@node9/proxy 2.11.0 → 2.12.0

package/dist/cli.mjs

@@ -57928,6 +57928,50 @@ function readLocalTree(dir) {
   }
   return { source: root, files, notes };
 }
+function readGitRefTree(dir, ref) {
+  const root = dir.replace(/^~/, process.env.HOME ?? "~");
+  if (!ref || ref.startsWith("-")) return null;
+  const git = (args) => {
+    try {
+      return execFileSync2("git", ["-C", root, ...args], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 32 * 1024 * 1024,
+        timeout: 2e4
+      });
+    } catch {
+      return null;
+    }
+  };
+  const sha = git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`])?.trim();
+  if (!sha) return null;
+  const listing = git(["ls-tree", "-r", "--name-only", "-z", sha]);
+  if (listing === null) return null;
+  const all = listing.split("\0").filter(Boolean);
+  const notes = [];
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  const present = new Set(all);
+  const add = (rel) => {
+    if (seen.has(rel) || !present.has(rel)) return;
+    seen.add(rel);
+    const content = git(["show", `${sha}:${rel}`]);
+    if (content !== null) files.push({ path: rel, content });
+  };
+  for (const rel of SURFACE_FILES) add(rel);
+  const nested = all.filter((rel) => SURFACE_BASENAME.test(rel) && !isIgnoredDir(rel));
+  if (nested.length > MAX_SURFACE_FILES) {
+    notes.push(
+      `repo is large \u2014 some agent-surface files may be INCOMPLETE (capped at ${MAX_SURFACE_FILES} files).`
+    );
+  }
+  for (const rel of nested.slice(0, MAX_SURFACE_FILES)) add(rel);
+  for (const rel of all) {
+    if (rel.startsWith(`${WORKFLOW_DIR}/`) && /\.ya?ml$/.test(rel) && !rel.slice(WORKFLOW_DIR.length + 1).includes("/"))
+      add(rel);
+  }
+  return { source: `${root}@${ref}`, files, notes };
+}
 async function fetchTree(input, onProgress) {
   if (isLocalPath(input)) return readLocalTree(input);
   const parsed = parseRepoUrl(input);
@@ -58349,6 +58393,8 @@ function analyzeWorkflow(path77, content) {
   const title = severity === "critical" || severity === "high" ? "Injectable agent workflow \u2014 untrusted input reaches a tool-using agent with secrets" : severity === "medium" ? "Agent workflow with a risky pattern (partially mitigated)" : "Agent workflow on a privileged trigger \u2014 review the actor gate";
   return {
     check: "CI-2",
+    // One verdict per workflow file — the finding IS the file's reachability score.
+    rule: "CI-2.injectable-workflow",
     dimension: "workflows",
     severity,
     title,
@@ -58445,6 +58491,7 @@ function analyzeWorkflowSecrets(path77, content) {
   if (!worst) return null;
   return {
     check: "CI-4",
+    rule: "CI-4.agent-reachable-secret",
     dimension: "data",
     severity: worst.severity,
     title: worst.severity === "advisory" ? "Secrets reachable by the agent \u2014 hardening" : "Exfiltratable secrets reachable by an injectable agent",
@@ -58491,6 +58538,10 @@ function analyzeAgentConfig(path77, content) {
     const high = remoteExec || unpinned;
     findings.push({
       check: "CI-1",
+      rule: "CI-1.hook-remote-code",
+      // Identity is the command itself: the same hook keeps its identity when its
+      // severity changes (pinned → unpinned), and two different hooks stay distinct.
+      locator: cmd,
       dimension: "toolRules",
       severity: high ? "high" : "medium",
       title: high ? "Agent hook runs UNPINNED/remote third-party code on every action" : "Agent hook runs third-party code in the agent hot path",
@@ -58511,6 +58562,9 @@ function analyzeAgentConfig(path77, content) {
     const hasBackstop = deny.some((d) => /Bash|Write|Edit/.test(d));
     findings.push({
       check: "CI-1",
+      rule: "CI-1.broad-allow",
+      // File-level: one finding per config file. Adding a SECOND broad allow makes the
+      // same statement about the same file, so it must not read as a new finding.
       dimension: "toolRules",
       severity: hasBackstop ? "medium" : "high",
       title: hasBackstop ? "Committed agent config pre-authorizes broad tools" : "Committed agent config pre-authorizes broad tools with no deny backstop",
@@ -58544,6 +58598,8 @@ function analyzeMcpServers(servers, path77) {
     if (/\bnpx\b/.test(argv) && (/@latest\b/.test(argv) || !/@\d/.test(argv))) {
       findings.push({
         check: "CI-3",
+        rule: "CI-3.mcp-unpinned",
+        locator: name,
         dimension: "mcp",
         severity: "medium",
         title: `MCP server "${name}" runs an unpinned executable`,
@@ -58558,6 +58614,8 @@ function analyzeMcpServers(servers, path77) {
       if (hit) {
         findings.push({
           check: "CI-3",
+          rule: "CI-3.mcp-inline-credential",
+          locator: `${name}.env.${k}`,
           dimension: "mcp",
           severity: "high",
           title: `MCP server "${name}" has an inline credential`,
@@ -58595,6 +58653,10 @@ function analyzeCodexConfig(path77, content) {
     ].filter((s) => s !== null);
     findings.push({
       check: "CI-1",
+      // One finding per Codex config; `danger-full-access` vs `approval_policy = never`
+      // are two severities of the same statement, so tightening one is a de-escalation
+      // of THIS finding rather than the removal of one and the arrival of another.
+      rule: "CI-1.codex-unsafe-defaults",
       dimension: "toolRules",
       severity: fullAccess ? "high" : "medium",
       title: fullAccess ? "Codex config grants a full-access sandbox" : "Codex config never requires approval",
@@ -58654,8 +58716,17 @@ function decodeSuspiciousBase64(text) {
   }
   return out;
 }
-function mk(severity, title, signals, fix, path77) {
-  return { check: "CI-6", dimension: "instructions", severity, title, file: path77, signals, fix };
+function mk(rule, severity, title, signals, fix, path77) {
+  return {
+    check: "CI-6",
+    rule,
+    dimension: "instructions",
+    severity,
+    title,
+    file: path77,
+    signals,
+    fix
+  };
 }
 function analyzeInstructionFile(path77, content) {
   const findings = [];
@@ -58663,6 +58734,7 @@ function analyzeInstructionFile(path77, content) {
   if (TAG_CHARS.test(content))
     findings.push(
       mk(
+        "CI-6.unicode-tag-chars",
         "critical",
         "Unicode tag characters in an agent instruction file",
         [
@@ -58675,6 +58747,7 @@ function analyzeInstructionFile(path77, content) {
   if (BIDI_OVERRIDE.test(content))
     findings.push(
       mk(
+        "CI-6.bidi-override",
         "critical",
         "Bidirectional override characters in an agent instruction file",
         [
@@ -58687,6 +58760,7 @@ function analyzeInstructionFile(path77, content) {
   else if (BIDI_EMBED_ISOLATE.test(content))
     findings.push(
       mk(
+        "CI-6.bidi-formatting",
         "advisory",
         "Bidirectional formatting characters in an agent instruction file",
         [
@@ -58701,6 +58775,7 @@ function analyzeInstructionFile(path77, content) {
     const revealed = OVERRIDE_RE.test(stripZeroWidth(content)) && !OVERRIDE_RE.test(content);
     findings.push(
       mk(
+        "CI-6.zero-width",
         revealed ? "critical" : "medium",
         "Zero-width characters splitting text in an agent instruction file",
         [
@@ -58717,6 +58792,7 @@ function analyzeInstructionFile(path77, content) {
     const m = ov || ovEnc;
     findings.push(
       mk(
+        "CI-6.prompt-override",
         ovEnc ? "critical" : "high",
         "Prompt-override directive in an agent instruction file",
         [
@@ -58731,6 +58807,7 @@ function analyzeInstructionFile(path77, content) {
   if (fo && !inHumanSection(content, fo.index) && !isNegated(content, fo.index)) {
     findings.push(
       mk(
+        "CI-6.fetch-and-obey",
         "medium",
         "Instruction directs the agent to fetch and run remote code",
         [`\`${fo[0].slice(0, 70).trim()}\` \u2014 fetch-and-obey, outside an install/setup section`],
@@ -58743,6 +58820,7 @@ function analyzeInstructionFile(path77, content) {
   if (sp && !isNegated(content, sp.index)) {
     findings.push(
       mk(
+        "CI-6.secret-path",
         "medium",
         "Instruction points the agent at credential material",
         [`references \`${sp[0].slice(0, 50).trim()}\` \u2014 directs the agent toward secrets`],
@@ -58755,6 +58833,7 @@ function analyzeInstructionFile(path77, content) {
   if (ex && !inHumanSection(content, ex.index) && !isNegated(content, ex.index)) {
     findings.push(
       mk(
+        "CI-6.exfil-directive",
         "medium",
         "Instruction directs the agent to send data to an external endpoint",
         [`\`${ex[0].slice(0, 70).trim()}\` \u2014 possible exfiltration directive`],
@@ -58766,8 +58845,82 @@ function analyzeInstructionFile(path77, content) {
   return findings;
 }
 
+// src/ci-check/diff.ts
+import { createHash as createHash4 } from "crypto";
+function fingerprintOf(f) {
+  const key = JSON.stringify([f.rule, f.file, f.locator ?? "", f.ordinal ?? 0]);
+  return createHash4("sha256").update(key).digest("hex").slice(0, 16);
+}
+function assignOrdinals(findings) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const key = JSON.stringify([f.rule, f.file, f.locator ?? ""]);
+    const n = seen.get(key) ?? 0;
+    if (n > 0) f.ordinal = n;
+    seen.set(key, n + 1);
+  }
+  return findings;
+}
+function worstOf(severities) {
+  let worst = null;
+  for (const s of severities) {
+    if (!worst || SEVERITY_RANK2[s] > SEVERITY_RANK2[worst]) worst = s;
+  }
+  return worst;
+}
+function baseStateOf(base) {
+  if (!base) return "did-not-run";
+  return base.incomplete ? "incomplete" : "ok";
+}
+function diffScans(base, head) {
+  const state = baseStateOf(base);
+  if (state !== "ok" || !base) {
+    return {
+      base: state,
+      added: [],
+      removed: [],
+      unchanged: [...head.findings],
+      escalated: [],
+      worstIntroduced: head.worst,
+      incomplete: true
+    };
+  }
+  const baseByFp = /* @__PURE__ */ new Map();
+  for (const f of base.findings) baseByFp.set(fingerprintOf(f), f);
+  const added = [];
+  const unchanged = [];
+  const escalated = [];
+  const matched = /* @__PURE__ */ new Set();
+  for (const f of head.findings) {
+    const fp = fingerprintOf(f);
+    const prior = baseByFp.get(fp);
+    if (!prior) {
+      added.push(f);
+      continue;
+    }
+    matched.add(fp);
+    if (SEVERITY_RANK2[f.severity] > SEVERITY_RANK2[prior.severity]) {
+      escalated.push({ finding: f, from: prior.severity, to: f.severity });
+    } else {
+      unchanged.push(f);
+    }
+  }
+  const removed = base.findings.filter((f) => !matched.has(fingerprintOf(f)));
+  return {
+    base: state,
+    added,
+    removed,
+    unchanged,
+    escalated,
+    worstIntroduced: worstOf([...added.map((f) => f.severity), ...escalated.map((e) => e.to)]),
+    // The head side of the same guard: a scan that could not read every file has not
+    // earned the word "clean", however trustworthy the base was.
+    incomplete: head.incomplete
+  };
+}
+
 // src/ci-check/index.ts
-function worstOf(findings) {
+function worstOf2(findings) {
   let worst = null;
   for (const f of findings) {
     if (!worst || SEVERITY_RANK2[f.severity] > SEVERITY_RANK2[worst]) worst = f.severity;
@@ -58801,11 +58954,12 @@ function scanTree(tree) {
       notes.push(`checker degraded on ${file.path}: ${err2?.message ?? "error"}`);
     }
   }
+  assignOrdinals(findings);
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
   const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
+  return { source: tree.source, findings, inspected, notes, worst: worstOf2(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -58859,12 +59013,37 @@ function renderCta(res) {
 function ownedHint(source) {
   return source.startsWith("/") || source.startsWith(".") || source.startsWith("~");
 }
-function renderScan(res) {
+function findingMd(f, L) {
+  L.push(`**${ICON2[f.severity]} ${f.severity.toUpperCase()} \u2014 ${f.title}**`);
+  L.push(`\`${f.file}${f.line ? ":" + f.line : ""}\`  \xB7  ${f.rule}`);
+  L.push("");
+  for (const s of f.signals) L.push(`- ${s}`);
+  if (f.mitigations?.length) L.push(`- _mitigated:_ ${f.mitigations.join("; ")}`);
+  L.push("");
+  L.push(`\u2192 **Fix:** ${f.fix}`);
+  L.push("");
+}
+function baseWarning(base) {
+  return base === "did-not-run" ? '\u26A0\uFE0F **Could not read the base commit**, so nothing below can be called "new" \u2014 every finding in this repo is listed. (A shallow clone is the usual cause: fetch the base ref.)' : "\u26A0\uFE0F **The base scan could not read every file**, so a finding missing from it would look new. Every finding in this repo is listed instead.";
+}
+function renderScan(res, diff) {
   const L = [];
   const n = res.findings.length;
   const head = res.worst === "critical" || res.worst === "high" ? chalk32.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk32.yellow("agent-security notes") : res.incomplete ? chalk32.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk32.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${chalk32.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(chalk32.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (diff) {
+    const introduced = diff.added.length + diff.escalated.length;
+    L.push(
+      diff.base !== "ok" ? chalk32.yellow.bold(
+        `   \u26A0\uFE0F  base ${diff.base === "did-not-run" ? "could not be read" : "scan was incomplete"} \u2014 cannot say what is new; showing everything`
+      ) : introduced > 0 ? chalk32.red.bold(
+        `   \u26A0\uFE0F  this change introduced ${introduced} finding(s)` + (diff.escalated.length ? ` (${diff.escalated.length} by widening an existing one)` : "")
+      ) : chalk32.green(
+        `   \u2705 this change introduced nothing` + (diff.unchanged.length ? ` (${diff.unchanged.length} pre-existing)` : "") + (diff.removed.length ? `, and fixed ${diff.removed.length}` : "")
+      )
+    );
+  }
   if (res.incomplete) {
     const rateLimited = res.notes.some((nt) => /rate limit/i.test(nt));
     L.push(
@@ -58904,7 +59083,7 @@ function renderScan(res) {
   L.push(...renderCta(res));
   return L.join("\n");
 }
-function renderScanMarkdown(res) {
+function renderScanMarkdown(res, diff) {
   const L = [];
   const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
@@ -58913,25 +59092,57 @@ function renderScanMarkdown(res) {
     `Inspected ${res.inspected.length} config file(s) \xB7 **${res.findings.length} finding(s)**`
   );
   L.push("");
-  for (const f of res.findings) {
-    L.push(`**${ICON2[f.severity]} ${f.severity.toUpperCase()} \u2014 ${f.title}**`);
-    L.push(`\`${f.file}${f.line ? ":" + f.line : ""}\` \xB7 ${f.check}`);
-    L.push("");
-    for (const s of f.signals) L.push(`- ${s}`);
-    if (f.mitigations?.length) L.push(`- _mitigated:_ ${f.mitigations.join("; ")}`);
-    L.push("");
-    L.push(`\u2192 **Fix:** ${f.fix}`);
+  if (diff && diff.base === "ok") {
+    const introduced = [...diff.added, ...diff.escalated.map((e) => e.finding)];
+    if (introduced.length === 0) {
+      L.push(
+        `\u2705 **This change introduces no agent-security findings.**` + (diff.removed.length ? ` It also fixes ${diff.removed.length}.` : "")
+      );
+      L.push("");
+    } else {
+      L.push(`#### \u26A0\uFE0F Introduced by this change \u2014 ${introduced.length} finding(s)`);
+      L.push("");
+      for (const f of diff.added) findingMd(f, L);
+      for (const e of diff.escalated) {
+        L.push(
+          `> _Guardrail erosion: this finding already existed at **${e.from}** and this change widens it to **${e.to}**._`
+        );
+        L.push("");
+        findingMd(e.finding, L);
+      }
+    }
+    if (diff.removed.length) {
+      L.push(`\u2705 Fixed by this change: ${diff.removed.length} finding(s).`);
+      L.push("");
+    }
+    if (diff.unchanged.length) {
+      L.push(
+        `<details><summary>${diff.unchanged.length} pre-existing finding(s) \u2014 not introduced by this change</summary>`
+      );
+      L.push("");
+      for (const f of diff.unchanged) findingMd(f, L);
+      L.push("</details>");
+      L.push("");
+    }
+    return L.join("\n");
+  }
+  if (diff) {
+    L.push(baseWarning(diff.base));
     L.push("");
   }
+  for (const f of res.findings) findingMd(f, L);
   if (res.findings.length === 0) L.push("No committed agent-security issues found.");
   return L.join("\n");
 }
-function exitCodeFor(res) {
-  if (res.worst === "critical" || res.worst === "high") return 2;
-  if (res.worst === "medium") return 1;
-  if (res.incomplete) return 3;
+function exitCodeForSeverity(worst, incomplete) {
+  if (worst === "critical" || worst === "high") return 2;
+  if (worst === "medium") return 1;
+  if (incomplete) return 3;
   return 0;
 }
+function exitCodeFor(res) {
+  return exitCodeForSeverity(res.worst, res.incomplete);
+}
 
 // src/cli/commands/scan-repo.ts
 var SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -58957,23 +59168,36 @@ function makeProgress(target, quiet) {
   };
 }
 function registerScanRepoCommand(program2) {
-  program2.command("scan-repo <target>").description("Scan a repo's agent-security surface (GitHub URL or local path)").option("--json", "emit the raw result as JSON").option("--markdown", "emit a Markdown report (for a PR comment)").action(async (target, opts) => {
-    const { onProgress, done } = makeProgress(target, !!(opts.json || opts.markdown));
-    let res;
-    try {
-      res = await scanRepo(target, onProgress);
-    } finally {
-      done();
-    }
-    if (opts.json) {
-      console.log(JSON.stringify(res, null, 2));
-    } else if (opts.markdown) {
-      console.log(renderScanMarkdown(res));
-    } else {
-      console.log(renderScan(res));
+  program2.command("scan-repo <target>").description("Scan a repo's agent-security surface (GitHub URL or local path)").option("--json", "emit the raw result as JSON").option("--markdown", "emit a Markdown report (for a PR comment)").option(
+    "--base <ref>",
+    "also scan this git ref and report what the working tree INTRODUCED (local path targets only)"
+  ).option(
+    "--fail-on-introduced",
+    "exit non-zero only for findings this change introduced (requires --base)"
+  ).action(
+    async (target, opts) => {
+      const { onProgress, done } = makeProgress(target, !!(opts.json || opts.markdown));
+      let res;
+      try {
+        res = await scanRepo(target, onProgress);
+      } finally {
+        done();
+      }
+      let diff;
+      if (opts.base) {
+        const baseTree = readGitRefTree(target, opts.base);
+        diff = diffScans(baseTree ? scanTree(baseTree) : null, res);
+      }
+      if (opts.json) {
+        console.log(JSON.stringify(diff ? { ...res, diff } : res, null, 2));
+      } else if (opts.markdown) {
+        console.log(renderScanMarkdown(res, diff));
+      } else {
+        console.log(renderScan(res, diff));
+      }
+      process.exitCode = opts.failOnIntroduced && diff ? exitCodeForSeverity(diff.worstIntroduced, diff.incomplete) : exitCodeFor(res);
     }
-    process.exitCode = exitCodeFor(res);
-  });
+  );
 }
 
 // src/cli/commands/egress.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.11.0",
+  "version": "2.12.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -16,7 +16,7 @@
     "node9": "./dist/cli.js"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "workspaces": [
     "packages/*"
@@ -54,7 +54,6 @@
   "license": "Apache-2.0",
   "files": [
     "dist",
-    "docs",
     "README.md",
     "LICENSE"
   ],

package/docs/README.md

@@ -1,49 +0,0 @@
-# node9 documentation
-
-These pages are the source of truth for how node9 behaves. They live next to the code so the tests
-in this repository can check them: a page that names a command the CLI does not have, or a command
-with no page at all, fails CI.
-
-The site at [node9.ai/docs](https://node9.ai/docs) renders these same files.
-
-## Protections
-
-| Page                        | What it covers                                                                                                                           |
-| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| [Egress Control](egress.md) | Which hosts an agent may reach, the always-on floor around cloud metadata and private ranges, and what a destination gate does not cover |
-
-## Per agent
-
-[One page per agent](agents/README.md): how node9 is wired in, what that covers, and what it does
-not. Twelve agents, split by control model.
-
-## Reference
-
-| Page                        | What it covers                                                                                        |
-| --------------------------- | ----------------------------------------------------------------------------------------------------- |
-| [Comparison](comparison.md) | Where node9 sits among agent-security tools, on the axis of what a tool can read before an agent runs |
-| [Badges](badges.md)         | The `scanned by node9` badge for your own README                                                      |
-
-## Writing a page here
-
-Every page starts with front matter:
-
-```yaml
----
-id: egress
-label: Egress Control
-description: One sentence. It becomes the page's search description.
-group: Protections
-order: 20
----
-```
-
-`id` becomes the URL (`/docs/egress`), `group` places it in the site's left navigation, and `order`
-sorts it within that group. Use GitHub-flavoured Markdown plus GitHub alerts (`> [!NOTE]`,
-`> [!WARNING]`), which render in both places.
-
-Two rules the tests enforce:
-
-- Every command a page names must exist. Check with `node9 <command> --help` before you write it.
-- Every page must state what the feature does **not** do. A page that only sells is a page that
-  will be wrong within a release.

package/docs/agents/README.md

@@ -1,29 +0,0 @@
-# node9 per agent
-
-One page per agent: what node9 wires into it, what that covers, and what it does not. The
-"what is not covered" section is the one to read before you tell your team an agent is governed.
-
-| Agent                       | Control model | Prompt scan | Guide                                  |
-| --------------------------- | ------------- | ----------- | -------------------------------------- |
-| Claude Code                 | hooks + MCP   | yes         | [claude-code.md](claude-code.md)       |
-| Codex CLI                   | hooks + MCP   | yes         | [codex.md](codex.md)                   |
-| GitHub Copilot CLI          | hooks + MCP   | yes         | [copilot-cli.md](copilot-cli.md)       |
-| Gemini CLI                  | hooks + MCP   | no          | [gemini-cli.md](gemini-cli.md)         |
-| Antigravity                 | hooks + MCP   | no          | [antigravity.md](antigravity.md)       |
-| Hermes Agent                | hooks         | no          | [hermes.md](hermes.md)                 |
-| OpenCode                    | plugin        | yes         | [opencode.md](opencode.md)             |
-| Pi                          | extension     | yes         | [pi.md](pi.md)                         |
-| Cursor                      | MCP only      | no          | [cursor.md](cursor.md)                 |
-| Windsurf                    | MCP only      | no          | [windsurf.md](windsurf.md)             |
-| VS Code (Copilot extension) | MCP only      | no          | [vscode.md](vscode.md)                 |
-| Claude Desktop              | MCP only      | no          | [claude-desktop.md](claude-desktop.md) |
-
-"Hooks" means node9 sees every tool call before it runs. "MCP only" means node9 sees the tools
-that go through MCP servers and nothing the editor does on its own.
-
-Every page ends with the same two commands, and they are the real check:
-
-```bash
-node9 doctor
-node9 explain Bash 'cat ~/.ssh/id_rsa'
-```

package/docs/agents/antigravity.md

@@ -1,33 +0,0 @@
-# node9 with Antigravity
-
-| Surface           | How node9 is wired                                     | What it does                                |
-| ----------------- | ------------------------------------------------------ | ------------------------------------------- |
-| Every tool call   | `PreToolUse` hook in `~/.gemini/config/hooks.json`     | allow / review / block before the tool runs |
-| Every tool result | `PostToolUse` hook                                     | audit record                                |
-| MCP servers       | `~/.gemini/config/mcp_config.json` entries are wrapped | per-tool allow / review / block             |
-
-Payload shape verified against Antigravity 1.0.6.
-
-## Set it up
-
-```bash
-node9 agents add antigravity
-```
-
-`node9 init` does this for every agent it detects on the machine. Either command is safe to
-re-run; it repairs a hook that an agent update removed and leaves everything else alone.
-
-## What is not covered
-
-- **No prompt scan.** There is no prompt event to hook.
-- Cost is not tracked for Antigravity.
-
-## Verify it on this machine
-
-```bash
-node9 doctor                                   # is the hook (or MCP wrap) actually in place?
-node9 explain Bash 'cat ~/.ssh/id_rsa'         # shows the verdict the live hook enforces: BLOCK
-```
-
-`node9 explain` prints the exact rule that fires and where the decision came from. If `doctor`
-says the agent is not wired, the guard is not running, whatever the config looks like.

package/docs/agents/claude-code.md

@@ -1,40 +0,0 @@
-# node9 with Claude Code
-
-Claude Code is the most fully covered agent.
-
-| Surface           | How node9 is wired                                                | What it does                                              |
-| ----------------- | ----------------------------------------------------------------- | --------------------------------------------------------- |
-| Every tool call   | `PreToolUse` hook in `~/.claude/settings.json`                    | allow / review / block before the tool runs               |
-| Every tool result | `PostToolUse` hook                                                | writes the audit record                                   |
-| Pasted prompts    | `UserPromptSubmit` hook                                           | secret pasted into the prompt is caught before it is sent |
-| MCP servers       | entries in `~/.claude.json` are wrapped through the node9 gateway | per-tool allow / review / block                           |
-| Cost              | reads `~/.claude/projects` session logs                           | per-project spend in `node9 report`                       |
-
-The `PreToolUse` hook runs in every Claude Code permission mode, including
-`--dangerously-skip-permissions`. That was verified with a standalone probe, and it is
-undocumented behaviour, so treat it as a fact about today's Claude Code rather than a guarantee.
-
-## Set it up
-
-```bash
-node9 agents add claude
-```
-
-`node9 init` does this for every agent it detects on the machine. Either command is safe to
-re-run; it repairs a hook that an agent update removed and leaves everything else alone.
-
-## What is not covered
-
-- Tool **output** is observed, not gated. Claude Code's `PostToolUse` cannot suppress a
-  result, so a secret or an injected instruction inside a tool result is recorded and the
-  session is tainted for review on the next call; it is not stripped before Claude sees it.
-
-## Verify it on this machine
-
-```bash
-node9 doctor                                   # is the hook (or MCP wrap) actually in place?
-node9 explain Bash 'cat ~/.ssh/id_rsa'         # shows the verdict the live hook enforces: BLOCK
-```
-
-`node9 explain` prints the exact rule that fires and where the decision came from. If `doctor`
-says the agent is not wired, the guard is not running, whatever the config looks like.