCacheReadIssue(cacheFile, "RULES_CACHE_USED_MEMORY");
+      return lastParsedRulesCache;
+    }
+    logCacheReadIssue(cacheFile, "RULES_CACHE_UNREADABLE");
+  }
+  return {};
+}
+var lastParsedRulesCache = null;
+var CACHE_LOG_REARM_MS = 5 * 60 * 1e3;
+var cacheReadLastLoggedAt = 0;
+function logCacheReadIssue(cacheFile, kind) {
+  const now = Date.now();
+  if (now - cacheReadLastLoggedAt < CACHE_LOG_REARM_MS) return;
+  cacheReadLastLoggedAt = now;
+  try {
+    fs4.appendFileSync(
+      path4.join(os4.homedir(), ".node9", "hook-debug.log"),
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] ${kind} ${cacheFile}
+`
+    );
+  } catch {
+  }
+}
 function getConfig(cwd) {
   if (!cwd && cachedConfig) return cachedConfig;
   const globalPath = path4.join(os4.homedir(), ".node9", "config.json");
@@ -4105,6 +4162,7 @@ function getConfig(cwd) {
     if (s.mcpAutoWrap !== void 0) mergedSettings.mcpAutoWrap = s.mcpAutoWrap === true;
     if (s.mcpReconcileIntervalMinutes !== void 0)
       mergedSettings.mcpReconcileIntervalMinutes = s.mcpReconcileIntervalMinutes;
+    if (s.mcpStaleAfterDays !== void 0) mergedSettings.mcpStaleAfterDays = s.mcpStaleAfterDays;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
@@ -4114,12 +4172,13 @@ function getConfig(cwd) {
     if (p.smartRules) {
       const defaultBlocks = mergedPolicy.smartRules.filter((r) => r.verdict === "block");
       const defaultNonBlocks = mergedPolicy.smartRules.filter((r) => r.verdict !== "block");
-      const userRuleNames = new Set(p.smartRules.filter((r) => r.name).map((r) => r.name));
+      const localRules = p.smartRules.map(({ pinned: _pinned, ...r }) => r);
+      const userRuleNames = new Set(localRules.filter((r) => r.name).map((r) => r.name));
       const filteredBlocks = defaultBlocks.filter((r) => !r.name || !userRuleNames.has(r.name));
       const filteredNonBlocks = defaultNonBlocks.filter(
         (r) => !r.name || !userRuleNames.has(r.name)
       );
-      mergedPolicy.smartRules = [...filteredBlocks, ...p.smartRules, ...filteredNonBlocks];
+      mergedPolicy.smartRules = [...filteredBlocks, ...localRules, ...filteredNonBlocks];
     }
     if (p.snapshot) {
       const s2 = p.snapshot;
@@ -4184,10 +4243,12 @@ function getConfig(cwd) {
   applyLayer(globalConfig);
   applyLayer(projectConfig);
   let cloudManagedShields = [];
+  let modeCloudControlled = false;
+  let modeCloudStaged = false;
   {
     const cacheFile = path4.join(os4.homedir(), ".node9", "rules-cache.json");
     try {
-      const raw = JSON.parse(fs4.readFileSync(cacheFile, "utf-8"));
+      const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
         applyLayer({ policy: { smartRules: raw.rules } });
       }
@@ -4204,6 +4265,9 @@ function getConfig(cwd) {
             locked.includes("mode")
           );
         }
+        if (typeof mc.mode === "string" || locked.includes("mode")) {
+          modeCloudControlled = true;
+        }
         if (mc.egress && typeof mc.egress === "object") {
           const hosts = (v) => Array.isArray(v) ? v.filter((h) => typeof h === "string") : void 0;
           mergedPolicy.egress = applyManagedEgress(
@@ -4302,19 +4366,28 @@ function getConfig(cwd) {
       }
       if (raw.shadowMode === true) {
         mergedSettings.mode = "observe";
+        modeCloudStaged = true;
       }
     } catch {
     }
   }
   const shieldOverrides = readShieldOverrides();
   const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  const cloudManagedSet = new Set(cloudManagedShields);
   for (const shieldName of activeShieldNames) {
-    const shield = getShield(shieldName);
+    const isCloudMandated = cloudManagedSet.has(shieldName);
+    const shield = isCloudMandated ? BUILTIN_SHIELDS[shieldName] : getShield(shieldName);
     if (!shield) continue;
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
-    const ruleOverrides = shieldOverrides[shieldName] ?? {};
+    const ruleOverrides = isCloudMandated ? {} : shieldOverrides[shieldName] ?? {};
     for (const rule of shield.smartRules) {
-      if (!existingRuleNames.has(rule.name)) {
+      const collides = rule.name ? existingRuleNames.has(rule.name) : false;
+      if (isCloudMandated) {
+        if (collides) {
+          mergedPolicy.smartRules = mergedPolicy.smartRules.filter((r) => r.name !== rule.name);
+        }
+        mergedPolicy.smartRules.push({ ...rule, pinned: true });
+      } else if (!collides) {
         const overrideVerdict = rule.name ? ruleOverrides[rule.name] : void 0;
         mergedPolicy.smartRules.push(
           overrideVerdict !== void 0 ? { ...rule, verdict: overrideVerdict } : rule
@@ -4330,7 +4403,27 @@ function getConfig(cwd) {
   for (const rule of ADVISORY_SMART_RULES) {
     if (!existingAdvisoryNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
   }
-  if (process.env.NODE9_MODE) mergedSettings.mode = process.env.NODE9_MODE;
+  const envMode = process.env.NODE9_MODE;
+  if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+    mergedSettings.mode = envMode;
+  }
+  if (cloudManagedShields.length > 0 && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
+    mergedSettings.mode = "standard";
+  }
+  const managedFloorActive = cloudManagedShields.length > 0 || modeCloudControlled && mergedSettings.mode === "strict";
+  if (modeCloudControlled && mergedSettings.mode === "strict") {
+    for (const name of Object.keys(mergedEnvironments)) {
+      if (mergedEnvironments[name]?.requireApproval === false) {
+        const cleaned = { ...mergedEnvironments[name] };
+        delete cleaned.requireApproval;
+        mergedEnvironments[name] = cleaned;
+      }
+    }
+  }
+  if (managedFloorActive) {
+    mergedPolicy.ignoredTools = [...DEFAULT_CONFIG.policy.ignoredTools];
+    mergedPolicy.sandboxPaths = [...DEFAULT_CONFIG.policy.sandboxPaths];
+  }
   mergedPolicy.sandboxPaths = [...new Set(mergedPolicy.sandboxPaths)];
   mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
@@ -4718,6 +4811,18 @@ function isDaemonRunning() {
   }
   return false;
 }
+async function daemonHasInteractiveApprover(timeoutMs = 400) {
+  try {
+    const res = await fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/approver`, {
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) return false;
+    const body = await res.json();
+    return body.interactive === true;
+  } catch {
+    return false;
+  }
+}
 async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd, recoveryCommand, skipBackgroundAuth, viewOnly, localSmartRuleMatched, socketActivitySent) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   const ctrl = new AbortController();
@@ -5414,6 +5519,12 @@ function isNetworkTool(toolName, args) {
 function notifyActivity(data) {
   return notifyActivitySocket(data);
 }
+async function hasReachableHumanApprover(opts) {
+  const hasDisplay = !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+  const nativeReachable = !opts.calledFromDaemon && opts.approvers.native !== false && hasDisplay;
+  if (nativeReachable) return true;
+  return opts.approvers.terminal !== false && await daemonHasInteractiveApprover();
+}
 async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = randomUUID();
@@ -5487,6 +5598,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   let riskMetadata;
   let statefulRecoveryCommand;
   let localSmartRuleMatched = false;
+  let hardBlockDowngraded = false;
   let taintWarning = null;
   if (isNetworkTool(toolName, args)) {
     const filePaths = extractFilePaths(toolName, args);
@@ -5728,6 +5840,36 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       return { approved: true, checkedBy: "local-policy" };
     }
     if (policyResult.decision === "block") {
+      hardBlockDowngraded = true;
+      const daemonUp = isDaemonRunning();
+      let humanApproverReachable = false;
+      if (!policyResult.dependsOnStatePredicates?.length && daemonUp && !isTestEnv2) {
+        humanApproverReachable = await hasReachableHumanApprover({
+          approvers,
+          calledFromDaemon: options?.calledFromDaemon
+        });
+      }
+      const mayDowngrade = daemonUp && !isTestEnv2 && humanApproverReachable;
+      const hardBlock = () => {
+        if (!isManual)
+          appendLocalAudit(
+            toolName,
+            args,
+            "deny",
+            "smart-rule-block",
+            { ...meta, ruleName: policyResult.ruleName },
+            hashAuditArgs
+          );
+        return {
+          approved: false,
+          reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
+          blockedBy: "local-config",
+          blockedByLabel: policyResult.blockedByLabel,
+          ruleHit: policyResult.ruleName,
+          ...policyResult.recoveryCommand && { recoveryCommand: policyResult.recoveryCommand },
+          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription }
+        };
+      };
       if (policyResult.dependsOnStatePredicates?.length) {
         const stateResults = await checkStatePredicates(policyResult.dependsOnStatePredicates);
         const predicatesMet = stateResults !== null && policyResult.dependsOnStatePredicates.every((p) => stateResults[p] === true);
@@ -5744,7 +5886,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         if (predicatesMet && policyResult.recoveryCommand) {
           statefulRecoveryCommand = policyResult.recoveryCommand;
         }
-      } else if (isDaemonRunning() && !isTestEnv2) {
+      } else if (mayDowngrade) {
         if (!isManual)
           appendLocalAudit(
             toolName,
@@ -5766,36 +5908,14 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           };
         }
       } else {
-        if (!isManual)
-          appendLocalAudit(
-            toolName,
-            args,
-            "deny",
-            "smart-rule-block",
-            // Include policyResult.ruleName so the [2] Report SHIELDS
-            // panel can attribute this block to its specific shield
-            // (e.g. `shield:project-jail:block-read-ssh`) via the
-            // rule→shield map. checkedBy stays as the generic
-            // `smart-rule-block` for backward compat with existing
-            // log readers.
-            { ...meta, ruleName: policyResult.ruleName },
-            hashAuditArgs
-          );
-        return {
-          approved: false,
-          reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
-          blockedBy: "local-config",
-          blockedByLabel: policyResult.blockedByLabel,
-          ruleHit: policyResult.ruleName,
-          ...policyResult.recoveryCommand && { recoveryCommand: policyResult.recoveryCommand },
-          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription }
-        };
+        return hardBlock();
       }
     }
     explainableLabel = policyResult.blockedByLabel || "Local Config";
     policyMatchedField = policyResult.matchedField;
     policyMatchedWord = policyResult.matchedWord;
-    if (policyResult.ruleName) localSmartRuleMatched = true;
+    if (policyResult.ruleName || policyResult.tier === 7 || hardBlockDowngraded)
+      localSmartRuleMatched = true;
     if (policyResult.ruleDescription) policyRuleDescription = policyResult.ruleDescription;
     else if (policyResult.reason) policyRuleDescription = policyResult.reason;
     riskMetadata = computeRiskMetadata(
@@ -5807,7 +5927,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       policyResult.ruleName
     );
     if (policyRuleDescription) riskMetadata.ruleDescription = policyRuleDescription.slice(0, 200);
-    const persistent = policyResult.ruleName ? null : getPersistentDecision(toolName);
+    const persistent = policyResult.ruleName || policyResult.tier === 7 || hardBlockDowngraded ? null : getPersistentDecision(toolName);
     if (persistent === "allow" && !appPermReview) {
       if (!isManual) appendLocalAudit(toolName, args, "allow", "persistent", meta, hashAuditArgs);
       return { approved: true, checkedBy: "persistent" };
@@ -5840,7 +5960,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       return { approved: true };
     }
   }
-  if (!taintWarning && !appPermReview && getActiveTrustSession(toolName, args)) {
+  if (!taintWarning && !appPermReview && !hardBlockDowngraded && getActiveTrustSession(toolName, args)) {
     if (!isManual) appendLocalAudit(toolName, args, "allow", "trust", meta, hashAuditArgs);
     return { approved: true, checkedBy: "trust" };
   }
@@ -5904,7 +6024,7 @@ ${appPermReview}`
         forceReview
       );
       if (!initResult.pending) {
-        if (initResult.shadowMode && !appPermReview) {
+        if (initResult.shadowMode && !localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview) {
           return { approved: true, checkedBy: "cloud" };
         }
         if (!localSmartRuleMatched && !options?.localSmartRuleMatched && !appPermReview) {

package/dist/scan-ink.mjs

@@ -1500,6 +1500,7 @@ var redis_default = {
   name: "redis",
   description: "Protects Redis instances from destructive AI operations",
   aliases: [],
+  _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
   smartRules: [
     {
       name: "shield:redis:block-flushall",
@@ -1508,7 +1509,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHALL\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
           flags: "i"
         }
       ],
@@ -1522,7 +1523,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHDB\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
           flags: "i"
         }
       ],
@@ -1536,7 +1537,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+RESETSTAT\\b",
+          value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
           flags: "i"
         }
       ],
@@ -1550,7 +1551,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+SET\\b",
+          value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
           flags: "i"
         }
       ],
@@ -1564,7 +1565,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
+          value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
           flags: "i"
         }
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.63.0",
+  "version": "1.65.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",