@node9/proxy 2.19.2 → 2.20.0

package/dist/dashboard.mjs

@@ -2946,7 +2946,14 @@ var init_dist = __esm({
       // reader right after `"` / `'`, and without these two characters the
       // prescreen rejected every string-wrapped read before the parser ran.
       // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
-      `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
+      `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`,
+      // Case-insensitive on purpose. Without `i`, `CAT .env` failed this fast path
+      // and analyzeFsOperation returned before the AST ran at all — a live bypass
+      // on macOS and Windows, whose filesystems resolve `CAT` to `cat`, and on
+      // PowerShell, which is case-insensitive by language. Linux is unaffected in
+      // practice (`CAT` is not an executable there) but folding costs nothing.
+      // Dogfound 2026-09-22; pinned by verb-case-coverage.spec.ts.
+      "i"
     );
     HOME_CACHE_ALLOWLIST = [
       ".cache",
@@ -5602,7 +5609,7 @@ var init_config = __esm({
             description: "The AI wants to download a script from the internet and run it immediately, without you seeing what it contains. This is one of the most common ways malware gets installed."
           }
         ],
-        dlp: { enabled: true, scanIgnoredTools: true, pii: "off" },
+        dlp: { enabled: true, scanIgnoredTools: true, pii: "block" },
         egress: {
           enabled: false,
           mode: "review",
@@ -6650,6 +6657,22 @@ var init_scan_summary = __esm({
   }
 });
 
+// src/utils/platform-shell.ts
+var init_platform_shell = __esm({
+  "src/utils/platform-shell.ts"() {
+    "use strict";
+  }
+});
+
+// src/codex-trust.ts
+import { parse as parseToml } from "smol-toml";
+var init_codex_trust = __esm({
+  "src/codex-trust.ts"() {
+    "use strict";
+    init_platform_shell();
+  }
+});
+
 // src/mcp-pin.ts
 var init_mcp_pin = __esm({
   "src/mcp-pin.ts"() {
@@ -6693,11 +6716,12 @@ var init_atomic_write = __esm({
 // src/setup.ts
 import chalk3 from "chalk";
 import { confirm as rawConfirm } from "@inquirer/prompts";
-import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { parse as parseToml2, stringify as stringifyToml } from "smol-toml";
 import * as yaml from "yaml";
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
+    init_codex_trust();
     init_mcp_pin();
     init_hook_baseline();
     init_setup_opencode_shim();

package/dist/index.js

@@ -2123,7 +2123,14 @@ var FS_OP_PRESCREEN_RE = new RegExp(
   // reader right after `"` / `'`, and without these two characters the
   // prescreen rejected every string-wrapped read before the parser ran.
   // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
-  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
+  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`,
+  // Case-insensitive on purpose. Without `i`, `CAT .env` failed this fast path
+  // and analyzeFsOperation returned before the AST ran at all — a live bypass
+  // on macOS and Windows, whose filesystems resolve `CAT` to `cat`, and on
+  // PowerShell, which is case-insensitive by language. Linux is unaffected in
+  // practice (`CAT` is not an executable there) but folding costs nothing.
+  // Dogfound 2026-09-22; pinned by verb-case-coverage.spec.ts.
+  "i"
 );
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
@@ -6183,7 +6190,7 @@ var DEFAULT_CONFIG = {
         description: "The AI wants to download a script from the internet and run it immediately, without you seeing what it contains. This is one of the most common ways malware gets installed."
       }
     ],
-    dlp: { enabled: true, scanIgnoredTools: true, pii: "off" },
+    dlp: { enabled: true, scanIgnoredTools: true, pii: "block" },
     egress: {
       enabled: false,
       mode: "review",

package/dist/index.mjs

@@ -2093,7 +2093,14 @@ var FS_OP_PRESCREEN_RE = new RegExp(
   // reader right after `"` / `'`, and without these two characters the
   // prescreen rejected every string-wrapped read before the parser ran.
   // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
-  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
+  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`,
+  // Case-insensitive on purpose. Without `i`, `CAT .env` failed this fast path
+  // and analyzeFsOperation returned before the AST ran at all — a live bypass
+  // on macOS and Windows, whose filesystems resolve `CAT` to `cat`, and on
+  // PowerShell, which is case-insensitive by language. Linux is unaffected in
+  // practice (`CAT` is not an executable there) but folding costs nothing.
+  // Dogfound 2026-09-22; pinned by verb-case-coverage.spec.ts.
+  "i"
 );
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
@@ -6153,7 +6160,7 @@ var DEFAULT_CONFIG = {
         description: "The AI wants to download a script from the internet and run it immediately, without you seeing what it contains. This is one of the most common ways malware gets installed."
       }
     ],
-    dlp: { enabled: true, scanIgnoredTools: true, pii: "off" },
+    dlp: { enabled: true, scanIgnoredTools: true, pii: "block" },
     egress: {
       enabled: false,
       mode: "review",

package/dist/scan-ink.mjs

@@ -1188,7 +1188,14 @@ var FS_OP_PRESCREEN_RE = new RegExp(
   // reader right after `"` / `'`, and without these two characters the
   // prescreen rejected every string-wrapped read before the parser ran.
   // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
-  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
+  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`,
+  // Case-insensitive on purpose. Without `i`, `CAT .env` failed this fast path
+  // and analyzeFsOperation returned before the AST ran at all — a live bypass
+  // on macOS and Windows, whose filesystems resolve `CAT` to `cat`, and on
+  // PowerShell, which is case-insensitive by language. Linux is unaffected in
+  // practice (`CAT` is not an executable there) but folding costs nothing.
+  // Dogfound 2026-09-22; pinned by verb-case-coverage.spec.ts.
+  "i"
 );
 function deriveRedirOp(sample) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.19.2",
+  "version": "2.20.0",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -107,7 +107,7 @@
     "mvdan-sh"
   ],
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.125.0",
+    "@anthropic-ai/sdk": "^0.127.0",
     "@octokit/rest": "^22.0.1",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",