@node9/proxy 1.7.1 → 1.8.3

package/dist/index.mjs

@@ -250,251 +250,73 @@ ${lines.join("\n")}`
 import fs2 from "fs";
 import path2 from "path";
 import os2 from "os";
-var SHIELDS = {
-  postgres: {
-    name: "postgres",
-    description: "Protects PostgreSQL databases from destructive AI operations",
-    aliases: ["pg", "postgresql"],
-    smartRules: [
-      {
-        name: "shield:postgres:block-drop-table",
-        tool: "*",
-        conditions: [{ field: "sql", op: "matches", value: "DROP\\s+TABLE", flags: "i" }],
-        verdict: "block",
-        reason: "DROP TABLE is irreversible \u2014 blocked by Postgres shield"
-      },
-      {
-        name: "shield:postgres:block-truncate",
-        tool: "*",
-        conditions: [{ field: "sql", op: "matches", value: "TRUNCATE\\s+TABLE", flags: "i" }],
-        verdict: "block",
-        reason: "TRUNCATE is irreversible \u2014 blocked by Postgres shield"
-      },
-      {
-        name: "shield:postgres:block-drop-column",
-        tool: "*",
-        conditions: [
-          { field: "sql", op: "matches", value: "ALTER\\s+TABLE.*DROP\\s+COLUMN", flags: "i" }
-        ],
-        verdict: "block",
-        reason: "DROP COLUMN is irreversible \u2014 blocked by Postgres shield"
-      },
-      {
-        name: "shield:postgres:review-grant-revoke",
-        tool: "*",
-        conditions: [{ field: "sql", op: "matches", value: "\\b(GRANT|REVOKE)\\b", flags: "i" }],
-        verdict: "review",
-        reason: "Permission changes require human approval (Postgres shield)"
-      }
-    ],
-    dangerousWords: ["dropdb", "pg_dropcluster"]
-  },
-  github: {
-    name: "github",
-    description: "Protects GitHub repositories from destructive AI operations",
-    aliases: ["git"],
-    smartRules: [
-      {
-        // Note: git branch -d/-D is already caught by the built-in review-git-destructive rule.
-        // This rule adds coverage for `git push --delete` which the built-in does not match.
-        name: "shield:github:review-delete-branch-remote",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "git\\s+push\\s+.*--delete",
-            flags: "i"
-          }
-        ],
-        verdict: "review",
-        reason: "Remote branch deletion requires human approval (GitHub shield)"
-      },
-      {
-        name: "shield:github:block-delete-repo",
-        tool: "*",
-        conditions: [
-          { field: "command", op: "matches", value: "gh\\s+repo\\s+delete", flags: "i" }
-        ],
-        verdict: "block",
-        reason: "Repository deletion is irreversible \u2014 blocked by GitHub shield"
-      }
-    ],
-    dangerousWords: []
-  },
-  aws: {
-    name: "aws",
-    description: "Protects AWS infrastructure from destructive AI operations",
-    aliases: ["amazon"],
-    smartRules: [
-      {
-        name: "shield:aws:block-delete-s3-bucket",
-        tool: "*",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "aws\\s+s3.*rb\\s|aws\\s+s3api\\s+delete-bucket",
-            flags: "i"
-          }
-        ],
-        verdict: "block",
-        reason: "S3 bucket deletion is irreversible \u2014 blocked by AWS shield"
-      },
-      {
-        name: "shield:aws:review-iam-changes",
-        tool: "*",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "aws\\s+iam\\s+(create|delete|attach|detach|put|remove)",
-            flags: "i"
-          }
-        ],
-        verdict: "review",
-        reason: "IAM changes require human approval (AWS shield)"
-      },
-      {
-        name: "shield:aws:block-ec2-terminate",
-        tool: "*",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "aws\\s+ec2\\s+terminate-instances",
-            flags: "i"
-          }
-        ],
-        verdict: "block",
-        reason: "EC2 instance termination is irreversible \u2014 blocked by AWS shield"
-      },
-      {
-        name: "shield:aws:review-rds-delete",
-        tool: "*",
-        conditions: [
-          { field: "command", op: "matches", value: "aws\\s+rds\\s+delete-", flags: "i" }
-        ],
-        verdict: "review",
-        reason: "RDS deletion requires human approval (AWS shield)"
-      }
-    ],
-    dangerousWords: []
-  },
-  "bash-safe": {
-    name: "bash-safe",
-    description: "Blocks high-risk bash patterns: pipe-to-shell, rm -rf /, disk overwrites, eval",
-    aliases: ["bash", "shell"],
-    smartRules: [
-      {
-        name: "shield:bash-safe:block-pipe-to-shell",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "(curl|wget)\\s+[^|]*\\|\\s*(bash|sh|zsh|fish|python3?|ruby|perl|node)",
-            flags: "i"
-          }
-        ],
-        verdict: "block",
-        reason: "Pipe-to-shell is a common supply-chain attack vector \u2014 blocked by bash-safe shield"
-      },
-      {
-        name: "shield:bash-safe:block-obfuscated-exec",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "base64\\s+(-d|--decode).*\\|\\s*(bash|sh|zsh)",
-            flags: "i"
-          }
-        ],
-        verdict: "block",
-        reason: "Obfuscated execution via base64 decode \u2014 blocked by bash-safe shield"
-      },
-      {
-        name: "shield:bash-safe:block-rm-root",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "rm\\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r)[a-zA-Z]*\\s+(\\/|~|\\$HOME|\\$\\{HOME\\})\\s*$",
-            flags: "i"
-          }
-        ],
-        verdict: "block",
-        reason: "rm -rf of root or home directory is catastrophic \u2014 blocked by bash-safe shield"
-      },
-      {
-        name: "shield:bash-safe:block-disk-overwrite",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: "dd\\s+.*of=\\/dev\\/(sd|nvme|hd|vd|xvd)",
-            flags: "i"
-          }
-        ],
-        verdict: "block",
-        reason: "Writing directly to a block device is irreversible \u2014 blocked by bash-safe shield"
-      },
-      {
-        name: "shield:bash-safe:review-eval",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            op: "matches",
-            value: '\\beval\\s+[\\$`("]',
-            flags: "i"
-          }
-        ],
-        verdict: "review",
-        reason: "eval of dynamic content requires human approval (bash-safe shield)"
-      }
-    ],
-    dangerousWords: []
-  },
-  filesystem: {
-    name: "filesystem",
-    description: "Protects the local filesystem from dangerous AI operations",
-    aliases: ["fs"],
-    smartRules: [
-      {
-        name: "shield:filesystem:review-chmod-777",
-        tool: "bash",
-        conditions: [
-          { field: "command", op: "matches", value: "chmod\\s+(777|a\\+rwx)", flags: "i" }
-        ],
-        verdict: "review",
-        reason: "chmod 777 requires human approval (filesystem shield)"
-      },
-      {
-        name: "shield:filesystem:review-write-etc",
-        tool: "bash",
-        conditions: [
-          {
-            field: "command",
-            // Narrow to write-indicative operations to avoid approval fatigue on reads.
-            // Matches: tee /etc/*, cp .../etc/*, mv .../etc/*, > /etc/*, install .../etc/*
-            op: "matches",
-            value: "(tee|\\bcp\\b|\\bmv\\b|install|>+)\\s+.*\\/etc\\/"
-          }
-        ],
-        verdict: "review",
-        reason: "Writing to /etc requires human approval (filesystem shield)"
-      }
-    ],
-    // dd removed: too common as a legitimate tool (disk imaging, file ops).
-    // mkfs removed: already in the built-in DANGEROUS_WORDS baseline.
-    // wipefs retained: rarely legitimate in an agent context and not in built-ins.
-    dangerousWords: ["wipefs"]
+var BUILTIN_DIR = path2.join(__dirname, "shields", "builtin");
+var USER_SHIELDS_DIR = path2.join(os2.homedir(), ".node9", "shields");
+function validateShieldDefinition(raw, filePath) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    process.stderr.write(`[node9] Shield file is not an object: ${filePath}
+`);
+    return null;
   }
-};
+  const r = raw;
+  if (typeof r.name !== "string" || !r.name) {
+    process.stderr.write(`[node9] Shield file missing 'name': ${filePath}
+`);
+    return null;
+  }
+  if (typeof r.description !== "string") {
+    process.stderr.write(`[node9] Shield file missing 'description': ${filePath}
+`);
+    return null;
+  }
+  if (!Array.isArray(r.aliases)) {
+    process.stderr.write(`[node9] Shield file missing 'aliases' array: ${filePath}
+`);
+    return null;
+  }
+  if (!Array.isArray(r.smartRules)) {
+    process.stderr.write(`[node9] Shield file missing 'smartRules' array: ${filePath}
+`);
+    return null;
+  }
+  if (!Array.isArray(r.dangerousWords)) {
+    process.stderr.write(`[node9] Shield file missing 'dangerousWords' array: ${filePath}
+`);
+    return null;
+  }
+  return r;
+}
+function loadShieldsFromDir(dir, label) {
+  const result = {};
+  let entries;
+  try {
+    entries = fs2.readdirSync(dir).filter((f) => f.endsWith(".json"));
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      process.stderr.write(`[node9] Could not read ${label} shields dir ${dir}: ${String(err)}
+`);
+    }
+    return result;
+  }
+  for (const file of entries) {
+    const filePath = path2.join(dir, file);
+    try {
+      const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8"));
+      const shield = validateShieldDefinition(raw, filePath);
+      if (shield) result[shield.name] = shield;
+    } catch (err) {
+      process.stderr.write(`[node9] Failed to load ${label} shield ${file}: ${String(err)}
+`);
+    }
+  }
+  return result;
+}
+function buildSHIELDS() {
+  const builtins = loadShieldsFromDir(BUILTIN_DIR, "builtin");
+  const userShields = loadShieldsFromDir(USER_SHIELDS_DIR, "user");
+  return { ...builtins, ...userShields };
+}
+var SHIELDS = buildSHIELDS();
 function resolveShieldName(input) {
   const lower = input.toLowerCase();
   if (SHIELDS[lower]) return lower;
@@ -2118,7 +1940,7 @@ function isDaemonRunning() {
     return false;
   }
 }
-async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd, recoveryCommand, skipBackgroundAuth, viewOnly) {
+async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd, recoveryCommand, skipBackgroundAuth, viewOnly, localSmartRuleMatched) {
   const base = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), 5e3);
@@ -2139,7 +1961,8 @@ async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityI
         ...cwd && { cwd },
         ...recoveryCommand && { recoveryCommand },
         ...skipBackgroundAuth && { skipBackgroundAuth: true },
-        ...viewOnly && { viewOnly: true }
+        ...viewOnly && { viewOnly: true },
+        ...localSmartRuleMatched && { localSmartRuleMatched: true }
       }),
       signal: ctrl.signal
     });
@@ -2529,9 +2352,7 @@ end run`;
           "--text",
           pangoMessage,
           "--ok-label",
-          locked ? "Waiting..." : "Allow  \u21B5",
-          "--timeout",
-          "300"
+          locked ? "Waiting..." : "Allow  \u21B5"
         ];
         if (!locked) {
           argsList.push("--cancel-label", "Block  \u238B");
@@ -2807,6 +2628,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
   let policyMatchedWord;
   let riskMetadata;
   let statefulRecoveryCommand;
+  let localSmartRuleMatched = false;
   let taintWarning = null;
   if (isNetworkTool(toolName, args)) {
     const filePaths = extractFilePaths(toolName, args);
@@ -2950,6 +2772,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
     explainableLabel = policyResult.blockedByLabel || "Local Config";
     policyMatchedField = policyResult.matchedField;
     policyMatchedWord = policyResult.matchedWord;
+    if (policyResult.ruleName) localSmartRuleMatched = true;
     riskMetadata = computeRiskMetadata(
       args,
       policyResult.tier ?? 6,
@@ -2992,22 +2815,26 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
   }
   let cloudRequestId = null;
   const cloudEnforced = approvers.cloud && !!creds?.apiKey;
-  if (cloudEnforced) {
+  if (cloudEnforced && !localSmartRuleMatched && !options?.localSmartRuleMatched) {
     try {
       const initResult = await initNode9SaaS(toolName, args, creds, meta, riskMetadata);
       if (!initResult.pending) {
         if (initResult.shadowMode) {
           return { approved: true, checkedBy: "cloud" };
         }
-        return {
-          approved: !!initResult.approved,
-          reason: initResult.reason || (initResult.approved ? void 0 : "Action rejected by organization policy."),
-          checkedBy: initResult.approved ? "cloud" : void 0,
-          blockedBy: initResult.approved ? void 0 : "team-policy",
-          blockedByLabel: "Organization Policy (SaaS)"
-        };
+        if (!localSmartRuleMatched && !options?.localSmartRuleMatched) {
+          return {
+            approved: !!initResult.approved,
+            reason: initResult.reason || (initResult.approved ? void 0 : "Action rejected by organization policy."),
+            checkedBy: initResult.approved ? "cloud" : void 0,
+            blockedBy: initResult.approved ? void 0 : "team-policy",
+            blockedByLabel: "Organization Policy (SaaS)"
+          };
+        }
+      }
+      if (!localSmartRuleMatched && !options?.localSmartRuleMatched) {
+        cloudRequestId = initResult.requestId || null;
       }
-      cloudRequestId = initResult.requestId || null;
       if (!taintWarning) explainableLabel = "Organization Policy (SaaS)";
     } catch {
     }
@@ -3053,7 +2880,10 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
           riskMetadata,
           options?.activityId,
           options?.cwd,
-          statefulRecoveryCommand
+          statefulRecoveryCommand,
+          void 0,
+          void 0,
+          localSmartRuleMatched || options?.localSmartRuleMatched
         );
         daemonEntryId = entry.id;
         daemonAllowCount = entry.allowCount;
@@ -3061,7 +2891,7 @@ async function _authorizeHeadlessCore(toolName, args, meta, options) {
       }
     }
   }
-  if (cloudEnforced && cloudRequestId) {
+  if (cloudEnforced && cloudRequestId && !localSmartRuleMatched && !options?.localSmartRuleMatched) {
     racePromises.push(
       (async () => {
         try {

package/dist/shields/builtin/aws.json

@@ -0,0 +1,59 @@
+{
+  "name": "aws",
+  "description": "Protects AWS infrastructure from destructive AI operations",
+  "aliases": ["amazon"],
+  "smartRules": [
+    {
+      "name": "shield:aws:block-delete-s3-bucket",
+      "tool": "*",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "aws\\s+s3.*rb\\s|aws\\s+s3api\\s+delete-bucket",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "S3 bucket deletion is irreversible — blocked by AWS shield"
+    },
+    {
+      "name": "shield:aws:review-iam-changes",
+      "tool": "*",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "aws\\s+iam\\s+(create|delete|attach|detach|put|remove)",
+          "flags": "i"
+        }
+      ],
+      "verdict": "review",
+      "reason": "IAM changes require human approval (AWS shield)"
+    },
+    {
+      "name": "shield:aws:block-ec2-terminate",
+      "tool": "*",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "aws\\s+ec2\\s+terminate-instances",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "EC2 instance termination is irreversible — blocked by AWS shield"
+    },
+    {
+      "name": "shield:aws:review-rds-delete",
+      "tool": "*",
+      "conditions": [
+        { "field": "command", "op": "matches", "value": "aws\\s+rds\\s+delete-", "flags": "i" }
+      ],
+      "verdict": "review",
+      "reason": "RDS deletion requires human approval (AWS shield)"
+    }
+  ],
+  "dangerousWords": []
+}

package/dist/shields/builtin/bash-safe.json

@@ -0,0 +1,78 @@
+{
+  "name": "bash-safe",
+  "description": "Blocks high-risk bash patterns: pipe-to-shell, rm -rf /, disk overwrites, eval",
+  "aliases": ["bash", "shell"],
+  "smartRules": [
+    {
+      "name": "shield:bash-safe:block-pipe-to-shell",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "(curl|wget)\\s+[^|]*\\|\\s*(bash|sh|zsh|fish|python3?|ruby|perl|node)",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "Pipe-to-shell is a common supply-chain attack vector — blocked by bash-safe shield"
+    },
+    {
+      "name": "shield:bash-safe:block-obfuscated-exec",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "base64\\s+(-d|--decode).*\\|\\s*(bash|sh|zsh)",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "Obfuscated execution via base64 decode — blocked by bash-safe shield"
+    },
+    {
+      "name": "shield:bash-safe:block-rm-root",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "rm\\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r)[a-zA-Z]*\\s+(\\/|~|\\$HOME|\\$\\{HOME\\})\\s*$",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "rm -rf of root or home directory is catastrophic — blocked by bash-safe shield"
+    },
+    {
+      "name": "shield:bash-safe:block-disk-overwrite",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "dd\\s+.*of=\\/dev\\/(sd|nvme|hd|vd|xvd)",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "Writing directly to a block device is irreversible — blocked by bash-safe shield"
+    },
+    {
+      "name": "shield:bash-safe:review-eval",
+      "tool": "bash",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "\\beval\\s+[\\$`(\"]",
+          "flags": "i"
+        }
+      ],
+      "verdict": "review",
+      "reason": "eval of dynamic content requires human approval (bash-safe shield)"
+    }
+  ],
+  "dangerousWords": []
+}

package/dist/shields/builtin/docker.json

@@ -0,0 +1,120 @@
+{
+  "name": "docker",
+  "description": "Protects Docker environments from destructive AI operations",
+  "aliases": [],
+  "smartRules": [
+    {
+      "name": "shield:docker:block-system-prune",
+      "tool": "*",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "docker\\s+system\\s+prune",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "docker system prune removes all unused containers, images, and volumes — blocked by Docker shield"
+    },
+    {
+      "name": "shield:docker:block-volume-prune",
+      "tool": "*",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "docker\\s+volume\\s+prune",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "docker volume prune destroys all unused volumes and their data — blocked by Docker shield"
+    },
+    {
+      "name": "shield:docker:block-rm-force",
+      "tool": "*",
+      "conditionMode": "all",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "docker\\s+rm\\b",
+          "flags": "i"
+        },
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "(^|\\s)(-f|--force)(\\s|$)",
+          "flags": "i"
+        }
+      ],
+      "verdict": "block",
+      "reason": "Force-removing running containers is destructive — blocked by Docker shield"
+    },
+    {
+      "name": "shield:docker:review-volume-rm",
+      "tool": "*",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "docker\\s+volume\\s+rm\\s+",
+          "flags": "i"
+        }
+      ],
+      "verdict": "review",
+      "reason": "Volume removal deletes persistent data and requires human approval (Docker shield)"
+    },
+    {
+      "name": "shield:docker:review-stop-kill",
+      "tool": "*",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "docker\\s+(stop|kill)\\s+",
+          "flags": "i"
+        }
+      ],
+      "verdict": "review",
+      "reason": "Stopping or killing containers requires human approval (Docker shield)"
+    },
+    {
+      "name": "shield:docker:review-image-rm",
+      "tool": "*",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "docker\\s+image\\s+rm\\b",
+          "flags": "i"
+        }
+      ],
+      "verdict": "review",
+      "reason": "Image removal requires human approval (Docker shield)"
+    },
+    {
+      "name": "shield:docker:review-rmi-force",
+      "tool": "*",
+      "conditionMode": "all",
+      "conditions": [
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "docker\\s+rmi\\b",
+          "flags": "i"
+        },
+        {
+          "field": "command",
+          "op": "matches",
+          "value": "(^|\\s)(-f|--force)(\\s|$)",
+          "flags": "i"
+        }
+      ],
+      "verdict": "review",
+      "reason": "Force image removal requires human approval (Docker shield)"
+    }
+  ],
+  "dangerousWords": []
+}