@node9/proxy 2.28.1 → 2.29.0

package/dist/cli.js

@@ -11103,6 +11103,14 @@ async function checkStatePredicates(predicates) {
     return null;
   }
 }
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
 function getInternalToken() {
   try {
     const pidFile = import_path10.default.join(import_os8.default.homedir(), ".node9", "daemon.pid");
@@ -11376,7 +11384,7 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
     signal: AbortSignal.timeout(3e3)
   });
 }
-var import_fs10, import_net, import_path10, import_os8, ACTIVITY_SOCKET_PATH, DAEMON_PORT, DAEMON_HOST;
+var import_fs10, import_net, import_path10, import_os8, ACTIVITY_SOCKET_PATH, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
@@ -11385,7 +11393,8 @@ var init_daemon = __esm({
     import_path10 = __toESM(require("path"));
     import_os8 = __toESM(require("os"));
     ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path10.default.join(import_os8.default.tmpdir(), "node9-activity.sock");
-    DAEMON_PORT = 7391;
+    DEFAULT_DAEMON_PORT = 7391;
+    DAEMON_PORT = resolveDaemonPort();
     DAEMON_HOST = "127.0.0.1";
   }
 });
@@ -58994,6 +59003,42 @@ function shellOutputText(toolResponse) {
   }
   return collectToolOutputText(toolResponse).text;
 }
+function mapToolOutputStrings(toolResponse, fn) {
+  const walk = (v, depth) => {
+    if (typeof v === "string") return fn(v);
+    if (depth >= MAX_DEPTH3 || v === null || typeof v !== "object") return v;
+    if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+    const out = {};
+    for (const [k, x] of Object.entries(v)) out[k] = walk(x, depth + 1);
+    return out;
+  };
+  return walk(toolResponse, 0);
+}
+function frameToolOutputLeaves(toolResponse, isSuspect, frame, neutralize) {
+  const suspect = [];
+  let largestAt = -1;
+  let largestLen = 0;
+  mapToolOutputStrings(toolResponse, (s) => {
+    const i2 = suspect.length;
+    suspect.push(s.length > 0 && isSuspect(s));
+    if (s.length > largestLen) {
+      largestLen = s.length;
+      largestAt = i2;
+    }
+    return s;
+  });
+  const anySuspect = suspect.some(Boolean);
+  let i = 0;
+  return mapToolOutputStrings(toolResponse, (s) => {
+    const at = i++;
+    const pick2 = anySuspect ? suspect[at] : at === largestAt;
+    if (!pick2) return neutralize(s);
+    const f = frame();
+    return `${f.header}
+${neutralize(s)}
+${f.footer}`;
+  });
+}
 
 // src/cli/commands/log.ts
 init_hasher();
@@ -59224,19 +59269,36 @@ function registerLogCommand(program2) {
               process.stdout.write(JSON.stringify({ redacted: out, found, injection }) + "\n");
             } else {
               const warnings = [];
+              const inPlace = agent === "Claude Code" && config.policy.dlp.enabled;
+              const redactedNames = /* @__PURE__ */ new Set();
+              let updatedToolOutput = void 0;
+              if (inPlace) {
+                const mapped = mapToolOutputStrings(payload.tool_response, (leaf) => {
+                  const r = redactText(leaf);
+                  for (const name of r.found) redactedNames.add(name);
+                  return r.result;
+                });
+                if (redactedNames.size > 0) updatedToolOutput = mapped;
+              }
               const hit = scanText(toolOutput);
-              if (hit) {
-                await notifySessionTaint(
-                  payloadSessionId ?? "",
-                  `output-secret:${hit.patternName}`
-                );
+              const secretName = hit?.patternName ?? [...redactedNames][0];
+              if (secretName) {
+                await notifySessionTaint(payloadSessionId ?? "", `output-secret:${secretName}`);
                 warnings.push(
-                  `\u26A0\uFE0F node9: this tool output contained a credential (${hit.patternName}). Do not echo, store, or transmit it \u2014 treat it as compromised and rotate it. node9 has flagged this session: the next network or write action will require approval.`
+                  updatedToolOutput !== void 0 ? `\u26A0\uFE0F node9: this tool output contained a credential (${secretName}); node9 replaced it with [node9-redacted:\u2026] before you read it. Treat the credential as compromised. node9 has flagged this session: the next network or write action will require approval.` : `\u26A0\uFE0F node9: this tool output contained a credential (${secretName}). Do not echo, store, or transmit it \u2014 treat it as compromised and rotate it. node9 has flagged this session: the next network or write action will require approval.`
                 );
               }
               if (injectionOn) {
                 const m = scanInjection(toolOutput, { tool: rawToolName });
                 if (m && atLeastConfidence(m.confidence, inj.minConfidence)) {
+                  if (agent === "Claude Code") {
+                    updatedToolOutput = frameToolOutputLeaves(
+                      updatedToolOutput ?? payload.tool_response,
+                      (leaf) => scanInjection(leaf, { tool: rawToolName }) !== null,
+                      newUntrustedFrame,
+                      neutralizeMarkers
+                    );
+                  }
                   await notifySessionTaint(
                     payloadSessionId ?? "",
                     `output-injection:${m.signals.join("+")}`
@@ -59246,12 +59308,22 @@ function registerLogCommand(program2) {
                   );
                 }
               }
-              if (warnings.length > 0 && (agent === "Claude Code" || agent === "Codex")) {
+              if (redactedNames.size > 0) {
+                appendToLog(LOCAL_AUDIT_LOG, {
+                  ts: (/* @__PURE__ */ new Date()).toISOString(),
+                  tool,
+                  source: "output-redacted",
+                  outputRedacted: [...redactedNames],
+                  ...payloadSessionId ? { sessionId: payloadSessionId } : {}
+                });
+              }
+              if ((warnings.length > 0 || updatedToolOutput !== void 0) && (agent === "Claude Code" || agent === "Codex")) {
                 process.stdout.write(
                   JSON.stringify({
                     hookSpecificOutput: {
                       hookEventName: "PostToolUse",
-                      additionalContext: warnings.join("\n\n")
+                      ...warnings.length > 0 ? { additionalContext: warnings.join("\n\n") } : {},
+                      ...updatedToolOutput !== void 0 ? { updatedToolOutput } : {}
                     }
                   }) + "\n"
                 );

package/dist/cli.mjs

@@ -11109,6 +11109,14 @@ async function checkStatePredicates(predicates) {
     return null;
   }
 }
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
 function getInternalToken() {
   try {
     const pidFile = path10.join(os8.homedir(), ".node9", "daemon.pid");
@@ -11382,12 +11390,13 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
     signal: AbortSignal.timeout(3e3)
   });
 }
-var ACTIVITY_SOCKET_PATH, DAEMON_PORT, DAEMON_HOST;
+var ACTIVITY_SOCKET_PATH, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
     ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path10.join(os8.tmpdir(), "node9-activity.sock");
-    DAEMON_PORT = 7391;
+    DEFAULT_DAEMON_PORT = 7391;
+    DAEMON_PORT = resolveDaemonPort();
     DAEMON_HOST = "127.0.0.1";
   }
 });
@@ -58976,6 +58985,42 @@ function shellOutputText(toolResponse) {
   }
   return collectToolOutputText(toolResponse).text;
 }
+function mapToolOutputStrings(toolResponse, fn) {
+  const walk = (v, depth) => {
+    if (typeof v === "string") return fn(v);
+    if (depth >= MAX_DEPTH3 || v === null || typeof v !== "object") return v;
+    if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+    const out = {};
+    for (const [k, x] of Object.entries(v)) out[k] = walk(x, depth + 1);
+    return out;
+  };
+  return walk(toolResponse, 0);
+}
+function frameToolOutputLeaves(toolResponse, isSuspect, frame, neutralize) {
+  const suspect = [];
+  let largestAt = -1;
+  let largestLen = 0;
+  mapToolOutputStrings(toolResponse, (s) => {
+    const i2 = suspect.length;
+    suspect.push(s.length > 0 && isSuspect(s));
+    if (s.length > largestLen) {
+      largestLen = s.length;
+      largestAt = i2;
+    }
+    return s;
+  });
+  const anySuspect = suspect.some(Boolean);
+  let i = 0;
+  return mapToolOutputStrings(toolResponse, (s) => {
+    const at = i++;
+    const pick2 = anySuspect ? suspect[at] : at === largestAt;
+    if (!pick2) return neutralize(s);
+    const f = frame();
+    return `${f.header}
+${neutralize(s)}
+${f.footer}`;
+  });
+}
 
 // src/cli/commands/log.ts
 init_hasher();
@@ -59206,19 +59251,36 @@ function registerLogCommand(program2) {
               process.stdout.write(JSON.stringify({ redacted: out, found, injection }) + "\n");
             } else {
               const warnings = [];
+              const inPlace = agent === "Claude Code" && config.policy.dlp.enabled;
+              const redactedNames = /* @__PURE__ */ new Set();
+              let updatedToolOutput = void 0;
+              if (inPlace) {
+                const mapped = mapToolOutputStrings(payload.tool_response, (leaf) => {
+                  const r = redactText(leaf);
+                  for (const name of r.found) redactedNames.add(name);
+                  return r.result;
+                });
+                if (redactedNames.size > 0) updatedToolOutput = mapped;
+              }
               const hit = scanText(toolOutput);
-              if (hit) {
-                await notifySessionTaint(
-                  payloadSessionId ?? "",
-                  `output-secret:${hit.patternName}`
-                );
+              const secretName = hit?.patternName ?? [...redactedNames][0];
+              if (secretName) {
+                await notifySessionTaint(payloadSessionId ?? "", `output-secret:${secretName}`);
                 warnings.push(
-                  `\u26A0\uFE0F node9: this tool output contained a credential (${hit.patternName}). Do not echo, store, or transmit it \u2014 treat it as compromised and rotate it. node9 has flagged this session: the next network or write action will require approval.`
+                  updatedToolOutput !== void 0 ? `\u26A0\uFE0F node9: this tool output contained a credential (${secretName}); node9 replaced it with [node9-redacted:\u2026] before you read it. Treat the credential as compromised. node9 has flagged this session: the next network or write action will require approval.` : `\u26A0\uFE0F node9: this tool output contained a credential (${secretName}). Do not echo, store, or transmit it \u2014 treat it as compromised and rotate it. node9 has flagged this session: the next network or write action will require approval.`
                 );
               }
               if (injectionOn) {
                 const m = scanInjection(toolOutput, { tool: rawToolName });
                 if (m && atLeastConfidence(m.confidence, inj.minConfidence)) {
+                  if (agent === "Claude Code") {
+                    updatedToolOutput = frameToolOutputLeaves(
+                      updatedToolOutput ?? payload.tool_response,
+                      (leaf) => scanInjection(leaf, { tool: rawToolName }) !== null,
+                      newUntrustedFrame,
+                      neutralizeMarkers
+                    );
+                  }
                   await notifySessionTaint(
                     payloadSessionId ?? "",
                     `output-injection:${m.signals.join("+")}`
@@ -59228,12 +59290,22 @@ function registerLogCommand(program2) {
                   );
                 }
               }
-              if (warnings.length > 0 && (agent === "Claude Code" || agent === "Codex")) {
+              if (redactedNames.size > 0) {
+                appendToLog(LOCAL_AUDIT_LOG, {
+                  ts: (/* @__PURE__ */ new Date()).toISOString(),
+                  tool,
+                  source: "output-redacted",
+                  outputRedacted: [...redactedNames],
+                  ...payloadSessionId ? { sessionId: payloadSessionId } : {}
+                });
+              }
+              if ((warnings.length > 0 || updatedToolOutput !== void 0) && (agent === "Claude Code" || agent === "Codex")) {
                 process.stdout.write(
                   JSON.stringify({
                     hookSpecificOutput: {
                       hookEventName: "PostToolUse",
-                      additionalContext: warnings.join("\n\n")
+                      ...warnings.length > 0 ? { additionalContext: warnings.join("\n\n") } : {},
+                      ...updatedToolOutput !== void 0 ? { updatedToolOutput } : {}
                     }
                   }) + "\n"
                 );

package/dist/dashboard.mjs

@@ -5380,6 +5380,14 @@ var init_blast = __esm({
 import fs4 from "fs";
 import path5 from "path";
 import os5 from "os";
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
 function getInternalToken() {
   try {
     const pidFile = path5.join(os5.homedir(), ".node9", "daemon.pid");
@@ -5391,12 +5399,13 @@ function getInternalToken() {
     return null;
   }
 }
-var ACTIVITY_SOCKET_PATH, DAEMON_PORT, DAEMON_HOST;
+var ACTIVITY_SOCKET_PATH, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
     ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path5.join(os5.tmpdir(), "node9-activity.sock");
-    DAEMON_PORT = 7391;
+    DEFAULT_DAEMON_PORT = 7391;
+    DAEMON_PORT = resolveDaemonPort();
     DAEMON_HOST = "127.0.0.1";
   }
 });

package/dist/index.js

@@ -9625,7 +9625,16 @@ async function checkStatePredicates(predicates) {
     return null;
   }
 }
-var DAEMON_PORT = 7391;
+var DEFAULT_DAEMON_PORT = 7391;
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
+var DAEMON_PORT = resolveDaemonPort();
 var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   try {

package/dist/index.mjs

@@ -9595,7 +9595,16 @@ async function checkStatePredicates(predicates) {
     return null;
   }
 }
-var DAEMON_PORT = 7391;
+var DEFAULT_DAEMON_PORT = 7391;
+function resolveDaemonPort(env = process.env) {
+  if (env.NODE9_TESTING !== "1") return DEFAULT_DAEMON_PORT;
+  const raw = env.NODE9_DAEMON_PORT;
+  if (raw === void 0 || raw === "") return DEFAULT_DAEMON_PORT;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return DEFAULT_DAEMON_PORT;
+  return port;
+}
+var DAEMON_PORT = resolveDaemonPort();
 var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.28.1",
+  "version": "2.29.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",