@node9/proxy 2.48.2 → 2.50.0

package/dist/scan-ink.mjs

@@ -2378,6 +2378,47 @@ var BLOCK_ALL = {
   "commands.unknown": "review",
   "commands.temp-binary": "block"
 };
+var ASI = {
+  ASI01: "Agent Goal Hijack",
+  ASI02: "Tool Misuse and Exploitation",
+  ASI03: "Identity and Privilege Abuse",
+  ASI04: "Agentic Supply Chain Vulnerabilities",
+  ASI05: "Unexpected Code Execution",
+  ASI06: "Memory and Context Poisoning",
+  ASI07: "Insecure Inter-Agent Communication",
+  ASI08: "Cascading Failures",
+  ASI09: "Human-Agent Trust Exploitation",
+  ASI10: "Rogue Agents"
+};
+var ASI_IDS = Object.keys(ASI);
+var PACK_SHIELD_OWASP = {
+  aws: "ASI02",
+  "bash-safe": "ASI02",
+  docker: "ASI02",
+  filesystem: "ASI02",
+  github: "ASI02",
+  k8s: "ASI02",
+  mongodb: "ASI02",
+  postgres: "ASI02",
+  redis: "ASI02",
+  stripe: "ASI09",
+  paypal: "ASI09",
+  square: "ASI09",
+  plaid: "ASI09",
+  okta: "ASI09",
+  auth0: "ASI09"
+};
+var PACK_RULE_OWASP = {
+  "packs.bash-safe.pipe-to-shell": "ASI05",
+  "packs.bash-safe.obfuscated-exec": "ASI05",
+  "packs.bash-safe.eval-remote": "ASI05",
+  "packs.bash-safe.eval-dynamic": "ASI05",
+  "packs.aws.iam-changes": "ASI03",
+  "packs.postgres.grant-revoke": "ASI03"
+};
+function packRowOwasp(id, shield) {
+  return PACK_RULE_OWASP[id] ?? PACK_SHIELD_OWASP[shield];
+}
 var VERDICTS = ["off", "log", "review", "block"];
 var ALL = VERDICTS;
 var BUILTIN_DANGEROUS_WORDS = ["mkfs", "shred"];
@@ -2385,6 +2426,7 @@ var PRODUCT_CHECKS = [
   {
     id: "files.shell-startup",
     group: "files",
+    owasp: "ASI02",
     title: "Shell startup files",
     catches: "Writes, replacements and removals of personal shell startup files",
     values: ALL,
@@ -2394,6 +2436,7 @@ var PRODUCT_CHECKS = [
   {
     id: "files.system-auth",
     group: "files",
+    owasp: "ASI03",
     title: "System authentication files",
     catches: "Changes to system authentication files and PAM configuration",
     values: ["block"],
@@ -2404,6 +2447,7 @@ var PRODUCT_CHECKS = [
   {
     id: "files.password-hashes",
     group: "files",
+    owasp: "ASI03",
     title: "System password hashes",
     catches: "Reads and copies of /etc/shadow and /etc/gshadow",
     values: ALL,
@@ -2413,6 +2457,7 @@ var PRODUCT_CHECKS = [
   {
     id: "files.system-dirs",
     group: "files",
+    owasp: "ASI02",
     title: "System directories",
     catches: "Writes, new files and removals under /usr, /etc, /boot, /bin, /sbin, /lib and /var/log, and uploads of system files",
     values: ALL,
@@ -2422,6 +2467,7 @@ var PRODUCT_CHECKS = [
   {
     id: "files.agent-instructions",
     group: "files",
+    owasp: "ASI06",
     title: "Agent instruction and memory files",
     catches: "writes to the files every later agent session loads as instructions (CLAUDE.md, AGENTS.md, memory, agents, commands) and changes to the agent's hooks; Standard asks only when the text carries an instruction to hide, skip approvals or touch secrets",
     values: ALL,
@@ -2432,6 +2478,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.inline-exec",
     group: "commands",
+    owasp: "ASI05",
     title: "Inline code execution",
     catches: "inline code (python -c, node -e, a heredoc into an interpreter) that deletes, sends, opens a socket, runs commands, reads protected files or decodes and runs; unreadable inline code",
     values: ALL,
@@ -2441,6 +2488,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.eval-dynamic",
     group: "commands",
+    owasp: "ASI05",
     title: "Eval of dynamic content",
     catches: "generated executable names, shell code from stdin, or dynamic eval/-c payloads",
     values: ALL,
@@ -2450,6 +2498,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.eval-remote",
     group: "commands",
+    owasp: "ASI05",
     title: "Eval of a remote download",
     catches: "eval or sh over the output of curl or wget",
     values: ["block"],
@@ -2460,6 +2509,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.curl-pipe-shell",
     group: "commands",
+    owasp: "ASI05",
     title: "Remote script piped into a shell",
     catches: "curl or wget piped into sh, bash, zsh or PowerShell",
     values: ALL,
@@ -2469,6 +2519,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.rm",
     group: "commands",
+    owasp: "ASI02",
     title: "Delete files",
     catches: "rm outside the known build-artifact paths",
     values: ALL,
@@ -2478,6 +2529,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.rm-home",
     group: "commands",
+    owasp: "ASI02",
     title: "Recursive delete of the home directory",
     catches: "rm -rf on ~, $HOME, /home or /",
     values: ["block"],
@@ -2488,6 +2540,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.chmod",
     group: "commands",
+    owasp: "ASI02",
     title: "World-writable permissions",
     catches: "chmod 777, 0777 or a+rwx",
     values: ALL,
@@ -2497,6 +2550,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.sudo",
     group: "commands",
+    owasp: "ASI03",
     title: "Elevated privileges",
     catches: "a command run through sudo",
     values: ALL,
@@ -2506,6 +2560,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.git-destructive",
     group: "commands",
+    owasp: "ASI02",
     title: "Destructive git operation",
     catches: "force push, reset --hard, clean -f, branch -D or tag delete, also through -C, env, wrappers, variables and aliases",
     values: ALL,
@@ -2515,6 +2570,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.git-hooks-bypass",
     group: "commands",
+    owasp: "ASI10",
     title: "Git hooks bypassed",
     catches: "the agent switches off the git hooks that check its own work: --no-verify, core.hooksPath, HUSKY=0 and its peers, or a hook file removed, emptied or made non-executable",
     values: ALL,
@@ -2524,6 +2580,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.git-stage-all",
     group: "commands",
+    owasp: "ASI02",
     title: "Stage everything at once",
     catches: "git add -A, git add ., git commit -a and other ways to stage every change instead of naming the files; off unless you switch it on",
     values: ALL,
@@ -2533,6 +2590,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.reverse-shell",
     group: "commands",
+    owasp: "ASI05",
     title: "Reverse shell",
     catches: "a shell wired to a network socket: bash -i >& /dev/tcp/\u2026, nc -e, socat exec:, a socket fd read by a shell, a shell piped to and from nc or telnet",
     values: ALL,
@@ -2542,6 +2600,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.node9-disarm",
     group: "commands",
+    owasp: "ASI10",
     title: "node9 disarmed from the shell",
     catches: "a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield, run by the agent",
     values: ALL,
@@ -2551,6 +2610,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.sql-ddl",
     group: "commands",
+    owasp: "ASI02",
     title: "Drop or truncate",
     catches: "DROP or TRUNCATE through a database CLI or a database tool",
     values: ALL,
@@ -2565,6 +2625,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.sql-no-where",
     group: "commands",
+    owasp: "ASI02",
     title: "Unscoped SQL mutation",
     catches: "DELETE or UPDATE without a WHERE clause",
     values: ALL,
@@ -2574,6 +2635,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.temp-binary",
     group: "commands",
+    owasp: "ASI05",
     title: "Binary from a temp directory",
     catches: "an absolute path under /tmp, /var/tmp, /dev/shm or a world-writable file",
     values: ALL,
@@ -2583,6 +2645,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.disk-destroy",
     group: "commands",
+    owasp: "ASI02",
     title: "Disk or filesystem destruction",
     catches: "mkfs, shred, dd and the manual-terminal disaster list",
     values: ALL,
@@ -2592,6 +2655,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.dangerous-word",
     group: "commands",
+    owasp: "ASI02",
     title: "Dangerous word",
     catches: "a word from a pack or from the config dangerousWords list",
     values: ALL,
@@ -2600,6 +2664,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.unanalysable",
     group: "commands",
+    owasp: "ASI02",
     title: "Command too nested to analyse",
     catches: "wrappers nested past the depth the shell parser follows",
     values: ALL,
@@ -2609,6 +2674,7 @@ var PRODUCT_CHECKS = [
   {
     id: "commands.unknown",
     group: "commands",
+    owasp: "ASI02",
     title: "Any command no check recognised",
     catches: "the strict-mode catch-all",
     values: ["off", "review"],
@@ -2619,6 +2685,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.secrets",
     group: "data",
+    owasp: "ASI03",
     title: "Secret in arguments",
     catches: "an API key, token or private key matching one of the DLP patterns",
     values: ALL,
@@ -2628,6 +2695,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.secrets-weak",
     group: "data",
+    owasp: "ASI03",
     title: "Weak credential in arguments",
     catches: "a JWT or a bearer token",
     values: ALL,
@@ -2637,6 +2705,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.pii",
     group: "data",
+    owasp: "ASI02",
     title: "Personal data in arguments",
     catches: "a social security number or a credit card number",
     values: ALL,
@@ -2646,6 +2715,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.credential-files",
     group: "data",
+    owasp: "ASI03",
     title: "Credential file read",
     catches: "~/.ssh, ~/.aws and .env files, through any reader or any file tool",
     values: ALL,
@@ -2654,6 +2724,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.credential-files-other",
     group: "data",
+    owasp: "ASI03",
     title: "Other credential file",
     catches: ".netrc, .npmrc, kube and docker config, and a copy of any credential file",
     values: ALL,
@@ -2662,6 +2733,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.credential-files-unknown",
     group: "data",
+    owasp: "ASI03",
     title: "Files read by names known only at run time",
     catches: "a reader fed names from a listing that can include credential files (find . | xargs cat)",
     values: ALL,
@@ -2670,6 +2742,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.pipe-chain",
     group: "data",
+    owasp: "ASI03",
     title: "Sensitive file piped to the network",
     catches: "a credential file read and piped into curl, nc or ssh",
     values: ALL,
@@ -2679,6 +2752,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.pipe-chain-obfuscated",
     group: "data",
+    owasp: "ASI03",
     title: "Obfuscated exfiltration",
     catches: "a sensitive file encoded or compressed on its way to the network",
     values: ALL,
@@ -2691,6 +2765,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.env-exfil",
     group: "data",
+    owasp: "ASI03",
     title: "Environment sent out",
     catches: "the whole environment (env, printenv, set, export -p, /proc/*/environ) handed to curl, nc or another sender, through $(\u2026), a pipe or a variable",
     values: ALL,
@@ -2700,6 +2775,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.output-secrets",
     group: "data",
+    owasp: "ASI03",
     title: "Secret in tool output",
     catches: "a credential a tool returned; the session is tainted, nothing is stopped",
     values: ["off", "log"],
@@ -2708,6 +2784,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.prompt-secrets",
     group: "data",
+    owasp: "ASI03",
     title: "Secret in the prompt",
     catches: "a credential pasted into the conversation",
     values: ALL,
@@ -2716,6 +2793,7 @@ var PRODUCT_CHECKS = [
   {
     id: "data.canary",
     group: "data",
+    owasp: "ASI03",
     title: "Decoy credential used",
     catches: "a planted decoy value appears in a tool call",
     values: ALL,
@@ -2726,6 +2804,7 @@ var PRODUCT_CHECKS = [
   {
     id: "network.unknown-host",
     group: "network",
+    owasp: "ASI02",
     title: "Unknown host",
     catches: "a destination on neither the allowlist nor the builtin list",
     values: ["off", "review", "block"],
@@ -2735,6 +2814,7 @@ var PRODUCT_CHECKS = [
   {
     id: "network.internal-addresses",
     group: "network",
+    owasp: "ASI02",
     title: "Internal address",
     catches: "loopback, the RFC 1918 ranges and carrier-grade NAT",
     values: ["off", "block"],
@@ -2743,6 +2823,7 @@ var PRODUCT_CHECKS = [
   {
     id: "network.metadata",
     group: "network",
+    owasp: "ASI02",
     title: "Cloud metadata address",
     catches: "169.254.169.254 and its peers, link-local and multicast",
     values: ["block"],
@@ -2753,6 +2834,7 @@ var PRODUCT_CHECKS = [
   {
     id: "network.taint-egress",
     group: "network",
+    owasp: "ASI01",
     title: "Tainted data sent out",
     catches: "a file or an output flagged earlier in the session reaches a host not on the allowlist",
     values: ALL,
@@ -2766,6 +2848,7 @@ var PRODUCT_CHECKS = [
   {
     id: "files.jail",
     group: "files",
+    owasp: "ASI03",
     title: "Jailed path",
     catches: "a path the workspace or the developer added to the jail",
     values: ALL,
@@ -2775,6 +2858,7 @@ var PRODUCT_CHECKS = [
   {
     id: "behavior.loops",
     group: "behavior",
+    owasp: "ASI08",
     title: "Runaway loop",
     catches: "the same tool call repeated past the threshold inside the window",
     values: ["off", "block"],
@@ -2784,6 +2868,7 @@ var PRODUCT_CHECKS = [
   {
     id: "behavior.prompt-injection",
     group: "behavior",
+    owasp: "ASI01",
     title: "Prompt injection in tool output",
     catches: "instructions aimed at the model inside content a tool returned",
     values: ["off", "log"],
@@ -2792,6 +2877,7 @@ var PRODUCT_CHECKS = [
   {
     id: "behavior.session-taint",
     group: "behavior",
+    owasp: "ASI01",
     title: "Action after tainted output",
     catches: "a network call or a write after a flagged file or a flagged tool output",
     values: ALL,
@@ -2801,6 +2887,7 @@ var PRODUCT_CHECKS = [
   {
     id: "behavior.untrusted-content",
     group: "behavior",
+    owasp: "ASI01",
     title: "Send after reading outside content",
     catches: "a send to an unknown destination, a destination found in what was read, or a destructive call after the session read an email, a web page or an issue",
     values: ["off", "log", "review"],
@@ -2811,6 +2898,7 @@ var PRODUCT_CHECKS = [
   {
     id: "loading.skill-tamper",
     group: "loading",
+    owasp: "ASI04",
     title: "Skill file changed",
     catches: "a skill or plugin file whose hash differs from the one approved",
     values: ["off", "log", "block"],
@@ -2820,6 +2908,7 @@ var PRODUCT_CHECKS = [
   {
     id: "loading.mcp-tamper",
     group: "loading",
+    owasp: "ASI04",
     title: "MCP server changed",
     catches: "tool definitions that differ from the pinned ones",
     values: ALL,
@@ -2829,6 +2918,7 @@ var PRODUCT_CHECKS = [
   {
     id: "loading.malicious-package",
     group: "loading",
+    owasp: "ASI04",
     title: "Malicious package",
     catches: "an install of a package the index flags",
     values: ALL,
@@ -2838,6 +2928,7 @@ var PRODUCT_CHECKS = [
   {
     id: "loading.unknown-registry",
     group: "loading",
+    owasp: "ASI04",
     title: "Package from an unknown registry",
     catches: "an install that names a registry on the command line (--registry, --index-url, -i, npm_config_registry=\u2026) that is not the public one, not in your npm, yarn, bun, pip or uv config and not on the allowlist",
     values: ALL,
@@ -2852,6 +2943,7 @@ var PRODUCT_CHECKS = [
   {
     id: "actions.money",
     group: "actions",
+    owasp: "ASI09",
     title: "Money moves",
     catches: "a refund, payout, transfer, charge or withdrawal through an app with no protection of its own",
     values: ALL,
@@ -2864,6 +2956,7 @@ var PRODUCT_CHECKS = [
   {
     id: "actions.access",
     group: "actions",
+    owasp: "ASI09",
     title: "Accounts and access change",
     catches: "a password, key, role, permission or user changed through an app with no protection of its own",
     values: ALL,
@@ -2873,6 +2966,7 @@ var PRODUCT_CHECKS = [
   {
     id: "actions.publish",
     group: "actions",
+    owasp: "ASI09",
     title: "Something is published",
     catches: "a release, package, deploy or public post through an app with no protection of its own",
     values: ALL,
@@ -2885,6 +2979,7 @@ var PRODUCT_CHECKS = [
   {
     id: "actions.settings",
     group: "actions",
+    owasp: "ASI09",
     title: "Repository, account and mailbox settings change",
     catches: "a repository made public, a deploy key, webhook or CI secret added, branch protection changed, mail forwarded outside or a public share link, through an app",
     values: ALL,
@@ -2894,6 +2989,7 @@ var PRODUCT_CHECKS = [
   {
     id: "actions.protected-branch",
     group: "actions",
+    owasp: "ASI09",
     title: "The main branch changes through an app",
     catches: "a merge, a commit straight to main or master, or a CI workflow file written through an app",
     values: ALL,
@@ -2921,6 +3017,10 @@ function packRows() {
       rows.push({
         id,
         group: "commands",
+        // A shield missing from the table falls back to tool misuse instead of
+        // throwing here: this module loads on every hook call, and a mapping
+        // omission must fail a test (owasp.spec.ts), never the gate.
+        owasp: packRowOwasp(id, shield.name) ?? "ASI02",
         title: rule.name.replace(SHIELD_RULE_NAME, "$3").replace(/-/g, " "),
         catches: rule.description ?? rule.reason ?? "",
         values: ALL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.48.2",
+  "version": "2.50.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -110,7 +110,7 @@
     "mvdan-sh"
   ],
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.135.0",
+    "@anthropic-ai/sdk": "^1.3.0",
     "@octokit/rest": "^22.0.1",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",