@agenshield/daemon 0.6.0 → 0.6.2

package/acl.d.ts

@@ -1,7 +1,7 @@
 /**
  * macOS ACL utilities for filesystem policies.
  *
- * Uses `chmod +a / -a` to grant/revoke group-level ACLs on paths
+ * Uses `chmod +a / -a` to grant/revoke user-level ACLs on paths
  * derived from policy patterns. Failures are logged but never thrown.
  */
 import type { PolicyConfig } from '@agenshield/ipc';
@@ -21,24 +21,27 @@ export declare function stripGlobToBasePath(pattern: string): string;
  */
 export declare function operationsToAclPerms(operations: string[]): string;
 /**
- * Add a group ACL entry to a path.
+ * Add a user ACL entry to a path.
  */
-export declare function addGroupAcl(targetPath: string, groupName: string, permissions: string, log?: Logger): void;
+export declare function addUserAcl(targetPath: string, userName: string, permissions: string, log?: Logger): void;
 /**
- * Remove all ACL entries for a group from a path.
+ * Remove all ACL entries for a user from a path.
  *
- * Reads current ACL entries via `ls -le`, finds entries matching the group,
- * and removes them by index (highest-first so indices stay valid).
+ * Reads current ACL entries via `ls -le`, finds entries matching the user
+ * (both allow and deny), and removes them by index (highest-first so indices
+ * stay valid). This ensures a clean slate before reapplying permissions.
  */
-export declare function removeGroupAcl(targetPath: string, groupName: string, log?: Logger): void;
+export declare function removeUserAcl(targetPath: string, userName: string, log?: Logger): void;
 /**
  * Synchronise filesystem policy ACLs after a config change.
  *
- * Compares old and new policy arrays, and for filesystem-target policies:
- *   - Removed policies → revoke ACLs for each pattern
- *   - Added policies   → apply ACLs for each pattern
- *   - Changed policies → revoke old patterns, apply new ones
+ * For every path in the union of old and new ACL maps:
+ *   1. Remove all existing user ACLs (clean slate)
+ *   2. Reapply permissions if the path is in the new map
+ *
+ * This "wipe then reapply" strategy avoids stale permission accumulation
+ * and the deny+allow conflict where layering ACLs produces wrong results.
  */
-export declare function syncFilesystemPolicyAcls(oldPolicies: PolicyConfig[], newPolicies: PolicyConfig[], groupName: string, logger?: Logger): void;
+export declare function syncFilesystemPolicyAcls(oldPolicies: PolicyConfig[], newPolicies: PolicyConfig[], userName: string, logger?: Logger): void;
 export {};
 //# sourceMappingURL=acl.d.ts.map

package/acl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../src/acl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,UAAU,MAAM;IACd,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CAC7C;AAoBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAe3D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CASjE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,GAAE,MAAa,GAAG,IAAI,CAahH;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAa,GAAG,IAAI,CAoC9F;AAmED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,YAAY,EAAE,EAC3B,WAAW,EAAE,YAAY,EAAE,EAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAoBN"}
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../src/acl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,UAAU,MAAM;IACd,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CAC7C;AAoBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAe3D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CASjE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,GAAE,MAAa,GAAG,IAAI,CAa9G;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAa,GAAG,IAAI,CAqC5F;AAmED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,YAAY,EAAE,EAC3B,WAAW,EAAE,YAAY,EAAE,EAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAsBN"}

package/command-sync.d.ts

@@ -31,7 +31,7 @@ export declare function syncCommandPolicies(policies: PolicyConfig[], logger?: L
  *   - Agent user (type='agent') → homeDir/bin
  *   - If AGENSHIELD_AGENT_HOME is set, also use that
  */
-export declare function ensureWrappersInstalled(state: SystemState, logger?: Logger): void;
+export declare function ensureWrappersInstalled(state: SystemState, logger?: Logger, policyCommands?: Set<string>): void;
 /**
  * Full sync: update allowlist + ensure wrappers installed.
  * Called from PUT /config when policies change.

package/command-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-sync.d.ts","sourceRoot":"","sources":["../src/command-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEjE,UAAU,MAAM;IACd,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CAC7C;AAuFD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CA+DN;AAsDD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAoBN;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,YAAY,EAAE,EACxB,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAGN"}
+{"version":3,"file":"command-sync.d.ts","sourceRoot":"","sources":["../src/command-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjE,UAAU,MAAM;IACd,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CAC7C;AA4GD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAoDN;AA6ID;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAC3B,IAAI,CA0BN;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,YAAY,EAAE,EACxB,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAIN"}