@node9/proxy 1.67.4 → 1.67.5

package/dist/dashboard.mjs

@@ -2376,7 +2376,11 @@ var init_config_schema = __esm({
       settings: z.object({
         mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
         autoStartDaemon: z.boolean().optional(),
-        enableUndo: z.boolean().optional(),
+        // enableUndo / policy.snapshot: removed with the undo feature. The
+        // schema strips undeclared keys silently (plain zod object — no
+        // .strict(), no .passthrough()), so a config still carrying them stays
+        // valid and simply loses them. Keeping the fields would instead make
+        // `node9_config_get` advertise a removed feature as a live knob.
         enableHookLogDebug: z.boolean().optional(),
         approvalTimeoutMs: z.number().nonnegative().optional(),
         approvalTimeoutSeconds: z.number().nonnegative().optional(),
@@ -2428,11 +2432,6 @@ var init_config_schema = __esm({
         ignoredTools: z.array(z.string()).optional(),
         toolInspection: z.record(z.string()).optional(),
         smartRules: z.array(SmartRuleSchema).optional(),
-        snapshot: z.object({
-          tools: z.array(z.string()).optional(),
-          onlyPaths: z.array(z.string()).optional(),
-          ignorePaths: z.array(z.string()).optional()
-        }).optional(),
         dlp: z.object({
           enabled: z.boolean().optional(),
           scanIgnoredTools: z.boolean().optional(),
@@ -2597,13 +2596,18 @@ var init_config = __esm({
       settings: {
         mode: "standard",
         autoStartDaemon: true,
-        // OFF by default. The snapshot store is a per-project bare git repo with
-        // no size ceiling, and eviction drops the index row without deleting the
-        // objects — on one machine it reached 378G (352G of it orphaned tmp_pack_*
-        // from interrupted `git gc`) and filled the disk. A security tool must not
-        // be what fills a customer's disk. Re-enable per install with
-        // `{"settings":{"enableUndo":true}}`; the default flips back when the
-        // bounded copy-store lands (doc/undo-v2-copy-store-design.md).
+        // The undo feature was REMOVED. This default is one of two places that say
+        // so; the other is the pin further down, which overwrites whatever a config
+        // file, the dashboard or the cloud supplies. Setting `enableUndo` anywhere
+        // has no effect — do not restore the advice that used to live here, because
+        // a comment recommending a knob that is silently discarded is the same lie
+        // on disk the pin exists to prevent.
+        //
+        // Why it went: the store was a per-project bare git repo with no size
+        // ceiling, and eviction dropped the index row without deleting the objects.
+        // On one machine it reached 378G (352G of it orphaned tmp_pack_* from an
+        // interrupted `git gc`) and filled the disk. A security tool must not be
+        // what fills a customer's disk. Leftovers: `node9 undo --purge`.
         enableUndo: false,
         enableHookLogDebug: true,
         approvalTimeoutMs: 12e4,

package/dist/index.js

@@ -295,7 +295,11 @@ var ConfigFileSchema = import_zod.z.object({
   settings: import_zod.z.object({
     mode: import_zod.z.enum(["standard", "strict", "audit", "observe"]).optional(),
     autoStartDaemon: import_zod.z.boolean().optional(),
-    enableUndo: import_zod.z.boolean().optional(),
+    // enableUndo / policy.snapshot: removed with the undo feature. The
+    // schema strips undeclared keys silently (plain zod object — no
+    // .strict(), no .passthrough()), so a config still carrying them stays
+    // valid and simply loses them. Keeping the fields would instead make
+    // `node9_config_get` advertise a removed feature as a live knob.
     enableHookLogDebug: import_zod.z.boolean().optional(),
     approvalTimeoutMs: import_zod.z.number().nonnegative().optional(),
     approvalTimeoutSeconds: import_zod.z.number().nonnegative().optional(),
@@ -347,11 +351,6 @@ var ConfigFileSchema = import_zod.z.object({
     ignoredTools: import_zod.z.array(import_zod.z.string()).optional(),
     toolInspection: import_zod.z.record(import_zod.z.string()).optional(),
     smartRules: import_zod.z.array(SmartRuleSchema).optional(),
-    snapshot: import_zod.z.object({
-      tools: import_zod.z.array(import_zod.z.string()).optional(),
-      onlyPaths: import_zod.z.array(import_zod.z.string()).optional(),
-      ignorePaths: import_zod.z.array(import_zod.z.string()).optional()
-    }).optional(),
     dlp: import_zod.z.object({
       enabled: import_zod.z.boolean().optional(),
       scanIgnoredTools: import_zod.z.boolean().optional(),
@@ -4181,13 +4180,18 @@ var DEFAULT_CONFIG = {
   settings: {
     mode: "standard",
     autoStartDaemon: true,
-    // OFF by default. The snapshot store is a per-project bare git repo with
-    // no size ceiling, and eviction drops the index row without deleting the
-    // objects — on one machine it reached 378G (352G of it orphaned tmp_pack_*
-    // from interrupted `git gc`) and filled the disk. A security tool must not
-    // be what fills a customer's disk. Re-enable per install with
-    // `{"settings":{"enableUndo":true}}`; the default flips back when the
-    // bounded copy-store lands (doc/undo-v2-copy-store-design.md).
+    // The undo feature was REMOVED. This default is one of two places that say
+    // so; the other is the pin further down, which overwrites whatever a config
+    // file, the dashboard or the cloud supplies. Setting `enableUndo` anywhere
+    // has no effect — do not restore the advice that used to live here, because
+    // a comment recommending a knob that is silently discarded is the same lie
+    // on disk the pin exists to prevent.
+    //
+    // Why it went: the store was a per-project bare git repo with no size
+    // ceiling, and eviction dropped the index row without deleting the objects.
+    // On one machine it reached 378G (352G of it orphaned tmp_pack_* from an
+    // interrupted `git gc`) and filled the disk. A security tool must not be
+    // what fills a customer's disk. Leftovers: `node9 undo --purge`.
     enableUndo: false,
     enableHookLogDebug: true,
     approvalTimeoutMs: 12e4,
@@ -4597,7 +4601,6 @@ function getConfig(cwd) {
     const p = source.policy || {};
     if (s.mode !== void 0) mergedSettings.mode = s.mode;
     if (s.autoStartDaemon !== void 0) mergedSettings.autoStartDaemon = s.autoStartDaemon;
-    if (s.enableUndo !== void 0) mergedSettings.enableUndo = s.enableUndo;
     if (s.enableHookLogDebug !== void 0)
       mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
     if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
@@ -4974,6 +4977,7 @@ function getConfig(cwd) {
   mergedPolicy.snapshot.tools = [...new Set(mergedPolicy.snapshot.tools)];
   mergedPolicy.snapshot.onlyPaths = [...new Set(mergedPolicy.snapshot.onlyPaths)];
   mergedPolicy.snapshot.ignorePaths = [...new Set(mergedPolicy.snapshot.ignorePaths)];
+  mergedSettings.enableUndo = false;
   const result = {
     settings: mergedSettings,
     policy: mergedPolicy,

package/dist/index.mjs

@@ -265,7 +265,11 @@ var ConfigFileSchema = z.object({
   settings: z.object({
     mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
     autoStartDaemon: z.boolean().optional(),
-    enableUndo: z.boolean().optional(),
+    // enableUndo / policy.snapshot: removed with the undo feature. The
+    // schema strips undeclared keys silently (plain zod object — no
+    // .strict(), no .passthrough()), so a config still carrying them stays
+    // valid and simply loses them. Keeping the fields would instead make
+    // `node9_config_get` advertise a removed feature as a live knob.
     enableHookLogDebug: z.boolean().optional(),
     approvalTimeoutMs: z.number().nonnegative().optional(),
     approvalTimeoutSeconds: z.number().nonnegative().optional(),
@@ -317,11 +321,6 @@ var ConfigFileSchema = z.object({
     ignoredTools: z.array(z.string()).optional(),
     toolInspection: z.record(z.string()).optional(),
     smartRules: z.array(SmartRuleSchema).optional(),
-    snapshot: z.object({
-      tools: z.array(z.string()).optional(),
-      onlyPaths: z.array(z.string()).optional(),
-      ignorePaths: z.array(z.string()).optional()
-    }).optional(),
     dlp: z.object({
       enabled: z.boolean().optional(),
       scanIgnoredTools: z.boolean().optional(),
@@ -4151,13 +4150,18 @@ var DEFAULT_CONFIG = {
   settings: {
     mode: "standard",
     autoStartDaemon: true,
-    // OFF by default. The snapshot store is a per-project bare git repo with
-    // no size ceiling, and eviction drops the index row without deleting the
-    // objects — on one machine it reached 378G (352G of it orphaned tmp_pack_*
-    // from interrupted `git gc`) and filled the disk. A security tool must not
-    // be what fills a customer's disk. Re-enable per install with
-    // `{"settings":{"enableUndo":true}}`; the default flips back when the
-    // bounded copy-store lands (doc/undo-v2-copy-store-design.md).
+    // The undo feature was REMOVED. This default is one of two places that say
+    // so; the other is the pin further down, which overwrites whatever a config
+    // file, the dashboard or the cloud supplies. Setting `enableUndo` anywhere
+    // has no effect — do not restore the advice that used to live here, because
+    // a comment recommending a knob that is silently discarded is the same lie
+    // on disk the pin exists to prevent.
+    //
+    // Why it went: the store was a per-project bare git repo with no size
+    // ceiling, and eviction dropped the index row without deleting the objects.
+    // On one machine it reached 378G (352G of it orphaned tmp_pack_* from an
+    // interrupted `git gc`) and filled the disk. A security tool must not be
+    // what fills a customer's disk. Leftovers: `node9 undo --purge`.
     enableUndo: false,
     enableHookLogDebug: true,
     approvalTimeoutMs: 12e4,
@@ -4567,7 +4571,6 @@ function getConfig(cwd) {
     const p = source.policy || {};
     if (s.mode !== void 0) mergedSettings.mode = s.mode;
     if (s.autoStartDaemon !== void 0) mergedSettings.autoStartDaemon = s.autoStartDaemon;
-    if (s.enableUndo !== void 0) mergedSettings.enableUndo = s.enableUndo;
     if (s.enableHookLogDebug !== void 0)
       mergedSettings.enableHookLogDebug = s.enableHookLogDebug;
     if (s.approvers) mergedSettings.approvers = { ...mergedSettings.approvers, ...s.approvers };
@@ -4944,6 +4947,7 @@ function getConfig(cwd) {
   mergedPolicy.snapshot.tools = [...new Set(mergedPolicy.snapshot.tools)];
   mergedPolicy.snapshot.onlyPaths = [...new Set(mergedPolicy.snapshot.onlyPaths)];
   mergedPolicy.snapshot.ignorePaths = [...new Set(mergedPolicy.snapshot.ignorePaths)];
+  mergedSettings.enableUndo = false;
   const result = {
     settings: mergedSettings,
     policy: mergedPolicy,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.67.4",
+  "version": "1.67.5",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",