@node9/proxy 2.14.1 → 2.14.3

package/dist/dashboard.mjs

@@ -1775,6 +1775,9 @@ function classifySsrf(host) {
     return null;
   }
 }
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -1936,7 +1939,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SOURCE_COMMANDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SOURCE_COMMANDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, TERMINAL_ESCAPE_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3150,6 +3153,7 @@ var init_dist = __esm({
       const p = a.split(".");
       return p.length === 4 ? p.map(Number) : null;
     };
+    TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -4656,6 +4660,51 @@ var init_trusted_hosts = __esm({
   }
 });
 
+// src/auth/api-url.ts
+function defaultHostSuffixes() {
+  const host = new URL(DEFAULT_API_URL).hostname.toLowerCase();
+  const parent = host.split(".").slice(1).join(".");
+  return parent.includes(".") ? [host, parent] : [host];
+}
+function allowedSuffixes() {
+  const extra = (process.env[HOST_ALLOW_ENV] ?? "").split(",").map(
+    (s) => s.trim().toLowerCase().replace(/^\*?\./, "")
+  ).filter(Boolean);
+  return [...defaultHostSuffixes(), ...extra];
+}
+function validateApiUrl(raw) {
+  if (typeof raw !== "string" || raw.length === 0 || raw.length > 2048) return null;
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (u.username || u.password) return null;
+  if (u.protocol !== "https:" && u.protocol !== "http:") return null;
+  const host = u.hostname.toLowerCase();
+  if (LOOPBACK.has(host)) return u;
+  if (u.protocol !== "https:") return null;
+  const suffixes = allowedSuffixes();
+  const ok = suffixes.some((s) => host === s || host.endsWith("." + s));
+  return ok ? u : null;
+}
+function safeApiUrl(raw, onReject) {
+  const ok = validateApiUrl(raw);
+  if (ok) return typeof raw === "string" ? raw : ok.toString();
+  onReject?.(raw);
+  return DEFAULT_API_URL;
+}
+var DEFAULT_API_URL, LOOPBACK, HOST_ALLOW_ENV;
+var init_api_url = __esm({
+  "src/auth/api-url.ts"() {
+    "use strict";
+    DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
+    LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]", "0.0.0.0"]);
+    HOST_ALLOW_ENV = "NODE9_API_HOST_ALLOW";
+  }
+});
+
 // src/config/index.ts
 import fs6 from "fs";
 import path7 from "path";
@@ -4674,12 +4723,26 @@ function sanitizeSsrfAllow(entries, source) {
   }
   return kept;
 }
+function noteRejectedApiUrl(raw) {
+  const key = String(raw).slice(0, 200);
+  if (rejectedApiUrlsSeen.has(key)) return;
+  rejectedApiUrlsSeen.add(key);
+  try {
+    fs6.appendFileSync(
+      path7.join(os7.homedir(), ".node9", "hook-debug.log"),
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] REFUSED apiUrl, using the default instead: ${String(raw).slice(0, 200).replace(/[\r\n]+/g, " ")}
+`
+    );
+  } catch {
+  }
+}
 function getCredentials() {
-  const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
   if (process.env.NODE9_API_KEY) {
     return {
       apiKey: process.env.NODE9_API_KEY,
-      apiUrl: process.env.NODE9_API_URL || DEFAULT_API_URL
+      // NODE9_API_URL is env, and a hook inherits the agent's env, so it is
+      // no more trusted than the file below.
+      apiUrl: safeApiUrl(process.env.NODE9_API_URL || DEFAULT_API_URL, noteRejectedApiUrl)
     };
   }
   try {
@@ -4691,14 +4754,14 @@ function getCredentials() {
       if (profile?.apiKey) {
         return {
           apiKey: profile.apiKey,
-          apiUrl: profile.apiUrl || DEFAULT_API_URL,
+          apiUrl: safeApiUrl(profile.apiUrl || DEFAULT_API_URL, noteRejectedApiUrl),
           localOnly: profile.localOnly === true || profileName !== "default"
         };
       }
       if (creds.apiKey) {
         return {
           apiKey: creds.apiKey,
-          apiUrl: creds.apiUrl || DEFAULT_API_URL,
+          apiUrl: safeApiUrl(creds.apiUrl || DEFAULT_API_URL, noteRejectedApiUrl),
           localOnly: creds.localOnly === true
         };
       }
@@ -5328,7 +5391,7 @@ ${error.replace("Invalid config:\n", "")}
   }
   return sanitized;
 }
-var DANGEROUS_WORDS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt;
+var DANGEROUS_WORDS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, rejectedApiUrlsSeen, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt;
 var init_config = __esm({
   "src/config/index.ts"() {
     "use strict";
@@ -5339,6 +5402,7 @@ var init_config = __esm({
     init_trusted_hosts();
     init_dist();
     init_dist();
+    init_api_url();
     DANGEROUS_WORDS = [
       "mkfs",
       // formats/wipes a filesystem partition
@@ -5612,6 +5676,7 @@ var init_config = __esm({
       }
     ];
     cachedConfig = null;
+    rejectedApiUrlsSeen = /* @__PURE__ */ new Set();
     lastParsedRulesCache = null;
     CACHE_LOG_REARM_MS = 5 * 60 * 1e3;
     cacheReadLastLoggedAt = 0;
@@ -5678,6 +5743,14 @@ var init_session_files = __esm({
   }
 });
 
+// src/utils/safe-text.ts
+var init_safe_text = __esm({
+  "src/utils/safe-text.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
 // src/costSync.ts
 function decodeProjectDirName(dirName) {
   return dirName.replace(/-/g, "/");
@@ -5693,6 +5766,7 @@ var init_costSync = __esm({
     init_cost_gemini();
     init_cost_copilot();
     init_session_files();
+    init_safe_text();
     SYNC_INTERVAL_MS = 10 * 60 * 1e3;
   }
 });
@@ -6602,6 +6676,13 @@ var init_setup_pi_shim = __esm({
   }
 });
 
+// src/utils/atomic-write.ts
+var init_atomic_write = __esm({
+  "src/utils/atomic-write.ts"() {
+    "use strict";
+  }
+});
+
 // src/setup.ts
 import chalk3 from "chalk";
 import { confirm as rawConfirm } from "@inquirer/prompts";
@@ -6614,6 +6695,7 @@ var init_setup = __esm({
     init_hook_baseline();
     init_setup_opencode_shim();
     init_setup_pi_shim();
+    init_atomic_write();
   }
 });
 
@@ -6638,6 +6720,7 @@ var init_scan_json = __esm({
 var init_scan_history = __esm({
   "src/cli/render/scan-history.ts"() {
     "use strict";
+    init_atomic_write();
   }
 });
 
@@ -6666,9 +6749,6 @@ function isNode9SelfOutput(text) {
   }
   return false;
 }
-function stripTerminalEscapes(s) {
-  return s.replace(TERMINAL_ESCAPE_RE, "");
-}
 function preview(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
   const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
@@ -7644,7 +7724,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
   }
   return result;
 }
-var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, TERMINAL_ESCAPE_RE, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
+var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
@@ -7670,6 +7750,7 @@ var init_scan = __esm({
     init_scan_json();
     init_session_files();
     init_scan_history();
+    init_safe_text();
     toolInspectionMap = DEFAULT_CONFIG.policy.toolInspection;
     CODE_EXTENSIONS = /* @__PURE__ */ new Set([
       ".ts",
@@ -7704,7 +7785,6 @@ var init_scan = __esm({
       /\bseverity:\s*['"](?:block|review|allow)['"]/,
       /NODE9 SECURITY ALERT/
     ];
-    TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     LOOP_TOOLS = /* @__PURE__ */ new Set([
       "bash",
       "execute_bash",