@node9/proxy 2.36.0 → 2.37.0

package/dist/scan-ink.mjs

@@ -543,6 +543,77 @@ var filesystem_default = {
   ],
   dangerousWords: ["wipefs"]
 };
+var finance_default = {
+  name: "finance",
+  description: "Asks before money moves through a payment or banking app (refunds, payouts, transfers, charges, invoices), whatever the request said. Reads are never asked about.",
+  aliases: ["payments", "money"],
+  smartRules: [
+    {
+      name: "shield:finance:review-refund",
+      tool: "{,mcp__*__}{create_refund,refund_payment,refund_charge,refund_order,issue_refund}",
+      conditions: [],
+      verdict: "review",
+      reason: "A refund returns money to a customer. node9 asks before money moves, whatever the request said (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-payout",
+      tool: "{,mcp__*__}{create_payout,send_payout,payout,create_payouts_batch}",
+      conditions: [],
+      verdict: "review",
+      reason: "A payout moves the balance to a bank account. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-transfer",
+      tool: "{,mcp__*__}{transfer_create,transfer_authorization_create,create_transfer,transfer_money,transfer_funds,send_money,wire_transfer,create_wire,schedule_transaction,update_scheduled_transaction,create_transaction}",
+      conditions: [],
+      verdict: "review",
+      reason: "A transfer moves money between accounts. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-charge",
+      tool: "{,mcp__*__}{create_payment_intent,confirm_payment_intent,capture_payment_intent,create_charge,create_payment,capture_payment,capture_order,create_order,authorize_order,create_checkout_session}",
+      conditions: [],
+      verdict: "review",
+      reason: "This charges a card or captures a payment. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-payment-link",
+      tool: "{,mcp__*__}{create_payment_link,create_invoice,finalize_invoice,send_invoice,pay_invoice,create_invoice_item}",
+      conditions: [],
+      verdict: "review",
+      reason: "This bills someone or creates a link that charges a card. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-subscription",
+      tool: "{,mcp__*__}{create_subscription,cancel_subscription,update_subscription,pause_subscription,resume_subscription}",
+      conditions: [],
+      verdict: "review",
+      reason: "A subscription starts or stops recurring charges. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-dispute",
+      tool: "{,mcp__*__}{update_dispute,accept_dispute,close_dispute}",
+      conditions: [],
+      verdict: "review",
+      reason: "This answers or concedes a chargeback. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-card",
+      tool: "{,mcp__*__}{issue_card,create_virtual_card,create_issuing_card,update_card_limit}",
+      conditions: [],
+      verdict: "review",
+      reason: "This issues a card or changes its limit. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-withdraw",
+      tool: "{,mcp__*__}{withdraw,withdraw_funds,create_withdrawal,request_withdrawal}",
+      conditions: [],
+      verdict: "review",
+      reason: "A withdrawal moves money out. node9 asks before money moves (Finance shield)."
+    }
+  ],
+  dangerousWords: []
+};
 var github_default = {
   name: "github",
   description: "Protects GitHub repositories from destructive AI operations",
@@ -569,6 +640,56 @@ var github_default = {
   ],
   dangerousWords: []
 };
+var identity_default = {
+  name: "identity",
+  description: "Asks before a password, a key, a token, a role or a user changes in an identity or admin app, whatever the request said. Reads are never asked about.",
+  aliases: ["access", "iam"],
+  smartRules: [
+    {
+      name: "shield:identity:review-password",
+      tool: "{,mcp__*__}{change_password,update_password,reset_password,set_password,expire_password,force_password_reset}",
+      conditions: [],
+      verdict: "review",
+      reason: "This changes or resets a password. node9 asks before credentials change, whatever the request said (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-key",
+      tool: "{,mcp__*__}{rotate_key,rotate_api_key,create_api_key,create_token,create_access_token,create_personal_access_token,regenerate_secret,rotate_secret,create_service_account_key,create_credential}",
+      conditions: [],
+      verdict: "review",
+      reason: "This creates or rotates a key, token or secret. node9 asks before credentials change (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-access",
+      tool: "{,mcp__*__}{grant_access,grant_permission,grant_role,revoke_access,revoke_permission,revoke_role,revoke_token,set_permission,set_permissions,set_role,assign_role,update_role,add_permission,remove_permission,attach_policy,detach_policy}",
+      conditions: [],
+      verdict: "review",
+      reason: "This grants or revokes access. node9 asks before access changes (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-membership",
+      tool: "{,mcp__*__}{add_member,remove_member,add_user_to_group,remove_user_from_group,add_collaborator,remove_collaborator,invite_user,invite_member,invite_user_to_slack,invite_users,add_org_member,remove_org_member,add_team_member,remove_team_member}",
+      conditions: [],
+      verdict: "review",
+      reason: "This changes who belongs where. node9 asks before membership changes (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-user",
+      tool: "{,mcp__*__}{create_user,delete_user,deactivate_user,suspend_user,activate_user,unlock_user,make_admin,promote_user,demote_user,update_user_role}",
+      conditions: [],
+      verdict: "review",
+      reason: "This creates, removes or promotes an account. node9 asks before accounts change (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-mfa",
+      tool: "{,mcp__*__}{reset_mfa,reset_factors,disable_mfa,enroll_factor,deactivate_factor}",
+      conditions: [],
+      verdict: "review",
+      reason: "This changes a second factor. node9 asks before credentials change (Identity shield)."
+    }
+  ],
+  dangerousWords: []
+};
 var k8s_default = {
   name: "k8s",
   description: "Protects Kubernetes clusters from destructive AI operations",
@@ -901,6 +1022,175 @@ var project_jail_default = {
   ],
   dangerousWords: []
 };
+var publishing_default = {
+  name: "publishing",
+  description: "Asks before something goes public or ships outside the organisation (a release, a package, a deploy, a post), whatever the request said. The same switch covers the shell commands that publish.",
+  aliases: ["release", "deploy"],
+  smartRules: [
+    {
+      name: "shield:publishing:review-release",
+      tool: "{,mcp__*__}{create_release,publish_release,create_tag_release,update_release,promote_release}",
+      conditions: [],
+      verdict: "review",
+      reason: "A release ships code to everyone who installs it. node9 asks before publishing, whatever the request said (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-package",
+      tool: "{,mcp__*__}{publish_package,npm_publish,pypi_upload,publish_version,publish_extension}",
+      conditions: [],
+      verdict: "review",
+      reason: "This publishes a package. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-deploy",
+      tool: "{,mcp__*__}{deploy,create_deployment,deploy_site,promote_deployment,trigger_deploy,deploy_to_production,rollout}",
+      conditions: [],
+      verdict: "review",
+      reason: "This deploys to an environment other people use. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-post",
+      tool: "{,mcp__*__}{post_tweet,create_tweet,post_webpage,publish_post,create_post,publish_page,send_announcement,post_announcement,create_linkedin_post,schedule_post}",
+      conditions: [],
+      verdict: "review",
+      reason: "This posts outside the organisation. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-visibility",
+      tool: "{,mcp__*__}{set_visibility,make_public,set_public,publish_repository,change_visibility,update_visibility}",
+      conditions: [],
+      verdict: "review",
+      reason: "This makes something public. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-npm-publish",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:npm|pnpm)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "npm publish ships the package to everyone who installs it. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-yarn-publish",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:yarn)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "yarn publish ships the package to everyone who installs it. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-twine-upload",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:twine)(?![\\w-])[^;&|]{0,200}?\\s(?:upload)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "twine upload publishes to PyPI. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-python-publish",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:poetry|uv|hatch|flit)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "This publishes the Python package to PyPI. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-release-tool-publish",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:lerna|changeset|vsce|ovsx)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "This publishes packages or an editor extension through a release tool. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-cargo-publish",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:cargo)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "cargo publish ships the crate. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-gem-push",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:gem)(?![\\w-])[^;&|]{0,200}?\\s(?:push)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "gem push publishes to RubyGems. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-docker-push",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:docker|podman)(?![\\w-])[^;&|]{0,200}?\\s(?:push|--push)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "docker push publishes the image to a registry. node9 asks before publishing (Publishing shield)."
+    },
+    {
+      name: "shield:publishing:review-gh-release",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:gh)(?![\\w-])[^;&|]{0,200}?\\srelease\\s+(?:create|upload|edit)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "gh release ships a release on GitHub. node9 asks before publishing (Publishing shield)."
+    }
+  ],
+  dangerousWords: []
+};
 var redis_default = {
   name: "redis",
   description: "Protects Redis instances from destructive AI operations",
@@ -998,13 +1288,25 @@ var BUILTIN_SHIELDS = {
   [bash_safe_default.name]: bash_safe_default,
   [docker_default.name]: docker_default,
   [filesystem_default.name]: filesystem_default,
+  // Dangerous actions as category shields (node9Firewall#385): an MCP app's
+  // money, credential and publishing tools, asked about whatever the request
+  // said. One glob per rule covers the bare name the gateway sends and the
+  // mcp__<server>__ name the agent hook sends.
+  [finance_default.name]: finance_default,
   [github_default.name]: github_default,
+  [identity_default.name]: identity_default,
   [k8s_default.name]: k8s_default,
   [mongodb_default.name]: mongodb_default,
   [postgres_default.name]: postgres_default,
   [project_jail_default.name]: project_jail_default,
+  [publishing_default.name]: publishing_default,
   [redis_default.name]: redis_default
 };
+var ACTION_SHIELD_NAMES = /* @__PURE__ */ new Set([
+  "finance",
+  "identity",
+  "publishing"
+]);
 function assertBuiltinShieldRegexesAreSafe() {
   for (const shield of Object.values(BUILTIN_SHIELDS)) {
     for (const rule of shield.smartRules) {
@@ -6005,7 +6307,7 @@ function ShieldsPanel({ summary, width, enabledShields = [] }) {
   });
   const hitShields = ranked.filter((i) => i.totalCatches > 0);
   const hitNames = new Set(hitShields.map((i) => i.shieldName));
-  const zeroHitAll = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitNames.has(name)).sort();
+  const zeroHitAll = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitNames.has(name) && !ACTION_SHIELD_NAMES.has(name)).sort();
   const zeroHitBuiltins = zeroHitAll.filter((name) => !enabled.has(name));
   const zeroHitEnabled = zeroHitAll.filter((name) => enabled.has(name));
   const topRec = hitShields.find(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.36.0",
+  "version": "2.37.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",