node9-ai 1.38.0 → 1.40.0

package/README.md

@@ -31,6 +31,43 @@ node9 scan          # after installation, same output
   <img src="https://github.com/user-attachments/assets/7c5b30f1-1ca1-40b4-bfd5-d6671002e98e" width="720" alt="Node9 scan scorecard" />
 </p>
 
+## Security posture scorecard
+
+`node9 posture` grades how exposed this machine is to a compromised agent — isolation, egress, secrets on disk, supply chain, privilege — and hands you the exact command to fix each finding.
+
+```bash
+node9 posture          # scorecard with the #1 risk and a fix for every finding
+node9 posture --ship   # send a redacted snapshot to your node9 dashboard (fleet view)
+```
+
+Findings are grouped by **who can fix them**: 🔒 the ones node9 reduces (just run the command) and 🧱 the ones only you can. Each carries a plain-language what / why / who and a real remediation — e.g. the "agent runs unsandboxed on the host" finding points straight at `node9 sandbox run` (below).
+
+```text
+🛡️  Node9 Posture — agent on this host        Score: 100/100  (Good)
+  2 advisories below don't affect the score — OS-level exposure, yours to weigh.
+
+  🟢 node9 is already protecting you
+  ✅ Secrets        node9 DLP is blocking this
+  ✅ Egress         node9 egress is approval-gating this
+  ✅ Approval gate  node9 is blocking this
+  ✅ Privilege      node9 is approval-gating this
+
+  🔒 node9 reduces these — run the command, the rest is yours
+  ⚠️  Isolation     Running directly on the host — no container
+                   The agent runs loose on your whole machine, not in a sandbox.
+                   → node9 sandbox run <agent>   — jail it: kernel egress + scoped mounts + node9 inside
+                   → node9 shield enable project-jail   — or shrink the blast radius, keep host access
+  ⚠️  Network exposure  4 services on 0.0.0.0 (node :3000/:4000, PostgreSQL :5432, Redis :6379)
+                   Reachable from your whole network, not just this laptop.
+                   → node9 shield enable postgres|redis   — node9 blocks DROP TABLE / FLUSHALL
+                   → bind to 127.0.0.1 / firewall the port   (your part)
+
+  ✅ Supply chain   no issues found
+  ✅ Coverage       no issues found
+
+  Track this across your fleet & keep it green → node9.ai
+```
+
 ## Live monitoring
 
 <p align="center">
@@ -104,6 +141,23 @@ node9 shield list    # show all shields + status
 - **Auto-undo** — git snapshot before every AI file edit → `node9 undo` to revert
 - **Skills pinning** — SHA-256 verification of installed Claude skills / plugins between sessions
 
+## Sandbox — run an agent in a jail
+
+When watching isn't enough, **`node9 sandbox`** runs the agent inside a disposable container with a **kernel-enforced egress allowlist** and **scoped mounts** — while node9's hooks govern and audit every tool call _inside_ the box. The hard version of protection: the agent can only touch the folder you mount and reach the hosts you allow; everything else is dropped at the kernel.
+
+```bash
+cd ~/my-project
+node9 sandbox new        # write node9.sandbox.yaml — what to mount + which hosts to allow
+node9 sandbox run        # build + boot the jailed agent (your project at /workspace)
+node9 sandbox tail       # watch the agent's actions live, from the host
+```
+
+- **Disposable** — the container is destroyed on exit; your project edits land on your real disk, nothing else survives.
+- **Same policy** — your existing shields / egress rules / approvals apply inside the box, streamed to the same audit log and dashboard.
+- **Closes the posture loop** — running it flips the Isolation / Egress findings green.
+
+Honest scope (Phase 1): single container, **Claude first** (Codex next); the agent still holds its _own_ credentials in the box (the egress wall confines them to the allowed hosts) — _"the agent never holds a secret"_ is the credential-broker phase on the roadmap. Requires Docker.
+
 ## MCP gateway
 
 Wrap any MCP server transparently. The agent sees the same server — Node9 intercepts every tool call.
@@ -199,6 +253,7 @@ def run_command(cmd: str) -> str:
 - **MCP gateway** is a stdio proxy; intercepts `tools/list` + `tools/call` JSON-RPC, forwards the rest
 - **Policy engine** uses [mvdan-sh](https://github.com/mvdan/sh) for bash AST analysis — defeats obfuscation via backslash escaping, variable substitution, eval of remote download
 - **Shadow repo** for auto-undo lives at `~/.node9/snapshots/<hash16>/` — never touches your `.git`
+- **Sandbox** generates a Dockerfile + entrypoint that seal an `ipset`/`iptables` deny-by-default egress wall, then drop to a non-root agent with node9's daemon + hooks running inside; only the agent's credential file is mounted, never your whole `~/.claude`
 
 ## Full docs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node9-ai",
-  "version": "1.38.0",
+  "version": "1.40.0",
   "description": "Security layer for AI coding agents — intercepts dangerous tool calls before they execute",
   "keywords": [
     "ai",
@@ -25,7 +25,7 @@
     "node9-ai": "bin/node9.js"
   },
   "dependencies": {
-    "@node9/proxy": "1.38.0"
+    "@node9/proxy": "1.40.0"
   },
   "type": "module",
   "engines": {