@gethelio/proxy 0.6.0 → 0.7.0

package/dist/cli.js

@@ -8045,6 +8045,13 @@ function warnIfDashboardOpenMode(config, log = console.error) {
   );
   return true;
 }
+function warnIfNoEnforcement(policy, log = console.error) {
+  if (policy.rules.length > 0 || policy.defaultAction !== "allow" || policy.dryRun) return false;
+  log(
+    '[helio] No policy rules are loaded and the default action is "allow" - Helio is recording an audit trail but NOT blocking anything. Add rules under `policies:` in helio.yaml to start enforcing (see docs/policies.md).'
+  );
+  return true;
+}
 
 // src/crash-drain.ts
 var hooks = [];
@@ -8117,18 +8124,6 @@ upstream:
 #   headers:
 #     Authorization: "Bearer \${UPSTREAM_TOKEN}"
 
-# Operator dashboard + approval REST API. Bound to 127.0.0.1 by default \u2014 do
-# not change to 0.0.0.0 without putting an authenticating reverse proxy in
-# front. dashboard.api_secret is the manual dashboard login secret and also
-# supports machine Bearer auth for sideband API clients. Store it safely; it
-# stays valid until you rotate it. Rotate by editing this file and restarting
-# (or hot-reloading) the proxy. Rotation invalidates active dashboard sessions.
-dashboard:
-  enabled: true
-  port: 3100
-  host: 127.0.0.1
-  api_secret: "${apiSecret}"
-
 # listen:
 #   port: 3000
 #   host: 127.0.0.1
@@ -8149,6 +8144,18 @@ dashboard:
 #   retention: 90d
 #   include_responses: true
 
+# Operator dashboard + approval REST API. Bound to 127.0.0.1 by default \u2014 do
+# not change to 0.0.0.0 without putting an authenticating reverse proxy in
+# front. dashboard.api_secret is the manual dashboard login secret and also
+# supports machine Bearer auth for sideband API clients. Store it safely; it
+# stays valid until you rotate it. Rotate by editing this file and restarting
+# (or hot-reloading) the proxy. Rotation invalidates active dashboard sessions.
+dashboard:
+  enabled: true
+  port: 3100
+  host: 127.0.0.1
+  api_secret: "${apiSecret}"
+
 # sdk:
 #   enabled: false
 #   port: 3200
@@ -8444,6 +8451,7 @@ async function startCommand(configPath, options) {
   console.error(
     `Policies: ${String(ruleCount)} rule${ruleCount !== 1 ? "s" : ""} loaded (default: ${policy.defaultAction})`
   );
+  warnIfNoEnforcement(policy);
   if (config.upstream.transport === "stdio") {
     console.error(`Upstream: ${config.upstream.command ?? ""} (stdio)`);
   } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gethelio/proxy",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "description": "Open-source MCP governance proxy for AI agents",
   "license": "Apache-2.0",