@agenshield/interceptor 0.6.0 → 0.6.2

package/client/sync-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-client.d.ts","sourceRoot":"","sources":["../../src/client/sync-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,iBAAiB;IAOtC;;OAEG;IACH,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;IAU9D;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAgFzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAqCvB;;OAEG;IACH,IAAI,IAAI,OAAO;CAQhB"}
+{"version":3,"file":"sync-client.d.ts","sourceRoot":"","sources":["../../src/client/sync-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,iBAAiB;IAOtC;;OAEG;IACH,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;IAgB9D;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAsFzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAwCvB;;OAEG;IACH,IAAI,IAAI,OAAO;CAQhB"}

package/debug-log.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Debug Logger
+ *
+ * Writes diagnostic logs to /var/log/agenshield/interceptor.log using
+ * a captured (pre-patch) appendFileSync. Safe from interception.
+ */
+export declare function debugLog(msg: string): void;
+//# sourceMappingURL=debug-log.d.ts.map

package/debug-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-log.d.ts","sourceRoot":"","sources":["../src/debug-log.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAM1C"}

package/index.js

@@ -59,7 +59,7 @@ function createConfig(overrides) {
     interceptFetch: env["AGENSHIELD_INTERCEPT_FETCH"] !== "false",
     interceptHttp: env["AGENSHIELD_INTERCEPT_HTTP"] !== "false",
     interceptWs: env["AGENSHIELD_INTERCEPT_WS"] !== "false",
-    interceptFs: env["AGENSHIELD_INTERCEPT_FS"] !== "false",
+    interceptFs: false,
     interceptExec: env["AGENSHIELD_INTERCEPT_EXEC"] !== "false",
     timeout: parseInt(env["AGENSHIELD_TIMEOUT"] || "30000", 10),
     ...overrides
@@ -102,6 +102,18 @@ var TimeoutError = class extends AgenShieldError {
   }
 };
 
+// libs/shield-interceptor/src/debug-log.ts
+var fs = __toESM(require("node:fs"), 1);
+var _appendFileSync = fs.appendFileSync.bind(fs);
+var LOG_PATH = "/var/log/agenshield/interceptor.log";
+function debugLog(msg) {
+  try {
+    _appendFileSync(LOG_PATH, `[${(/* @__PURE__ */ new Date()).toISOString()}] [pid:${process.pid}] ${msg}
+`);
+  } catch {
+  }
+}
+
 // libs/shield-interceptor/src/interceptors/base.ts
 var BaseInterceptor = class {
   client;
@@ -127,7 +139,9 @@ var BaseInterceptor = class {
         return false;
       }
       const port = parsed.port;
-      return port === String(this.brokerHttpPort) || port === "5200";
+      const result = port === String(this.brokerHttpPort) || port === "5200";
+      debugLog(`isBrokerUrl url=${url} hostname=${parsed.hostname} port=${port} brokerPort=${this.brokerHttpPort} result=${result}`);
+      return result;
     } catch {
       return false;
     }
@@ -143,9 +157,11 @@ var BaseInterceptor = class {
    */
   async checkPolicy(operation, target) {
     const startTime = Date.now();
+    debugLog(`base.checkPolicy START op=${operation} target=${target}`);
     try {
       this.eventReporter.intercept(operation, target);
       const result = await this.policyEvaluator.check(operation, target);
+      debugLog(`base.checkPolicy evaluator result op=${operation} target=${target} allowed=${result.allowed} policyId=${result.policyId}`);
       if (!result.allowed) {
         this.eventReporter.deny(operation, target, result.policyId, result.reason);
         throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
@@ -162,8 +178,10 @@ var BaseInterceptor = class {
       );
     } catch (error) {
       if (error instanceof PolicyDeniedError) {
+        debugLog(`base.checkPolicy DENIED op=${operation} target=${target} reason=${error.message}`);
         throw error;
       }
+      debugLog(`base.checkPolicy ERROR op=${operation} target=${target} error=${error.message} failOpen=${this.failOpen}`);
       if (this.failOpen) {
         this.eventReporter.error(
           operation,
@@ -213,10 +231,14 @@ var FetchInterceptor = class extends BaseInterceptor {
     } else {
       url = input.url;
     }
-    if (this.isBrokerUrl(url)) {
+    const isBroker = this.isBrokerUrl(url);
+    debugLog(`fetch ENTER url=${url} isBroker=${isBroker}`);
+    if (isBroker) {
       return this.originalFetch(input, init);
     }
+    debugLog(`fetch checkPolicy START url=${url}`);
     await this.checkPolicy("http_request", url);
+    debugLog(`fetch checkPolicy DONE url=${url}`);
     try {
       const method = init?.method || "GET";
       const headers = {};
@@ -256,10 +278,12 @@ var FetchInterceptor = class extends BaseInterceptor {
         headers: responseHeaders
       });
     } catch (error) {
+      debugLog(`fetch ERROR url=${url} error=${error.message}`);
       if (error.name === "PolicyDeniedError") {
         throw error;
       }
       if (this.failOpen) {
+        debugLog(`fetch failOpen fallback url=${url}`);
         return this.originalFetch(input, init);
       }
       throw error;
@@ -403,11 +427,11 @@ var WebSocketInterceptor = class extends BaseInterceptor {
 
 // libs/shield-interceptor/src/client/sync-client.ts
 var import_node_child_process = require("node:child_process");
-var fs = __toESM(require("node:fs"), 1);
+var fs2 = __toESM(require("node:fs"), 1);
 var import_node_crypto = require("node:crypto");
-var _existsSync = fs.existsSync.bind(fs);
-var _readFileSync = fs.readFileSync.bind(fs);
-var _unlinkSync = fs.unlinkSync.bind(fs);
+var _existsSync = fs2.existsSync.bind(fs2);
+var _readFileSync = fs2.readFileSync.bind(fs2);
+var _unlinkSync = fs2.unlinkSync.bind(fs2);
 var _spawnSync = import_node_child_process.spawnSync;
 var _execSync = import_node_child_process.execSync;
 var SyncClient = class {
@@ -425,10 +449,16 @@ var SyncClient = class {
    * Send a synchronous request to the broker
    */
   request(method, params) {
+    debugLog(`syncClient.request START method=${method}`);
     try {
-      return this.socketRequestSync(method, params);
-    } catch {
-      return this.httpRequestSync(method, params);
+      const result = this.socketRequestSync(method, params);
+      debugLog(`syncClient.request socket OK method=${method}`);
+      return result;
+    } catch (socketErr) {
+      debugLog(`syncClient.request socket FAILED: ${socketErr.message}, trying HTTP`);
+      const result = this.httpRequestSync(method, params);
+      debugLog(`syncClient.request http OK method=${method}`);
+      return result;
     }
   }
   /**
@@ -474,13 +504,19 @@ var SyncClient = class {
       }, ${this.timeout});
     `;
     try {
-      _spawnSync("/opt/agenshield/bin/node-bin", ["-e", script], {
+      debugLog(`syncClient.socketRequestSync _spawnSync START node-bin method=${method}`);
+      const spawnResult = _spawnSync("/opt/agenshield/bin/node-bin", ["-e", script], {
         timeout: this.timeout + 1e3,
         stdio: "ignore",
         env: { ...process.env, NODE_OPTIONS: "" }
       });
-      if (_existsSync(tmpFile)) {
-        const response = JSON.parse(_readFileSync(tmpFile, "utf-8"));
+      debugLog(`syncClient.socketRequestSync _spawnSync DONE status=${spawnResult?.status} signal=${spawnResult?.signal} error=${spawnResult?.error?.message || "none"}`);
+      const tmpExists = _existsSync(tmpFile);
+      debugLog(`syncClient.socketRequestSync tmpFile exists=${tmpExists}`);
+      if (tmpExists) {
+        const raw = _readFileSync(tmpFile, "utf-8");
+        debugLog(`syncClient.socketRequestSync response raw=${raw.slice(0, 200)}`);
+        const response = JSON.parse(raw);
         _unlinkSync(tmpFile);
         if (response.error) {
           throw new Error(response.error);
@@ -510,6 +546,7 @@ var SyncClient = class {
       params
     });
     try {
+      debugLog(`syncClient.httpRequestSync curl START url=${url} method=${method}`);
       const result = _execSync(
         `/usr/bin/curl -s -X POST -H "Content-Type: application/json" -d '${request.replace(/'/g, "\\'")}' "${url}"`,
         {
@@ -517,12 +554,14 @@ var SyncClient = class {
           encoding: "utf-8"
         }
       );
+      debugLog(`syncClient.httpRequestSync curl DONE len=${result?.length}`);
       const response = JSON.parse(result);
       if (response.error) {
         throw new Error(response.error.message);
       }
       return response.result;
     } catch (error) {
+      debugLog(`syncClient.httpRequestSync FAILED: ${error.message}`);
       throw new Error(`Sync request failed: ${error.message}`);
     }
   }
@@ -543,6 +582,7 @@ var SyncClient = class {
 var childProcessModule = require("node:child_process");
 var ChildProcessInterceptor = class extends BaseInterceptor {
   syncClient;
+  _checking = false;
   originalExec = null;
   originalExecSync = null;
   originalSpawn = null;
@@ -596,6 +636,11 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const original = this.originalExec;
     return function interceptedExec(command, ...args) {
       const callback = typeof args[args.length - 1] === "function" ? args.pop() : void 0;
+      debugLog(`cp.exec ENTER command=${command} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.exec SKIP (re-entrancy) command=${command}`);
+        return original(command, ...args, callback);
+      }
       self.eventReporter.intercept("exec", command);
       self.checkPolicy("exec", command).then(() => {
         original(command, ...args, callback);
@@ -611,12 +656,20 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalExecSync;
     const interceptedExecSync = function(command, options) {
-      self.eventReporter.intercept("exec", command);
+      debugLog(`cp.execSync ENTER command=${command} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.execSync SKIP (re-entrancy) command=${command}`);
+        return original(command, options);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept("exec", command);
+        debugLog(`cp.execSync policy_check START command=${command}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation: "exec", target: command }
         );
+        debugLog(`cp.execSync policy_check DONE allowed=${result.allowed} command=${command}`);
         if (!result.allowed) {
           throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
             operation: "exec",
@@ -624,13 +677,17 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
           });
         }
       } catch (error) {
+        debugLog(`cp.execSync policy_check ERROR: ${error.message} command=${command}`);
         if (error instanceof PolicyDeniedError) {
           throw error;
         }
         if (!self.failOpen) {
           throw error;
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`cp.execSync calling original command=${command}`);
       return original(command, options);
     };
     return interceptedExecSync;
@@ -639,6 +696,12 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalSpawn;
     const interceptedSpawn = function(command, args, options) {
+      const fullCmd = args ? `${command} ${args.join(" ")}` : command;
+      debugLog(`cp.spawn ENTER command=${fullCmd} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.spawn SKIP (re-entrancy) command=${fullCmd}`);
+        return original(command, args, options || {});
+      }
       const fullCommand = args ? `${command} ${args.join(" ")}` : command;
       self.eventReporter.intercept("exec", fullCommand);
       self.checkPolicy("exec", fullCommand).catch((error) => {
@@ -653,12 +716,20 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const original = this.originalSpawnSync;
     return function interceptedSpawnSync(command, args, options) {
       const fullCommand = args ? `${command} ${args.join(" ")}` : command;
-      self.eventReporter.intercept("exec", fullCommand);
+      debugLog(`cp.spawnSync ENTER command=${fullCommand} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.spawnSync SKIP (re-entrancy) command=${fullCommand}`);
+        return original(command, args, options);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept("exec", fullCommand);
+        debugLog(`cp.spawnSync policy_check START command=${fullCommand}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation: "exec", target: fullCommand }
         );
+        debugLog(`cp.spawnSync policy_check DONE allowed=${result.allowed} command=${fullCommand}`);
         if (!result.allowed) {
           return {
             pid: -1,
@@ -671,6 +742,7 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
           };
         }
       } catch (error) {
+        debugLog(`cp.spawnSync policy_check ERROR: ${error.message} command=${fullCommand}`);
         if (!self.failOpen) {
           return {
             pid: -1,
@@ -682,7 +754,10 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
             error
           };
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`cp.spawnSync calling original command=${fullCommand}`);
       return original(command, args, options);
     };
   }
@@ -690,6 +765,9 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalExecFile;
     return function interceptedExecFile(file, ...args) {
+      if (self._checking) {
+        return original(file, ...args);
+      }
       self.eventReporter.intercept("exec", file);
       self.checkPolicy("exec", file).catch((error) => {
         self.eventReporter.error("exec", file, error.message);
@@ -701,6 +779,9 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalFork;
     const interceptedFork = function(modulePath, args, options) {
+      if (self._checking) {
+        return original(modulePath, args, options);
+      }
       const pathStr = modulePath.toString();
       self.eventReporter.intercept("exec", `fork:${pathStr}`);
       self.checkPolicy("exec", `fork:${pathStr}`).catch((error) => {
@@ -713,6 +794,7 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
 };
 
 // libs/shield-interceptor/src/interceptors/fs.ts
+var import_node_url = require("node:url");
 var fsModule = require("node:fs");
 var fsPromisesModule = require("node:fs/promises");
 function safeOverride(target, prop, value) {
@@ -727,9 +809,23 @@ function safeOverride(target, prop, value) {
     });
   }
 }
+function normalizePathArg(p) {
+  if (p instanceof URL) {
+    return (0, import_node_url.fileURLToPath)(p);
+  }
+  const s = p.toString();
+  if (s.startsWith("file://")) {
+    try {
+      return (0, import_node_url.fileURLToPath)(new URL(s));
+    } catch {
+    }
+  }
+  return s;
+}
 var FsInterceptor = class extends BaseInterceptor {
   syncClient;
   originals = /* @__PURE__ */ new Map();
+  _checking = false;
   constructor(options) {
     super(options);
     this.syncClient = new SyncClient({
@@ -785,12 +881,20 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, function intercepted(path, ...args) {
-      const pathString = path.toString();
+      const pathString = normalizePathArg(path);
       const callback = typeof args[args.length - 1] === "function" ? args.pop() : void 0;
+      debugLog(`fs.${methodName} ENTER (async) path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fs.${methodName} SKIP (re-entrancy, async) path=${pathString}`);
+        original.call(module2, path, ...args, callback);
+        return;
+      }
       self.eventReporter.intercept(operation, pathString);
       self.checkPolicy(operation, pathString).then(() => {
+        debugLog(`fs.${methodName} policy OK (async) path=${pathString}`);
         original.call(module2, path, ...args, callback);
       }).catch((error) => {
+        debugLog(`fs.${methodName} policy ERROR (async): ${error.message} path=${pathString}`);
         if (callback) {
           callback(error);
         }
@@ -804,13 +908,21 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, function interceptedSync(path, ...args) {
-      const pathString = path.toString();
-      self.eventReporter.intercept(operation, pathString);
+      const pathString = normalizePathArg(path);
+      debugLog(`fs.${methodName} ENTER path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fs.${methodName} SKIP (re-entrancy) path=${pathString}`);
+        return original.call(module2, path, ...args);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept(operation, pathString);
+        debugLog(`fs.${methodName} policy_check START path=${pathString}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation, target: pathString }
         );
+        debugLog(`fs.${methodName} policy_check DONE allowed=${result.allowed} path=${pathString}`);
         if (!result.allowed) {
           throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
             operation,
@@ -818,13 +930,17 @@ var FsInterceptor = class extends BaseInterceptor {
           });
         }
       } catch (error) {
+        debugLog(`fs.${methodName} policy_check ERROR: ${error.message} path=${pathString}`);
         if (error instanceof PolicyDeniedError) {
           throw error;
         }
         if (!self.failOpen) {
           throw error;
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`fs.${methodName} calling original path=${pathString}`);
       return original.call(module2, path, ...args);
     });
   }
@@ -835,9 +951,15 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, async function interceptedPromise(path, ...args) {
-      const pathString = path.toString();
+      const pathString = normalizePathArg(path);
+      debugLog(`fsPromises.${methodName} ENTER path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fsPromises.${methodName} SKIP (re-entrancy) path=${pathString}`);
+        return original.call(module2, path, ...args);
+      }
       self.eventReporter.intercept(operation, pathString);
       await self.checkPolicy(operation, pathString);
+      debugLog(`fsPromises.${methodName} policy OK path=${pathString}`);
       return original.call(module2, path, ...args);
     });
   }

package/interceptors/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/interceptors/base.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8BAAsB,eAAe;IACnC,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC;IAC9B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAC3C,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,SAAS,EAAE,OAAO,CAAS;IACrC,OAAO,CAAC,cAAc,CAAS;gBAEnB,OAAO,EAAE,sBAAsB;IAQ3C;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAa3C;;OAEG;IACH,QAAQ,CAAC,OAAO,IAAI,IAAI;IAExB;;OAEG;IACH,QAAQ,CAAC,SAAS,IAAI,IAAI;IAE1B;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;cACa,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IA0ChB;;OAEG;IACH,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAGvC"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/interceptors/base.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAI3D,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8BAAsB,eAAe;IACnC,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC;IAC9B,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAC3C,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,SAAS,EAAE,OAAO,CAAS;IACrC,OAAO,CAAC,cAAc,CAAS;gBAEnB,OAAO,EAAE,sBAAsB;IAQ3C;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAe3C;;OAEG;IACH,QAAQ,CAAC,OAAO,IAAI,IAAI;IAExB;;OAEG;IACH,QAAQ,CAAC,SAAS,IAAI,IAAI;IAE1B;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;cACa,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IA8ChB;;OAEG;IACH,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAGvC"}

package/interceptors/child-process.d.ts

@@ -6,6 +6,7 @@
 import { BaseInterceptor, type BaseInterceptorOptions } from './base.js';
 export declare class ChildProcessInterceptor extends BaseInterceptor {
     private syncClient;
+    private _checking;
     private originalExec;
     private originalExecSync;
     private originalSpawn;

package/interceptors/child-process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"child-process.d.ts","sourceRoot":"","sources":["../../src/interceptors/child-process.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAQzE,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,YAAY,CAAyC;IAC7D,OAAO,CAAC,gBAAgB,CAA6C;IACrE,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,iBAAiB,CAA8C;IACvE,OAAO,CAAC,gBAAgB,CAA6C;IACrE,OAAO,CAAC,YAAY,CAAyC;gBAEjD,OAAO,EAAE,sBAAsB;IAU3C,OAAO,IAAI,IAAI;IAsBf,SAAS,IAAI,IAAI;IAmBjB,OAAO,CAAC,qBAAqB;IAgC7B,OAAO,CAAC,yBAAyB;IAuCjC,OAAO,CAAC,sBAAsB;IAyB9B,OAAO,CAAC,0BAA0B;IAiDlC,OAAO,CAAC,yBAAyB;IAmBjC,OAAO,CAAC,qBAAqB;CAsB9B"}
+{"version":3,"file":"child-process.d.ts","sourceRoot":"","sources":["../../src/interceptors/child-process.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AASzE,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAyC;IAC7D,OAAO,CAAC,gBAAgB,CAA6C;IACrE,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,iBAAiB,CAA8C;IACvE,OAAO,CAAC,gBAAgB,CAA6C;IACrE,OAAO,CAAC,YAAY,CAAyC;gBAEjD,OAAO,EAAE,sBAAsB;IAU3C,OAAO,IAAI,IAAI;IAsBf,SAAS,IAAI,IAAI;IAmBjB,OAAO,CAAC,qBAAqB;IAwC7B,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,sBAAsB;IAkC9B,OAAO,CAAC,0BAA0B;IA+DlC,OAAO,CAAC,yBAAyB;IAwBjC,OAAO,CAAC,qBAAqB;CA2B9B"}

package/interceptors/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/interceptors/fetch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEzE,qBAAa,gBAAiB,SAAQ,eAAe;IACnD,OAAO,CAAC,aAAa,CAA6B;gBAEtC,OAAO,EAAE,sBAAsB;IAI3C,OAAO,IAAI,IAAI;IAYf,SAAS,IAAI,IAAI;YAQH,gBAAgB;CA0F/B"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/interceptors/fetch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAGzE,qBAAa,gBAAiB,SAAQ,eAAe;IACnD,OAAO,CAAC,aAAa,CAA6B;gBAEtC,OAAO,EAAE,sBAAsB;IAI3C,OAAO,IAAI,IAAI;IAYf,SAAS,IAAI,IAAI;YAQH,gBAAgB;CAiG/B"}

package/interceptors/fs.d.ts

@@ -7,6 +7,7 @@ import { BaseInterceptor, type BaseInterceptorOptions } from './base.js';
 export declare class FsInterceptor extends BaseInterceptor {
     private syncClient;
     private originals;
+    private _checking;
     constructor(options: BaseInterceptorOptions);
     install(): void;
     uninstall(): void;

package/interceptors/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/interceptors/fs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AA2BzE,qBAAa,aAAc,SAAQ,eAAe;IAChD,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAAoC;gBAEzC,OAAO,EAAE,sBAAsB;IAU3C,OAAO,IAAI,IAAI;IAoCf,SAAS,IAAI,IAAI;IAcjB,OAAO,CAAC,eAAe;IAuCvB,OAAO,CAAC,mBAAmB;IAgD3B,OAAO,CAAC,sBAAsB;CA2B/B"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/interceptors/fs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AA4CzE,qBAAa,aAAc,SAAQ,eAAe;IAChD,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,EAAE,sBAAsB;IAU3C,OAAO,IAAI,IAAI;IAoCf,SAAS,IAAI,IAAI;IAcjB,OAAO,CAAC,eAAe;IAkDvB,OAAO,CAAC,mBAAmB;IA+D3B,OAAO,CAAC,sBAAsB;CAoC/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenshield/interceptor",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "type": "module",
   "description": "Node.js runtime interception via ESM loader and CJS preload",
   "main": "./index.js",
@@ -25,7 +25,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@agenshield/ipc": "0.6.0"
+    "@agenshield/ipc": "0.6.2"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",

package/register.js

@@ -34,7 +34,7 @@ function createConfig(overrides) {
     interceptFetch: env["AGENSHIELD_INTERCEPT_FETCH"] !== "false",
     interceptHttp: env["AGENSHIELD_INTERCEPT_HTTP"] !== "false",
     interceptWs: env["AGENSHIELD_INTERCEPT_WS"] !== "false",
-    interceptFs: env["AGENSHIELD_INTERCEPT_FS"] !== "false",
+    interceptFs: false,
     interceptExec: env["AGENSHIELD_INTERCEPT_EXEC"] !== "false",
     timeout: parseInt(env["AGENSHIELD_TIMEOUT"] || "30000", 10),
     ...overrides
@@ -77,6 +77,18 @@ var TimeoutError = class extends AgenShieldError {
   }
 };
 
+// libs/shield-interceptor/src/debug-log.ts
+var fs = __toESM(require("node:fs"), 1);
+var _appendFileSync = fs.appendFileSync.bind(fs);
+var LOG_PATH = "/var/log/agenshield/interceptor.log";
+function debugLog(msg) {
+  try {
+    _appendFileSync(LOG_PATH, `[${(/* @__PURE__ */ new Date()).toISOString()}] [pid:${process.pid}] ${msg}
+`);
+  } catch {
+  }
+}
+
 // libs/shield-interceptor/src/interceptors/base.ts
 var BaseInterceptor = class {
   client;
@@ -102,7 +114,9 @@ var BaseInterceptor = class {
         return false;
       }
       const port = parsed.port;
-      return port === String(this.brokerHttpPort) || port === "5200";
+      const result = port === String(this.brokerHttpPort) || port === "5200";
+      debugLog(`isBrokerUrl url=${url} hostname=${parsed.hostname} port=${port} brokerPort=${this.brokerHttpPort} result=${result}`);
+      return result;
     } catch {
       return false;
     }
@@ -118,9 +132,11 @@ var BaseInterceptor = class {
    */
   async checkPolicy(operation, target) {
     const startTime = Date.now();
+    debugLog(`base.checkPolicy START op=${operation} target=${target}`);
     try {
       this.eventReporter.intercept(operation, target);
       const result = await this.policyEvaluator.check(operation, target);
+      debugLog(`base.checkPolicy evaluator result op=${operation} target=${target} allowed=${result.allowed} policyId=${result.policyId}`);
       if (!result.allowed) {
         this.eventReporter.deny(operation, target, result.policyId, result.reason);
         throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
@@ -137,8 +153,10 @@ var BaseInterceptor = class {
       );
     } catch (error) {
       if (error instanceof PolicyDeniedError) {
+        debugLog(`base.checkPolicy DENIED op=${operation} target=${target} reason=${error.message}`);
         throw error;
       }
+      debugLog(`base.checkPolicy ERROR op=${operation} target=${target} error=${error.message} failOpen=${this.failOpen}`);
       if (this.failOpen) {
         this.eventReporter.error(
           operation,
@@ -188,10 +206,14 @@ var FetchInterceptor = class extends BaseInterceptor {
     } else {
       url = input.url;
     }
-    if (this.isBrokerUrl(url)) {
+    const isBroker = this.isBrokerUrl(url);
+    debugLog(`fetch ENTER url=${url} isBroker=${isBroker}`);
+    if (isBroker) {
       return this.originalFetch(input, init);
     }
+    debugLog(`fetch checkPolicy START url=${url}`);
     await this.checkPolicy("http_request", url);
+    debugLog(`fetch checkPolicy DONE url=${url}`);
     try {
       const method = init?.method || "GET";
       const headers = {};
@@ -231,10 +253,12 @@ var FetchInterceptor = class extends BaseInterceptor {
         headers: responseHeaders
       });
     } catch (error) {
+      debugLog(`fetch ERROR url=${url} error=${error.message}`);
       if (error.name === "PolicyDeniedError") {
         throw error;
       }
       if (this.failOpen) {
+        debugLog(`fetch failOpen fallback url=${url}`);
         return this.originalFetch(input, init);
       }
       throw error;
@@ -378,11 +402,11 @@ var WebSocketInterceptor = class extends BaseInterceptor {
 
 // libs/shield-interceptor/src/client/sync-client.ts
 var import_node_child_process = require("node:child_process");
-var fs = __toESM(require("node:fs"), 1);
+var fs2 = __toESM(require("node:fs"), 1);
 var import_node_crypto = require("node:crypto");
-var _existsSync = fs.existsSync.bind(fs);
-var _readFileSync = fs.readFileSync.bind(fs);
-var _unlinkSync = fs.unlinkSync.bind(fs);
+var _existsSync = fs2.existsSync.bind(fs2);
+var _readFileSync = fs2.readFileSync.bind(fs2);
+var _unlinkSync = fs2.unlinkSync.bind(fs2);
 var _spawnSync = import_node_child_process.spawnSync;
 var _execSync = import_node_child_process.execSync;
 var SyncClient = class {
@@ -400,10 +424,16 @@ var SyncClient = class {
    * Send a synchronous request to the broker
    */
   request(method, params) {
+    debugLog(`syncClient.request START method=${method}`);
     try {
-      return this.socketRequestSync(method, params);
-    } catch {
-      return this.httpRequestSync(method, params);
+      const result = this.socketRequestSync(method, params);
+      debugLog(`syncClient.request socket OK method=${method}`);
+      return result;
+    } catch (socketErr) {
+      debugLog(`syncClient.request socket FAILED: ${socketErr.message}, trying HTTP`);
+      const result = this.httpRequestSync(method, params);
+      debugLog(`syncClient.request http OK method=${method}`);
+      return result;
     }
   }
   /**
@@ -449,13 +479,19 @@ var SyncClient = class {
       }, ${this.timeout});
     `;
     try {
-      _spawnSync("/opt/agenshield/bin/node-bin", ["-e", script], {
+      debugLog(`syncClient.socketRequestSync _spawnSync START node-bin method=${method}`);
+      const spawnResult = _spawnSync("/opt/agenshield/bin/node-bin", ["-e", script], {
         timeout: this.timeout + 1e3,
         stdio: "ignore",
         env: { ...process.env, NODE_OPTIONS: "" }
       });
-      if (_existsSync(tmpFile)) {
-        const response = JSON.parse(_readFileSync(tmpFile, "utf-8"));
+      debugLog(`syncClient.socketRequestSync _spawnSync DONE status=${spawnResult?.status} signal=${spawnResult?.signal} error=${spawnResult?.error?.message || "none"}`);
+      const tmpExists = _existsSync(tmpFile);
+      debugLog(`syncClient.socketRequestSync tmpFile exists=${tmpExists}`);
+      if (tmpExists) {
+        const raw = _readFileSync(tmpFile, "utf-8");
+        debugLog(`syncClient.socketRequestSync response raw=${raw.slice(0, 200)}`);
+        const response = JSON.parse(raw);
         _unlinkSync(tmpFile);
         if (response.error) {
           throw new Error(response.error);
@@ -485,6 +521,7 @@ var SyncClient = class {
       params
     });
     try {
+      debugLog(`syncClient.httpRequestSync curl START url=${url} method=${method}`);
       const result = _execSync(
         `/usr/bin/curl -s -X POST -H "Content-Type: application/json" -d '${request.replace(/'/g, "\\'")}' "${url}"`,
         {
@@ -492,12 +529,14 @@ var SyncClient = class {
           encoding: "utf-8"
         }
       );
+      debugLog(`syncClient.httpRequestSync curl DONE len=${result?.length}`);
       const response = JSON.parse(result);
       if (response.error) {
         throw new Error(response.error.message);
       }
       return response.result;
     } catch (error) {
+      debugLog(`syncClient.httpRequestSync FAILED: ${error.message}`);
       throw new Error(`Sync request failed: ${error.message}`);
     }
   }
@@ -518,6 +557,7 @@ var SyncClient = class {
 var childProcessModule = require("node:child_process");
 var ChildProcessInterceptor = class extends BaseInterceptor {
   syncClient;
+  _checking = false;
   originalExec = null;
   originalExecSync = null;
   originalSpawn = null;
@@ -571,6 +611,11 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const original = this.originalExec;
     return function interceptedExec(command, ...args) {
       const callback = typeof args[args.length - 1] === "function" ? args.pop() : void 0;
+      debugLog(`cp.exec ENTER command=${command} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.exec SKIP (re-entrancy) command=${command}`);
+        return original(command, ...args, callback);
+      }
       self.eventReporter.intercept("exec", command);
       self.checkPolicy("exec", command).then(() => {
         original(command, ...args, callback);
@@ -586,12 +631,20 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalExecSync;
     const interceptedExecSync = function(command, options) {
-      self.eventReporter.intercept("exec", command);
+      debugLog(`cp.execSync ENTER command=${command} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.execSync SKIP (re-entrancy) command=${command}`);
+        return original(command, options);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept("exec", command);
+        debugLog(`cp.execSync policy_check START command=${command}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation: "exec", target: command }
         );
+        debugLog(`cp.execSync policy_check DONE allowed=${result.allowed} command=${command}`);
         if (!result.allowed) {
           throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
             operation: "exec",
@@ -599,13 +652,17 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
           });
         }
       } catch (error) {
+        debugLog(`cp.execSync policy_check ERROR: ${error.message} command=${command}`);
         if (error instanceof PolicyDeniedError) {
           throw error;
         }
         if (!self.failOpen) {
           throw error;
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`cp.execSync calling original command=${command}`);
       return original(command, options);
     };
     return interceptedExecSync;
@@ -614,6 +671,12 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalSpawn;
     const interceptedSpawn = function(command, args, options) {
+      const fullCmd = args ? `${command} ${args.join(" ")}` : command;
+      debugLog(`cp.spawn ENTER command=${fullCmd} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.spawn SKIP (re-entrancy) command=${fullCmd}`);
+        return original(command, args, options || {});
+      }
       const fullCommand = args ? `${command} ${args.join(" ")}` : command;
       self.eventReporter.intercept("exec", fullCommand);
       self.checkPolicy("exec", fullCommand).catch((error) => {
@@ -628,12 +691,20 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const original = this.originalSpawnSync;
     return function interceptedSpawnSync(command, args, options) {
       const fullCommand = args ? `${command} ${args.join(" ")}` : command;
-      self.eventReporter.intercept("exec", fullCommand);
+      debugLog(`cp.spawnSync ENTER command=${fullCommand} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.spawnSync SKIP (re-entrancy) command=${fullCommand}`);
+        return original(command, args, options);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept("exec", fullCommand);
+        debugLog(`cp.spawnSync policy_check START command=${fullCommand}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation: "exec", target: fullCommand }
         );
+        debugLog(`cp.spawnSync policy_check DONE allowed=${result.allowed} command=${fullCommand}`);
         if (!result.allowed) {
           return {
             pid: -1,
@@ -646,6 +717,7 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
           };
         }
       } catch (error) {
+        debugLog(`cp.spawnSync policy_check ERROR: ${error.message} command=${fullCommand}`);
         if (!self.failOpen) {
           return {
             pid: -1,
@@ -657,7 +729,10 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
             error
           };
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`cp.spawnSync calling original command=${fullCommand}`);
       return original(command, args, options);
     };
   }
@@ -665,6 +740,9 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalExecFile;
     return function interceptedExecFile(file, ...args) {
+      if (self._checking) {
+        return original(file, ...args);
+      }
       self.eventReporter.intercept("exec", file);
       self.checkPolicy("exec", file).catch((error) => {
         self.eventReporter.error("exec", file, error.message);
@@ -676,6 +754,9 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalFork;
     const interceptedFork = function(modulePath, args, options) {
+      if (self._checking) {
+        return original(modulePath, args, options);
+      }
       const pathStr = modulePath.toString();
       self.eventReporter.intercept("exec", `fork:${pathStr}`);
       self.checkPolicy("exec", `fork:${pathStr}`).catch((error) => {
@@ -688,6 +769,7 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
 };
 
 // libs/shield-interceptor/src/interceptors/fs.ts
+var import_node_url = require("node:url");
 var fsModule = require("node:fs");
 var fsPromisesModule = require("node:fs/promises");
 function safeOverride(target, prop, value) {
@@ -702,9 +784,23 @@ function safeOverride(target, prop, value) {
     });
   }
 }
+function normalizePathArg(p) {
+  if (p instanceof URL) {
+    return (0, import_node_url.fileURLToPath)(p);
+  }
+  const s = p.toString();
+  if (s.startsWith("file://")) {
+    try {
+      return (0, import_node_url.fileURLToPath)(new URL(s));
+    } catch {
+    }
+  }
+  return s;
+}
 var FsInterceptor = class extends BaseInterceptor {
   syncClient;
   originals = /* @__PURE__ */ new Map();
+  _checking = false;
   constructor(options) {
     super(options);
     this.syncClient = new SyncClient({
@@ -760,12 +856,20 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, function intercepted(path, ...args) {
-      const pathString = path.toString();
+      const pathString = normalizePathArg(path);
       const callback = typeof args[args.length - 1] === "function" ? args.pop() : void 0;
+      debugLog(`fs.${methodName} ENTER (async) path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fs.${methodName} SKIP (re-entrancy, async) path=${pathString}`);
+        original.call(module2, path, ...args, callback);
+        return;
+      }
       self.eventReporter.intercept(operation, pathString);
       self.checkPolicy(operation, pathString).then(() => {
+        debugLog(`fs.${methodName} policy OK (async) path=${pathString}`);
         original.call(module2, path, ...args, callback);
       }).catch((error) => {
+        debugLog(`fs.${methodName} policy ERROR (async): ${error.message} path=${pathString}`);
         if (callback) {
           callback(error);
         }
@@ -779,13 +883,21 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, function interceptedSync(path, ...args) {
-      const pathString = path.toString();
-      self.eventReporter.intercept(operation, pathString);
+      const pathString = normalizePathArg(path);
+      debugLog(`fs.${methodName} ENTER path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fs.${methodName} SKIP (re-entrancy) path=${pathString}`);
+        return original.call(module2, path, ...args);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept(operation, pathString);
+        debugLog(`fs.${methodName} policy_check START path=${pathString}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation, target: pathString }
         );
+        debugLog(`fs.${methodName} policy_check DONE allowed=${result.allowed} path=${pathString}`);
         if (!result.allowed) {
           throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
             operation,
@@ -793,13 +905,17 @@ var FsInterceptor = class extends BaseInterceptor {
           });
         }
       } catch (error) {
+        debugLog(`fs.${methodName} policy_check ERROR: ${error.message} path=${pathString}`);
         if (error instanceof PolicyDeniedError) {
           throw error;
         }
         if (!self.failOpen) {
           throw error;
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`fs.${methodName} calling original path=${pathString}`);
       return original.call(module2, path, ...args);
     });
   }
@@ -810,9 +926,15 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, async function interceptedPromise(path, ...args) {
-      const pathString = path.toString();
+      const pathString = normalizePathArg(path);
+      debugLog(`fsPromises.${methodName} ENTER path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fsPromises.${methodName} SKIP (re-entrancy) path=${pathString}`);
+        return original.call(module2, path, ...args);
+      }
       self.eventReporter.intercept(operation, pathString);
       await self.checkPolicy(operation, pathString);
+      debugLog(`fsPromises.${methodName} policy OK path=${pathString}`);
       return original.call(module2, path, ...args);
     });
   }

package/require.js

@@ -34,7 +34,7 @@ function createConfig(overrides) {
     interceptFetch: env["AGENSHIELD_INTERCEPT_FETCH"] !== "false",
     interceptHttp: env["AGENSHIELD_INTERCEPT_HTTP"] !== "false",
     interceptWs: env["AGENSHIELD_INTERCEPT_WS"] !== "false",
-    interceptFs: env["AGENSHIELD_INTERCEPT_FS"] !== "false",
+    interceptFs: false,
     interceptExec: env["AGENSHIELD_INTERCEPT_EXEC"] !== "false",
     timeout: parseInt(env["AGENSHIELD_TIMEOUT"] || "30000", 10),
     ...overrides
@@ -77,6 +77,18 @@ var TimeoutError = class extends AgenShieldError {
   }
 };
 
+// libs/shield-interceptor/src/debug-log.ts
+var fs = __toESM(require("node:fs"), 1);
+var _appendFileSync = fs.appendFileSync.bind(fs);
+var LOG_PATH = "/var/log/agenshield/interceptor.log";
+function debugLog(msg) {
+  try {
+    _appendFileSync(LOG_PATH, `[${(/* @__PURE__ */ new Date()).toISOString()}] [pid:${process.pid}] ${msg}
+`);
+  } catch {
+  }
+}
+
 // libs/shield-interceptor/src/interceptors/base.ts
 var BaseInterceptor = class {
   client;
@@ -102,7 +114,9 @@ var BaseInterceptor = class {
         return false;
       }
       const port = parsed.port;
-      return port === String(this.brokerHttpPort) || port === "5200";
+      const result = port === String(this.brokerHttpPort) || port === "5200";
+      debugLog(`isBrokerUrl url=${url} hostname=${parsed.hostname} port=${port} brokerPort=${this.brokerHttpPort} result=${result}`);
+      return result;
     } catch {
       return false;
     }
@@ -118,9 +132,11 @@ var BaseInterceptor = class {
    */
   async checkPolicy(operation, target) {
     const startTime = Date.now();
+    debugLog(`base.checkPolicy START op=${operation} target=${target}`);
     try {
       this.eventReporter.intercept(operation, target);
       const result = await this.policyEvaluator.check(operation, target);
+      debugLog(`base.checkPolicy evaluator result op=${operation} target=${target} allowed=${result.allowed} policyId=${result.policyId}`);
       if (!result.allowed) {
         this.eventReporter.deny(operation, target, result.policyId, result.reason);
         throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
@@ -137,8 +153,10 @@ var BaseInterceptor = class {
       );
     } catch (error) {
       if (error instanceof PolicyDeniedError) {
+        debugLog(`base.checkPolicy DENIED op=${operation} target=${target} reason=${error.message}`);
         throw error;
       }
+      debugLog(`base.checkPolicy ERROR op=${operation} target=${target} error=${error.message} failOpen=${this.failOpen}`);
       if (this.failOpen) {
         this.eventReporter.error(
           operation,
@@ -188,10 +206,14 @@ var FetchInterceptor = class extends BaseInterceptor {
     } else {
       url = input.url;
     }
-    if (this.isBrokerUrl(url)) {
+    const isBroker = this.isBrokerUrl(url);
+    debugLog(`fetch ENTER url=${url} isBroker=${isBroker}`);
+    if (isBroker) {
       return this.originalFetch(input, init);
     }
+    debugLog(`fetch checkPolicy START url=${url}`);
     await this.checkPolicy("http_request", url);
+    debugLog(`fetch checkPolicy DONE url=${url}`);
     try {
       const method = init?.method || "GET";
       const headers = {};
@@ -231,10 +253,12 @@ var FetchInterceptor = class extends BaseInterceptor {
         headers: responseHeaders
       });
     } catch (error) {
+      debugLog(`fetch ERROR url=${url} error=${error.message}`);
       if (error.name === "PolicyDeniedError") {
         throw error;
       }
       if (this.failOpen) {
+        debugLog(`fetch failOpen fallback url=${url}`);
         return this.originalFetch(input, init);
       }
       throw error;
@@ -378,11 +402,11 @@ var WebSocketInterceptor = class extends BaseInterceptor {
 
 // libs/shield-interceptor/src/client/sync-client.ts
 var import_node_child_process = require("node:child_process");
-var fs = __toESM(require("node:fs"), 1);
+var fs2 = __toESM(require("node:fs"), 1);
 var import_node_crypto = require("node:crypto");
-var _existsSync = fs.existsSync.bind(fs);
-var _readFileSync = fs.readFileSync.bind(fs);
-var _unlinkSync = fs.unlinkSync.bind(fs);
+var _existsSync = fs2.existsSync.bind(fs2);
+var _readFileSync = fs2.readFileSync.bind(fs2);
+var _unlinkSync = fs2.unlinkSync.bind(fs2);
 var _spawnSync = import_node_child_process.spawnSync;
 var _execSync = import_node_child_process.execSync;
 var SyncClient = class {
@@ -400,10 +424,16 @@ var SyncClient = class {
    * Send a synchronous request to the broker
    */
   request(method, params) {
+    debugLog(`syncClient.request START method=${method}`);
     try {
-      return this.socketRequestSync(method, params);
-    } catch {
-      return this.httpRequestSync(method, params);
+      const result = this.socketRequestSync(method, params);
+      debugLog(`syncClient.request socket OK method=${method}`);
+      return result;
+    } catch (socketErr) {
+      debugLog(`syncClient.request socket FAILED: ${socketErr.message}, trying HTTP`);
+      const result = this.httpRequestSync(method, params);
+      debugLog(`syncClient.request http OK method=${method}`);
+      return result;
     }
   }
   /**
@@ -449,13 +479,19 @@ var SyncClient = class {
       }, ${this.timeout});
     `;
     try {
-      _spawnSync("/opt/agenshield/bin/node-bin", ["-e", script], {
+      debugLog(`syncClient.socketRequestSync _spawnSync START node-bin method=${method}`);
+      const spawnResult = _spawnSync("/opt/agenshield/bin/node-bin", ["-e", script], {
         timeout: this.timeout + 1e3,
         stdio: "ignore",
         env: { ...process.env, NODE_OPTIONS: "" }
       });
-      if (_existsSync(tmpFile)) {
-        const response = JSON.parse(_readFileSync(tmpFile, "utf-8"));
+      debugLog(`syncClient.socketRequestSync _spawnSync DONE status=${spawnResult?.status} signal=${spawnResult?.signal} error=${spawnResult?.error?.message || "none"}`);
+      const tmpExists = _existsSync(tmpFile);
+      debugLog(`syncClient.socketRequestSync tmpFile exists=${tmpExists}`);
+      if (tmpExists) {
+        const raw = _readFileSync(tmpFile, "utf-8");
+        debugLog(`syncClient.socketRequestSync response raw=${raw.slice(0, 200)}`);
+        const response = JSON.parse(raw);
         _unlinkSync(tmpFile);
         if (response.error) {
           throw new Error(response.error);
@@ -485,6 +521,7 @@ var SyncClient = class {
       params
     });
     try {
+      debugLog(`syncClient.httpRequestSync curl START url=${url} method=${method}`);
       const result = _execSync(
         `/usr/bin/curl -s -X POST -H "Content-Type: application/json" -d '${request.replace(/'/g, "\\'")}' "${url}"`,
         {
@@ -492,12 +529,14 @@ var SyncClient = class {
           encoding: "utf-8"
         }
       );
+      debugLog(`syncClient.httpRequestSync curl DONE len=${result?.length}`);
       const response = JSON.parse(result);
       if (response.error) {
         throw new Error(response.error.message);
       }
       return response.result;
     } catch (error) {
+      debugLog(`syncClient.httpRequestSync FAILED: ${error.message}`);
       throw new Error(`Sync request failed: ${error.message}`);
     }
   }
@@ -518,6 +557,7 @@ var SyncClient = class {
 var childProcessModule = require("node:child_process");
 var ChildProcessInterceptor = class extends BaseInterceptor {
   syncClient;
+  _checking = false;
   originalExec = null;
   originalExecSync = null;
   originalSpawn = null;
@@ -571,6 +611,11 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const original = this.originalExec;
     return function interceptedExec(command, ...args) {
       const callback = typeof args[args.length - 1] === "function" ? args.pop() : void 0;
+      debugLog(`cp.exec ENTER command=${command} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.exec SKIP (re-entrancy) command=${command}`);
+        return original(command, ...args, callback);
+      }
       self.eventReporter.intercept("exec", command);
       self.checkPolicy("exec", command).then(() => {
         original(command, ...args, callback);
@@ -586,12 +631,20 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalExecSync;
     const interceptedExecSync = function(command, options) {
-      self.eventReporter.intercept("exec", command);
+      debugLog(`cp.execSync ENTER command=${command} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.execSync SKIP (re-entrancy) command=${command}`);
+        return original(command, options);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept("exec", command);
+        debugLog(`cp.execSync policy_check START command=${command}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation: "exec", target: command }
         );
+        debugLog(`cp.execSync policy_check DONE allowed=${result.allowed} command=${command}`);
         if (!result.allowed) {
           throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
             operation: "exec",
@@ -599,13 +652,17 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
           });
         }
       } catch (error) {
+        debugLog(`cp.execSync policy_check ERROR: ${error.message} command=${command}`);
         if (error instanceof PolicyDeniedError) {
           throw error;
         }
         if (!self.failOpen) {
           throw error;
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`cp.execSync calling original command=${command}`);
       return original(command, options);
     };
     return interceptedExecSync;
@@ -614,6 +671,12 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalSpawn;
     const interceptedSpawn = function(command, args, options) {
+      const fullCmd = args ? `${command} ${args.join(" ")}` : command;
+      debugLog(`cp.spawn ENTER command=${fullCmd} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.spawn SKIP (re-entrancy) command=${fullCmd}`);
+        return original(command, args, options || {});
+      }
       const fullCommand = args ? `${command} ${args.join(" ")}` : command;
       self.eventReporter.intercept("exec", fullCommand);
       self.checkPolicy("exec", fullCommand).catch((error) => {
@@ -628,12 +691,20 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const original = this.originalSpawnSync;
     return function interceptedSpawnSync(command, args, options) {
       const fullCommand = args ? `${command} ${args.join(" ")}` : command;
-      self.eventReporter.intercept("exec", fullCommand);
+      debugLog(`cp.spawnSync ENTER command=${fullCommand} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`cp.spawnSync SKIP (re-entrancy) command=${fullCommand}`);
+        return original(command, args, options);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept("exec", fullCommand);
+        debugLog(`cp.spawnSync policy_check START command=${fullCommand}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation: "exec", target: fullCommand }
         );
+        debugLog(`cp.spawnSync policy_check DONE allowed=${result.allowed} command=${fullCommand}`);
         if (!result.allowed) {
           return {
             pid: -1,
@@ -646,6 +717,7 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
           };
         }
       } catch (error) {
+        debugLog(`cp.spawnSync policy_check ERROR: ${error.message} command=${fullCommand}`);
         if (!self.failOpen) {
           return {
             pid: -1,
@@ -657,7 +729,10 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
             error
           };
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`cp.spawnSync calling original command=${fullCommand}`);
       return original(command, args, options);
     };
   }
@@ -665,6 +740,9 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalExecFile;
     return function interceptedExecFile(file, ...args) {
+      if (self._checking) {
+        return original(file, ...args);
+      }
       self.eventReporter.intercept("exec", file);
       self.checkPolicy("exec", file).catch((error) => {
         self.eventReporter.error("exec", file, error.message);
@@ -676,6 +754,9 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const self = this;
     const original = this.originalFork;
     const interceptedFork = function(modulePath, args, options) {
+      if (self._checking) {
+        return original(modulePath, args, options);
+      }
       const pathStr = modulePath.toString();
       self.eventReporter.intercept("exec", `fork:${pathStr}`);
       self.checkPolicy("exec", `fork:${pathStr}`).catch((error) => {
@@ -688,6 +769,7 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
 };
 
 // libs/shield-interceptor/src/interceptors/fs.ts
+var import_node_url = require("node:url");
 var fsModule = require("node:fs");
 var fsPromisesModule = require("node:fs/promises");
 function safeOverride(target, prop, value) {
@@ -702,9 +784,23 @@ function safeOverride(target, prop, value) {
     });
   }
 }
+function normalizePathArg(p) {
+  if (p instanceof URL) {
+    return (0, import_node_url.fileURLToPath)(p);
+  }
+  const s = p.toString();
+  if (s.startsWith("file://")) {
+    try {
+      return (0, import_node_url.fileURLToPath)(new URL(s));
+    } catch {
+    }
+  }
+  return s;
+}
 var FsInterceptor = class extends BaseInterceptor {
   syncClient;
   originals = /* @__PURE__ */ new Map();
+  _checking = false;
   constructor(options) {
     super(options);
     this.syncClient = new SyncClient({
@@ -760,12 +856,20 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, function intercepted(path, ...args) {
-      const pathString = path.toString();
+      const pathString = normalizePathArg(path);
       const callback = typeof args[args.length - 1] === "function" ? args.pop() : void 0;
+      debugLog(`fs.${methodName} ENTER (async) path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fs.${methodName} SKIP (re-entrancy, async) path=${pathString}`);
+        original.call(module2, path, ...args, callback);
+        return;
+      }
       self.eventReporter.intercept(operation, pathString);
       self.checkPolicy(operation, pathString).then(() => {
+        debugLog(`fs.${methodName} policy OK (async) path=${pathString}`);
         original.call(module2, path, ...args, callback);
       }).catch((error) => {
+        debugLog(`fs.${methodName} policy ERROR (async): ${error.message} path=${pathString}`);
         if (callback) {
           callback(error);
         }
@@ -779,13 +883,21 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, function interceptedSync(path, ...args) {
-      const pathString = path.toString();
-      self.eventReporter.intercept(operation, pathString);
+      const pathString = normalizePathArg(path);
+      debugLog(`fs.${methodName} ENTER path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fs.${methodName} SKIP (re-entrancy) path=${pathString}`);
+        return original.call(module2, path, ...args);
+      }
+      self._checking = true;
       try {
+        self.eventReporter.intercept(operation, pathString);
+        debugLog(`fs.${methodName} policy_check START path=${pathString}`);
         const result = self.syncClient.request(
           "policy_check",
           { operation, target: pathString }
         );
+        debugLog(`fs.${methodName} policy_check DONE allowed=${result.allowed} path=${pathString}`);
         if (!result.allowed) {
           throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
             operation,
@@ -793,13 +905,17 @@ var FsInterceptor = class extends BaseInterceptor {
           });
         }
       } catch (error) {
+        debugLog(`fs.${methodName} policy_check ERROR: ${error.message} path=${pathString}`);
         if (error instanceof PolicyDeniedError) {
           throw error;
         }
         if (!self.failOpen) {
           throw error;
         }
+      } finally {
+        self._checking = false;
       }
+      debugLog(`fs.${methodName} calling original path=${pathString}`);
       return original.call(module2, path, ...args);
     });
   }
@@ -810,9 +926,15 @@ var FsInterceptor = class extends BaseInterceptor {
     this.originals.set(key, original);
     const self = this;
     safeOverride(module2, methodName, async function interceptedPromise(path, ...args) {
-      const pathString = path.toString();
+      const pathString = normalizePathArg(path);
+      debugLog(`fsPromises.${methodName} ENTER path=${pathString} _checking=${self._checking}`);
+      if (self._checking) {
+        debugLog(`fsPromises.${methodName} SKIP (re-entrancy) path=${pathString}`);
+        return original.call(module2, path, ...args);
+      }
       self.eventReporter.intercept(operation, pathString);
       await self.checkPolicy(operation, pathString);
+      debugLog(`fsPromises.${methodName} policy OK path=${pathString}`);
       return original.call(module2, path, ...args);
     });
   }