@node9/proxy 1.65.1 → 1.67.0

package/dist/index.mjs

@@ -72,7 +72,7 @@ function redactSecrets(text) {
   if (!text) return text;
   let redacted = text;
   redacted = redacted.replace(
-    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/\\=]+/gi,
+    /(authorization:\s*(?:bearer|basic)\s+)[a-zA-Z0-9._\-\/=]+/gi,
     "$1********"
   );
   redacted = redacted.replace(
@@ -133,7 +133,7 @@ function filePathFromArgs(args) {
   return void 0;
 }
 function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashArgsEnabled) {
-  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern);
+  const isDlpRow = checkedBy.toLowerCase().includes("dlp") || Boolean(meta?.dlpPattern) || /dlp|taint/i.test(String(meta?.ruleName ?? ""));
   const preview = auditHashArgsEnabled && !isDlpRow ? buildArgsPreview(args) : void 0;
   const argsField = auditHashArgsEnabled ? { argsHash: hashArgs(args), ...preview ? { argsPreview: preview } : {} } : { args: args ? JSON.parse(redactSecrets(JSON.stringify(args))) : {} };
   const testRun = isTestCall(toolName, args) || process.env.NODE9_TESTING === "1" ? { testRun: true } : {};
@@ -284,8 +284,10 @@ var ConfigFileSchema = z.object({
     agentPolicy: z.enum(["require_approval", "block_on_rules"]).optional(),
     // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
     // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
-    // node9's own approver (terminal/native/cloud). Unset → smart default
-    // (ask for ask-capable agents unless a cloud approver is configured).
+    // node9's own approver (terminal/native/cloud). Unset → default ASK for
+    // ask-capable agents (v2: cloud no longer disables inline — the outcome
+    // ships to the dashboard as audit; admins force routing via managed
+    // reviewChannel, which outranks the local --ask flag).
     reviewChannel: z.enum(["ask", "approver"]).optional(),
     // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
     // approver_set). Default (unset/false): those tools refuse over MCP — a human
@@ -323,7 +325,18 @@ var ConfigFileSchema = z.object({
     dlp: z.object({
       enabled: z.boolean().optional(),
       scanIgnoredTools: z.boolean().optional(),
-      pii: z.enum(["off", "block"]).optional()
+      pii: z.enum(["off", "block"]).optional(),
+      reviewAction: z.enum(["review", "block"]).optional()
+    }).optional(),
+    // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
+    // deliberately exclude 'off' — tighten-only.
+    commandChecks: z.object({
+      inlineExec: z.enum(["off", "review", "block"]).optional(),
+      rmAdvisory: z.enum(["off", "review", "block"]).optional(),
+      chmod: z.enum(["off", "review", "block"]).optional(),
+      sqlDdl: z.enum(["off", "review", "block"]).optional(),
+      evalDynamic: z.enum(["review", "block"]).optional(),
+      pipeChainHigh: z.enum(["review", "block"]).optional()
     }).optional(),
     egress: z.object({
       enabled: z.boolean().optional(),
@@ -2335,6 +2348,47 @@ function evaluateSmartConditions(args, rule) {
   });
   return mode === "any" ? results.some((r) => r) : results.every((r) => r);
 }
+function resolveCheck(v) {
+  return v === "off" || v === "block" ? v : "review";
+}
+function resolveCheckTight(v) {
+  return v === "block" ? "block" : "review";
+}
+var INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
+var INLINE_SHELL = /^(bash|sh|zsh)$/i;
+function detectInlineExec(command) {
+  const pipeFed = command.includes("|");
+  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
+  for (const rawSeg of segments) {
+    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
+    if (i >= tokens.length) continue;
+    const base = tokens[i].split("/").pop() ?? tokens[i];
+    if (!INLINE_INTERP.test(base)) continue;
+    const args = tokens.slice(i + 1);
+    let hadRedirect = false;
+    const positionals = [];
+    for (let j = 0; j < args.length; j++) {
+      const a = args[j];
+      if (a === "-") return true;
+      if (a.startsWith("<")) {
+        hadRedirect = true;
+        if (a === "<" || a === "<<") j++;
+        continue;
+      }
+      if (a.startsWith("-")) {
+        if (/^-(c|e|eval)$/i.test(a)) return true;
+        continue;
+      }
+      positionals.push(a);
+    }
+    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
+      return true;
+    }
+  }
+  return false;
+}
 var VERDICT_RANK = {
   allow: 0,
   review: 1,
@@ -2367,7 +2421,7 @@ function isSqlTool(toolName, toolInspection) {
   return fieldName === "sql" || fieldName === "query";
 }
 var SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
-function pipeChainVerdict(command, isTrustedHost2) {
+function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
   const pipeAnalysis = analyzePipeChain(command);
   if (!pipeAnalysis.isPipeline) return null;
   if (pipeAnalysis.risk !== "critical" && pipeAnalysis.risk !== "high") return null;
@@ -2398,7 +2452,7 @@ function pipeChainVerdict(command, isTrustedHost2) {
     };
   }
   return {
-    decision: "review",
+    decision: highAction,
     blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
     reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
     tier: 3
@@ -2412,7 +2466,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const dlpMatch = args !== void 0 ? scanArgs(args) : null;
     if (dlpMatch) {
       return {
-        decision: dlpMatch.severity,
+        // reviewAction:'block' (inline-ask v2): the admin upgraded
+        // review-severity matches to a hard block — every evaluatePolicy
+        // caller (orchestrator, explain, gateway) must agree with the gate.
+        decision: dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block" ? "block" : "review",
         blockedByLabel: `DLP: ${dlpMatch.patternName}`,
         reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
       };
@@ -2421,7 +2478,11 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   if (wouldBeIgnored) return { decision: "allow" };
   const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
   if (bashCommand !== null) {
-    const pipeVerdict = pipeChainVerdict(bashCommand, isTrustedHost2);
+    const pipeVerdict = pipeChainVerdict(
+      bashCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (pipeVerdict) return pipeVerdict;
     const fsVerdict = analyzeFsOperation(bashCommand);
     if (fsVerdict) {
@@ -2436,10 +2497,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
-    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
+    const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
     if (sqlVerdict) {
       return {
-        decision: sqlVerdict.verdict,
+        // analyzeSqlDestructive is typed review-only, so the knob maps 1:1.
+        decision: sqlAction === "block" ? "block" : "review",
         blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
         reason: sqlVerdict.reason,
         tier: 2,
@@ -2447,10 +2510,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
-    const chmodVerdict = analyzeChmod777(bashCommand);
+    const chmodAction = resolveCheck(config.policy.commandChecks?.chmod);
+    const chmodVerdict = chmodAction === "off" ? null : analyzeChmod777(bashCommand);
     if (chmodVerdict) {
       return {
-        decision: chmodVerdict.verdict,
+        // analyzeChmod777 is typed review-only, so the knob maps 1:1.
+        decision: chmodAction === "block" ? "block" : "review",
         blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
         reason: chmodVerdict.reason,
         tier: 2,
@@ -2493,10 +2558,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
       return {
-        decision: "review",
+        decision: inlineAction === "block" ? "block" : "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
         ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
         tier: 3
@@ -2514,14 +2579,21 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     if (evalVerdict === "review") {
       return {
-        decision: "review",
+        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
+        // block but can never turn this off (eval-remote above is Class A —
+        // no knob at all).
+        decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
       };
     }
-    const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost2);
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost2,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (ptVerdict) return ptVerdict;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
@@ -3608,6 +3680,7 @@ function applyManagedEgress(local, managed, locked) {
   return next;
 }
 var DLP_PII_ORDER = ["off", "block"];
+var DLP_REVIEW_ACTION_ORDER = ["review", "block"];
 function applyManagedDlp(local, managed, locked) {
   const next = { ...local };
   if (typeof managed.enabled === "boolean") {
@@ -3621,6 +3694,40 @@ function applyManagedDlp(local, managed, locked) {
       locked.includes("dlpPii")
     );
   }
+  if (typeof managed.reviewAction === "string") {
+    next.reviewAction = resolveByOrder(
+      DLP_REVIEW_ACTION_ORDER,
+      local.reviewAction ?? "review",
+      managed.reviewAction,
+      locked.includes("dlpReviewAction")
+    );
+  }
+  return next;
+}
+var COMMAND_CHECK_ORDER = ["off", "review", "block"];
+var COMMAND_CHECK_KEYS = [
+  "inlineExec",
+  "rmAdvisory",
+  "chmod",
+  "sqlDdl",
+  "evalDynamic",
+  "pipeChainHigh"
+];
+function applyManagedCommandChecks(local, managed, locked) {
+  const next = { ...local };
+  for (const key of COMMAND_CHECK_KEYS) {
+    const m = managed[key];
+    if (typeof m !== "string") continue;
+    const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
+    const resolved = resolveByOrder(
+      COMMAND_CHECK_ORDER,
+      local[key] ?? "review",
+      m,
+      locked.includes(lockKey)
+    );
+    if ((key === "evalDynamic" || key === "pipeChainHigh") && resolved === "off") continue;
+    next[key] = resolved;
+  }
   return next;
 }
 function applyManagedApprovers(local, managed) {
@@ -4191,6 +4298,22 @@ function getConfig(cwd) {
       if (d.enabled !== void 0) mergedPolicy.dlp.enabled = d.enabled;
       if (d.scanIgnoredTools !== void 0) mergedPolicy.dlp.scanIgnoredTools = d.scanIgnoredTools;
       if (d.pii !== void 0) mergedPolicy.dlp.pii = d.pii;
+      if (d.reviewAction !== void 0) mergedPolicy.dlp.reviewAction = d.reviewAction;
+    }
+    if (p.commandChecks && typeof p.commandChecks === "object") {
+      const src = p.commandChecks;
+      const cc2 = {
+        ...mergedPolicy.commandChecks
+      };
+      for (const k of ["inlineExec", "rmAdvisory", "chmod", "sqlDdl"]) {
+        const v = src[k];
+        if (v === "off" || v === "review" || v === "block") cc2[k] = v;
+      }
+      for (const k of ["evalDynamic", "pipeChainHigh"]) {
+        const v = src[k];
+        if (v === "review" || v === "block") cc2[k] = v;
+      }
+      if (Object.keys(cc2).length > 0) mergedPolicy.commandChecks = cc2;
     }
     if (p.egress) {
       const e = p.egress;
@@ -4287,11 +4410,19 @@ function getConfig(cwd) {
             mergedPolicy.dlp,
             {
               enabled: typeof mc.dlp.enabled === "boolean" ? mc.dlp.enabled : void 0,
-              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0
+              pii: typeof mc.dlp.pii === "string" ? mc.dlp.pii : void 0,
+              reviewAction: mc.dlp.reviewAction === "review" || mc.dlp.reviewAction === "block" ? mc.dlp.reviewAction : void 0
             },
             locked
           );
         }
+        if (mc.commandChecks && typeof mc.commandChecks === "object") {
+          mergedPolicy.commandChecks = applyManagedCommandChecks(
+            mergedPolicy.commandChecks ?? {},
+            mc.commandChecks,
+            locked
+          );
+        }
         if (mc.approvers && typeof mc.approvers === "object") {
           const bool = (v) => typeof v === "boolean" ? v : void 0;
           mergedSettings.approvers = applyManagedApprovers(mergedSettings.approvers, {
@@ -4303,6 +4434,7 @@ function getConfig(cwd) {
         }
         if (mc.reviewChannel === "ask" || mc.reviewChannel === "approver") {
           mergedSettings.reviewChannel = mc.reviewChannel;
+          mergedSettings.reviewChannelManaged = true;
         }
         if (typeof mc.approvalTimeoutMs === "number" && mc.approvalTimeoutMs > 0) {
           mergedSettings.approvalTimeoutMs = mc.approvalTimeoutMs;
@@ -4400,8 +4532,17 @@ function getConfig(cwd) {
     }
   }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
+  const cc = mergedPolicy.commandChecks ?? {};
+  const advisoryKnob = (name) => {
+    if (name === "review-rm") return cc.rmAdvisory;
+    if (name?.endsWith("-sql")) return cc.sqlDdl;
+    return void 0;
+  };
   for (const rule of ADVISORY_SMART_RULES) {
-    if (!existingAdvisoryNames.has(rule.name)) mergedPolicy.smartRules.push(rule);
+    if (existingAdvisoryNames.has(rule.name)) continue;
+    const knob = rule.verdict === "review" ? advisoryKnob(rule.name) : void 0;
+    if (knob === "off") continue;
+    mergedPolicy.smartRules.push(knob === "block" ? { ...rule, verdict: "block" } : rule);
   }
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && ["observe", "audit", "standard", "strict"].includes(envMode)) {
@@ -5661,7 +5802,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const dlpMatch = (filePath ? scanFilePath(filePath) : null) ?? scanArgs(args);
     if (dlpMatch) {
       const dlpReason = `\u{1F6A8} DATA LOSS PREVENTION: ${dlpMatch.patternName} detected in field "${dlpMatch.fieldPath}" (${dlpMatch.redactedSample})`;
-      if (dlpMatch.severity === "block") {
+      if (dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block") {
         let dlpEid;
         if (!isManual)
           dlpEid = appendLocalAudit(
@@ -5999,12 +6140,14 @@ ${appPermReview}`
       );
     }
   }
-  const cloudEnforcedForDefer = approvers.cloud && !!creds?.apiKey;
-  if (options?.deferReview && !hardBlockDowngraded && !taintWarning && !appPermReview && !cloudEnforcedForDefer) {
+  if (options?.deferReview && !hardBlockDowngraded) {
     return {
       approved: false,
       review: true,
-      reason: explainableLabel || "Node9 flagged this action for review.",
+      // The prompt must say WHY: the taint sentence beats the bare label so
+      // the dev sees the actual risk context inline. (No appPermReview term:
+      // deferReview and serverKey never co-occur in production — see above.)
+      reason: taintWarning || explainableLabel || "Node9 flagged this action for review.",
       ruleDescription: policyRuleDescription,
       blockedByLabel: explainableLabel
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.65.1",
+  "version": "1.67.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",