npm - @gethelio/proxy - Versions diffs - 0.13.1 → 0.14.0 - Mend

@gethelio/proxy 0.13.1 → 0.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/README.md +7 -1
package/dist/cli.js +774 -152
package/dist/dashboard-assets/assets/{index-BRvkMXWl.js → index-D9zeFAzU.js} +2 -2
package/dist/dashboard-assets/index.html +1 -1
package/dist/index.d.ts +75 -9
package/dist/index.js +167 -77
package/package.json +1 -1

package/dist/dashboard-assets/index.html CHANGED Viewed

@@ -6,7 +6,7 @@
     <meta name="referrer" content="no-referrer" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <title>Helio Dashboard</title>
-    <script type="module" crossorigin src="/assets/index-BRvkMXWl.js"></script>
+    <script type="module" crossorigin src="/assets/index-D9zeFAzU.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DtnT1Y9r.css">
   </head>
   <body>

package/dist/index.d.ts CHANGED Viewed

@@ -735,6 +735,10 @@ declare class ConfigError extends Error {
  */
 declare function loadConfig(filePath: string, env?: Record<string, string | undefined>): Promise<HelioConfig>;
+/** Every outcome a reload attempt can record. `watch_failed` means the watch itself failed; nothing was read. */
+declare const POLICY_RELOAD_OUTCOMES: readonly ["applied", "rejected_invalid", "rejected_unroutable", "rejected_budget_flush", "rejected_pinned", "watch_failed"];
+type PolicyReloadOutcome = (typeof POLICY_RELOAD_OUTCOMES)[number];
 /** Pre-compiled glob matcher for tool names. */
 interface ToolMatcher {
     /** Original glob pattern string (e.g. "send_*") for audit/logging. */
@@ -1461,9 +1465,12 @@ interface AuditRecord {
      * records; `'install_scan'` for sideband install evaluations; and
      * `'evaluation_expired'` for sideband evaluations whose `/audit` never
      * arrived (the bypass/tamper signal — block_reason stays null so they do not
-     * count as enforcement blocks).
+     * count as enforcement blocks); and `'policy_reload'` for a config reload
+     * attempt the proxy records about itself (issue #341): the outcome is in
+     * `block_reason` and under `evidence_chain.policy_reload`, and the decision
+     * column holds the constant `policy_reload` so analytics can exclude the kind.
      */
-    readonly record_kind: 'tool_call' | 'drift_event' | 'install_scan' | 'evaluation_expired';
+    readonly record_kind: 'tool_call' | 'drift_event' | 'install_scan' | 'evaluation_expired' | 'policy_reload';
     /**
      * Enforcement origin: `'mcp'` for the proxy path, or an adapter-supplied
      * origin string (e.g. `'openclaw'`) for sideband-governed calls. Surfaces
@@ -1492,9 +1499,20 @@ interface AuditRecord {
      * could silently omit it would exempt that door from attribution.
      */
     readonly upstream: string | null;
+    /**
+     * SHA-256 (lowercase hex) of the config file bytes in force when the
+     * record was written (issue #341); the value `helio config hash` prints.
+     * Stamped by the writer, never by a record builder. Null on rows written
+     * before the column existed.
+     */
+    readonly config_sha256: string | null;
     /** ISO 8601 timestamp of when the record was persisted. */
     readonly created_at: string;
 }
+/** What a record builder produces: the stored shape without the ids and with the writer-stamped hash optional. */
+type AuditRecordInput = Omit<AuditRecord, 'id' | 'created_at' | 'config_sha256'> & {
+    readonly config_sha256?: string | null;
+};
 /** Fields available for filtering audit record queries. */
 interface AuditQueryFilters {
     /** Filter by tool name (exact match). */
@@ -1687,7 +1705,7 @@ declare class AuditStore {
      * @param createdAt - Optional override for the created_at timestamp (for testing).
      * @param id - Optional pre-generated ID (used by AuditWriter to share ID with SSE event bus).
      */
-    insert(record: Omit<AuditRecord, 'id' | 'created_at'>, createdAt?: string, id?: string): string;
+    insert(record: AuditRecordInput, createdAt?: string, id?: string): string;
     /**
      * Insert multiple audit records in a single SQLite transaction.
      *
@@ -1703,7 +1721,7 @@ declare class AuditStore {
      *   the SSE event bus before the record is persisted.
      * @returns The number of records successfully inserted.
      */
-    insertBatch(records: ReadonlyArray<Omit<AuditRecord, 'id' | 'created_at'>>, onError?: (record: Omit<AuditRecord, 'id' | 'created_at'>, err: unknown) => void, ids?: ReadonlyArray<string>, onPersist?: (record: Omit<AuditRecord, 'id' | 'created_at'>, id: string) => void): number;
+    insertBatch(records: ReadonlyArray<AuditRecordInput>, onError?: (record: AuditRecordInput, err: unknown) => void, ids?: ReadonlyArray<string>, onPersist?: (record: AuditRecordInput, id: string) => void): number;
     /** Get a single record by ID, or undefined if not found. */
     get(id: string): AuditRecord | undefined;
     /** Query records with filters and pagination. Capped at 1,000 per page. */
@@ -1743,9 +1761,11 @@ interface AuditWriterOptions {
     /** Max milliseconds between flushes (default: 100). */
     readonly flushIntervalMs?: number;
     /** Optional callback invoked when a record enters the in-memory buffer. */
-    readonly onPush?: (record: Omit<AuditRecord, 'id' | 'created_at'>, id: string) => void;
+    readonly onPush?: (record: AuditRecordInput, id: string) => void;
     /** Optional callback invoked after a record is successfully persisted. */
-    readonly onPersist?: (record: Omit<AuditRecord, 'id' | 'created_at'>, id: string) => void;
+    readonly onPersist?: (record: AuditRecordInput, id: string) => void;
+    /** The hash of the config in force at construction; every record that leaves `config_sha256` nullish is stamped with the current value. */
+    readonly configSha256?: string;
 }
 /**
  * Async buffered audit record writer.
@@ -1759,6 +1779,15 @@ declare class AuditWriter {
     private readonly bufferSize;
     private readonly onPush;
     private readonly onPersist;
+    /**
+     * The hash of the config file in force (issue #341), stamped onto every
+     * record whose builder left `config_sha256` nullish. Seeded at
+     * construction so no record is pushed unstamped before the first
+     * `setConfigSha256`; replaced by the reload path once the new policy is
+     * in force. Null only when the caller never had a hash (library
+     * embeddings without a config file).
+     */
+    private configSha256;
     private buffer;
     private timer;
     private flushSoonTimer;
@@ -1774,7 +1803,7 @@ declare class AuditWriter {
      * is scheduled. This keeps request-path latency bounded even under bursty
      * write load.
      */
-    push(record: Omit<AuditRecord, 'id' | 'created_at'>, id?: string): void;
+    push(input: AuditRecordInput, id?: string): void;
     /**
      * Push a record and schedule a high-priority async flush.
      *
@@ -1783,7 +1812,20 @@ declare class AuditWriter {
      * A fatal-process crash still invokes the crash-drain hook, which calls
      * `flush()` synchronously before exit.
      */
-    pushImmediate(record: Omit<AuditRecord, 'id' | 'created_at'>, id?: string): void;
+    pushImmediate(input: AuditRecordInput, id?: string): void;
+    /**
+     * Replace the config hash every later record is stamped with. Called by
+     * the reload path after the new policy is in force, before the reload's
+     * own record is pushed, so the reload record and every call it governs
+     * carry the new hash.
+     */
+    setConfigSha256(hash: string): void;
+    /**
+     * Stamp the active config hash onto a record whose builder left the field
+     * nullish; a record that already carries a hash is passed through. The
+     * stamped record is what `onPush`, the store, and `onPersist` see.
+     */
+    private stamp;
     /**
      * Schedule a flush on the next tick, coalescing multiple calls into one.
      */
@@ -3463,7 +3505,23 @@ declare class GovernanceConfigError extends Error {
  * reserved `'<header_mismatch>'` sentinel — either way `top_tools` already
  * excludes rejected records, so these rows never pollute tool rankings.
  */
-declare function buildHeaderMismatchAuditRecord(rejection: HeaderMismatchRejection, environment?: string, upstream?: string): Omit<AuditRecord, 'id' | 'created_at'>;
+declare function buildHeaderMismatchAuditRecord(rejection: HeaderMismatchRejection, environment?: string, upstream?: string): AuditRecordInput;
+interface PolicyReloadEvidence {
+    readonly outcome: PolicyReloadOutcome;
+    readonly config_path: string;
+    readonly sha256_before: string;
+    readonly sha256_after: string | null;
+    readonly rule_count_before: number;
+    readonly rule_count_after: number | null;
+    readonly default_action_before: 'allow' | 'deny';
+    readonly default_action_after: 'allow' | 'deny' | null;
+    readonly budget_count_before: number;
+    readonly budget_count_after: number | null;
+    readonly rules_removed: readonly string[];
+    readonly restart_required_paths: readonly string[];
+    readonly error: string | null;
+}
 /** @internal Exported for testing only. */
 declare class QueueChannel implements ApprovalChannel {
@@ -3659,6 +3717,13 @@ type BudgetUpdateEvent = BudgetCommitEvent;
  * engine's breach-event DTO.
  */
 type BudgetBreachedEvent = BudgetBreachEvent;
+/** A policy reload attempt, emitted beside the record's own `action` event (issue #341). */
+interface PolicyReloadEvent extends PolicyReloadEvidence {
+    /** The audit record's id. */
+    readonly id: string;
+    /** The record's timestamp. */
+    readonly at: string;
+}
 /** Map of event type names to their payload types. */
 interface DashboardEvents {
     action: ActionEvent;
@@ -3668,6 +3733,7 @@ interface DashboardEvents {
     approval_notification_failed: ApprovalNotificationFailedEvent;
     budget_update: BudgetUpdateEvent;
     budget_breached: BudgetBreachedEvent;
+    policy_reload: PolicyReloadEvent;
 }
 /** Union of all dashboard event type names. */
 type DashboardEventType = keyof DashboardEvents;