@node9/proxy 2.0.0 → 2.1.0

package/dist/index.js

@@ -4847,11 +4847,13 @@ function getConfig(cwd) {
   }
   const shieldOverrides = readShieldOverrides();
   const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  const appliedShields = [];
   const cloudManagedSet = new Set(cloudManagedShields);
   for (const shieldName of activeShieldNames) {
     const isCloudMandated = cloudManagedSet.has(shieldName);
     const shield = isCloudMandated ? BUILTIN_SHIELDS[shieldName] : getShield(shieldName);
     if (!shield) continue;
+    appliedShields.push(shieldName);
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
     const ruleOverrides = isCloudMandated ? {} : shieldOverrides[shieldName] ?? {};
     for (const rule of shield.smartRules) {
@@ -4873,6 +4875,7 @@ function getConfig(cwd) {
       if (!existingWords.has(word)) mergedPolicy.dangerousWords.push(word);
     }
   }
+  mergedPolicy.appliedShields = appliedShields.sort();
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
   const cc = mergedPolicy.commandChecks ?? {};
   const advisoryKnobKey = (name) => {

package/dist/index.mjs

@@ -4817,11 +4817,13 @@ function getConfig(cwd) {
   }
   const shieldOverrides = readShieldOverrides();
   const activeShieldNames = [.../* @__PURE__ */ new Set([...readActiveShields(), ...cloudManagedShields])];
+  const appliedShields = [];
   const cloudManagedSet = new Set(cloudManagedShields);
   for (const shieldName of activeShieldNames) {
     const isCloudMandated = cloudManagedSet.has(shieldName);
     const shield = isCloudMandated ? BUILTIN_SHIELDS[shieldName] : getShield(shieldName);
     if (!shield) continue;
+    appliedShields.push(shieldName);
     const existingRuleNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
     const ruleOverrides = isCloudMandated ? {} : shieldOverrides[shieldName] ?? {};
     for (const rule of shield.smartRules) {
@@ -4843,6 +4845,7 @@ function getConfig(cwd) {
       if (!existingWords.has(word)) mergedPolicy.dangerousWords.push(word);
     }
   }
+  mergedPolicy.appliedShields = appliedShields.sort();
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
   const cc = mergedPolicy.commandChecks ?? {};
   const advisoryKnobKey = (name) => {

package/dist/scan-ink.mjs

@@ -152,6 +152,18 @@ function rollupByShield(sections, topRulesPerShield = 3) {
   }
   return out.sort((a, b) => b.totalCatches - a.totalCatches);
 }
+function originForRule(ruleName, sections, enabled) {
+  for (const section of sections) {
+    if (section.rules.some((r) => r.name === ruleName)) {
+      if (section.sourceType === "default") return "default";
+      if (section.sourceType === "shield") {
+        const key = section.shieldKey ?? section.id;
+        return enabled.has(key) ? `\u2713 shield:${key}` : `needs shield:${key}`;
+      }
+    }
+  }
+  return "";
+}
 function relativeDate(timestamp, now = /* @__PURE__ */ new Date()) {
   const t = new Date(timestamp).getTime();
   if (Number.isNaN(t)) return "?";
@@ -161,6 +173,11 @@ function relativeDate(timestamp, now = /* @__PURE__ */ new Date()) {
   return `${days}d`;
 }
 
+// src/cli/render/ink/panels/title-count.ts
+function topOf(shown, total) {
+  return total > shown ? ` \xB7 top ${shown} of ${total}` : "";
+}
+
 // src/cli/render/ink/panels/LeaksPanel.tsx
 import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
 var ROW_LIMIT = 4;
@@ -168,7 +185,10 @@ function LeaksPanel({ summary, width, now = /* @__PURE__ */ new Date() }) {
   const leaks = summary.leaks;
   if (leaks.length === 0) return null;
   return /* @__PURE__ */ jsxs5(Box5, { borderStyle: "round", borderColor: "red", paddingX: 1, flexDirection: "column", width, children: [
-    /* @__PURE__ */ jsx5(Text5, { bold: true, color: "red", children: "CREDENTIAL LEAKS" }),
+    /* @__PURE__ */ jsxs5(Text5, { bold: true, color: "red", children: [
+      "CREDENTIAL LEAKS",
+      /* @__PURE__ */ jsx5(Text5, { dimColor: true, children: topOf(Math.min(leaks.length, ROW_LIMIT), leaks.length) })
+    ] }),
     leaks.slice(0, ROW_LIMIT).map((leak, i) => /* @__PURE__ */ jsxs5(Box5, { children: [
       /* @__PURE__ */ jsx5(Box5, { width: 5, children: /* @__PURE__ */ jsx5(Text5, { dimColor: true, children: relativeDate(leak.timestamp, now).padStart(4) }) }),
       /* @__PURE__ */ jsx5(Box5, { width: 16, children: /* @__PURE__ */ jsx5(Text5, { color: "red", bold: true, wrap: "truncate-end", children: leak.patternName }) }),
@@ -188,30 +208,31 @@ function LeaksPanel({ summary, width, now = /* @__PURE__ */ new Date() }) {
 // src/cli/render/ink/panels/BlockedPanel.tsx
 import { Box as Box6, Text as Text6 } from "ink";
 import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
-function originForRule(ruleName, sections) {
-  for (const section of sections) {
-    if (section.rules.some((r) => r.name === ruleName)) {
-      if (section.sourceType === "default") return "default";
-      if (section.sourceType === "shield") {
-        return `needs shield:${section.shieldKey ?? section.id}`;
-      }
-    }
-  }
-  return "";
-}
 var ROW_LIMIT2 = 12;
-function BlockedPanel({ summary, width }) {
-  const rules = topRulesByVerdict(summary.sections, "block", ROW_LIMIT2);
+function BlockedPanel({
+  summary,
+  width,
+  enabledShields = []
+}) {
+  const enabled = new Set(enabledShields);
+  const allRules = topRulesByVerdict(summary.sections, "block", Number.MAX_SAFE_INTEGER);
+  const rules = allRules.slice(0, ROW_LIMIT2);
   if (rules.length === 0) return null;
+  const origins = rules.map((r) => originForRule(r.name, summary.sections, enabled));
+  const anyNeeds = origins.some((o) => o.startsWith("needs shield:"));
+  const footer = enabled.size === 0 ? "\u2192 install node9 + enable shields above" : anyNeeds ? "\u2192 \u2713 marks rules from enabled shields \xB7 enable the rest above" : "\u2192 \u2713 all these rules come from enabled shields";
   return /* @__PURE__ */ jsxs6(Box6, { borderStyle: "round", borderColor: "red", paddingX: 1, flexDirection: "column", width, children: [
-    /* @__PURE__ */ jsx6(Text6, { bold: true, color: "red", children: "WOULD HAVE BLOCKED" }),
+    /* @__PURE__ */ jsxs6(Text6, { bold: true, color: "red", children: [
+      "WOULD HAVE BLOCKED",
+      /* @__PURE__ */ jsx6(Text6, { dimColor: true, children: topOf(rules.length, allRules.length) })
+    ] }),
     rules.map((rule, i) => /* @__PURE__ */ jsxs6(Box6, { children: [
       /* @__PURE__ */ jsx6(Box6, { width: 3, children: /* @__PURE__ */ jsx6(Text6, { color: "red", children: "\u2717" }) }),
       /* @__PURE__ */ jsx6(Box6, { width: 24, children: /* @__PURE__ */ jsx6(Text6, { bold: true, wrap: "truncate-end", children: rule.name }) }),
       /* @__PURE__ */ jsx6(Box6, { width: 6, children: /* @__PURE__ */ jsx6(Text6, { bold: true, children: `\xD7${rule.count}` }) }),
-      /* @__PURE__ */ jsx6(Text6, { dimColor: true, wrap: "truncate-end", children: originForRule(rule.name, summary.sections) })
+      /* @__PURE__ */ jsx6(Text6, { dimColor: true, wrap: "truncate-end", children: originForRule(rule.name, summary.sections, enabled) })
     ] }, i)),
-    /* @__PURE__ */ jsx6(Box6, { children: /* @__PURE__ */ jsx6(Text6, { dimColor: true, wrap: "truncate-end", children: "\u2192 install node9 + enable shields above" }) })
+    /* @__PURE__ */ jsx6(Box6, { children: /* @__PURE__ */ jsx6(Text6, { dimColor: true, wrap: "truncate-end", children: footer }) })
   ] });
 }
 
@@ -219,14 +240,19 @@ function BlockedPanel({ summary, width }) {
 import { Box as Box7, Text as Text7 } from "ink";
 import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 var ROW_LIMIT3 = 4;
+var ENV_ROW_LIMIT = 3;
 function BlastRadiusPanel({
   blast,
   blastExposures,
   width
 }) {
   if (blastExposures === 0) return null;
+  const shown = Math.min(blast.reachable.length, ROW_LIMIT3) + Math.min(blast.envFindings.length, ENV_ROW_LIMIT);
   return /* @__PURE__ */ jsxs7(Box7, { borderStyle: "round", borderColor: "yellow", paddingX: 1, flexDirection: "column", width, children: [
-    /* @__PURE__ */ jsx7(Text7, { bold: true, color: "yellow", children: "BLAST RADIUS" }),
+    /* @__PURE__ */ jsxs7(Text7, { bold: true, color: "yellow", children: [
+      "BLAST RADIUS",
+      /* @__PURE__ */ jsx7(Text7, { dimColor: true, children: topOf(shown, blastExposures) })
+    ] }),
     blast.reachable.slice(0, ROW_LIMIT3).map((path, i) => {
       const desc = path.description.split(" \u2014 ")[0].split(/—|--/)[0].trim();
       return /* @__PURE__ */ jsxs7(Box7, { children: [
@@ -251,19 +277,13 @@ function BlastRadiusPanel({
 // src/cli/render/ink/panels/ReviewQueuePanel.tsx
 import { Box as Box8, Text as Text8 } from "ink";
 import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
-function originForRule2(ruleName, sections) {
-  for (const section of sections) {
-    if (section.rules.some((r) => r.name === ruleName)) {
-      if (section.sourceType === "default") return "default";
-      if (section.sourceType === "shield") {
-        return `needs shield:${section.shieldKey ?? section.id}`;
-      }
-    }
-  }
-  return "";
-}
 var ROW_LIMIT4 = 5;
-function ReviewQueuePanel({ summary, width }) {
+function ReviewQueuePanel({
+  summary,
+  width,
+  enabledShields = []
+}) {
+  const enabled = new Set(enabledShields);
   const rules = topRulesByVerdict(summary.sections, "review", ROW_LIMIT4);
   if (rules.length === 0) return null;
   return /* @__PURE__ */ jsxs8(Box8, { borderStyle: "round", borderColor: "gray", paddingX: 1, flexDirection: "column", width, children: [
@@ -271,7 +291,7 @@ function ReviewQueuePanel({ summary, width }) {
     rules.map((rule, i) => /* @__PURE__ */ jsxs8(Box8, { children: [
       /* @__PURE__ */ jsx8(Box8, { width: 22, children: /* @__PURE__ */ jsx8(Text8, { wrap: "truncate-end", children: rule.name }) }),
       /* @__PURE__ */ jsx8(Box8, { width: 6, children: /* @__PURE__ */ jsx8(Text8, { bold: true, children: `\xD7${rule.count}` }) }),
-      /* @__PURE__ */ jsx8(Text8, { dimColor: true, wrap: "truncate-end", children: originForRule2(rule.name, summary.sections) })
+      /* @__PURE__ */ jsx8(Text8, { dimColor: true, wrap: "truncate-end", children: originForRule(rule.name, summary.sections, enabled) })
     ] }, i)),
     /* @__PURE__ */ jsxs8(Box8, { children: [
       /* @__PURE__ */ jsx8(Text8, { dimColor: true, wrap: "truncate-end", children: "\u2192 " }),
@@ -304,7 +324,10 @@ function AgentLoopsPanel({ loopFindings, width }) {
   const toolEntries = [...byTool.entries()].sort((a, b) => b[1] - a[1]).slice(0, TOOL_ROW_LIMIT);
   const topStuck = [...loopFindings].sort((a, b) => b.count - a.count).slice(0, STUCK_ROW_LIMIT);
   return /* @__PURE__ */ jsxs9(Box9, { borderStyle: "round", borderColor: "gray", paddingX: 1, flexDirection: "column", width, children: [
-    /* @__PURE__ */ jsx9(Text9, { bold: true, children: "AGENT LOOPS" }),
+    /* @__PURE__ */ jsxs9(Text9, { bold: true, children: [
+      "AGENT LOOPS",
+      /* @__PURE__ */ jsx9(Text9, { dimColor: true, children: topOf(toolEntries.length, byTool.size) })
+    ] }),
     toolEntries.map(([tool, repeats]) => {
       const pct = totalRepeats > 0 ? Math.round(repeats / totalRepeats * 100) : 0;
       return /* @__PURE__ */ jsxs9(Box9, { children: [
@@ -1651,9 +1674,9 @@ var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 
 // src/cli/render/ink/panels/ShieldsPanel.tsx
 import { jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
-function ShieldsPanel({ summary, blastScore, width }) {
+function ShieldsPanel({ summary, width, enabledShields = [] }) {
+  const enabled = new Set(enabledShields);
   const impacts = rollupByShield(summary.sections);
-  const exposed = Math.max(0, 100 - blastScore);
   const ranked = [...impacts].sort((a, b) => {
     const aDiscount = PROTECTIVE_SHIELD_DISCOUNTS[a.shieldName] ?? 0;
     const bDiscount = PROTECTIVE_SHIELD_DISCOUNTS[b.shieldName] ?? 0;
@@ -1662,30 +1685,30 @@ function ShieldsPanel({ summary, blastScore, width }) {
   });
   const hitShields = ranked.filter((i) => i.totalCatches > 0);
   const hitNames = new Set(hitShields.map((i) => i.shieldName));
-  const zeroHitBuiltins = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitNames.has(name)).sort();
-  const topRec = hitShields.find((r) => (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0);
-  const topRecBonus = topRec ? Math.round(exposed * (PROTECTIVE_SHIELD_DISCOUNTS[topRec.shieldName] ?? 0)) : 0;
+  const zeroHitAll = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitNames.has(name)).sort();
+  const zeroHitBuiltins = zeroHitAll.filter((name) => !enabled.has(name));
+  const zeroHitEnabled = zeroHitAll.filter((name) => enabled.has(name));
+  const topRec = hitShields.find(
+    (r) => (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0 && !enabled.has(r.shieldName)
+  );
+  const allCovered = !topRec && hitShields.some(
+    (r) => (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0 && enabled.has(r.shieldName)
+  );
   return /* @__PURE__ */ jsxs10(Box10, { borderStyle: "round", borderColor: "cyan", paddingX: 1, flexDirection: "column", width, children: [
     /* @__PURE__ */ jsx10(Text10, { bold: true, color: "cyan", children: "SHIELDS" }),
     hitShields.map((impact) => {
       const discount = PROTECTIVE_SHIELD_DISCOUNTS[impact.shieldName] ?? 0;
-      const bonus = Math.round(exposed * discount);
+      const isOn = enabled.has(impact.shieldName);
       const noun = `op${impact.totalCatches !== 1 ? "s" : ""}`;
       return /* @__PURE__ */ jsxs10(Box10, { children: [
         /* @__PURE__ */ jsx10(Box10, { width: 16, children: /* @__PURE__ */ jsx10(Text10, { bold: true, color: discount > 0 ? "cyan" : void 0, dimColor: discount === 0, children: impact.shieldName }) }),
         /* @__PURE__ */ jsx10(Box10, { width: 20, children: /* @__PURE__ */ jsx10(Text10, { dimColor: true, children: `catches ${impact.totalCatches} ${noun}` }) }),
-        bonus > 0 ? /* @__PURE__ */ jsx10(
-          Text10,
-          {
-            bold: true,
-            color: "green",
-            children: `\u2192 +${bonus} pts (${blastScore} \u2192 ${blastScore + bonus})`
-          }
-        ) : null
+        isOn ? /* @__PURE__ */ jsx10(Text10, { bold: true, color: "green", children: `\u2713 enabled` }) : discount > 0 ? /* @__PURE__ */ jsx10(Text10, { bold: true, color: "green", children: `\u2192 blocks these reads in-path` }) : null
       ] }, impact.shieldName);
     }),
+    zeroHitEnabled.length > 0 ? /* @__PURE__ */ jsx10(Box10, { flexDirection: "column", children: /* @__PURE__ */ jsx10(Text10, { dimColor: true, wrap: "truncate-end", children: "\u2713 active: " + zeroHitEnabled.join(" \xB7 ") + "  (no hits in this history)" }) }) : null,
     zeroHitBuiltins.length > 0 ? /* @__PURE__ */ jsx10(Box10, { flexDirection: "column", children: /* @__PURE__ */ jsx10(Text10, { dimColor: true, wrap: "truncate-end", children: zeroHitBuiltins.join(" \xB7 ") + "  (no hits \u2014 install proactively)" }) }) : null,
-    topRec ? /* @__PURE__ */ jsx10(Box10, { children: /* @__PURE__ */ jsx10(Text10, { color: "cyan", bold: true, children: `\u2192 node9 shield enable ${topRec.shieldName}   (start here \u2014 +${topRecBonus} pts)` }) }) : null
+    topRec ? /* @__PURE__ */ jsx10(Box10, { children: /* @__PURE__ */ jsx10(Text10, { color: "cyan", bold: true, children: `\u2192 node9 shield enable ${topRec.shieldName}   (start here \u2014 widest coverage)` }) }) : allCovered ? /* @__PURE__ */ jsx10(Box10, { children: /* @__PURE__ */ jsx10(Text10, { color: "green", bold: true, children: "\u2713 recommended shields are enabled" }) }) : null
   ] });
 }
 
@@ -1708,7 +1731,7 @@ function StaticScorecard({ input, rangeLabel, now }) {
       parts.push(`${leakCount} secret${leakCount !== 1 ? "s" : ""} leaked`);
     }
     if (blockedCount > 0) {
-      parts.push(`${blockedCount} op${blockedCount !== 1 ? "s" : ""} blocked`);
+      parts.push(`${blockedCount} op${blockedCount !== 1 ? "s" : ""} would be blocked`);
     }
     return `Critical (${parts.join(" + ")})`;
   })();
@@ -1723,14 +1746,27 @@ function StaticScorecard({ input, rangeLabel, now }) {
       /* @__PURE__ */ jsx11(SeverityBand, { label: criticalLabel, width }),
       /* @__PURE__ */ jsxs11(Box11, { flexDirection: "row", gap: 1, children: [
         /* @__PURE__ */ jsx11(LeaksPanel, { summary, width: halfWidth, now }),
-        /* @__PURE__ */ jsx11(BlockedPanel, { summary, width: halfWidth })
+        /* @__PURE__ */ jsx11(
+          BlockedPanel,
+          {
+            summary,
+            width: halfWidth,
+            enabledShields: input.enabledShields
+          }
+        )
       ] })
     ] }) : null,
     input.blastExposures > 0 ? /* @__PURE__ */ jsxs11(Fragment2, { children: [
       /* @__PURE__ */ jsx11(
         SeverityBand,
         {
-          label: `High (${input.blastExposures} path${input.blastExposures !== 1 ? "s" : ""} reachable on disk)`,
+          label: (() => {
+            const paths = input.blast.reachable.length;
+            const envs = input.blast.envFindings.length;
+            const pathPart = `${paths} path${paths !== 1 ? "s" : ""}`;
+            const envPart = envs > 0 ? ` + ${envs} env var${envs !== 1 ? "s" : ""}` : "";
+            return `High (${pathPart}${envPart} reachable)`;
+          })(),
           width
         }
       ),
@@ -1747,23 +1783,33 @@ function StaticScorecard({ input, rangeLabel, now }) {
       const reviewCount = input.reviewCount;
       const loopCount = input.scan.loopFindings.length;
       if (reviewCount === 0 && loopCount === 0) return null;
-      const { wastePct } = computeLoopWaste(input.scan.loopFindings, input.scan.totalToolCalls);
+      const { wastePct, wastedCalls } = computeLoopWaste(
+        input.scan.loopFindings,
+        input.scan.totalToolCalls
+      );
       const parts = [];
       if (reviewCount > 0) parts.push(`${reviewCount} op${reviewCount !== 1 ? "s" : ""} flagged`);
       if (loopCount > 0)
         parts.push(
-          `${loopCount} loop${loopCount !== 1 ? "s" : ""}${wastePct > 0 ? ` \xB7 ${wastePct}% wasted` : ""}`
+          `${loopCount} loop${loopCount !== 1 ? "s" : ""}${wastedCalls > 0 ? ` \xB7 ${wastedCalls} wasted calls (${wastePct}% of all calls)` : ""}`
         );
       return /* @__PURE__ */ jsxs11(Fragment2, { children: [
         /* @__PURE__ */ jsx11(SeverityBand, { label: `Medium (${parts.join(" \xB7 ")})`, width }),
         /* @__PURE__ */ jsxs11(Box11, { flexDirection: "row", gap: 1, children: [
-          /* @__PURE__ */ jsx11(ReviewQueuePanel, { summary: input.summary, width: halfWidth }),
+          /* @__PURE__ */ jsx11(
+            ReviewQueuePanel,
+            {
+              summary: input.summary,
+              width: halfWidth,
+              enabledShields: input.enabledShields
+            }
+          ),
           /* @__PURE__ */ jsx11(AgentLoopsPanel, { loopFindings: input.scan.loopFindings, width: halfWidth })
         ] })
       ] });
     })(),
     /* @__PURE__ */ jsx11(SeverityBand, { label: "Recommended action", width }),
-    /* @__PURE__ */ jsx11(ShieldsPanel, { summary: input.summary, blastScore: input.blast.score, width })
+    /* @__PURE__ */ jsx11(ShieldsPanel, { summary: input.summary, width, enabledShields: input.enabledShields })
   ] });
 }
 function renderScanScorecardInk(input, rangeLabel) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",