@node9/proxy 2.25.1 → 2.26.0

package/dist/dashboard.mjs

@@ -1282,19 +1282,19 @@ function resolvePart(p, inQuotes) {
 }
 function analyzeFsOperation(command) {
   const normalized = normalizeCommandForPolicy(command);
-  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
-  if (fsOpCache.has(normalized)) {
-    const hit = fsOpCache.get(normalized) ?? null;
-    fsOpCache.delete(normalized);
-    fsOpCache.set(normalized, hit);
+  if (!FS_OP_PRESCREEN_RE.test(normalized) && !FS_OP_PRESCREEN_RE.test(command)) return null;
+  if (fsOpCache.has(command)) {
+    const hit = fsOpCache.get(command) ?? null;
+    fsOpCache.delete(command);
+    fsOpCache.set(command, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(normalized);
+  const computed = analyzeFsOperationImpl(command);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(normalized, computed);
+  fsOpCache.set(command, computed);
   return computed;
 }
 function deriveRedirOp(sample) {
@@ -5638,6 +5638,9 @@ function tryLoadConfig(filePath) {
       );
     }
   }
+  if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+    for (const key of RUNTIME_ONLY_CONFIG_KEYS) delete raw[key];
+  }
   const { sanitized, error } = sanitizeConfig(raw);
   if (error) {
     process.stderr.write(
@@ -5651,7 +5654,7 @@ ${error.replace("Invalid config:\n", "")}
   }
   return sanitized;
 }
-var DANGEROUS_WORDS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, rejectedApiUrlsSeen, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt;
+var DANGEROUS_WORDS, RUNTIME_ONLY_CONFIG_KEYS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, rejectedApiUrlsSeen, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt;
 var init_config = __esm({
   "src/config/index.ts"() {
     "use strict";
@@ -5669,6 +5672,7 @@ var init_config = __esm({
       "shred"
       // permanently overwrites file contents (unrecoverable)
     ];
+    RUNTIME_ONLY_CONFIG_KEYS = ["policySource", "ssrfStrictSource"];
     DEFAULT_CONFIG = {
       version: "1.0",
       policySource: "local",

package/dist/index.js

@@ -3078,19 +3078,19 @@ var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
   const normalized = normalizeCommandForPolicy(command);
-  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
-  if (fsOpCache.has(normalized)) {
-    const hit = fsOpCache.get(normalized) ?? null;
-    fsOpCache.delete(normalized);
-    fsOpCache.set(normalized, hit);
+  if (!FS_OP_PRESCREEN_RE.test(normalized) && !FS_OP_PRESCREEN_RE.test(command)) return null;
+  if (fsOpCache.has(command)) {
+    const hit = fsOpCache.get(command) ?? null;
+    fsOpCache.delete(command);
+    fsOpCache.set(command, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(normalized);
+  const computed = analyzeFsOperationImpl(command);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(normalized, computed);
+  fsOpCache.set(command, computed);
   return computed;
 }
 var stripDotSlash = (p) => p.replace(/^\.\//, "");
@@ -6317,6 +6317,7 @@ var DANGEROUS_WORDS = [
   "shred"
   // permanently overwrites file contents (unrecoverable)
 ];
+var RUNTIME_ONLY_CONFIG_KEYS = ["policySource", "ssrfStrictSource"];
 var DEFAULT_CONFIG = {
   version: "1.0",
   policySource: "local",
@@ -7251,6 +7252,9 @@ function tryLoadConfig(filePath) {
       );
     }
   }
+  if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+    for (const key of RUNTIME_ONLY_CONFIG_KEYS) delete raw[key];
+  }
   const { sanitized, error } = sanitizeConfig(raw);
   if (error) {
     process.stderr.write(
@@ -8383,6 +8387,37 @@ function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
 }
 
 // src/auth/orchestrator.ts
+var SENSITIVE_PATH_PATTERN = sensitivePathMatch("").patternName;
+function isProtectedPathRule(ruleName) {
+  if (!ruleName) return false;
+  return /^(?:org:)?block-path-/.test(ruleName) || /^shield:project-jail:block-read-/.test(ruleName);
+}
+function matchedPathField(ruleName) {
+  if (/-anytool-pattern$/.test(ruleName)) return "pattern";
+  if (/-anytool-path$/.test(ruleName)) return "path";
+  if (/-anytool$/.test(ruleName)) return "file_path";
+  return void 0;
+}
+function protectedPathOf(ruleName, toolName, args) {
+  const a = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+  if (isBashTool(toolName) && typeof a.command === "string") {
+    return analyzeFsOperation(a.command)?.path || void 0;
+  }
+  const field = matchedPathField(ruleName);
+  const order = field ? [field] : ["file_path", "path", "filename", "pattern"];
+  for (const k of order) {
+    if (typeof a[k] === "string" && a[k]) return a[k];
+  }
+  return void 0;
+}
+function safePathForDisplay(p) {
+  return safeMessage(p).replace(/[\u0080-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+function protectedPathFields(ruleName, toolName, args, credentialInArgs) {
+  if (!ruleName || credentialInArgs || !isProtectedPathRule(ruleName)) return {};
+  const p = protectedPathOf(ruleName, toolName, args);
+  return { blockKind: "protected-path", blockedPath: p ? safePathForDisplay(p) : void 0 };
+}
 var WRITE_TOOLS = /* @__PURE__ */ new Set([
   "write",
   "write_file",
@@ -8675,7 +8710,17 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           approved: false,
           reason: dlpReason,
           blockedBy: "local-config",
-          blockedByLabel: "\u{1F6A8} Node9 DLP (Secret Detected)"
+          blockedByLabel: "\u{1F6A8} Node9 DLP (Secret Detected)",
+          // A PATH hit is a protected file, not a secret in the arguments: the
+          // agent must not be told to rotate a credential it never saw (MSG-1).
+          // Only when the arguments carry no credential: a path match
+          // short-circuits the argument scan above (`scanFilePath ?? scanArgs`),
+          // so a Write of a real key into .env would otherwise be told "nothing
+          // was exposed" (/code-review).
+          ...dlpMatch.patternName === SENSITIVE_PATH_PATTERN && !scanArgs(args) && {
+            blockKind: "protected-path",
+            blockedPath: safePathForDisplay(dlpMatch.redactedSample)
+          }
         };
       }
       if (!isManual)
@@ -8861,7 +8906,8 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           blockedByLabel: policyResult.blockedByLabel,
           ruleHit: policyResult.ruleName,
           ...policyResult.recoveryCommand && { recoveryCommand: policyResult.recoveryCommand },
-          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription }
+          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription },
+          ...protectedPathFields(policyResult.ruleName, toolName, args, dlpReviewFlagged)
         };
       };
       if (policyResult.dependsOnStatePredicates?.length) {
@@ -8965,7 +9011,8 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
             reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
             blockedBy: "local-config",
             blockedByLabel: policyResult.blockedByLabel,
-            ruleHit: policyResult.ruleName
+            ruleHit: policyResult.ruleName,
+            ...protectedPathFields(policyResult.ruleName, toolName, args, dlpReviewFlagged)
           };
         }
       } else {

package/dist/index.mjs

@@ -3048,19 +3048,19 @@ var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
   const normalized = normalizeCommandForPolicy(command);
-  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
-  if (fsOpCache.has(normalized)) {
-    const hit = fsOpCache.get(normalized) ?? null;
-    fsOpCache.delete(normalized);
-    fsOpCache.set(normalized, hit);
+  if (!FS_OP_PRESCREEN_RE.test(normalized) && !FS_OP_PRESCREEN_RE.test(command)) return null;
+  if (fsOpCache.has(command)) {
+    const hit = fsOpCache.get(command) ?? null;
+    fsOpCache.delete(command);
+    fsOpCache.set(command, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(normalized);
+  const computed = analyzeFsOperationImpl(command);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(normalized, computed);
+  fsOpCache.set(command, computed);
   return computed;
 }
 var stripDotSlash = (p) => p.replace(/^\.\//, "");
@@ -6287,6 +6287,7 @@ var DANGEROUS_WORDS = [
   "shred"
   // permanently overwrites file contents (unrecoverable)
 ];
+var RUNTIME_ONLY_CONFIG_KEYS = ["policySource", "ssrfStrictSource"];
 var DEFAULT_CONFIG = {
   version: "1.0",
   policySource: "local",
@@ -7221,6 +7222,9 @@ function tryLoadConfig(filePath) {
       );
     }
   }
+  if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+    for (const key of RUNTIME_ONLY_CONFIG_KEYS) delete raw[key];
+  }
   const { sanitized, error } = sanitizeConfig(raw);
   if (error) {
     process.stderr.write(
@@ -8353,6 +8357,37 @@ function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
 }
 
 // src/auth/orchestrator.ts
+var SENSITIVE_PATH_PATTERN = sensitivePathMatch("").patternName;
+function isProtectedPathRule(ruleName) {
+  if (!ruleName) return false;
+  return /^(?:org:)?block-path-/.test(ruleName) || /^shield:project-jail:block-read-/.test(ruleName);
+}
+function matchedPathField(ruleName) {
+  if (/-anytool-pattern$/.test(ruleName)) return "pattern";
+  if (/-anytool-path$/.test(ruleName)) return "path";
+  if (/-anytool$/.test(ruleName)) return "file_path";
+  return void 0;
+}
+function protectedPathOf(ruleName, toolName, args) {
+  const a = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+  if (isBashTool(toolName) && typeof a.command === "string") {
+    return analyzeFsOperation(a.command)?.path || void 0;
+  }
+  const field = matchedPathField(ruleName);
+  const order = field ? [field] : ["file_path", "path", "filename", "pattern"];
+  for (const k of order) {
+    if (typeof a[k] === "string" && a[k]) return a[k];
+  }
+  return void 0;
+}
+function safePathForDisplay(p) {
+  return safeMessage(p).replace(/[\u0080-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+function protectedPathFields(ruleName, toolName, args, credentialInArgs) {
+  if (!ruleName || credentialInArgs || !isProtectedPathRule(ruleName)) return {};
+  const p = protectedPathOf(ruleName, toolName, args);
+  return { blockKind: "protected-path", blockedPath: p ? safePathForDisplay(p) : void 0 };
+}
 var WRITE_TOOLS = /* @__PURE__ */ new Set([
   "write",
   "write_file",
@@ -8645,7 +8680,17 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           approved: false,
           reason: dlpReason,
           blockedBy: "local-config",
-          blockedByLabel: "\u{1F6A8} Node9 DLP (Secret Detected)"
+          blockedByLabel: "\u{1F6A8} Node9 DLP (Secret Detected)",
+          // A PATH hit is a protected file, not a secret in the arguments: the
+          // agent must not be told to rotate a credential it never saw (MSG-1).
+          // Only when the arguments carry no credential: a path match
+          // short-circuits the argument scan above (`scanFilePath ?? scanArgs`),
+          // so a Write of a real key into .env would otherwise be told "nothing
+          // was exposed" (/code-review).
+          ...dlpMatch.patternName === SENSITIVE_PATH_PATTERN && !scanArgs(args) && {
+            blockKind: "protected-path",
+            blockedPath: safePathForDisplay(dlpMatch.redactedSample)
+          }
         };
       }
       if (!isManual)
@@ -8831,7 +8876,8 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           blockedByLabel: policyResult.blockedByLabel,
           ruleHit: policyResult.ruleName,
           ...policyResult.recoveryCommand && { recoveryCommand: policyResult.recoveryCommand },
-          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription }
+          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription },
+          ...protectedPathFields(policyResult.ruleName, toolName, args, dlpReviewFlagged)
         };
       };
       if (policyResult.dependsOnStatePredicates?.length) {
@@ -8935,7 +8981,8 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
             reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
             blockedBy: "local-config",
             blockedByLabel: policyResult.blockedByLabel,
-            ruleHit: policyResult.ruleName
+            ruleHit: policyResult.ruleName,
+            ...protectedPathFields(policyResult.ruleName, toolName, args, dlpReviewFlagged)
           };
         }
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.25.1",
+  "version": "2.26.0",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",