@node9/proxy 2.32.0 → 2.33.0

package/dist/scan-ink.mjs

@@ -42,195 +42,6 @@ function formatCost(usd) {
 // src/config/keyed-guard.ts
 import chalk from "chalk";
 
-// src/config-schema.ts
-import { z } from "zod";
-var noNewlines = z.string().refine((s) => !s.includes("\n") && !s.includes("\r"), {
-  message: "Value must not contain literal newline characters (use \\n instead)"
-});
-var SmartConditionSchema = z.object({
-  field: z.string().min(1, "Condition field must not be empty"),
-  op: z.enum(
-    [
-      "matches",
-      "notMatches",
-      "contains",
-      "notContains",
-      "exists",
-      "notExists",
-      "matchesGlob",
-      "notMatchesGlob"
-    ],
-    {
-      // zod 4 replaced errorMap with `error`. The wording is kept verbatim:
-      // it is what a user sees when their config is rejected.
-      error: () => "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
-    }
-  ),
-  value: z.string().optional(),
-  flags: z.string().optional()
-}).refine(
-  (c) => {
-    if (c.op === "matchesGlob" || c.op === "notMatchesGlob") return c.value !== void 0;
-    return true;
-  },
-  { message: "matchesGlob and notMatchesGlob conditions require a value field" }
-);
-var SmartRuleSchema = z.object({
-  name: z.string().optional(),
-  tool: z.string().min(1, "Smart rule tool must not be empty"),
-  conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
-  conditionMode: z.enum(["all", "any"]).optional(),
-  verdict: z.enum(["allow", "review", "block"], {
-    error: () => "verdict must be one of: allow, review, block"
-  }),
-  reason: z.string().optional(),
-  description: z.string().optional(),
-  // Unknown predicate names are filtered out rather than failing the whole rule.
-  // Failing the whole z.array() would cause sanitizeConfig to drop the entire
-  // `policy` top-level key, silently disabling ALL smart rules in the config.
-  dependsOnState: z.array(z.string()).transform(
-    (arr) => arr.filter(
-      (p) => p === "no_test_passed_since_last_edit"
-    )
-  ).optional(),
-  recoveryCommand: z.string().optional()
-});
-var ConfigFileSchema = z.object({
-  version: z.string().optional(),
-  settings: z.object({
-    mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
-    autoStartDaemon: z.boolean().optional(),
-    // enableUndo / policy.snapshot: removed with the undo feature. The
-    // schema strips undeclared keys silently (plain zod object — no
-    // .strict(), no .passthrough()), so a config still carrying them stays
-    // valid and simply loses them. Keeping the fields would instead make
-    // `node9_config_get` advertise a removed feature as a live knob.
-    enableHookLogDebug: z.boolean().optional(),
-    approvalTimeoutMs: z.number().nonnegative().optional(),
-    approvalTimeoutSeconds: z.number().nonnegative().optional(),
-    flightRecorder: z.boolean().optional(),
-    approvers: z.object({
-      native: z.boolean().optional(),
-      browser: z.boolean().optional(),
-      cloud: z.boolean().optional(),
-      terminal: z.boolean().optional()
-    }).optional(),
-    environment: z.string().optional(),
-    slackEnabled: z.boolean().optional(),
-    enableTrustSessions: z.boolean().optional(),
-    allowGlobalPause: z.boolean().optional(),
-    auditHashArgs: z.boolean().optional(),
-    agentPolicy: z.enum(["require_approval", "block_on_rules"]).optional(),
-    // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
-    // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
-    // node9's own approver (terminal/native/cloud). Unset → default ASK for
-    // ask-capable agents (v2: cloud no longer disables inline — the outcome
-    // ships to the dashboard as audit; admins force routing via managed
-    // reviewChannel, which outranks the local --ask flag).
-    reviewChannel: z.enum(["ask", "approver"]).optional(),
-    // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
-    // approver_set). Default (unset/false): those tools refuse over MCP — a human
-    // must run them from the CLI. node9's threat model is the agent itself.
-    mcpAllowWeakening: z.boolean().optional(),
-    // Auto-wire reconciler (P3 2.6): auto-wrap new ungoverned MCP servers vs
-    // nudge-only (default), and the scan cadence in minutes.
-    mcpAutoWrap: z.boolean().optional(),
-    mcpReconcileIntervalMinutes: z.number().positive().optional(),
-    mcpStaleAfterDays: z.number().min(0).optional(),
-    cloudSyncIntervalHours: z.number().positive().optional(),
-    // Seconds-granular override for the cloud policy sync cadence. Wins over
-    // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
-    // for an incident; clamped to a 15s floor so it can't hammer the API.
-    // Unset → falls back to hours, then the 5h default.
-    cloudSyncIntervalSeconds: z.number().positive().optional(),
-    // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
-    // to true; set false to fall back to local-only auditing.
-    shipper: z.object({
-      enabled: z.boolean().optional(),
-      intervalSeconds: z.number().min(5).optional()
-    }).optional()
-  }).optional(),
-  policy: z.object({
-    sandboxPaths: z.array(z.string()).optional(),
-    dangerousWords: z.array(noNewlines).optional(),
-    ignoredTools: z.array(z.string()).optional(),
-    toolInspection: z.record(
-      z.string(),
-      z.union([
-        z.string(),
-        z.object({ kind: z.literal("shell"), field: z.string().min(1) }).strict()
-      ])
-    ).optional(),
-    smartRules: z.array(SmartRuleSchema).optional(),
-    dlp: z.object({
-      enabled: z.boolean().optional(),
-      scanIgnoredTools: z.boolean().optional(),
-      pii: z.enum(["off", "block"]).optional(),
-      reviewAction: z.enum(["review", "block"]).optional()
-    }).optional(),
-    // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
-    // deliberately exclude 'off' — tighten-only.
-    commandChecks: z.object({
-      inlineExec: z.enum(["off", "review", "block"]).optional(),
-      rmAdvisory: z.enum(["off", "review", "block"]).optional(),
-      chmod: z.enum(["off", "review", "block"]).optional(),
-      sqlDdl: z.enum(["off", "review", "block"]).optional(),
-      evalDynamic: z.enum(["review", "block"]).optional(),
-      pipeChainHigh: z.enum(["review", "block"]).optional()
-    }).optional(),
-    egress: z.object({
-      enabled: z.boolean().optional(),
-      mode: z.enum(["off", "review", "block"]).optional(),
-      allow: z.array(z.string()).optional(),
-      deny: z.array(z.string()).optional(),
-      allowPrivate: z.boolean().optional(),
-      // SSRF floor. `ssrfAllow` exempts OVERRIDABLE tiers only; a tier-1
-      // entry is dropped with a warning at load, never silently honoured.
-      ssrfAllow: z.array(z.string()).optional(),
-      ssrfStrict: z.boolean().optional()
-    }).optional(),
-    loopDetection: z.object({
-      enabled: z.boolean().optional(),
-      threshold: z.number().min(2).optional(),
-      windowSeconds: z.number().min(10).optional()
-    }).optional(),
-    injectionScan: z.object({
-      enabled: z.boolean().optional(),
-      minConfidence: z.enum(["medium", "high"]).optional(),
-      allow: z.array(z.string()).optional()
-    }).optional(),
-    packageCheck: z.object({
-      enabled: z.boolean().optional(),
-      onMalicious: z.enum(["block", "review"]).optional(),
-      // 2.27.0 shape, still accepted: false = newPackage and installScript off.
-      registrySignals: z.boolean().optional(),
-      newPackage: z.enum(["review", "off"]).optional(),
-      installScript: z.enum(["review", "off"]).optional(),
-      maxAgeHours: z.number().min(0).optional(),
-      onlineFallback: z.boolean().optional(),
-      allow: z.array(z.string()).optional()
-    }).optional(),
-    untrustedContent: z.object({
-      enabled: z.boolean().optional(),
-      spotlight: z.boolean().optional(),
-      afterExposure: z.enum(["ask-once", "ask-every-time", "log-only"]).optional(),
-      orgDomains: z.array(z.string()).optional(),
-      roles: z.record(z.string(), z.record(z.string(), z.enum(["source", "action", "read"]))).optional()
-    }).optional(),
-    skillPinning: z.object({
-      enabled: z.boolean().optional(),
-      mode: z.enum(["warn", "block"]).optional(),
-      roots: z.array(z.string()).optional()
-    }).optional()
-  }).optional(),
-  environments: z.record(z.string(), z.object({ requireApproval: z.boolean().optional() })).optional()
-}).strict();
-
-// src/shields.ts
-import fs from "fs";
-import path from "path";
-import os from "os";
-
 // packages/policy-engine/dist/index.mjs
 import picomatch from "picomatch";
 import safeRegex from "safe-regex2";
@@ -2194,7 +2005,19 @@ var BASH_TOOL_NAMES = /* @__PURE__ */ new Set([
   "shell",
   "exec_command"
 ]);
-var MCP_EXECUTORS = /* @__PURE__ */ new Set([...BASH_TOOL_NAMES, "exec", "run_command", "terminal"]);
+var MCP_EXECUTORS = /* @__PURE__ */ new Set([
+  ...BASH_TOOL_NAMES,
+  "exec",
+  "run_command",
+  "terminal",
+  "execute_command",
+  "execute_shell",
+  "execute_shell_command",
+  "shell_execute",
+  "run_shell",
+  "run_terminal_command",
+  "start_process"
+]);
 var { syntax: syntax2 } = mvdanSh2;
 function opOf(sample) {
   return parseShared(sample).Stmts[0].Redirs[0].Op;
@@ -4367,6 +4190,8 @@ function validateCask(raw) {
   const second = b64urlIndex(s[tsAt + 5]);
   return month <= 11 && day <= 30 && hour <= 23 && minute <= 59 && second <= 59;
 }
+var INVISIBLE_RE = /[­͏؜᠎​-‏‪-‮⁠-⁤-︀-️]|[\u{E0000}-\u{E007F}]/gu;
+var INVISIBLE_ONE = new RegExp(`^(?:${INVISIBLE_RE.source.split("|")[0]})$`, "u");
 var HOMOGLYPHS = {
   // Cyrillic lowercase
   \u0430: "a",
@@ -5224,7 +5049,194 @@ var PUBLISH = {
 var OWN_HEADS = /* @__PURE__ */ new Set([...Object.keys(PUBLISH), "git", "gh"]);
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 
+// src/config-schema.ts
+import { z } from "zod";
+var noNewlines = z.string().refine((s) => !s.includes("\n") && !s.includes("\r"), {
+  message: "Value must not contain literal newline characters (use \\n instead)"
+});
+var SmartConditionSchema = z.object({
+  field: z.string().min(1, "Condition field must not be empty"),
+  op: z.enum(
+    [
+      "matches",
+      "notMatches",
+      "contains",
+      "notContains",
+      "exists",
+      "notExists",
+      "matchesGlob",
+      "notMatchesGlob"
+    ],
+    {
+      // zod 4 replaced errorMap with `error`. The wording is kept verbatim:
+      // it is what a user sees when their config is rejected.
+      error: () => "op must be one of: matches, notMatches, contains, notContains, exists, notExists, matchesGlob, notMatchesGlob"
+    }
+  ),
+  value: z.string().optional(),
+  flags: z.string().optional()
+}).refine(
+  (c) => {
+    if (c.op === "matchesGlob" || c.op === "notMatchesGlob") return c.value !== void 0;
+    return true;
+  },
+  { message: "matchesGlob and notMatchesGlob conditions require a value field" }
+);
+var SmartRuleSchema = z.object({
+  name: z.string().optional(),
+  tool: z.string().min(1, "Smart rule tool must not be empty"),
+  conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
+  conditionMode: z.enum(["all", "any"]).optional(),
+  verdict: z.enum(["allow", "review", "block"], {
+    error: () => "verdict must be one of: allow, review, block"
+  }),
+  reason: z.string().optional(),
+  description: z.string().optional(),
+  // Unknown predicate names are filtered out rather than failing the whole rule.
+  // Failing the whole z.array() would cause sanitizeConfig to drop the entire
+  // `policy` top-level key, silently disabling ALL smart rules in the config.
+  dependsOnState: z.array(z.string()).transform(
+    (arr) => arr.filter(
+      (p) => p === "no_test_passed_since_last_edit"
+    )
+  ).optional(),
+  recoveryCommand: z.string().optional()
+});
+var ConfigFileSchema = z.object({
+  version: z.string().optional(),
+  settings: z.object({
+    mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
+    autoStartDaemon: z.boolean().optional(),
+    // enableUndo / policy.snapshot: removed with the undo feature. The
+    // schema strips undeclared keys silently (plain zod object — no
+    // .strict(), no .passthrough()), so a config still carrying them stays
+    // valid and simply loses them. Keeping the fields would instead make
+    // `node9_config_get` advertise a removed feature as a live knob.
+    enableHookLogDebug: z.boolean().optional(),
+    approvalTimeoutMs: z.number().nonnegative().optional(),
+    approvalTimeoutSeconds: z.number().nonnegative().optional(),
+    flightRecorder: z.boolean().optional(),
+    approvers: z.object({
+      native: z.boolean().optional(),
+      browser: z.boolean().optional(),
+      cloud: z.boolean().optional(),
+      terminal: z.boolean().optional()
+    }).optional(),
+    environment: z.string().optional(),
+    slackEnabled: z.boolean().optional(),
+    enableTrustSessions: z.boolean().optional(),
+    allowGlobalPause: z.boolean().optional(),
+    auditHashArgs: z.boolean().optional(),
+    agentPolicy: z.enum(["require_approval", "block_on_rules"]).optional(),
+    // Where a `review` verdict's prompt is rendered: 'ask' = the agent's own
+    // inline approve/deny prompt (Claude Code / GitHub Copilot); 'approver' =
+    // node9's own approver (terminal/native/cloud). Unset → default ASK for
+    // ask-capable agents (v2: cloud no longer disables inline — the outcome
+    // ships to the dashboard as audit; admins force routing via managed
+    // reviewChannel, which outranks the local --ask flag).
+    reviewChannel: z.enum(["ask", "approver"]).optional(),
+    // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+    // approver_set). Default (unset/false): those tools refuse over MCP — a human
+    // must run them from the CLI. node9's threat model is the agent itself.
+    mcpAllowWeakening: z.boolean().optional(),
+    // Auto-wire reconciler (P3 2.6): auto-wrap new ungoverned MCP servers vs
+    // nudge-only (default), and the scan cadence in minutes.
+    mcpAutoWrap: z.boolean().optional(),
+    mcpReconcileIntervalMinutes: z.number().positive().optional(),
+    mcpStaleAfterDays: z.number().min(0).optional(),
+    cloudSyncIntervalHours: z.number().positive().optional(),
+    // Seconds-granular override for the cloud policy sync cadence. Wins over
+    // cloudSyncIntervalHours when set. Lets you opt into fast apply (e.g. 20)
+    // for an incident; clamped to a 15s floor so it can't hammer the API.
+    // Unset → falls back to hours, then the 5h default.
+    cloudSyncIntervalSeconds: z.number().positive().optional(),
+    // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
+    // to true; set false to fall back to local-only auditing.
+    shipper: z.object({
+      enabled: z.boolean().optional(),
+      intervalSeconds: z.number().min(5).optional()
+    }).optional()
+  }).optional(),
+  policy: z.object({
+    sandboxPaths: z.array(z.string()).optional(),
+    dangerousWords: z.array(noNewlines).optional(),
+    ignoredTools: z.array(z.string()).optional(),
+    toolInspection: z.record(
+      z.string(),
+      z.union([
+        z.string(),
+        z.object({ kind: z.literal("shell"), field: z.string().min(1) }).strict()
+      ])
+    ).optional(),
+    smartRules: z.array(SmartRuleSchema).optional(),
+    dlp: z.object({
+      enabled: z.boolean().optional(),
+      scanIgnoredTools: z.boolean().optional(),
+      pii: z.enum(["off", "block"]).optional(),
+      reviewAction: z.enum(["review", "block"]).optional()
+    }).optional(),
+    // Command-checks governance. Class-B keys (evalDynamic, pipeChainHigh)
+    // deliberately exclude 'off' — tighten-only.
+    commandChecks: z.object({
+      inlineExec: z.enum(["off", "review", "block"]).optional(),
+      rmAdvisory: z.enum(["off", "review", "block"]).optional(),
+      chmod: z.enum(["off", "review", "block"]).optional(),
+      sqlDdl: z.enum(["off", "review", "block"]).optional(),
+      evalDynamic: z.enum(["review", "block"]).optional(),
+      pipeChainHigh: z.enum(["review", "block"]).optional()
+    }).optional(),
+    egress: z.object({
+      enabled: z.boolean().optional(),
+      mode: z.enum(["off", "review", "block"]).optional(),
+      allow: z.array(z.string()).optional(),
+      deny: z.array(z.string()).optional(),
+      allowPrivate: z.boolean().optional(),
+      // SSRF floor. `ssrfAllow` exempts OVERRIDABLE tiers only; a tier-1
+      // entry is dropped with a warning at load, never silently honoured.
+      ssrfAllow: z.array(z.string()).optional(),
+      ssrfStrict: z.boolean().optional()
+    }).optional(),
+    loopDetection: z.object({
+      enabled: z.boolean().optional(),
+      threshold: z.number().min(2).optional(),
+      windowSeconds: z.number().min(10).optional()
+    }).optional(),
+    injectionScan: z.object({
+      enabled: z.boolean().optional(),
+      minConfidence: z.enum(["medium", "high"]).optional(),
+      allow: z.array(z.string()).optional()
+    }).optional(),
+    packageCheck: z.object({
+      enabled: z.boolean().optional(),
+      onMalicious: z.enum(["block", "review"]).optional(),
+      // 2.27.0 shape, still accepted: false = newPackage and installScript off.
+      registrySignals: z.boolean().optional(),
+      newPackage: z.enum(["review", "off"]).optional(),
+      installScript: z.enum(["review", "off"]).optional(),
+      maxAgeHours: z.number().min(0).optional(),
+      onlineFallback: z.boolean().optional(),
+      allow: z.array(z.string()).optional()
+    }).optional(),
+    untrustedContent: z.object({
+      enabled: z.boolean().optional(),
+      spotlight: z.boolean().optional(),
+      afterExposure: z.enum(["ask-once", "ask-every-time", "log-only"]).optional(),
+      orgDomains: z.array(z.string()).optional(),
+      roles: z.record(z.string(), z.record(z.string(), z.enum(["source", "action", "read"]))).optional()
+    }).optional(),
+    skillPinning: z.object({
+      enabled: z.boolean().optional(),
+      mode: z.enum(["warn", "block"]).optional(),
+      roots: z.array(z.string()).optional()
+    }).optional()
+  }).optional(),
+  environments: z.record(z.string(), z.object({ requireApproval: z.boolean().optional() })).optional()
+}).strict();
+
 // src/shields.ts
+import fs from "fs";
+import path from "path";
+import os from "os";
 var USER_SHIELDS_DIR = path.join(os.homedir(), ".node9", "shields");
 function loadUserShields() {
   const result = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",