@node9/proxy 2.28.0 → 2.29.0

package/dist/cli.js

@@ -11103,6 +11103,14 @@ async function checkStatePredicates(predicates) {
     return null;
   }
 }
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
 function getInternalToken() {
   try {
     const pidFile = import_path10.default.join(import_os8.default.homedir(), ".node9", "daemon.pid");
@@ -11376,7 +11384,7 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
     signal: AbortSignal.timeout(3e3)
   });
 }
-var import_fs10, import_net, import_path10, import_os8, ACTIVITY_SOCKET_PATH, DAEMON_PORT, DAEMON_HOST;
+var import_fs10, import_net, import_path10, import_os8, ACTIVITY_SOCKET_PATH, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
@@ -11385,7 +11393,8 @@ var init_daemon = __esm({
     import_path10 = __toESM(require("path"));
     import_os8 = __toESM(require("os"));
     ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path10.default.join(import_os8.default.tmpdir(), "node9-activity.sock");
-    DAEMON_PORT = 7391;
+    DEFAULT_DAEMON_PORT = 7391;
+    DAEMON_PORT = resolveDaemonPort();
     DAEMON_HOST = "127.0.0.1";
   }
 });
@@ -57986,15 +57995,25 @@ var VISIBLE_ESCAPES = {
 function toVisibleEscape(c) {
   return VISIBLE_ESCAPES[c] ?? `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
+var redact = (s) => redactText(s).result;
+var escapeUnsafe = (s) => s.replace(UNSAFE_CHARS, toVisibleEscape);
 function displaySafe(text) {
-  return redactText(text).result.replace(UNSAFE_CHARS, toVisibleEscape);
+  return escapeUnsafe(redact(text));
 }
 var INPUT_PREVIEW_MAX = 80;
 function inputPreview(raw) {
-  const safe = displaySafe(raw);
-  return safe.length > INPUT_PREVIEW_MAX ? safe.slice(0, INPUT_PREVIEW_MAX - 3) + "\u2026" : safe;
+  const redacted = redact(raw);
+  const points = Array.from(redacted);
+  const cut = points.length > INPUT_PREVIEW_MAX ? points.slice(0, INPUT_PREVIEW_MAX - 3).join("") + "\u2026" : redacted;
+  return escapeUnsafe(cut);
+}
+var JSON_RAW_UNSAFE = /[\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g;
+function toSafeJson(doc) {
+  return JSON.stringify(doc, null, 2).replace(
+    JSON_RAW_UNSAFE,
+    (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
 }
-var redact = (s) => redactText(s).result;
 function buildExplainJson(result, rawInput) {
   return {
     schemaVersion: 1,
@@ -58009,7 +58028,11 @@ function buildExplainJson(result, rawInput) {
       detail: redact(s.detail),
       final: s.isFinal === true
     })),
-    waterfall: result.waterfall
+    waterfall: result.waterfall.map((t) => ({
+      ...t,
+      ...t.path !== void 0 && { path: redact(t.path) },
+      ...t.note !== void 0 && { note: redact(t.note) }
+    }))
   };
 }
 function buildExplainJsonError(message) {
@@ -58935,6 +58958,88 @@ ${neutralizeMarkers(text)}
 ${f.footer}`;
 }
 
+// src/tool-output.ts
+init_dlp();
+var MAX_DEPTH3 = 8;
+function collectToolOutputText(toolResponse, opts = {}) {
+  const maxBytes = opts.maxBytes ?? DLP_SCAN_LIMITS.maxStringBytes;
+  const parts = [];
+  let size = 0;
+  let fields = 0;
+  let truncated = false;
+  const push = (s) => {
+    if (s.length === 0) return true;
+    const room = maxBytes - size;
+    if (s.length > room) {
+      if (room > 0) {
+        parts.push(s.slice(0, room));
+        fields++;
+      }
+      size = maxBytes;
+      truncated = true;
+      return false;
+    }
+    parts.push(s);
+    fields++;
+    size += s.length + 1;
+    return true;
+  };
+  const walk = (v, depth) => {
+    if (typeof v === "string") return push(v);
+    if (depth >= MAX_DEPTH3 || v === null || typeof v !== "object") return true;
+    const children = Array.isArray(v) ? v : Object.values(v);
+    for (const child of children) if (!walk(child, depth + 1)) return false;
+    return true;
+  };
+  walk(toolResponse, 0);
+  return { text: parts.join("\n"), truncated, fields };
+}
+function shellOutputText(toolResponse) {
+  if (toolResponse && typeof toolResponse === "object" && !Array.isArray(toolResponse)) {
+    const r = toolResponse;
+    if (typeof r.stdout === "string" || typeof r.stderr === "string") {
+      return [r.stdout, r.stderr].filter((s) => typeof s === "string").join("\n");
+    }
+  }
+  return collectToolOutputText(toolResponse).text;
+}
+function mapToolOutputStrings(toolResponse, fn) {
+  const walk = (v, depth) => {
+    if (typeof v === "string") return fn(v);
+    if (depth >= MAX_DEPTH3 || v === null || typeof v !== "object") return v;
+    if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+    const out = {};
+    for (const [k, x] of Object.entries(v)) out[k] = walk(x, depth + 1);
+    return out;
+  };
+  return walk(toolResponse, 0);
+}
+function frameToolOutputLeaves(toolResponse, isSuspect, frame, neutralize) {
+  const suspect = [];
+  let largestAt = -1;
+  let largestLen = 0;
+  mapToolOutputStrings(toolResponse, (s) => {
+    const i2 = suspect.length;
+    suspect.push(s.length > 0 && isSuspect(s));
+    if (s.length > largestLen) {
+      largestLen = s.length;
+      largestAt = i2;
+    }
+    return s;
+  });
+  const anySuspect = suspect.some(Boolean);
+  let i = 0;
+  return mapToolOutputStrings(toolResponse, (s) => {
+    const at = i++;
+    const pick2 = anySuspect ? suspect[at] : at === largestAt;
+    if (!pick2) return neutralize(s);
+    const f = frame();
+    return `${f.header}
+${neutralize(s)}
+${f.footer}`;
+  });
+}
+
 // src/cli/commands/log.ts
 init_hasher();
 
@@ -59080,7 +59185,7 @@ function registerLogCommand(program2) {
         }
         if ((tool === "Bash" || tool === "bash") && isDaemonRunning()) {
           const bashCommand = typeof rawInput === "object" && rawInput !== null && "command" in rawInput && typeof rawInput.command === "string" ? rawInput.command : null;
-          const output = payload.tool_response?.output ?? "";
+          const output = shellOutputText(payload.tool_response);
           if (bashCommand && output) {
             const testResult = detectTestResult(bashCommand, output);
             if (testResult) {
@@ -59132,10 +59237,24 @@ function registerLogCommand(program2) {
           }
         }
         {
-          const toolOutput = payload.tool_response?.output;
+          const rawResponse = payload.tool_response;
+          const shimOutput = rawResponse && typeof rawResponse === "object" && typeof rawResponse.output === "string" ? rawResponse.output : void 0;
+          const collected = redactOutputMode ? {
+            text: shimOutput ?? collectToolOutputText(rawResponse, { maxBytes: Number.MAX_SAFE_INTEGER }).text,
+            truncated: false
+          } : collectToolOutputText(rawResponse);
+          const toolOutput = collected.text;
+          if (collected.truncated) {
+            appendToLog(HOOK_DEBUG_LOG, {
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              event: "post-tool-scan-truncated",
+              tool,
+              scannedBytes: toolOutput.length
+            });
+          }
           const inj = config.policy.injectionScan;
           const injectionOn = inj.enabled && !inj.allow.includes(tool);
-          if (typeof toolOutput === "string" && toolOutput.length > 0) {
+          if (toolOutput.length > 0) {
             if (redactOutputMode) {
               const { result, found } = redactText(toolOutput);
               let out = result;
@@ -59150,19 +59269,36 @@ function registerLogCommand(program2) {
               process.stdout.write(JSON.stringify({ redacted: out, found, injection }) + "\n");
             } else {
               const warnings = [];
+              const inPlace = agent === "Claude Code" && config.policy.dlp.enabled;
+              const redactedNames = /* @__PURE__ */ new Set();
+              let updatedToolOutput = void 0;
+              if (inPlace) {
+                const mapped = mapToolOutputStrings(payload.tool_response, (leaf) => {
+                  const r = redactText(leaf);
+                  for (const name of r.found) redactedNames.add(name);
+                  return r.result;
+                });
+                if (redactedNames.size > 0) updatedToolOutput = mapped;
+              }
               const hit = scanText(toolOutput);
-              if (hit) {
-                await notifySessionTaint(
-                  payloadSessionId ?? "",
-                  `output-secret:${hit.patternName}`
-                );
+              const secretName = hit?.patternName ?? [...redactedNames][0];
+              if (secretName) {
+                await notifySessionTaint(payloadSessionId ?? "", `output-secret:${secretName}`);
                 warnings.push(
-                  `\u26A0\uFE0F node9: this tool output contained a credential (${hit.patternName}). Do not echo, store, or transmit it \u2014 treat it as compromised and rotate it. node9 has flagged this session: the next network or write action will require approval.`
+                  updatedToolOutput !== void 0 ? `\u26A0\uFE0F node9: this tool output contained a credential (${secretName}); node9 replaced it with [node9-redacted:\u2026] before you read it. Treat the credential as compromised. node9 has flagged this session: the next network or write action will require approval.` : `\u26A0\uFE0F node9: this tool output contained a credential (${secretName}). Do not echo, store, or transmit it \u2014 treat it as compromised and rotate it. node9 has flagged this session: the next network or write action will require approval.`
                 );
               }
               if (injectionOn) {
                 const m = scanInjection(toolOutput, { tool: rawToolName });
                 if (m && atLeastConfidence(m.confidence, inj.minConfidence)) {
+                  if (agent === "Claude Code") {
+                    updatedToolOutput = frameToolOutputLeaves(
+                      updatedToolOutput ?? payload.tool_response,
+                      (leaf) => scanInjection(leaf, { tool: rawToolName }) !== null,
+                      newUntrustedFrame,
+                      neutralizeMarkers
+                    );
+                  }
                   await notifySessionTaint(
                     payloadSessionId ?? "",
                     `output-injection:${m.signals.join("+")}`
@@ -59172,12 +59308,22 @@ function registerLogCommand(program2) {
                   );
                 }
               }
-              if (warnings.length > 0 && (agent === "Claude Code" || agent === "Codex")) {
+              if (redactedNames.size > 0) {
+                appendToLog(LOCAL_AUDIT_LOG, {
+                  ts: (/* @__PURE__ */ new Date()).toISOString(),
+                  tool,
+                  source: "output-redacted",
+                  outputRedacted: [...redactedNames],
+                  ...payloadSessionId ? { sessionId: payloadSessionId } : {}
+                });
+              }
+              if ((warnings.length > 0 || updatedToolOutput !== void 0) && (agent === "Claude Code" || agent === "Codex")) {
                 process.stdout.write(
                   JSON.stringify({
                     hookSpecificOutput: {
                       hookEventName: "PostToolUse",
-                      additionalContext: warnings.join("\n\n")
+                      ...warnings.length > 0 ? { additionalContext: warnings.join("\n\n") } : {},
+                      ...updatedToolOutput !== void 0 ? { updatedToolOutput } : {}
                     }
                   }) + "\n"
                 );
@@ -59196,7 +59342,7 @@ function registerLogCommand(program2) {
         } catch {
         }
       }
-      process.exit(0);
+      process.stdout.write("", () => process.exit(0));
     };
     if (data) {
       await logPayload(data);
@@ -70739,7 +70885,7 @@ program.command("explain").description(
   'Machine-readable output (one JSON document; no "decision" field means failure)'
 ).action(async (tool, argsRaw, opts) => {
   const failJson = (message) => {
-    console.log(JSON.stringify(buildExplainJsonError(message), null, 2));
+    console.log(toSafeJson(buildExplainJsonError(message)));
     process.exit(1);
   };
   let args = {};
@@ -70751,7 +70897,7 @@ program.command("explain").description(
       } catch {
         if (opts.json) failJson("Invalid JSON in [args]");
         console.error(import_chalk47.default.red(`
-\u274C Invalid JSON: ${inputPreview(trimmed)}
+\u274C Invalid JSON: ${displaySafe(trimmed)}
 `));
         process.exit(1);
       }
@@ -70767,7 +70913,7 @@ program.command("explain").description(
     throw err2;
   }
   if (opts.json) {
-    console.log(JSON.stringify(buildExplainJson(result, argsRaw), null, 2));
+    console.log(toSafeJson(buildExplainJson(result, argsRaw)));
     return;
   }
   console.log("");
@@ -70781,16 +70927,17 @@ program.command("explain").description(
   console.log(import_chalk47.default.bold("Config Sources (Waterfall):"));
   for (const tier of result.waterfall) {
     const num3 = import_chalk47.default.gray(`  ${tier.tier}.`);
-    const label3 = tier.label.padEnd(16);
+    const label3 = displaySafe(tier.label).padEnd(16);
+    const tierNote = tier.note === void 0 ? void 0 : displaySafe(tier.note);
     let statusStr;
     if (tier.tier === 1) {
-      statusStr = import_chalk47.default.gray(tier.note ?? "");
+      statusStr = import_chalk47.default.gray(tierNote ?? "");
     } else if (tier.status === "active") {
-      const loc = tier.path ? import_chalk47.default.gray(tier.path) : "";
-      const note = tier.note ? import_chalk47.default.gray(`(${tier.note})`) : "";
+      const loc = tier.path ? import_chalk47.default.gray(displaySafe(tier.path)) : "";
+      const note = tierNote ? import_chalk47.default.gray(`(${tierNote})`) : "";
       statusStr = import_chalk47.default.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
     } else {
-      statusStr = import_chalk47.default.gray("\u25CB " + (tier.note ?? "not found"));
+      statusStr = import_chalk47.default.gray("\u25CB " + (tierNote ?? "not found"));
     }
     console.log(`${num3} ${import_chalk47.default.white(label3)} ${statusStr}`);
   }

package/dist/cli.mjs

@@ -11109,6 +11109,14 @@ async function checkStatePredicates(predicates) {
     return null;
   }
 }
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
 function getInternalToken() {
   try {
     const pidFile = path10.join(os8.homedir(), ".node9", "daemon.pid");
@@ -11382,12 +11390,13 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
     signal: AbortSignal.timeout(3e3)
   });
 }
-var ACTIVITY_SOCKET_PATH, DAEMON_PORT, DAEMON_HOST;
+var ACTIVITY_SOCKET_PATH, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
     ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path10.join(os8.tmpdir(), "node9-activity.sock");
-    DAEMON_PORT = 7391;
+    DEFAULT_DAEMON_PORT = 7391;
+    DAEMON_PORT = resolveDaemonPort();
     DAEMON_HOST = "127.0.0.1";
   }
 });
@@ -57968,15 +57977,25 @@ var VISIBLE_ESCAPES = {
 function toVisibleEscape(c) {
   return VISIBLE_ESCAPES[c] ?? `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
+var redact = (s) => redactText(s).result;
+var escapeUnsafe = (s) => s.replace(UNSAFE_CHARS, toVisibleEscape);
 function displaySafe(text) {
-  return redactText(text).result.replace(UNSAFE_CHARS, toVisibleEscape);
+  return escapeUnsafe(redact(text));
 }
 var INPUT_PREVIEW_MAX = 80;
 function inputPreview(raw) {
-  const safe = displaySafe(raw);
-  return safe.length > INPUT_PREVIEW_MAX ? safe.slice(0, INPUT_PREVIEW_MAX - 3) + "\u2026" : safe;
+  const redacted = redact(raw);
+  const points = Array.from(redacted);
+  const cut = points.length > INPUT_PREVIEW_MAX ? points.slice(0, INPUT_PREVIEW_MAX - 3).join("") + "\u2026" : redacted;
+  return escapeUnsafe(cut);
+}
+var JSON_RAW_UNSAFE = /[\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g;
+function toSafeJson(doc) {
+  return JSON.stringify(doc, null, 2).replace(
+    JSON_RAW_UNSAFE,
+    (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
 }
-var redact = (s) => redactText(s).result;
 function buildExplainJson(result, rawInput) {
   return {
     schemaVersion: 1,
@@ -57991,7 +58010,11 @@ function buildExplainJson(result, rawInput) {
       detail: redact(s.detail),
       final: s.isFinal === true
     })),
-    waterfall: result.waterfall
+    waterfall: result.waterfall.map((t) => ({
+      ...t,
+      ...t.path !== void 0 && { path: redact(t.path) },
+      ...t.note !== void 0 && { note: redact(t.note) }
+    }))
   };
 }
 function buildExplainJsonError(message) {
@@ -58917,6 +58940,88 @@ ${neutralizeMarkers(text)}
 ${f.footer}`;
 }
 
+// src/tool-output.ts
+init_dlp();
+var MAX_DEPTH3 = 8;
+function collectToolOutputText(toolResponse, opts = {}) {
+  const maxBytes = opts.maxBytes ?? DLP_SCAN_LIMITS.maxStringBytes;
+  const parts = [];
+  let size = 0;
+  let fields = 0;
+  let truncated = false;
+  const push = (s) => {
+    if (s.length === 0) return true;
+    const room = maxBytes - size;
+    if (s.length > room) {
+      if (room > 0) {
+        parts.push(s.slice(0, room));
+        fields++;
+      }
+      size = maxBytes;
+      truncated = true;
+      return false;
+    }
+    parts.push(s);
+    fields++;
+    size += s.length + 1;
+    return true;
+  };
+  const walk = (v, depth) => {
+    if (typeof v === "string") return push(v);
+    if (depth >= MAX_DEPTH3 || v === null || typeof v !== "object") return true;
+    const children = Array.isArray(v) ? v : Object.values(v);
+    for (const child of children) if (!walk(child, depth + 1)) return false;
+    return true;
+  };
+  walk(toolResponse, 0);
+  return { text: parts.join("\n"), truncated, fields };
+}
+function shellOutputText(toolResponse) {
+  if (toolResponse && typeof toolResponse === "object" && !Array.isArray(toolResponse)) {
+    const r = toolResponse;
+    if (typeof r.stdout === "string" || typeof r.stderr === "string") {
+      return [r.stdout, r.stderr].filter((s) => typeof s === "string").join("\n");
+    }
+  }
+  return collectToolOutputText(toolResponse).text;
+}
+function mapToolOutputStrings(toolResponse, fn) {
+  const walk = (v, depth) => {
+    if (typeof v === "string") return fn(v);
+    if (depth >= MAX_DEPTH3 || v === null || typeof v !== "object") return v;
+    if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+    const out = {};
+    for (const [k, x] of Object.entries(v)) out[k] = walk(x, depth + 1);
+    return out;
+  };
+  return walk(toolResponse, 0);
+}
+function frameToolOutputLeaves(toolResponse, isSuspect, frame, neutralize) {
+  const suspect = [];
+  let largestAt = -1;
+  let largestLen = 0;
+  mapToolOutputStrings(toolResponse, (s) => {
+    const i2 = suspect.length;
+    suspect.push(s.length > 0 && isSuspect(s));
+    if (s.length > largestLen) {
+      largestLen = s.length;
+      largestAt = i2;
+    }
+    return s;
+  });
+  const anySuspect = suspect.some(Boolean);
+  let i = 0;
+  return mapToolOutputStrings(toolResponse, (s) => {
+    const at = i++;
+    const pick2 = anySuspect ? suspect[at] : at === largestAt;
+    if (!pick2) return neutralize(s);
+    const f = frame();
+    return `${f.header}
+${neutralize(s)}
+${f.footer}`;
+  });
+}
+
 // src/cli/commands/log.ts
 init_hasher();
 
@@ -59062,7 +59167,7 @@ function registerLogCommand(program2) {
         }
         if ((tool === "Bash" || tool === "bash") && isDaemonRunning()) {
           const bashCommand = typeof rawInput === "object" && rawInput !== null && "command" in rawInput && typeof rawInput.command === "string" ? rawInput.command : null;
-          const output = payload.tool_response?.output ?? "";
+          const output = shellOutputText(payload.tool_response);
           if (bashCommand && output) {
             const testResult = detectTestResult(bashCommand, output);
             if (testResult) {
@@ -59114,10 +59219,24 @@ function registerLogCommand(program2) {
           }
         }
         {
-          const toolOutput = payload.tool_response?.output;
+          const rawResponse = payload.tool_response;
+          const shimOutput = rawResponse && typeof rawResponse === "object" && typeof rawResponse.output === "string" ? rawResponse.output : void 0;
+          const collected = redactOutputMode ? {
+            text: shimOutput ?? collectToolOutputText(rawResponse, { maxBytes: Number.MAX_SAFE_INTEGER }).text,
+            truncated: false
+          } : collectToolOutputText(rawResponse);
+          const toolOutput = collected.text;
+          if (collected.truncated) {
+            appendToLog(HOOK_DEBUG_LOG, {
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              event: "post-tool-scan-truncated",
+              tool,
+              scannedBytes: toolOutput.length
+            });
+          }
           const inj = config.policy.injectionScan;
           const injectionOn = inj.enabled && !inj.allow.includes(tool);
-          if (typeof toolOutput === "string" && toolOutput.length > 0) {
+          if (toolOutput.length > 0) {
             if (redactOutputMode) {
               const { result, found } = redactText(toolOutput);
               let out = result;
@@ -59132,19 +59251,36 @@ function registerLogCommand(program2) {
               process.stdout.write(JSON.stringify({ redacted: out, found, injection }) + "\n");
             } else {
               const warnings = [];
+              const inPlace = agent === "Claude Code" && config.policy.dlp.enabled;
+              const redactedNames = /* @__PURE__ */ new Set();
+              let updatedToolOutput = void 0;
+              if (inPlace) {
+                const mapped = mapToolOutputStrings(payload.tool_response, (leaf) => {
+                  const r = redactText(leaf);
+                  for (const name of r.found) redactedNames.add(name);
+                  return r.result;
+                });
+                if (redactedNames.size > 0) updatedToolOutput = mapped;
+              }
               const hit = scanText(toolOutput);
-              if (hit) {
-                await notifySessionTaint(
-                  payloadSessionId ?? "",
-                  `output-secret:${hit.patternName}`
-                );
+              const secretName = hit?.patternName ?? [...redactedNames][0];
+              if (secretName) {
+                await notifySessionTaint(payloadSessionId ?? "", `output-secret:${secretName}`);
                 warnings.push(
-                  `\u26A0\uFE0F node9: this tool output contained a credential (${hit.patternName}). Do not echo, store, or transmit it \u2014 treat it as compromised and rotate it. node9 has flagged this session: the next network or write action will require approval.`
+                  updatedToolOutput !== void 0 ? `\u26A0\uFE0F node9: this tool output contained a credential (${secretName}); node9 replaced it with [node9-redacted:\u2026] before you read it. Treat the credential as compromised. node9 has flagged this session: the next network or write action will require approval.` : `\u26A0\uFE0F node9: this tool output contained a credential (${secretName}). Do not echo, store, or transmit it \u2014 treat it as compromised and rotate it. node9 has flagged this session: the next network or write action will require approval.`
                 );
               }
               if (injectionOn) {
                 const m = scanInjection(toolOutput, { tool: rawToolName });
                 if (m && atLeastConfidence(m.confidence, inj.minConfidence)) {
+                  if (agent === "Claude Code") {
+                    updatedToolOutput = frameToolOutputLeaves(
+                      updatedToolOutput ?? payload.tool_response,
+                      (leaf) => scanInjection(leaf, { tool: rawToolName }) !== null,
+                      newUntrustedFrame,
+                      neutralizeMarkers
+                    );
+                  }
                   await notifySessionTaint(
                     payloadSessionId ?? "",
                     `output-injection:${m.signals.join("+")}`
@@ -59154,12 +59290,22 @@ function registerLogCommand(program2) {
                   );
                 }
               }
-              if (warnings.length > 0 && (agent === "Claude Code" || agent === "Codex")) {
+              if (redactedNames.size > 0) {
+                appendToLog(LOCAL_AUDIT_LOG, {
+                  ts: (/* @__PURE__ */ new Date()).toISOString(),
+                  tool,
+                  source: "output-redacted",
+                  outputRedacted: [...redactedNames],
+                  ...payloadSessionId ? { sessionId: payloadSessionId } : {}
+                });
+              }
+              if ((warnings.length > 0 || updatedToolOutput !== void 0) && (agent === "Claude Code" || agent === "Codex")) {
                 process.stdout.write(
                   JSON.stringify({
                     hookSpecificOutput: {
                       hookEventName: "PostToolUse",
-                      additionalContext: warnings.join("\n\n")
+                      ...warnings.length > 0 ? { additionalContext: warnings.join("\n\n") } : {},
+                      ...updatedToolOutput !== void 0 ? { updatedToolOutput } : {}
                     }
                   }) + "\n"
                 );
@@ -59178,7 +59324,7 @@ function registerLogCommand(program2) {
         } catch {
         }
       }
-      process.exit(0);
+      process.stdout.write("", () => process.exit(0));
     };
     if (data) {
       await logPayload(data);
@@ -70721,7 +70867,7 @@ program.command("explain").description(
   'Machine-readable output (one JSON document; no "decision" field means failure)'
 ).action(async (tool, argsRaw, opts) => {
   const failJson = (message) => {
-    console.log(JSON.stringify(buildExplainJsonError(message), null, 2));
+    console.log(toSafeJson(buildExplainJsonError(message)));
     process.exit(1);
   };
   let args = {};
@@ -70733,7 +70879,7 @@ program.command("explain").description(
       } catch {
         if (opts.json) failJson("Invalid JSON in [args]");
         console.error(chalk47.red(`
-\u274C Invalid JSON: ${inputPreview(trimmed)}
+\u274C Invalid JSON: ${displaySafe(trimmed)}
 `));
         process.exit(1);
       }
@@ -70749,7 +70895,7 @@ program.command("explain").description(
     throw err2;
   }
   if (opts.json) {
-    console.log(JSON.stringify(buildExplainJson(result, argsRaw), null, 2));
+    console.log(toSafeJson(buildExplainJson(result, argsRaw)));
     return;
   }
   console.log("");
@@ -70763,16 +70909,17 @@ program.command("explain").description(
   console.log(chalk47.bold("Config Sources (Waterfall):"));
   for (const tier of result.waterfall) {
     const num3 = chalk47.gray(`  ${tier.tier}.`);
-    const label3 = tier.label.padEnd(16);
+    const label3 = displaySafe(tier.label).padEnd(16);
+    const tierNote = tier.note === void 0 ? void 0 : displaySafe(tier.note);
     let statusStr;
     if (tier.tier === 1) {
-      statusStr = chalk47.gray(tier.note ?? "");
+      statusStr = chalk47.gray(tierNote ?? "");
     } else if (tier.status === "active") {
-      const loc = tier.path ? chalk47.gray(tier.path) : "";
-      const note = tier.note ? chalk47.gray(`(${tier.note})`) : "";
+      const loc = tier.path ? chalk47.gray(displaySafe(tier.path)) : "";
+      const note = tierNote ? chalk47.gray(`(${tierNote})`) : "";
       statusStr = chalk47.green("\u2713 active") + (loc ? "  " + loc : "") + (note ? "  " + note : "");
     } else {
-      statusStr = chalk47.gray("\u25CB " + (tier.note ?? "not found"));
+      statusStr = chalk47.gray("\u25CB " + (tierNote ?? "not found"));
     }
     console.log(`${num3} ${chalk47.white(label3)} ${statusStr}`);
   }

package/dist/dashboard.mjs

@@ -5380,6 +5380,14 @@ var init_blast = __esm({
 import fs4 from "fs";
 import path5 from "path";
 import os5 from "os";
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
 function getInternalToken() {
   try {
     const pidFile = path5.join(os5.homedir(), ".node9", "daemon.pid");
@@ -5391,12 +5399,13 @@ function getInternalToken() {
     return null;
   }
 }
-var ACTIVITY_SOCKET_PATH, DAEMON_PORT, DAEMON_HOST;
+var ACTIVITY_SOCKET_PATH, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
     ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path5.join(os5.tmpdir(), "node9-activity.sock");
-    DAEMON_PORT = 7391;
+    DEFAULT_DAEMON_PORT = 7391;
+    DAEMON_PORT = resolveDaemonPort();
     DAEMON_HOST = "127.0.0.1";
   }
 });

package/dist/index.js

@@ -9625,7 +9625,16 @@ async function checkStatePredicates(predicates) {
     return null;
   }
 }
-var DAEMON_PORT = 7391;
+var DEFAULT_DAEMON_PORT = 7391;
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
+var DAEMON_PORT = resolveDaemonPort();
 var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   try {

package/dist/index.mjs

@@ -9595,7 +9595,16 @@ async function checkStatePredicates(predicates) {
     return null;
   }
 }
-var DAEMON_PORT = 7391;
+var DEFAULT_DAEMON_PORT = 7391;
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
+var DAEMON_PORT = resolveDaemonPort();
 var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.28.0",
+  "version": "2.29.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",