@node9/proxy 2.49.0 → 2.50.0

package/dist/dashboard.mjs

@@ -566,12 +566,13 @@ function packRows() {
       if (!rule.name || SHIELD_RULES_FOLDED_INTO_PRODUCT[rule.name]) continue;
       const id = packRowId(shield.name, rule.name);
       if (!id) continue;
-      const owasp = packRowOwasp(id, shield.name);
-      if (!owasp) throw new Error(`pack row ${id} has no OWASP risk: add the shield to owasp.ts`);
       rows.push({
         id,
         group: "commands",
-        owasp,
+        // A shield missing from the table falls back to tool misuse instead of
+        // throwing here: this module loads on every hook call, and a mapping
+        // omission must fail a test (owasp.spec.ts), never the gate.
+        owasp: packRowOwasp(id, shield.name) ?? "ASI02",
         title: rule.name.replace(SHIELD_RULE_NAME, "$3").replace(/-/g, " "),
         catches: rule.description ?? rule.reason ?? "",
         values: ALL,
@@ -25344,7 +25345,7 @@ var init_agent_permissions = __esm({
     init_codex();
     init_read_small_file();
     CATEGORY = "Agent permissions";
-    CLAUDE_NO_PROMPT_MODES = /* @__PURE__ */ new Set(["bypassPermissions", "dontAsk"]);
+    CLAUDE_NO_PROMPT_MODES = /* @__PURE__ */ new Set(["bypassPermissions"]);
     MAX_FILE_BYTES2 = 2 * 1024 * 1024;
     CI_SEVERITY = {
       critical: "critical",
@@ -25380,6 +25381,15 @@ function checkOutsideContent(ctx) {
   const roles = config.policy.untrustedContent?.roles ?? {};
   const sources = outsideSources(home, roles);
   if (sources.length === 0) return [];
+  const byServer = /* @__PURE__ */ new Map();
+  for (const src of sources) {
+    const e = byServer.get(src.server);
+    if (e) {
+      if (!e.agents.includes(src.agent)) e.agents.push(src.agent);
+      if (src.how === "role") e.how = "role";
+    } else byServer.set(src.server, { agents: [src.agent], how: src.how });
+  }
+  const servers = byServer.size;
   const egress = config.policy.egress;
   const egressGated = !!egress?.enabled && (egress.mode === "block" || egress.mode === "review");
   const hold = checkValue(
@@ -25396,11 +25406,14 @@ function checkOutsideContent(ctx) {
     {
       category: CATEGORY2,
       severity: "high",
-      title: `${sources.length} MCP server${sources.length === 1 ? "" : "s"} bring${sources.length === 1 ? "s" : ""} outside content in, and the way out is open`,
+      title: `${servers} MCP server${servers === 1 ? "" : "s"} bring${servers === 1 ? "s" : ""} outside content in, and the way out is open`,
       what: "An agent here reads pages, issues or messages written by others, and what it does next is not held.",
       why: gaps.join("; ") + ".",
       who: "One poisoned page or issue is enough: the agent reads it, then sends or deletes as it says.",
-      detail: [...sources.slice(0, 8).map((s) => `${s.server} (${s.agent}, by ${s.how})`), ...gaps],
+      detail: [
+        ...[...byServer].slice(0, 8).map(([name, e]) => `${name} (${e.agents.join(", ")}, by ${e.how})`),
+        ...gaps
+      ],
       owner: "node9",
       fix: 'Run `node9 egress watch` (or `node9 egress lock`), keep behavior.untrusted-content on, and mark each server\'s reading tools as "Brings outside content" on the Apps page so the hold applies to them.'
     }
@@ -25550,14 +25563,14 @@ import fs24 from "fs";
 import path27 from "path";
 import os21 from "os";
 import crypto3 from "crypto";
-function getPinsFilePath() {
-  return path27.join(os21.homedir(), ".node9", "skill-pins.json");
+function getPinsFilePath(home = os21.homedir()) {
+  return path27.join(home, ".node9", "skill-pins.json");
 }
 function getRootKey(absPath) {
   return crypto3.createHash("sha256").update(absPath).digest("hex").slice(0, 16);
 }
-function readSkillPinsSafe() {
-  const filePath = getPinsFilePath();
+function readSkillPinsSafe(home) {
+  const filePath = getPinsFilePath(home);
   try {
     const raw = fs24.readFileSync(filePath, "utf-8");
     if (!raw.trim()) return { ok: false, reason: "corrupt", detail: "empty file" };
@@ -25678,7 +25691,7 @@ function checkSupplyChain(ctx) {
 }
 function pluginPinState(home) {
   const roots = defaultSkillRoots(void 0, home);
-  const pins = readSkillPinsSafe();
+  const pins = readSkillPinsSafe(home);
   const pinned = pins.ok ? pins.pins.roots : {};
   return { roots, unpinned: roots.filter((r) => !pinned[getRootKey(r)]) };
 }
@@ -25691,7 +25704,7 @@ function pluginsAndPackages(ctx, home) {
   if (roots.length > 0 && tamper === "off") {
     findings.push({
       category: "Supply chain",
-      severity: "medium",
+      severity: "advisory",
       title: `${roots.length} installed plugin${roots.length === 1 ? "" : "s"} load${roots.length === 1 ? "s" : ""} unverified`,
       what: "Plugins and skills the agent loads are code that runs with its rights, and no content hash is kept for them.",
       why: "The check loading.skill-tamper is off, so node9 does not pin them.",
@@ -25703,7 +25716,7 @@ function pluginsAndPackages(ctx, home) {
   } else if (unpinned.length > 0) {
     findings.push({
       category: "Supply chain",
-      severity: "medium",
+      severity: "advisory",
       title: `${unpinned.length} of ${roots.length} installed plugin${roots.length === 1 ? "" : "s"} ${unpinned.length === 1 ? "has" : "have"} no pin yet`,
       what: "A plugin the agent can load has no recorded content hash yet.",
       why: "node9 pins a plugin the first time it loads; these have not loaded since pinning was turned on.",
@@ -26148,7 +26161,8 @@ function checkCoverage(ctx) {
     });
     return findings;
   }
-  const mode = getConfig(ctx.cwd).settings.mode;
+  const config = getConfig(ctx.cwd);
+  const mode = config.settings.mode;
   if (isRecordOnly(mode)) {
     const level = levelOf(mode);
     findings.push({
@@ -26163,7 +26177,6 @@ function checkCoverage(ctx) {
       fix: "Set mode to `standard` (or `strict`) to enforce in-path."
     });
   }
-  const config = getConfig(ctx.cwd);
   if (config.settings.autoStartDaemon !== false) {
     const state = autostartState();
     if (state === "disabled" || state === "absent") {
@@ -26482,8 +26495,6 @@ async function annotateCoverage(findings, ctx) {
     }
     if (probe.kind === "egress") {
       f.coverage = egressCoverage(env);
-      if (f.coverage.state === "open" && config.policy.egress.enabled && config.policy.egress.mode !== "off" && isRecordOnly(mode))
-        f.fix = auditModeFix(mode, "node9 egress is set");
       continue;
     }
     if (probe.kind === "gateWired") {
@@ -30440,7 +30451,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       systemAccessHandled: !isManual && fileAccess.handledPaths.has(filePath)
     }) : null) ?? argumentScan(),
     pii: () => detectArgsPii(args),
-    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, { offline: !!forecast }) : Promise.resolve(null)
+    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, {
+      offline: !!forecast && forecast.onlinePackages !== true
+    }) : Promise.resolve(null)
   });
   const dlpMatch = gates.stop?.dlpMatch ?? gates.reviews.dlp ?? null;
   if (dlpMatch) {
@@ -31463,7 +31476,8 @@ async function forecastDecision(toolName, args, meta, opts = {}) {
     session,
     config,
     unknown: /* @__PURE__ */ new Set(),
-    now: opts.at ?? Date.now()
+    now: opts.at ?? Date.now(),
+    ...opts.onlinePackages && { onlinePackages: true }
   };
   const result = await runForecast(
     run,
@@ -31558,6 +31572,20 @@ var init_forecast = __esm({
   }
 });
 
+// src/exposure/shell-fetch.ts
+function shellFetch(tool, rawInput) {
+  if (tool !== "Bash" && tool !== "bash") return null;
+  const cmd = rawInput && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput.command : void 0;
+  return typeof cmd === "string" && cmd.length > 0 ? classifyShellExposure(cmd) : null;
+}
+var init_shell_fetch = __esm({
+  "src/exposure/shell-fetch.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_dist();
+  }
+});
+
 // src/version.ts
 import fs44 from "fs";
 import path49 from "path";
@@ -31858,6 +31886,8 @@ var init_scan_judge = __esm({
     init_forecast();
     init_forecast_state();
     init_roles();
+    init_shell_fetch();
+    init_dist();
     init_scan_cache();
     init_dlp();
     init_scan();
@@ -31929,16 +31959,26 @@ var init_scan_judge = __esm({
         this.session(sessionId).noteOutputSecret(patternName, clockOf(timestamp2));
       }
       /** A tool that brings outside content returned something. */
-      noteToolResult(sessionId, toolName, timestamp2, cwd) {
+      /**
+       * A tool result reached the session. A source read marks it exposed, as the
+       * PostToolUse hook does (log.ts): a source tool, or a shell command that
+       * fetches outside content (`gh issue view`). `read.output` is the result's
+       * text: the destinations it names are recorded as the hook records them.
+       */
+      noteToolResult(sessionId, toolName, timestamp2, cwd, read2 = {}) {
         const policy = this.configFor(cwd).policy.untrustedContent;
         if (!policy?.enabled) return;
-        if (!toolRole(toolName, policy).source) return;
+        const shell = shellFetch(toolName, read2.input);
+        if (!toolRole(toolName, policy).source && !shell?.fetches) return;
         const mcp = /^mcp__([^_]+(?:_[^_]+)*)__/.exec(toolName);
-        this.session(sessionId).noteOutsideContent({
-          tool: toolName,
-          ...mcp && { server: mcp[1] },
-          at: clockOf(timestamp2)
-        });
+        this.session(sessionId).noteOutsideContent(
+          {
+            tool: toolName,
+            ...mcp && { server: mcp[1] },
+            at: clockOf(timestamp2)
+          },
+          read2.output ? extractContentDestinations(read2.output) : []
+        );
       }
       async judge(call, result, dedup) {
         const config = this.configFor(call.cwd);
@@ -32330,6 +32370,7 @@ async function processClaudeFile(file2, projPath, projLabel, judge, judgeFrom, r
   const sessionCalls = [];
   const toolUseFilePaths = /* @__PURE__ */ new Map();
   const toolUseNames = /* @__PURE__ */ new Map();
+  const toolUseInputs = /* @__PURE__ */ new Map();
   let firstDlpTs = null;
   let firstEditTs = null;
   for (const line of raw.split("\n")) {
@@ -32400,7 +32441,10 @@ async function processClaudeFile(file2, projPath, projLabel, judge, judgeFrom, r
           if (isNode9SelfOutput(resultText)) continue;
           const resultTool = block.tool_use_id ? toolUseNames.get(block.tool_use_id) : void 0;
           if (resultTool)
-            judge.noteToolResult(sessionId, resultTool, entry.timestamp ?? "", entry.cwd);
+            judge.noteToolResult(sessionId, resultTool, entry.timestamp ?? "", entry.cwd, {
+              input: block.tool_use_id ? toolUseInputs.get(block.tool_use_id) : void 0,
+              output: resultText
+            });
           const decoysHere1 = recordCanaries(
             { text: resultText },
             "tool-result",
@@ -32465,6 +32509,7 @@ async function processClaudeFile(file2, projPath, projLabel, judge, judgeFrom, r
         toolUseFilePaths.set(block.id, input.file_path);
       }
       if (block.id) toolUseNames.set(block.id, toolName);
+      if (block.id) toolUseInputs.set(block.id, input);
       sessionCalls.push({ toolName, input, timestamp: entry.timestamp ?? "" });
       if (toolNameLower === "bash" || toolNameLower === "execute_bash") {
         result.bashCalls++;

package/dist/hook.js

@@ -475,12 +475,13 @@ function packRows() {
       if (!rule.name || SHIELD_RULES_FOLDED_INTO_PRODUCT[rule.name]) continue;
       const id = packRowId(shield.name, rule.name);
       if (!id) continue;
-      const owasp = packRowOwasp(id, shield.name);
-      if (!owasp) throw new Error(`pack row ${id} has no OWASP risk: add the shield to owasp.ts`);
       rows.push({
         id,
         group: "commands",
-        owasp,
+        // A shield missing from the table falls back to tool misuse instead of
+        // throwing here: this module loads on every hook call, and a mapping
+        // omission must fail a test (owasp.spec.ts), never the gate.
+        owasp: packRowOwasp(id, shield.name) ?? "ASI02",
         title: rule.name.replace(SHIELD_RULE_NAME, "$3").replace(/-/g, " "),
         catches: rule.description ?? rule.reason ?? "",
         values: ALL,
@@ -25813,7 +25814,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       systemAccessHandled: !isManual && fileAccess.handledPaths.has(filePath)
     }) : null) ?? argumentScan(),
     pii: () => detectArgsPii(args),
-    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, { offline: !!forecast }) : Promise.resolve(null)
+    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, {
+      offline: !!forecast && forecast.onlinePackages !== true
+    }) : Promise.resolve(null)
   });
   const dlpMatch = gates.stop?.dlpMatch ?? gates.reviews.dlp ?? null;
   if (dlpMatch) {
@@ -26824,8 +26827,8 @@ var import_fs33 = __toESM(require("fs"));
 var import_path35 = __toESM(require("path"));
 var import_os24 = __toESM(require("os"));
 var import_crypto11 = __toESM(require("crypto"));
-function getPinsFilePath() {
-  return import_path35.default.join(import_os24.default.homedir(), ".node9", "skill-pins.json");
+function getPinsFilePath(home = import_os24.default.homedir()) {
+  return import_path35.default.join(home, ".node9", "skill-pins.json");
 }
 var MAX_FILES = 5e3;
 var MAX_TOTAL_BYTES = 50 * 1024 * 1024;
@@ -26897,8 +26900,8 @@ function hashSkillRoot(absPath) {
 function getRootKey(absPath) {
   return import_crypto11.default.createHash("sha256").update(absPath).digest("hex").slice(0, 16);
 }
-function readSkillPinsSafe() {
-  const filePath = getPinsFilePath();
+function readSkillPinsSafe(home) {
+  const filePath = getPinsFilePath(home);
   try {
     const raw = import_fs33.default.readFileSync(filePath, "utf-8");
     if (!raw.trim()) return { ok: false, reason: "corrupt", detail: "empty file" };
@@ -27885,6 +27888,15 @@ var import_os28 = __toESM(require("os"));
 init_audit();
 init_dist();
 
+// src/exposure/shell-fetch.ts
+init_cjs_shims();
+init_dist();
+function shellFetch(tool, rawInput) {
+  if (tool !== "Bash" && tool !== "bash") return null;
+  const cmd = rawInput && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput.command : void 0;
+  return typeof cmd === "string" && cmd.length > 0 ? classifyShellExposure(cmd) : null;
+}
+
 // src/exposure/source.ts
 init_cjs_shims();
 init_audit();
@@ -28098,11 +28110,6 @@ function buildArgsField(rawInput) {
     return hashed;
   }
 }
-function shellFetch(tool, rawInput) {
-  if (tool !== "Bash" && tool !== "bash") return null;
-  const cmd = rawInput && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput.command : void 0;
-  return typeof cmd === "string" && cmd.length > 0 ? classifyShellExposure(cmd) : null;
-}
 function registerLogCommand(program2) {
   program2.command("log", { hidden: true }).description("PostToolUse hook \u2014 records executed tool calls").argument("[data]", "JSON string of the tool call").option(
     "--agent <name>",

package/dist/index.js

@@ -529,12 +529,13 @@ function packRows() {
       if (!rule.name || SHIELD_RULES_FOLDED_INTO_PRODUCT[rule.name]) continue;
       const id = packRowId(shield.name, rule.name);
       if (!id) continue;
-      const owasp = packRowOwasp(id, shield.name);
-      if (!owasp) throw new Error(`pack row ${id} has no OWASP risk: add the shield to owasp.ts`);
       rows.push({
         id,
         group: "commands",
-        owasp,
+        // A shield missing from the table falls back to tool misuse instead of
+        // throwing here: this module loads on every hook call, and a mapping
+        // omission must fail a test (owasp.spec.ts), never the gate.
+        owasp: packRowOwasp(id, shield.name) ?? "ASI02",
         title: rule.name.replace(SHIELD_RULE_NAME, "$3").replace(/-/g, " "),
         catches: rule.description ?? rule.reason ?? "",
         values: ALL,
@@ -25293,7 +25294,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       systemAccessHandled: !isManual && fileAccess.handledPaths.has(filePath)
     }) : null) ?? argumentScan(),
     pii: () => detectArgsPii(args),
-    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, { offline: !!forecast }) : Promise.resolve(null)
+    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, {
+      offline: !!forecast && forecast.onlinePackages !== true
+    }) : Promise.resolve(null)
   });
   const dlpMatch = gates.stop?.dlpMatch ?? gates.reviews.dlp ?? null;
   if (dlpMatch) {

package/dist/index.mjs

@@ -516,12 +516,13 @@ function packRows() {
       if (!rule.name || SHIELD_RULES_FOLDED_INTO_PRODUCT[rule.name]) continue;
       const id = packRowId(shield.name, rule.name);
       if (!id) continue;
-      const owasp = packRowOwasp(id, shield.name);
-      if (!owasp) throw new Error(`pack row ${id} has no OWASP risk: add the shield to owasp.ts`);
       rows.push({
         id,
         group: "commands",
-        owasp,
+        // A shield missing from the table falls back to tool misuse instead of
+        // throwing here: this module loads on every hook call, and a mapping
+        // omission must fail a test (owasp.spec.ts), never the gate.
+        owasp: packRowOwasp(id, shield.name) ?? "ASI02",
         title: rule.name.replace(SHIELD_RULE_NAME, "$3").replace(/-/g, " "),
         catches: rule.description ?? rule.reason ?? "",
         values: ALL,
@@ -25264,7 +25265,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       systemAccessHandled: !isManual && fileAccess.handledPaths.has(filePath)
     }) : null) ?? argumentScan(),
     pii: () => detectArgsPii(args),
-    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, { offline: !!forecast }) : Promise.resolve(null)
+    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, {
+      offline: !!forecast && forecast.onlinePackages !== true
+    }) : Promise.resolve(null)
   });
   const dlpMatch = gates.stop?.dlpMatch ?? gates.reviews.dlp ?? null;
   if (dlpMatch) {

package/dist/scan-ink.mjs

@@ -3014,12 +3014,13 @@ function packRows() {
       if (!rule.name || SHIELD_RULES_FOLDED_INTO_PRODUCT[rule.name]) continue;
       const id = packRowId(shield.name, rule.name);
       if (!id) continue;
-      const owasp = packRowOwasp(id, shield.name);
-      if (!owasp) throw new Error(`pack row ${id} has no OWASP risk: add the shield to owasp.ts`);
       rows.push({
         id,
         group: "commands",
-        owasp,
+        // A shield missing from the table falls back to tool misuse instead of
+        // throwing here: this module loads on every hook call, and a mapping
+        // omission must fail a test (owasp.spec.ts), never the gate.
+        owasp: packRowOwasp(id, shield.name) ?? "ASI02",
         title: rule.name.replace(SHIELD_RULE_NAME, "$3").replace(/-/g, " "),
         catches: rule.description ?? rule.reason ?? "",
         values: ALL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.49.0",
+  "version": "2.50.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -110,7 +110,7 @@
     "mvdan-sh"
   ],
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.135.0",
+    "@anthropic-ai/sdk": "^1.3.0",
     "@octokit/rest": "^22.0.1",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",