node9-ai 1.11.3 → 1.11.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +201 -0
- package/README.md +346 -15
- package/package.json +7 -3
package/LICENSE
ADDED
|
@@ -0,0 +1,201 @@
|
|
|
1
|
+
Apache License
|
|
2
|
+
Version 2.0, January 2004
|
|
3
|
+
http://www.apache.org/licenses/
|
|
4
|
+
|
|
5
|
+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
6
|
+
|
|
7
|
+
1. Definitions.
|
|
8
|
+
|
|
9
|
+
"License" shall mean the terms and conditions for use, reproduction,
|
|
10
|
+
and distribution as defined by Sections 1 through 9 of this document.
|
|
11
|
+
|
|
12
|
+
"Licensor" shall mean the copyright owner or entity authorized by
|
|
13
|
+
the copyright owner that is granting the License.
|
|
14
|
+
|
|
15
|
+
"Legal Entity" shall mean the union of the acting entity and all
|
|
16
|
+
other entities that control, are controlled by, or are under common
|
|
17
|
+
control with that entity. For the purposes of this definition,
|
|
18
|
+
"control" means (i) the power, direct or indirect, to cause the
|
|
19
|
+
direction or management of such entity, whether by contract or
|
|
20
|
+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
21
|
+
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
22
|
+
|
|
23
|
+
"You" (or "Your") shall mean an individual or Legal Entity
|
|
24
|
+
exercising permissions granted by this License.
|
|
25
|
+
|
|
26
|
+
"Source" form shall mean the preferred form for making modifications,
|
|
27
|
+
including but not limited to software source code, documentation
|
|
28
|
+
source, and configuration files.
|
|
29
|
+
|
|
30
|
+
"Object" form shall mean any form resulting from mechanical
|
|
31
|
+
transformation or translation of a Source form, including but
|
|
32
|
+
not limited to compiled object code, generated documentation,
|
|
33
|
+
and conversions to other media types.
|
|
34
|
+
|
|
35
|
+
"Work" shall mean the work of authorship, whether in Source or
|
|
36
|
+
Object form, made available under the License, as indicated by a
|
|
37
|
+
copyright notice that is included in or attached to the work
|
|
38
|
+
(an example is provided in the Appendix below).
|
|
39
|
+
|
|
40
|
+
"Derivative Works" shall mean any work, whether in Source or Object
|
|
41
|
+
form, that is based on (or derived from) the Work and for which the
|
|
42
|
+
editorial revisions, annotations, elaborations, or other modifications
|
|
43
|
+
represent, as a whole, an original work of authorship. For the purposes
|
|
44
|
+
of this License, Derivative Works shall not include works that remain
|
|
45
|
+
separable from, or merely link (or bind by name) to the interfaces of,
|
|
46
|
+
the Work and Derivative Works thereof.
|
|
47
|
+
|
|
48
|
+
"Contribution" shall mean any work of authorship, including
|
|
49
|
+
the original version of the Work and any modifications or additions
|
|
50
|
+
to that Work or Derivative Works thereof, that is intentionally
|
|
51
|
+
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
52
|
+
or by an individual or Legal Entity authorized to submit on behalf of
|
|
53
|
+
the copyright owner. For the purposes of this definition, "submitted"
|
|
54
|
+
means any form of electronic, verbal, or written communication sent
|
|
55
|
+
to the Licensor or its representatives, including but not limited to
|
|
56
|
+
communication on electronic mailing lists, source code control systems,
|
|
57
|
+
and issue tracking systems that are managed by, or on behalf of, the
|
|
58
|
+
Licensor for the purpose of discussing and improving the Work, but
|
|
59
|
+
excluding communication that is conspicuously marked or otherwise
|
|
60
|
+
designated in writing by the copyright owner as "Not a Contribution."
|
|
61
|
+
|
|
62
|
+
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
63
|
+
on behalf of whom a Contribution has been received by Licensor and
|
|
64
|
+
subsequently incorporated within the Work.
|
|
65
|
+
|
|
66
|
+
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
67
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
68
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
69
|
+
copyright license to reproduce, prepare Derivative Works of,
|
|
70
|
+
publicly display, publicly perform, sublicense, and distribute the
|
|
71
|
+
Work and such Derivative Works in Source or Object form.
|
|
72
|
+
|
|
73
|
+
3. Grant of Patent License. Subject to the terms and conditions of
|
|
74
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
75
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
76
|
+
(except as stated in this section) patent license to make, have made,
|
|
77
|
+
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
78
|
+
where such license applies only to those patent claims licensable
|
|
79
|
+
by such Contributor that are necessarily infringed by their
|
|
80
|
+
Contribution(s) alone or by combination of their Contribution(s)
|
|
81
|
+
with the Work to which such Contribution(s) was submitted. If You
|
|
82
|
+
institute patent litigation against any entity (including a
|
|
83
|
+
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
84
|
+
or a Contribution incorporated within the Work constitutes direct
|
|
85
|
+
or contributory patent infringement, then any patent licenses
|
|
86
|
+
granted to You under this License for that Work shall terminate
|
|
87
|
+
as of the date such litigation is filed.
|
|
88
|
+
|
|
89
|
+
4. Redistribution. You may reproduce and distribute copies of the
|
|
90
|
+
Work or Derivative Works thereof in any medium, with or without
|
|
91
|
+
modifications, and in Source or Object form, provided that You
|
|
92
|
+
meet the following conditions:
|
|
93
|
+
|
|
94
|
+
(a) You must give any other recipients of the Work or
|
|
95
|
+
Derivative Works a copy of this License; and
|
|
96
|
+
|
|
97
|
+
(b) You must cause any modified files to carry prominent notices
|
|
98
|
+
stating that You changed the files; and
|
|
99
|
+
|
|
100
|
+
(c) You must retain, in the Source form of any Derivative Works
|
|
101
|
+
that You distribute, all copyright, patent, trademark, and
|
|
102
|
+
attribution notices from the Source form of the Work,
|
|
103
|
+
excluding those notices that do not pertain to any part of
|
|
104
|
+
the Derivative Works; and
|
|
105
|
+
|
|
106
|
+
(d) If the Work includes a "NOTICE" text file as part of its
|
|
107
|
+
distribution, then any Derivative Works that You distribute must
|
|
108
|
+
include a readable copy of the attribution notices contained
|
|
109
|
+
within such NOTICE file, excluding those notices that do not
|
|
110
|
+
pertain to any part of the Derivative Works, in at least one
|
|
111
|
+
of the following places: within a NOTICE text file distributed
|
|
112
|
+
as part of the Derivative Works; within the Source form or
|
|
113
|
+
documentation, if provided along with the Derivative Works; or,
|
|
114
|
+
within a display generated by the Derivative Works, if and
|
|
115
|
+
wherever such third-party notices normally appear. The contents
|
|
116
|
+
of the NOTICE file are for informational purposes only and
|
|
117
|
+
do not modify the License. You may add Your own attribution
|
|
118
|
+
notices within Derivative Works that You distribute, alongside
|
|
119
|
+
or as an addendum to the NOTICE text from the Work, provided
|
|
120
|
+
that such additional attribution notices cannot be construed
|
|
121
|
+
as modifying the License.
|
|
122
|
+
|
|
123
|
+
You may add Your own copyright statement to Your modifications and
|
|
124
|
+
may provide additional or different license terms and conditions
|
|
125
|
+
for use, reproduction, or distribution of Your modifications, or
|
|
126
|
+
for any such Derivative Works as a whole, provided Your use,
|
|
127
|
+
reproduction, and distribution of the Work otherwise complies with
|
|
128
|
+
the conditions stated in this License.
|
|
129
|
+
|
|
130
|
+
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
131
|
+
any Contribution intentionally submitted for inclusion in the Work
|
|
132
|
+
by You to the Licensor shall be under the terms and conditions of
|
|
133
|
+
this License, without any additional terms or conditions.
|
|
134
|
+
Notwithstanding the above, nothing herein shall supersede or modify
|
|
135
|
+
the terms of any separate license agreement you may have executed
|
|
136
|
+
with Licensor regarding such Contributions.
|
|
137
|
+
|
|
138
|
+
6. Trademarks. This License does not grant permission to use the trade
|
|
139
|
+
names, trademarks, service marks, or product names of the Licensor,
|
|
140
|
+
except as required for reasonable and customary use in describing the
|
|
141
|
+
origin of the Work and reproducing the content of the NOTICE file.
|
|
142
|
+
|
|
143
|
+
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
144
|
+
agreed to in writing, Licensor provides the Work (and each
|
|
145
|
+
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
146
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
147
|
+
implied, including, without limitation, any warranties or conditions
|
|
148
|
+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
149
|
+
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
150
|
+
appropriateness of using or redistributing the Work and assume any
|
|
151
|
+
risks associated with Your exercise of permissions under this License.
|
|
152
|
+
|
|
153
|
+
8. Limitation of Liability. In no event and under no legal theory,
|
|
154
|
+
whether in tort (including negligence), contract, or otherwise,
|
|
155
|
+
unless required by applicable law (such as deliberate and grossly
|
|
156
|
+
negligent acts) or agreed to in writing, shall any Contributor be
|
|
157
|
+
liable to You for damages, including any direct, indirect, special,
|
|
158
|
+
incidental, or consequential damages of any character arising as a
|
|
159
|
+
result of this License or out of the use or inability to use the
|
|
160
|
+
Work (including but not limited to damages for loss of goodwill,
|
|
161
|
+
work stoppage, computer failure or malfunction, or any and all
|
|
162
|
+
other commercial damages or losses), even if such Contributor
|
|
163
|
+
has been advised of the possibility of such damages.
|
|
164
|
+
|
|
165
|
+
9. Accepting Warranty or Additional Liability. While redistributing
|
|
166
|
+
the Work or Derivative Works thereof, You may choose to offer,
|
|
167
|
+
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
168
|
+
or other liability obligations and/or rights consistent with this
|
|
169
|
+
License. However, in accepting such obligations, You may act only
|
|
170
|
+
on Your own behalf and on Your sole responsibility, not on behalf
|
|
171
|
+
of any other Contributor, and only if You agree to indemnify,
|
|
172
|
+
defend, and hold each Contributor harmless for any liability
|
|
173
|
+
incurred by, or claims asserted against, such Contributor by reason
|
|
174
|
+
of your accepting any such warranty or additional liability.
|
|
175
|
+
|
|
176
|
+
END OF TERMS AND CONDITIONS
|
|
177
|
+
|
|
178
|
+
APPENDIX: How to apply the Apache License to your work.
|
|
179
|
+
|
|
180
|
+
To apply the Apache License to your work, attach the following
|
|
181
|
+
boilerplate notice, with the fields enclosed by brackets "[]"
|
|
182
|
+
replaced with your own identifying information. (Don't include
|
|
183
|
+
the brackets!) The text should be enclosed in the appropriate
|
|
184
|
+
comment syntax for the file format. We also recommend that a
|
|
185
|
+
file or class name and description of purpose be included on the
|
|
186
|
+
same "printed page" as the copyright notice for easier
|
|
187
|
+
identification within third-party archives.
|
|
188
|
+
|
|
189
|
+
Copyright [yyyy] [name of copyright owner]
|
|
190
|
+
|
|
191
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
|
192
|
+
you may not use this file except in compliance with the License.
|
|
193
|
+
You may obtain a copy of the License at
|
|
194
|
+
|
|
195
|
+
http://www.apache.org/licenses/LICENSE-2.0
|
|
196
|
+
|
|
197
|
+
Unless required by applicable law or agreed to in writing, software
|
|
198
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
|
199
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
200
|
+
See the License for the specific language governing permissions and
|
|
201
|
+
limitations under the License.
|
package/README.md
CHANGED
|
@@ -1,30 +1,361 @@
|
|
|
1
|
-
#
|
|
1
|
+
# 🛡️ Node9 Proxy
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
### The "Sudo" Command for AI Agents.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
[](https://www.npmjs.com/package/node9-ai)
|
|
6
|
+
[](https://opensource.org/licenses/Apache-2.0)
|
|
7
|
+
[](https://huggingface.co/spaces/Node9ai/node9-security-demo)
|
|
8
|
+
[](https://node9.ai/docs)
|
|
9
|
+
|
|
10
|
+
**Node9** sits between your AI agent and your system. Every shell command, file write, and tool call passes through Node9 first — blocked, approved, or logged based on your policy. Works with Claude Code, Gemini CLI, Cursor, Codex, and any MCP server.
|
|
11
|
+
|
|
12
|
+
📖 **[Full Documentation →](https://node9.ai/docs)**
|
|
13
|
+
|
|
14
|
+
---
|
|
15
|
+
|
|
16
|
+
## The "Aha!" Moment
|
|
17
|
+
|
|
18
|
+
**AIs move fast.** Ask an agent to "ship the fix" and it might push straight to git without asking you.
|
|
19
|
+
|
|
20
|
+
<p align="center">
|
|
21
|
+
<img src="https://github.com/user-attachments/assets/4aa6e45b-9aba-4953-9ce3-548226622588" width="100%">
|
|
22
|
+
</p>
|
|
23
|
+
|
|
24
|
+
With Node9:
|
|
25
|
+
|
|
26
|
+
1. **AI attempts:** `Bash("git push origin main")`
|
|
27
|
+
2. **Node9 intercepts:** OS-native popup appears instantly
|
|
28
|
+
3. **You block it** — one click
|
|
29
|
+
4. **AI pivots:** _"I'll create a PR for review instead"_
|
|
30
|
+
|
|
31
|
+
---
|
|
32
|
+
|
|
33
|
+
## Try it instantly — no install needed
|
|
34
|
+
|
|
35
|
+
See what node9 would have caught in your existing Claude Code, Gemini CLI, and Codex history:
|
|
6
36
|
|
|
7
37
|
```bash
|
|
8
|
-
npx node9 scan
|
|
38
|
+
npx node9-ai scan
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
No account, no daemon, no config. Reads `~/.claude/projects/`, `~/.gemini/tmp/`, and `~/.codex/`, runs the full policy engine, and shows every operation that would have been blocked or flagged.
|
|
42
|
+
|
|
9
43
|
```
|
|
44
|
+
🔍 Scanning your AI history — what would node9 have caught?
|
|
10
45
|
|
|
11
|
-
|
|
46
|
+
47 risky operations found — none were blocked
|
|
47
|
+
|
|
48
|
+
🛑 Would have blocked 2 operations stopped before execution
|
|
49
|
+
👁 Would have flagged 44 sent to you for approval
|
|
50
|
+
🔑 Credential leak 1 secret detected in tool call
|
|
51
|
+
|
|
52
|
+
──────────────────────────────────────────────────────────────────
|
|
53
|
+
bash-safe · 12 findings → node9 shield enable bash-safe
|
|
54
|
+
🛑 block-pipe-to-shell ×8 — Pipe-to-shell is a common supply-chain attack vector
|
|
55
|
+
👁 review-eval ×4 — eval of dynamic content requires human approval
|
|
56
|
+
|
|
57
|
+
⚡ 47 operations ran unprotected. node9 would have caught them.
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
---
|
|
12
61
|
|
|
13
62
|
## Install
|
|
14
63
|
|
|
15
64
|
```bash
|
|
16
|
-
|
|
17
|
-
node9
|
|
65
|
+
# macOS / Linux
|
|
66
|
+
brew tap node9-ai/node9 && brew install node9
|
|
67
|
+
|
|
68
|
+
# or via npm
|
|
69
|
+
npm install -g node9-ai
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
```bash
|
|
73
|
+
node9 init # auto-detects Claude Code, Gemini CLI, Cursor, Codex
|
|
74
|
+
node9 doctor # verify everything is wired correctly
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
---
|
|
78
|
+
|
|
79
|
+
## Shields — one command per service
|
|
80
|
+
|
|
81
|
+
Enable expert-crafted protection for the infrastructure your agent touches:
|
|
82
|
+
|
|
83
|
+
```bash
|
|
84
|
+
node9 shield enable postgres # blocks DROP TABLE, TRUNCATE, DROP COLUMN
|
|
85
|
+
node9 shield enable mongodb # blocks dropDatabase, drop(), deleteMany({})
|
|
86
|
+
node9 shield enable redis # blocks FLUSHALL, FLUSHDB
|
|
87
|
+
node9 shield enable aws # blocks S3 delete, EC2 terminate, IAM changes
|
|
88
|
+
node9 shield enable k8s # blocks namespace delete, helm uninstall
|
|
89
|
+
node9 shield enable docker # blocks system prune, volume prune, rm -f
|
|
90
|
+
node9 shield enable github # blocks gh repo delete, remote branch deletion
|
|
91
|
+
node9 shield enable bash-safe # blocks curl|bash, base64|sh, rm -rf /
|
|
92
|
+
node9 shield enable filesystem # reviews chmod 777, writes to /etc/
|
|
93
|
+
|
|
94
|
+
node9 shield list # see all shields and their status
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
---
|
|
98
|
+
|
|
99
|
+
## MCP Gateway — protect any MCP server
|
|
100
|
+
|
|
101
|
+
Wrap any MCP server transparently. The AI sees the same server — Node9 intercepts every tool call:
|
|
102
|
+
|
|
103
|
+
```json
|
|
104
|
+
{
|
|
105
|
+
"mcpServers": {
|
|
106
|
+
"postgres": {
|
|
107
|
+
"command": "node9",
|
|
108
|
+
"args": ["mcp", "--upstream", "npx -y @modelcontextprotocol/server-postgres postgresql://..."]
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
}
|
|
112
|
+
```
|
|
113
|
+
|
|
114
|
+
Or use `node9 init` — it wraps existing MCP servers automatically.
|
|
115
|
+
|
|
116
|
+
### MCP Tool Pinning — rug pull defense
|
|
117
|
+
|
|
118
|
+
MCP servers can change their tool definitions between sessions. A compromised or malicious server could silently add, remove, or modify tools after initial trust — a **rug pull** attack.
|
|
119
|
+
|
|
120
|
+
Node9 defends against this by **pinning** tool definitions on first use:
|
|
121
|
+
|
|
122
|
+
1. **First connection** — the gateway records a SHA-256 hash of all tool definitions
|
|
123
|
+
2. **Subsequent connections** — the hash is compared; if tools changed, the session is **quarantined** and all tool calls are blocked until a human reviews and approves the change
|
|
124
|
+
3. **Corrupt pin state** — fails closed (blocks), never silently re-trusts
|
|
125
|
+
|
|
126
|
+
```bash
|
|
127
|
+
node9 mcp pin list # show all pinned servers and hashes
|
|
128
|
+
node9 mcp pin update <serverKey> # remove pin, re-pin on next connection
|
|
129
|
+
node9 mcp pin reset # clear all pins (re-pin on next connection)
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
This is automatic — no configuration needed. The gateway pins on first `tools/list` and enforces on every subsequent session.
|
|
133
|
+
|
|
134
|
+
### Skills Pinning — installed-plugin drift detection
|
|
135
|
+
|
|
136
|
+
Marketplace plugins at `~/.claude/plugins/marketplaces/` come from registries, not your workspace — `git status` never sees them. Each installed plugin gets its own pin (same model as MCP server pinning): installing a new plugin creates a new pin silently; only changes to an already-pinned plugin trigger drift. Opt-in via `policy.skillPinning.enabled: true`; use `mode: 'block'` for strict enforcement. User-edited files are **not** in default scope. Extend via `policy.skillPinning.roots`.
|
|
137
|
+
|
|
138
|
+
---
|
|
139
|
+
|
|
140
|
+
## Python SDK — govern any Python agent
|
|
141
|
+
|
|
142
|
+
```python
|
|
143
|
+
from node9 import configure
|
|
144
|
+
|
|
145
|
+
configure(agent_name="my-agent", policy="require_approval")
|
|
146
|
+
|
|
147
|
+
# Your existing agent code runs unchanged — Node9 intercepts tool calls
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
**[Python SDK →](https://github.com/node9-ai/node9-python)** · **[Governed Agent examples →](https://github.com/node9-ai/governed-agent)**
|
|
151
|
+
|
|
152
|
+
---
|
|
153
|
+
|
|
154
|
+
## What's always on (no config needed)
|
|
155
|
+
|
|
156
|
+
- **Git:** blocks `git push --force`, `git reset --hard`, `git clean -fd`
|
|
157
|
+
- **SQL:** blocks `DELETE`/`UPDATE` without `WHERE`, `DROP TABLE`, `TRUNCATE`
|
|
158
|
+
- **Shell:** blocks `curl | bash`, `sudo` commands
|
|
159
|
+
- **DLP:** blocks AWS keys, GitHub tokens, Stripe keys, PEM private keys in any tool call argument
|
|
160
|
+
- **Response DLP:** background scanner reads Claude's JSONL history hourly and alerts you if a secret appears in Claude's _response text_ (not just tool args) — see [`node9 dlp`](#node9-dlp--response-secret-scanner)
|
|
161
|
+
- **Auto-undo:** git snapshot before every AI file edit → `node9 undo` to revert
|
|
162
|
+
- **Skills Pinning:** SHA-256 verification of agent skill files between sessions; quarantines on drift (AST 02 + AST 07 — supply chain & update drift)
|
|
163
|
+
|
|
164
|
+
---
|
|
165
|
+
|
|
166
|
+
## Observability
|
|
167
|
+
|
|
168
|
+
Every tool call your AI agent makes is recorded — command, arguments, result, and cost estimate. Node9 gives you four ways to see what your agent is doing.
|
|
169
|
+
|
|
170
|
+
### Live HUD (statusline)
|
|
171
|
+
|
|
172
|
+
Node9 wires a live statusline into Claude Code that shows you what's happening in real time:
|
|
173
|
+
|
|
174
|
+
```
|
|
175
|
+
🛡 node9 | standard | [bash-safe] | ✅ 12 allowed 🛑 2 blocked 🚨 0 dlp | ~$0.43 | ⚡ no-force-push
|
|
176
|
+
📊 claude-opus-4-6 | ctx [████████░░░░░░░] 54% | 5h [██░░░░░░░░░░░░░] 12% | 7d [█░░░░░░░░░░░░░░] 7%
|
|
177
|
+
🗂 2 CLAUDE.md | 8 rules | 3 MCPs | 4 hooks
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
**Line 1 — Security state:** active mode, enabled shields, session totals (allowed / blocked / DLP hits), estimated cost, last rule that fired.
|
|
181
|
+
|
|
182
|
+
**Line 2 — Context & rate limits:** model name, context window usage, 5-hour and 7-day token rate-limit bars — so you can see when an agent is burning through quota.
|
|
183
|
+
|
|
184
|
+
**Line 3 — Environment:** how many CLAUDE.md files, rules, MCP servers, and hooks are active in the current project.
|
|
185
|
+
|
|
186
|
+
The HUD is wired automatically by `node9 init`. Full session logs land in `~/.node9/audit.log`.
|
|
187
|
+
|
|
188
|
+
### `node9 scan` — flags
|
|
189
|
+
|
|
190
|
+
```bash
|
|
191
|
+
node9 scan # last 90 days
|
|
192
|
+
node9 scan --all # all time
|
|
193
|
+
node9 scan --drill-down # full commands + session IDs
|
|
194
|
+
```
|
|
195
|
+
|
|
196
|
+
### `node9 tail` — live stream
|
|
197
|
+
|
|
198
|
+
Stream every tool call as it happens. Useful when you send an agent off to work and want to watch what it's doing:
|
|
199
|
+
|
|
200
|
+
```bash
|
|
201
|
+
node9 tail # stream tool calls for the active session
|
|
202
|
+
node9 tail --all # include all projects
|
|
203
|
+
```
|
|
204
|
+
|
|
205
|
+
Each line shows the tool name, a summary of its arguments, and the decision (allowed / blocked / DLP hit).
|
|
206
|
+
|
|
207
|
+
At startup, `tail` prints a one-line context summary:
|
|
208
|
+
|
|
209
|
+
```
|
|
210
|
+
ctx: 34% (68k/200k out 2k · claude-sonnet-4-6)
|
|
211
|
+
```
|
|
212
|
+
|
|
213
|
+
This shows how full the context window is, how many output tokens were generated, and which model is running. Color-coded: cyan < 50%, yellow 50–79%, red ≥ 80%.
|
|
214
|
+
|
|
215
|
+
### `node9 report` — security dashboard
|
|
216
|
+
|
|
217
|
+
Run after a session to get a summary of what was allowed, blocked, DLP hits, cost, and daily activity:
|
|
218
|
+
|
|
219
|
+
```
|
|
220
|
+
$ node9 report --period 7d
|
|
221
|
+
|
|
222
|
+
🛡 node9 Report · Last 7 Days Apr 8 – Apr 14 2,255 events
|
|
223
|
+
──────────────────────────────────────────────────────────────────────────────
|
|
224
|
+
|
|
225
|
+
✅ 1,746 allowed 🛑 509 blocked 🚨 70 DLP hits 23% block rate 💰 $82.91
|
|
226
|
+
|
|
227
|
+
Top Tools Top Blocks
|
|
228
|
+
───────────────────────────────────── ─────────────────────────────────────
|
|
229
|
+
Bash ██████ 1,595 timeout ██████ 281
|
|
230
|
+
Read █░░░░░ 196 smart-rule-block ██░░░░ 79
|
|
231
|
+
Edit █░░░░░ 118 observe-mode-dlp-would… █░░░░░ 69
|
|
232
|
+
drop_resource █░░░░░ 69 persistent-deny █░░░░░ 69
|
|
233
|
+
Grep █░░░░░ 35 local-decision █░░░░░ 5
|
|
234
|
+
|
|
235
|
+
Daily Activity
|
|
236
|
+
──────────────────────────────────────────────────────────────────────────────
|
|
237
|
+
Apr 9 ██████████████████████████████ 833 216 blocked
|
|
238
|
+
Apr 10 █████░░░░░░░░░░░░░░░░░░░░░░░░░ 145 24 blocked
|
|
239
|
+
Apr 11 ██████████████████████░░░░░░░░ 617 139 blocked
|
|
240
|
+
```
|
|
241
|
+
|
|
242
|
+
The report also includes a **Tokens** section showing a breakdown of input, output, cache-write, and cache-read tokens with a cache hit-rate percentage — useful for spotting sessions that are burning tokens without getting cache savings.
|
|
243
|
+
|
|
244
|
+
Periods: `today`, `7d` (default), `30d`, `month`. Cost data is read from `~/.claude/projects/` — no API calls, fully offline.
|
|
245
|
+
|
|
246
|
+
If the response DLP scanner found secrets during the period, the report shows a `⚠️ DLP ALERT` banner at the top and a dedicated **Response DLP** section listing each finding with the pattern name, a masked sample, and the project it came from.
|
|
247
|
+
|
|
248
|
+
### `node9 sessions` — session history
|
|
249
|
+
|
|
250
|
+
See what your AI agent did across sessions — prompt, tool calls, cost, files modified, and whether a snapshot was taken. Useful when you hand off a task and come back to review what happened:
|
|
251
|
+
|
|
252
|
+
```
|
|
253
|
+
$ node9 sessions --all
|
|
254
|
+
|
|
255
|
+
📋 node9 sessions — what your AI agent did
|
|
256
|
+
|
|
257
|
+
7 sessions $178.93 total 2379 tool calls 122 files modified
|
|
258
|
+
avg $25.56 /session 7 of 7 sessions had snapshots
|
|
259
|
+
|
|
260
|
+
Tool breakdown:
|
|
261
|
+
Bash ████████████████████ 1165 (49%)
|
|
262
|
+
Read ███████████░░░░░░░░░ 613 (26%)
|
|
263
|
+
Edit ██████░░░░░░░░░░░░░░ 367 (15%)
|
|
264
|
+
Other ███░░░░░░░░░░░░░░░░░ 203 (9%)
|
|
265
|
+
Write █░░░░░░░░░░░░░░░░░░░ 31 (1%)
|
|
266
|
+
|
|
267
|
+
─── Apr 15 ~/node9
|
|
268
|
+
14:47 implement delegated sessions feature 919 tools $74.45 📸 00ac39e2
|
|
269
|
+
12:47 ok, it seems you crash and we have a bug… 95 tools $6.40 📸 5a4e7fab
|
|
18
270
|
```
|
|
19
271
|
|
|
20
|
-
|
|
272
|
+
Drill into any session for a full tool trace:
|
|
273
|
+
|
|
274
|
+
```
|
|
275
|
+
$ node9 sessions --detail 4812594b
|
|
276
|
+
|
|
277
|
+
Session 4812594b-c93f-4a26-91f0-44aa2e324918
|
|
278
|
+
Prompt can you push node9-proxy to git dev?
|
|
279
|
+
Project ~/node9
|
|
280
|
+
When Apr 9, 2026, 20:49
|
|
281
|
+
Cost ~$2.06
|
|
282
|
+
Snapshot ✓ taken
|
|
283
|
+
|
|
284
|
+
Tool calls (54):
|
|
285
|
+
20:49 Bash git status && git branch -a
|
|
286
|
+
20:52 Write /home/nadav/node9/node9-proxy/.git/hooks/pre-commit
|
|
287
|
+
20:56 Edit /home/nadav/node9/node9-proxy/src/cli/commands/check.ts
|
|
288
|
+
...
|
|
289
|
+
|
|
290
|
+
Files modified (3):
|
|
291
|
+
/home/nadav/node9/node9-proxy/.git/hooks/pre-commit
|
|
292
|
+
/home/nadav/node9/node9-proxy/src/cli/commands/check.ts
|
|
293
|
+
/home/nadav/node9/node9-proxy/src/cli/hud.ts
|
|
294
|
+
```
|
|
295
|
+
|
|
296
|
+
```bash
|
|
297
|
+
node9 sessions # last 7 days
|
|
298
|
+
node9 sessions --all # all time
|
|
299
|
+
node9 sessions --days 30 # last 30 days
|
|
300
|
+
node9 sessions --detail <session-id> # full tool trace (prefix match on session ID)
|
|
301
|
+
```
|
|
302
|
+
|
|
303
|
+
Currently works with Claude Code. Support for other agents coming as they expose session history.
|
|
304
|
+
|
|
305
|
+
### `node9 dlp` — response secret scanner
|
|
306
|
+
|
|
307
|
+
Node9's tool-call DLP blocks secrets _before_ they leave your machine. But Claude can also write secrets into its **response text** — a curl example with a real token, a config snippet with a live key — and that text bypasses tool-call interception entirely.
|
|
308
|
+
|
|
309
|
+
The **response DLP scanner** runs as a background daemon. It reads Claude's JSONL conversation history incrementally (delta scan — only new bytes since the last check), looks for secret patterns in assistant response text, and fires a desktop notification the moment it finds one.
|
|
310
|
+
|
|
311
|
+
```
|
|
312
|
+
⚠️ node9 DLP alert
|
|
313
|
+
AWS Access Key found in Claude response text.
|
|
314
|
+
Sample: AKIA****MPLE — run: node9 dlp
|
|
315
|
+
```
|
|
316
|
+
|
|
317
|
+
```bash
|
|
318
|
+
node9 dlp # show all open findings with pattern, sample, project, date
|
|
319
|
+
node9 dlp resolve # acknowledge all current findings (clears the banner)
|
|
320
|
+
```
|
|
321
|
+
|
|
322
|
+
The `node9 dlp` command shows a guided remediation workflow:
|
|
323
|
+
|
|
324
|
+
```
|
|
325
|
+
🔐 node9 dlp — secrets found in Claude response text
|
|
326
|
+
|
|
327
|
+
⚠️ 1 open finding
|
|
328
|
+
|
|
329
|
+
These secrets were included in Claude's response text — NOT blocked.
|
|
330
|
+
Rotate each affected key immediately.
|
|
331
|
+
|
|
332
|
+
● AWS Access Key ID Apr 14, 2026
|
|
333
|
+
Sample: AKIA****MPLE
|
|
334
|
+
Project: ~/node9
|
|
335
|
+
|
|
336
|
+
Next steps:
|
|
337
|
+
1. Rotate any exposed keys shown above
|
|
338
|
+
2. Run node9 dlp resolve to acknowledge
|
|
339
|
+
3. Run node9 report for full audit history
|
|
340
|
+
```
|
|
341
|
+
|
|
342
|
+
Findings are never re-shown after `node9 dlp resolve`. The scanner stores resolved keys in `~/.node9/dlp-resolved.json` so only genuinely new secrets surface.
|
|
343
|
+
|
|
344
|
+
---
|
|
345
|
+
|
|
346
|
+
## 📖 Full docs
|
|
347
|
+
|
|
348
|
+
Everything else — config reference, smart rules, stateful rules, trusted hosts, approval modes, CLI reference — is at **[node9.ai/docs](https://node9.ai/docs)**.
|
|
349
|
+
|
|
350
|
+
---
|
|
351
|
+
|
|
352
|
+
## Related
|
|
353
|
+
|
|
354
|
+
- [node9-python](https://github.com/node9-ai/node9-python) — Python SDK
|
|
355
|
+
- [governed-agent](https://github.com/node9-ai/governed-agent) — Reference governed agents (CI code review fixer)
|
|
21
356
|
|
|
22
|
-
|
|
23
|
-
Every tool call is checked before it runs — dangerous commands are blocked or sent to you for approval.
|
|
357
|
+
---
|
|
24
358
|
|
|
25
|
-
|
|
26
|
-
- 👁 **Reviews** risky commands — you approve or deny before they execute
|
|
27
|
-
- 🔑 **DLP** — catches credentials and secrets before they leak
|
|
28
|
-
- 📸 **Undo** — snapshots files before every edit so you can roll back
|
|
359
|
+
## Enterprise
|
|
29
360
|
|
|
30
|
-
|
|
361
|
+
Node9 Pro provides governance locking, SAML/SSO, and VPC deployment. Visit [node9.ai](https://node9.ai).
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "node9-ai",
|
|
3
|
-
"version": "1.11.
|
|
3
|
+
"version": "1.11.9",
|
|
4
4
|
"description": "Security layer for AI coding agents — intercepts dangerous tool calls before they execute",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"ai",
|
|
@@ -16,9 +16,13 @@
|
|
|
16
16
|
"type": "git",
|
|
17
17
|
"url": "https://github.com/node9-ai/node9-proxy"
|
|
18
18
|
},
|
|
19
|
-
"license": "
|
|
19
|
+
"license": "Apache-2.0",
|
|
20
|
+
"scripts": {
|
|
21
|
+
"prepublishOnly": "cp ../node9-proxy/README.md ./README.md"
|
|
22
|
+
},
|
|
20
23
|
"bin": {
|
|
21
|
-
"node9": "bin/node9.js"
|
|
24
|
+
"node9": "bin/node9.js",
|
|
25
|
+
"node9-ai": "bin/node9.js"
|
|
22
26
|
},
|
|
23
27
|
"dependencies": {
|
|
24
28
|
"@node9/proxy": ">=1.11.3"
|