@node9/proxy 2.14.2 → 2.15.0

package/dist/index.mjs

@@ -1,7 +1,12 @@
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -377,8 +382,8 @@ var ConfigFileSchema = z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path15 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path15}: ${issue.message}`;
+    const path16 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path16}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -391,9 +396,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path15 of ordered) {
+  for (const path16 of ordered) {
     let cur = root;
-    for (const key of path15.slice(0, -1)) {
+    for (const key of path16.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -401,7 +406,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path15[path15.length - 1];
+    const last = path16[path16.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -437,7 +442,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path15) => path15.length > 0);
+      }).filter((path16) => path16.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -1349,9 +1354,9 @@ function matchesPattern(text, patterns) {
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
 var FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function getNestedValue(obj, path15) {
+function getNestedValue(obj, path16) {
   if (!obj || typeof obj !== "object") return null;
-  const segments2 = path15.split(".");
+  const segments2 = path16.split(".");
   for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -4016,9 +4021,9 @@ function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
 }
-function valuesAt(args, path15) {
+function valuesAt(args, path16) {
   let cursors = [args];
-  for (const rawSegment of path15.split(".")) {
+  for (const rawSegment of path16.split(".")) {
     const isArray = rawSegment.endsWith("[]");
     const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
     const next = [];
@@ -4050,15 +4055,15 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
     const exempt = new Set((opts.ssrfAllow ?? []).map((a) => classifySsrf(a)?.normalized ?? a));
-    for (const path15 of paths) {
-      for (const value of valuesAt(args, path15)) {
+    for (const path16 of paths) {
+      for (const value of valuesAt(args, path16)) {
         const host = hostOf(value);
         if (!host) continue;
         const m = classifySsrf(host);
         if (!m) continue;
         if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
         if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-        return { ...m, argPath: path15, host, reason: ssrfReason(m, host) };
+        return { ...m, argPath: path16, host, reason: ssrfReason(m, host) };
       }
     }
     return null;
@@ -4181,7 +4186,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         reason: dest.reason,
         ruleName: `ssrf:${dest.tier}:${toolName}:${dest.host}`,
         ruleDescription: dest.reason,
-        tier: 3
+        tier: 3,
+        overridable: dest.overridable
       };
     }
   }
@@ -4330,7 +4336,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
           reason: ssrf.reason,
           ruleName: `ssrf:${ssrf.tier}:${ssrf.binary}:${ssrf.host}`,
           ruleDescription: ssrf.reason,
-          tier: 3
+          tier: 3,
+          overridable: ssrf.overridable
         };
       }
     }
@@ -5836,6 +5843,45 @@ function isTrustedHost(host) {
   );
 }
 
+// src/auth/api-url.ts
+var DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
+var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]", "0.0.0.0"]);
+var HOST_ALLOW_ENV = "NODE9_API_HOST_ALLOW";
+function defaultHostSuffixes() {
+  const host = new URL(DEFAULT_API_URL).hostname.toLowerCase();
+  const parent = host.split(".").slice(1).join(".");
+  return parent.includes(".") ? [host, parent] : [host];
+}
+function allowedSuffixes() {
+  const extra = (process.env[HOST_ALLOW_ENV] ?? "").split(",").map(
+    (s) => s.trim().toLowerCase().replace(/^\*?\./, "")
+  ).filter(Boolean);
+  return [...defaultHostSuffixes(), ...extra];
+}
+function validateApiUrl(raw) {
+  if (typeof raw !== "string" || raw.length === 0 || raw.length > 2048) return null;
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (u.username || u.password) return null;
+  if (u.protocol !== "https:" && u.protocol !== "http:") return null;
+  const host = u.hostname.toLowerCase();
+  if (LOOPBACK.has(host)) return u;
+  if (u.protocol !== "https:") return null;
+  const suffixes = allowedSuffixes();
+  const ok = suffixes.some((s) => host === s || host.endsWith("." + s));
+  return ok ? u : null;
+}
+function safeApiUrl(raw, onReject) {
+  const ok = validateApiUrl(raw);
+  if (ok) return typeof raw === "string" ? raw : ok.toString();
+  onReject?.(raw);
+  return DEFAULT_API_URL;
+}
+
 // src/config/index.ts
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
@@ -6124,12 +6170,27 @@ var ADVISORY_SMART_RULES = [
   }
 ];
 var cachedConfig = null;
+var rejectedApiUrlsSeen = /* @__PURE__ */ new Set();
+function noteRejectedApiUrl(raw) {
+  const key = String(raw).slice(0, 200);
+  if (rejectedApiUrlsSeen.has(key)) return;
+  rejectedApiUrlsSeen.add(key);
+  try {
+    fs4.appendFileSync(
+      path4.join(os4.homedir(), ".node9", "hook-debug.log"),
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] REFUSED apiUrl, using the default instead: ${String(raw).slice(0, 200).replace(/[\r\n]+/g, " ")}
+`
+    );
+  } catch {
+  }
+}
 function getCredentials() {
-  const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
   if (process.env.NODE9_API_KEY) {
     return {
       apiKey: process.env.NODE9_API_KEY,
-      apiUrl: process.env.NODE9_API_URL || DEFAULT_API_URL
+      // NODE9_API_URL is env, and a hook inherits the agent's env, so it is
+      // no more trusted than the file below.
+      apiUrl: safeApiUrl(process.env.NODE9_API_URL || DEFAULT_API_URL, noteRejectedApiUrl)
     };
   }
   try {
@@ -6141,14 +6202,14 @@ function getCredentials() {
       if (profile?.apiKey) {
         return {
           apiKey: profile.apiKey,
-          apiUrl: profile.apiUrl || DEFAULT_API_URL,
+          apiUrl: safeApiUrl(profile.apiUrl || DEFAULT_API_URL, noteRejectedApiUrl),
           localOnly: profile.localOnly === true || profileName !== "default"
         };
       }
       if (creds.apiKey) {
         return {
           apiKey: creds.apiKey,
-          apiUrl: creds.apiUrl || DEFAULT_API_URL,
+          apiUrl: safeApiUrl(creds.apiUrl || DEFAULT_API_URL, noteRejectedApiUrl),
           localOnly: creds.localOnly === true
         };
       }
@@ -6581,13 +6642,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path15 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path15) continue;
+            const path16 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path16) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path15, verdict, "org-managed jail")) {
+            for (const r of pathRules(path16, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path15, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path16, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -6924,11 +6985,41 @@ function isIgnoredTool2(toolName) {
 }
 
 // src/auth/state.ts
+import fs8 from "fs";
+import path8 from "path";
+import os6 from "os";
+
+// src/utils/atomic-write.ts
 import fs7 from "fs";
 import path7 from "path";
-import os6 from "os";
-var PAUSED_FILE = path7.join(os6.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = path7.join(os6.homedir(), ".node9", "trust.json");
+import { randomUUID } from "crypto";
+function atomicWriteSync(filePath, data, options) {
+  const dir = path7.dirname(filePath);
+  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
+  const tmpPath = `${filePath}.${randomUUID()}.tmp`;
+  try {
+    fs7.writeFileSync(tmpPath, data, options);
+  } catch (err) {
+    try {
+      fs7.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    fs7.renameSync(tmpPath, filePath);
+  } catch (err) {
+    try {
+      fs7.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
+
+// src/auth/state.ts
+var PAUSED_FILE = path8.join(os6.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = path8.join(os6.homedir(), ".node9", "trust.json");
 function extractCommandPattern(toolName, args) {
   const lower = toolName.toLowerCase();
   if (lower !== "bash" && lower !== "execute_bash" && lower !== "shell") return void 0;
@@ -6940,11 +7031,11 @@ function extractCommandPattern(toolName, args) {
 }
 function checkPause() {
   try {
-    if (!fs7.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(fs7.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!fs8.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(fs8.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        fs7.unlinkSync(PAUSED_FILE);
+        fs8.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -6954,21 +7045,14 @@ function checkPause() {
     return { paused: false };
   }
 }
-function atomicWriteSync(filePath, data, options) {
-  const dir = path7.dirname(filePath);
-  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
-  const tmpPath = `${filePath}.${os6.hostname()}.${process.pid}.tmp`;
-  fs7.writeFileSync(tmpPath, data, options);
-  fs7.renameSync(tmpPath, filePath);
-}
 function getActiveTrustSession(toolName, args) {
   try {
-    if (!fs7.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(fs7.readFileSync(TRUST_FILE, "utf-8"));
+    if (!fs8.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(fs8.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
-      fs7.writeFileSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
+      atomicWriteSync(TRUST_FILE, JSON.stringify({ entries: active }, null, 2));
     }
     return active.some((e) => {
       if (!(e.tool === toolName || matchesPattern(toolName, e.tool))) return false;
@@ -6987,8 +7071,8 @@ function writeTrustSession(toolName, durationMs, args) {
   try {
     let trust = { entries: [] };
     try {
-      if (fs7.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(fs7.readFileSync(TRUST_FILE, "utf-8"));
+      if (fs8.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(fs8.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -7010,9 +7094,9 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file = path7.join(os6.homedir(), ".node9", "decisions.json");
-    if (!fs7.existsSync(file)) return null;
-    const decisions = JSON.parse(fs7.readFileSync(file, "utf-8"));
+    const file = path8.join(os6.homedir(), ".node9", "decisions.json");
+    if (!fs8.existsSync(file)) return null;
+    const decisions = JSON.parse(fs8.readFileSync(file, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
@@ -7021,11 +7105,11 @@ function getPersistentDecision(toolName) {
 }
 
 // src/auth/daemon.ts
-import fs8 from "fs";
+import fs9 from "fs";
 import net from "net";
-import path8 from "path";
+import path9 from "path";
 import os7 from "os";
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path8.join(os7.tmpdir(), "node9-activity.sock");
+var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path9.join(os7.tmpdir(), "node9-activity.sock");
 function notifyActivitySocket(data) {
   return new Promise((resolve) => {
     try {
@@ -7058,9 +7142,9 @@ var DAEMON_PORT = 7391;
 var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   try {
-    const pidFile = path8.join(os7.homedir(), ".node9", "daemon.pid");
-    if (!fs8.existsSync(pidFile)) return null;
-    const data = JSON.parse(fs8.readFileSync(pidFile, "utf-8"));
+    const pidFile = path9.join(os7.homedir(), ".node9", "daemon.pid");
+    if (!fs9.existsSync(pidFile)) return null;
+    const data = JSON.parse(fs9.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -7068,12 +7152,12 @@ function getInternalToken() {
   }
 }
 function isDaemonRunning() {
-  const pidFile = path8.join(os7.homedir(), ".node9", "daemon.pid");
-  if (fs8.existsSync(pidFile)) {
+  const pidFile = path9.join(os7.homedir(), ".node9", "daemon.pid");
+  if (fs9.existsSync(pidFile)) {
     let pid;
     let port;
     try {
-      const data = JSON.parse(fs8.readFileSync(pidFile, "utf-8"));
+      const data = JSON.parse(fs9.readFileSync(pidFile, "utf-8"));
       pid = data.pid;
       port = data.port;
     } catch {
@@ -7091,7 +7175,7 @@ function isDaemonRunning() {
     } catch (err) {
       if (err instanceof Error && "code" in err && err.code === "ESRCH") {
         try {
-          fs8.unlinkSync(pidFile);
+          fs9.unlinkSync(pidFile);
         } catch {
         }
       }
@@ -7257,14 +7341,14 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
 }
 
 // src/auth/orchestrator.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // src/ui/native.ts
 import { spawn } from "child_process";
-import path10 from "path";
+import path11 from "path";
 
 // src/context-sniper.ts
-import path9 from "path";
+import path10 from "path";
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -7332,7 +7416,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = path9.basename(editFilePath);
+        editFileName = path10.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -7396,7 +7480,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file = obj.file_path ? path10.basename(String(obj.file_path)) : "file";
+      const file = obj.file_path ? path11.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -7594,22 +7678,22 @@ end run`;
 }
 
 // src/canary/registry.ts
-import fs10 from "fs";
+import fs11 from "fs";
 import os9 from "os";
-import path12 from "path";
+import path13 from "path";
 
 // src/shields/jail.ts
-import fs9 from "fs";
+import fs10 from "fs";
 import os8 from "os";
-import path11 from "path";
+import path12 from "path";
 var USER_JAIL_SHIELD = "user-jail";
 function jailStorePath() {
-  return path11.join(os8.homedir(), ".node9", "jail-paths.json");
+  return path12.join(os8.homedir(), ".node9", "jail-paths.json");
 }
 function readJailPaths() {
   let text;
   try {
-    text = fs9.readFileSync(jailStorePath(), "utf8");
+    text = fs10.readFileSync(jailStorePath(), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -7638,7 +7722,7 @@ function findJailedPathIn(candidate, paths) {
 
 // src/canary/registry.ts
 function canaryStorePath() {
-  return path12.join(os9.homedir(), ".node9", "canaries.json");
+  return path13.join(os9.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -7649,7 +7733,7 @@ function loadCanaries(opts) {
   const p = canaryStorePath();
   let raw;
   try {
-    raw = fs10.readFileSync(p, "utf-8");
+    raw = fs11.readFileSync(p, "utf-8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -7676,9 +7760,50 @@ init_audit();
 
 // src/auth/cloud.ts
 init_audit();
-import fs11 from "fs";
+import fs13 from "fs";
 import os10 from "os";
-import path13 from "path";
+import path14 from "path";
+
+// src/utils/read-capped.ts
+import fs12 from "fs";
+function readCapped(file, maxBytes) {
+  if (maxBytes < 0) return null;
+  let fd;
+  try {
+    fd = fs12.openSync(file, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const st = fs12.fstatSync(fd);
+    if (!st.isFile()) return null;
+    const want = Math.min(st.size, maxBytes + 1);
+    const buf = Buffer.alloc(want);
+    let read = 0;
+    while (read < want) {
+      const n = fs12.readSync(fd, buf, read, want - read, read);
+      if (n <= 0) break;
+      read += n;
+    }
+    return {
+      bytes: buf.subarray(0, Math.min(read, maxBytes)),
+      truncated: read > maxBytes
+    };
+  } catch {
+    return null;
+  } finally {
+    try {
+      fs12.closeSync(fd);
+    } catch {
+    }
+  }
+}
+function readCappedText(file, maxBytes) {
+  const r = readCapped(file, maxBytes);
+  return r ? { text: r.bytes.toString("utf8"), truncated: r.truncated } : null;
+}
+
+// src/auth/cloud.ts
 async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPolicy, forceReview) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1e4);
@@ -7686,10 +7811,11 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = path13.join(os10.homedir(), ".node9", "ci-context.json");
-      const stats = fs11.statSync(ciContextPath);
-      if (stats.size > 1e4) throw new Error("ci-context.json exceeds 10 KB");
-      const raw = fs11.readFileSync(ciContextPath, "utf8");
+      const ciContextPath = path14.join(os10.homedir(), ".node9", "ci-context.json");
+      const ci = readCappedText(ciContextPath, 1e4);
+      if (!ci) throw new Error("ci-context.json unreadable");
+      if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
+      const raw = ci.text;
       const parsed = JSON.parse(raw);
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
         throw new Error("ci-context.json is not a plain object");
@@ -7788,14 +7914,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      fs11.appendFileSync(
+      fs13.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    fs11.appendFileSync(
+    fs13.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err)}
 `
@@ -7804,16 +7930,16 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 }
 
 // src/loop-detector.ts
-import fs12 from "fs";
-import path14 from "path";
+import fs14 from "fs";
+import path15 from "path";
 import os11 from "os";
 function loopStateFile() {
-  return path14.join(os11.homedir(), ".node9", "loop-state.json");
+  return path15.join(os11.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
-    if (!fs12.existsSync(loopStateFile())) return [];
-    const raw = fs12.readFileSync(loopStateFile(), "utf-8");
+    if (!fs14.existsSync(loopStateFile())) return [];
+    const raw = fs14.readFileSync(loopStateFile(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return [];
     return parsed;
@@ -7822,11 +7948,11 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir = path14.dirname(loopStateFile());
-  if (!fs12.existsSync(dir)) fs12.mkdirSync(dir, { recursive: true });
+  const dir = path15.dirname(loopStateFile());
+  if (!fs14.existsSync(dir)) fs14.mkdirSync(dir, { recursive: true });
   const tmpPath = `${loopStateFile()}.${os11.hostname()}.${process.pid}.tmp`;
-  fs12.writeFileSync(tmpPath, JSON.stringify(records));
-  fs12.renameSync(tmpPath, loopStateFile());
+  fs14.writeFileSync(tmpPath, JSON.stringify(records));
+  fs14.renameSync(tmpPath, loopStateFile());
 }
 function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   try {
@@ -7894,9 +8020,13 @@ async function hasReachableHumanApprover(opts) {
   if (nativeReachable) return true;
   return opts.approvers.terminal !== false && await daemonHasInteractiveApprover();
 }
+function mayDowngradeHardBlock(opts) {
+  if (opts.overridable === false) return false;
+  return opts.daemonUp && !opts.isTestEnv && opts.humanApproverReachable;
+}
 async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
-    const actId = randomUUID();
+    const actId = randomUUID2();
     const actTs = Date.now();
     const sanitizedAgent = meta?.agent ? safeMessage(meta.agent, 80) : void 0;
     const sanitizedMcpServer = meta?.mcpServer ? safeMessage(meta.mcpServer, 40) : void 0;
@@ -8284,7 +8414,12 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           calledFromDaemon: options?.calledFromDaemon
         });
       }
-      const mayDowngrade = daemonUp && !isTestEnv2 && humanApproverReachable;
+      const mayDowngrade = mayDowngradeHardBlock({
+        daemonUp,
+        isTestEnv: isTestEnv2,
+        humanApproverReachable,
+        overridable: policyResult.overridable
+      });
       const hardBlock = () => {
         if (!isManual)
           appendLocalAudit(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.14.2",
+  "version": "2.15.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -16,7 +16,7 @@
     "node9": "./dist/cli.js"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "workspaces": [
     "packages/*"
@@ -100,7 +100,7 @@
     "mvdan-sh"
   ],
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.124.0",
+    "@anthropic-ai/sdk": "^0.125.0",
     "@octokit/rest": "^22.0.1",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
@@ -123,7 +123,8 @@
   },
   "overrides": {
     "undici": "^7.24.0",
-    "ws": "^8.21.0"
+    "ws": "^8.21.0",
+    "esbuild": "^0.28.1"
   },
   "publishConfig": {
     "access": "public"