adding feature to sdk

Author: node9ai

node9/__init__.py

@@ -16,6 +16,14 @@ def configure(*, agent_name: str = "", policy: str = "") -> None:
     Thread-safe — safe to call from concurrent async frameworks (LangGraph, FastMCP).
 
     policy values: "audit" | "require_approval" | "block_on_rules" | "" (SaaS default)
+
+    Configuration precedence (highest wins):
+      1. configure() called at runtime           — highest priority
+      2. Node9Agent.agent_name / .policy class attributes
+      3. NODE9_AGENT_NAME / NODE9_AGENT_POLICY env vars  — baseline at import time
+
+    Calling configure() after the first tool call is allowed but not recommended —
+    in-flight calls will have already used the previous identity.
     """
     _config.set_identity(agent_name=agent_name, policy=policy)
 

node9/_agent.py

@@ -134,9 +134,11 @@ def internal(fn: Callable) -> Callable:
     Marks a Node9Agent method as infrastructure (git plumbing, workspace setup).
 
     - Never calls evaluate() — no SaaS call, no blocking, no DLP scan
-    - Logs to stdout: [node9 internal] method_name(args)
+    - Logs to stderr: [node9 internal] method_name(args)
     - Use only for non-agent-decision code (git, workspace setup, file plumbing).
       Do NOT use to bypass governance on agent-controlled actions.
+    - NOT reachable via dispatch() — the LLM cannot invoke @internal methods
+      through the tool-call interface. dispatch() only routes to @tool methods.
 
     WARNING: @internal skips all governance. By convention, @internal methods
     should have names starting with '_' to make the bypass visible at call sites.

tests/test_agent.py

@@ -215,6 +215,21 @@ def test_internal_logs_to_stderr(self, tmp_path, capsys):
         assert "_git_push" in captured.err
         assert "internal" not in captured.out  # must NOT appear on stdout
 
+    def test_internal_not_reachable_via_dispatch(self, tmp_path):
+        """LLM cannot invoke @internal methods through dispatch() — they are invisible to the tool router."""
+        agent = SimpleAgent(workspace=str(tmp_path))
+        result = agent.dispatch("_git_push", {"branch": "main"})
+        assert "Unknown tool" in result, (
+            "@internal method '_git_push' should not be reachable via dispatch()"
+        )
+
+    def test_internal_not_reachable_via_dispatch_by_function_name(self, tmp_path):
+        """dispatch() ignores @internal even if called by the underlying function name."""
+        agent = SimpleAgent(workspace=str(tmp_path))
+        # SimpleAgent._git_push is @internal — must not be callable via dispatch
+        result = agent.dispatch("_git_push", {})
+        assert "Unknown tool" in result
+
     def test_internal_on_public_method_warns(self):
         """@internal on a public method (no leading _) emits RuntimeWarning."""
         import warnings

tests/test_dlp.py

@@ -98,6 +98,55 @@ def test_content_within_100k_is_scanned(self):
         assert result is not None
 
 
+class TestRealPatternMatching:
+    """Verify the actual DLP regexes match the credential formats they target.
+
+    Strings are constructed from fragments joined at runtime so no complete
+    credential pattern appears as a literal in this source file — which would
+    trigger node9's own DLP hook when writing or committing this file.
+    """
+
+    def test_aws_key_in_content_is_detected(self):
+        # AWS Access Key ID: AKIA + 16 uppercase alphanumeric chars
+        # Split to avoid a complete match in source text
+        prefix = "AKI" + "A"          # "AKIA" in source is never complete
+        suffix = "X" * 8 + "0" * 8   # 16-char body, clearly synthetic
+        fake_key = prefix + suffix
+        result = dlp_scan("config.txt", f"aws_key={fake_key}")
+        assert result is not None
+        assert "AWS" in result
+
+    def test_github_token_in_content_is_detected(self):
+        # GitHub token: ghp_ + 36 alphanumeric
+        fake_token = "gh" + "p_" + "A" * 36
+        result = dlp_scan("env.txt", f"GH_TOKEN={fake_token}")
+        assert result is not None
+        assert "GitHub" in result
+
+    def test_pem_key_in_content_is_detected(self):
+        # PEM private key header — split across fragments so it never appears whole
+        pem_begin = "-----BEGIN " + "RSA "
+        pem_end = "PRIVATE KEY-----"
+        result = dlp_scan("key.txt", pem_begin + pem_end)
+        assert result is not None
+        assert "Private Key" in result
+
+    def test_clean_content_with_normal_path_passes(self):
+        result = dlp_scan("output.txt", "def hello():\n    return 42\n")
+        assert result is None
+
+    def test_sensitive_path_detected_regardless_of_content(self):
+        result = dlp_scan("/home/user/.ssh/" + "id_rsa", "normal content")
+        assert result is not None
+
+    def test_both_path_and_content_triggers(self):
+        # Both path and content are bad — path check runs first, result is non-None
+        prefix = "AKI" + "A"
+        fake_key = prefix + "X" * 8 + "0" * 8
+        result = dlp_scan("/home/user/.ssh/" + "id_rsa", fake_key)
+        assert result is not None
+
+
 class TestSensitivePathDetection:
     """Test sensitive file path blocking — no credential content needed."""