@node9/proxy 2.50.0 → 2.50.1

package/dist/cli-main.js

@@ -24531,13 +24531,15 @@ function privateDir(dir2) {
   }
   return isPrivateDir(dir2);
 }
+function perHomeRuntimeDir(env, home) {
+  const xdg = env.XDG_RUNTIME_DIR;
+  if (!xdg || !import_path16.default.isAbsolute(xdg)) return null;
+  return import_path16.default.join(xdg, `node9-${(0, import_crypto10.createHash)("sha256").update(home).digest("hex").slice(0, 12)}`);
+}
 function chooseActivitySocketPath(env, home, platform = process.platform) {
   const candidates2 = [];
-  const xdg = env.XDG_RUNTIME_DIR;
-  if (xdg && import_path16.default.isAbsolute(xdg) && isPrivateDir(xdg))
-    candidates2.push(
-      import_path16.default.join(xdg, `node9-${(0, import_crypto10.createHash)("sha256").update(home).digest("hex").slice(0, 12)}`)
-    );
+  const xdgDir = perHomeRuntimeDir(env, home);
+  if (xdgDir && isPrivateDir(import_path16.default.dirname(xdgDir))) candidates2.push(xdgDir);
   candidates2.push(import_path16.default.join(home, ".node9", "run"));
   for (const dir2 of candidates2) {
     const socketPath = import_path16.default.join(dir2, SOCKET_NAME);
@@ -24572,6 +24574,19 @@ function isOwnStaleSocket(socketPath) {
     return false;
   }
 }
+function removeOwnSocketDir(socketPath, env, home, platform = process.platform) {
+  if (platform === "win32") return false;
+  const dir2 = import_path16.default.dirname(socketPath);
+  if (dir2 !== perHomeRuntimeDir(env, home)) return false;
+  if (!isPrivateDir(dir2)) return false;
+  try {
+    if (import_fs16.default.readdirSync(dir2).length > 0) return false;
+    import_fs16.default.rmdirSync(dir2);
+    return true;
+  } catch {
+    return false;
+  }
+}
 var import_fs16, import_path16, import_crypto10, SOCKET_NAME, currentUid, WINDOWS_PIPE;
 var init_activity_socket = __esm({
   "src/utils/activity-socket.ts"() {
@@ -44460,6 +44475,9 @@ function getDaemonServer() {
 function markRejectionHandlerRegistered() {
   daemonRejectionHandlerRegistered = true;
 }
+function markSignalHandlersRegistered() {
+  daemonSignalHandlersRegistered = true;
+}
 function getActivitySocketPath() {
   return ACTIVITY_SOCKET_PATH;
 }
@@ -44683,14 +44701,23 @@ function startActivitySocket() {
     if (ACTIVITY_SOCKET_PATH && !import_fs65.default.existsSync(ACTIVITY_SOCKET_PATH)) attemptRebind("health-probe");
   }, ACTIVITY_HEALTH_PROBE_MS);
   activityHealthInterval.unref();
-  process.on("exit", () => {
-    if (activityHealthInterval) clearInterval(activityHealthInterval);
-    try {
-      if (ACTIVITY_SOCKET_PATH && isOwnStaleSocket(ACTIVITY_SOCKET_PATH))
-        import_fs65.default.unlinkSync(ACTIVITY_SOCKET_PATH);
-    } catch {
-    }
-  });
+  process.on("exit", stopActivitySocket);
+}
+function stopActivitySocket() {
+  if (activityHealthInterval) clearInterval(activityHealthInterval);
+  activityHealthInterval = null;
+  const socketPath = ACTIVITY_SOCKET_PATH;
+  const bound = activitySocketIdentity;
+  ACTIVITY_SOCKET_PATH = null;
+  activitySocketIdentity = null;
+  if (!socketPath || !bound || process.platform === "win32") return;
+  try {
+    const st = import_fs65.default.lstatSync(socketPath);
+    if (isOwnStaleSocket(socketPath) && st.dev === bound.dev && st.ino === bound.ino)
+      import_fs65.default.unlinkSync(socketPath);
+  } catch {
+  }
+  removeOwnSocketDir(socketPath, process.env, import_os55.default.homedir());
 }
 function attemptRebind(reason) {
   if (!shouldRebind()) {
@@ -44824,6 +44851,8 @@ function bindActivitySocket() {
     if (process.platform !== "win32") {
       try {
         import_fs65.default.chmodSync(socketPath, 384);
+        const st = import_fs65.default.lstatSync(socketPath);
+        activitySocketIdentity = { dev: st.dev, ino: st.ino };
       } catch {
       }
     }
@@ -44831,7 +44860,7 @@ function bindActivitySocket() {
   });
   activitySocketServer = unixServer;
 }
-var import_net5, import_fs65, import_path68, import_os55, import_crypto20, homeDir, DAEMON_PID_FILE, DECISIONS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, INSIGHT_COUNTS_FILE, sseClients, cards, suggestionTracker, taintStore, sessionTaintStore, sessionExposureStore, sessionWriteStore, insightCounts, _abandonTimer, _hadBrowserClient, _daemonServer, daemonRejectionHandlerRegistered, AUTO_DENY_MS, TRUST_DURATIONS, autoStarted, ACTIVITY_SOCKET_PATH, activitySocketPathListeners, ACTIVITY_RING_SIZE, activityRing, LARGE_RESPONSE_RING_SIZE, largeResponseRing, cachedScanResult, cachedScanTs, SCAN_CACHE_TTL_MS, SECRET_KEY_RE, INPUT_PRICE_PER_1M, OUTPUT_PRICE_PER_1M, BYTES_PER_TOKEN, CRITICAL_FORENSIC_CATEGORIES, WRITE_TOOL_NAMES, ACTIVITY_REBIND_MAX_ATTEMPTS, ACTIVITY_REBIND_WINDOW_MS, ACTIVITY_HEALTH_PROBE_MS, activitySocketServer, activityHealthInterval, activityRebindAttempts, activityCircuitTripped;
+var import_net5, import_fs65, import_path68, import_os55, import_crypto20, homeDir, DAEMON_PID_FILE, DECISIONS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, INSIGHT_COUNTS_FILE, sseClients, cards, suggestionTracker, taintStore, sessionTaintStore, sessionExposureStore, sessionWriteStore, insightCounts, _abandonTimer, _hadBrowserClient, _daemonServer, daemonRejectionHandlerRegistered, daemonSignalHandlersRegistered, AUTO_DENY_MS, TRUST_DURATIONS, autoStarted, ACTIVITY_SOCKET_PATH, activitySocketPathListeners, ACTIVITY_RING_SIZE, activityRing, LARGE_RESPONSE_RING_SIZE, largeResponseRing, cachedScanResult, cachedScanTs, SCAN_CACHE_TTL_MS, SECRET_KEY_RE, INPUT_PRICE_PER_1M, OUTPUT_PRICE_PER_1M, BYTES_PER_TOKEN, CRITICAL_FORENSIC_CATEGORIES, WRITE_TOOL_NAMES, ACTIVITY_REBIND_MAX_ATTEMPTS, ACTIVITY_REBIND_WINDOW_MS, ACTIVITY_HEALTH_PROBE_MS, activitySocketServer, activitySocketIdentity, activityHealthInterval, activityRebindAttempts, activityCircuitTripped;
 var init_state3 = __esm({
   "src/daemon/state.ts"() {
     "use strict";
@@ -44876,6 +44905,7 @@ var init_state3 = __esm({
     _hadBrowserClient = false;
     _daemonServer = null;
     daemonRejectionHandlerRegistered = false;
+    daemonSignalHandlersRegistered = false;
     AUTO_DENY_MS = 12e4;
     TRUST_DURATIONS = {
       "30m": 30 * 6e4,
@@ -44916,6 +44946,7 @@ var init_state3 = __esm({
     ACTIVITY_REBIND_WINDOW_MS = 6e4;
     ACTIVITY_HEALTH_PROBE_MS = 2e3;
     activitySocketServer = null;
+    activitySocketIdentity = null;
     activityHealthInterval = null;
     activityRebindAttempts = [];
     activityCircuitTripped = false;
@@ -48528,6 +48559,12 @@ data: ${JSON.stringify(item.data)}
       console.error(import_chalk8.default.red("[node9 daemon] unhandled rejection \u2014 keeping daemon alive:"), stack);
     });
   }
+  if (!daemonSignalHandlersRegistered) {
+    markSignalHandlersRegistered();
+    process.once("SIGTERM", () => process.exit(0));
+    process.once("SIGINT", () => process.exit(130));
+    process.once("SIGHUP", () => process.exit(129));
+  }
   const writeOwnPidFile = () => atomicWriteSync(
     DAEMON_PID_FILE,
     JSON.stringify({
@@ -48544,6 +48581,7 @@ data: ${JSON.stringify(item.data)}
     { mode: 384 }
   );
   server.listen(DAEMON_PORT, DAEMON_HOST, () => {
+    startActivitySocket();
     writeOwnPidFile();
     onActivitySocketPathChange(() => {
       try {
@@ -48558,7 +48596,6 @@ data: ${JSON.stringify(item.data)}
   if (watchMode) {
     console.error(import_chalk8.default.cyan("\u{1F6F0}\uFE0F  Flight Recorder active \u2014 daemon will not idle-timeout"));
   }
-  startActivitySocket();
 }
 var import_http4, import_fs72, import_path74, import_os60, import_crypto23, import_child_process5, import_chalk8;
 var init_server = __esm({
@@ -85738,7 +85775,8 @@ function summarize(results, config) {
       if (stopped) c.interrupted++;
       continue;
     }
-    if (!stopped && (r.unknown?.length ?? 0) > 0) {
+    const notEnforcedStop = r.enforced === false && (r.decision === "review" || r.decision === "block");
+    if (!stopped && !notEnforcedStop && (r.unknown?.length ?? 0) > 0) {
       c.undetermined++;
       continue;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.50.0",
+  "version": "2.50.1",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",