npm - @gethelio/proxy - Versions diffs - 0.7.0 → 0.8.0 - Mend

@gethelio/proxy 0.7.0 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/cli.js +59 -3
package/dist/dashboard-assets/assets/{index-DgywE2WQ.js → index-0ylAcvX3.js} +11 -11
package/dist/dashboard-assets/index.html +1 -1
package/dist/index.d.ts +1 -1
package/dist/index.js +59 -3
package/package.json +1 -1

package/dist/dashboard-assets/index.html CHANGED Viewed

@@ -6,7 +6,7 @@
     <meta name="referrer" content="no-referrer" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <title>Helio Dashboard</title>
-    <script type="module" crossorigin src="/assets/index-DgywE2WQ.js"></script>
+    <script type="module" crossorigin src="/assets/index-0ylAcvX3.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DZKoV0Vx.css">
   </head>
   <body>

package/dist/index.d.ts CHANGED Viewed

@@ -946,7 +946,7 @@ interface AuditTimeBucket {
 interface AuditAggregateStats {
     /** Total number of records in the time range. */
     readonly total: number;
-    /** Total records that resolved without a block (`block_reason IS NULL`). */
+    /** Total records that resolved without a block (`block_reason IS NULL`), excluding drift events. */
     readonly allowed_total: number;
     /** Total records that resolved with a block (`block_reason IS NOT NULL`). */
     readonly blocked_total: number;

package/dist/index.js CHANGED Viewed

@@ -3141,6 +3141,7 @@ var GovernedForwarder = class {
     let result;
     let approvalOutcome;
     let approvalWaitMs = 0;
+    let approvalContext;
     let rateLimitResult;
     let spendLimitResult;
     let forwardingError;
@@ -3170,6 +3171,7 @@ var GovernedForwarder = class {
           result = approvalResult.result;
           approvalOutcome = approvalResult.outcome;
           approvalWaitMs = approvalResult.approvalWaitMs;
+          approvalContext = approvalResult.approvalContext;
         }
       } else if (decision.action === "rate_limit") {
         if (!this.rateLimiter) {
@@ -3222,6 +3224,7 @@ var GovernedForwarder = class {
       dependencyResult,
       evidenceBlocked,
       approvalOutcome,
+      approvalContext,
       rateLimitResult,
       spendLimitResult,
       isDryRun,
@@ -3243,6 +3246,16 @@ var GovernedForwarder = class {
       request.signal
     );
     const approvalWaitMs = performance.now() - approvalStart;
+    const ticket = outcome.ticketId ? router.getTicket(outcome.ticketId) : void 0;
+    const denialReason = outcome.status === "denied" && outcome.reason ? outcome.reason : void 0;
+    const approvalContext = outcome.ticketId && (denialReason || ticket?.escalated_at) ? {
+      ticket_id: outcome.ticketId,
+      ...denialReason ? { denial_reason: denialReason } : {},
+      ...ticket?.escalated_at ? {
+        escalated_at: ticket.escalated_at,
+        escalated_to: [...ticket.escalated_to ?? []]
+      } : {}
+    } : void 0;
     let result;
     if (outcome.status === "approved" || outcome.status === "break_glass") {
       if (request.signal?.aborted) {
@@ -3271,7 +3284,7 @@ var GovernedForwarder = class {
         result = makeErrorResult(request, POLICY_DENIED, message, { ...feedback });
       }
     }
-    return { result, outcome, approvalWaitMs };
+    return { result, outcome, approvalWaitMs, approvalContext };
   }
   async handleRateLimit(request, decision, toolName) {
     const limiter = this.rateLimiter;
@@ -3451,7 +3464,7 @@ var GovernedForwarder = class {
   wasForwardedUpstream(decision, approvalOutcome, rateLimitResult, spendLimitResult) {
     return decision.action === "allow" || approvalOutcome?.status === "approved" || approvalOutcome?.status === "break_glass" || approvalOutcome?.status === "timeout" && this.approvalRouter?.defaultOnTimeout === "allow" || rateLimitResult?.allowed === true || spendLimitResult?.allowed === true;
   }
-  writeAuditRecord(request, timestamp, toolName, toolArguments, decision, result, totalDurationMs, approvalWaitMs, flaggedDestructive, evidenceResult, dependencyResult, evidenceBlocked, approvalOutcome, rateLimitResult, spendLimitResult, isDryRun, forwardingError, drift) {
+  writeAuditRecord(request, timestamp, toolName, toolArguments, decision, result, totalDurationMs, approvalWaitMs, flaggedDestructive, evidenceResult, dependencyResult, evidenceBlocked, approvalOutcome, approvalContext, rateLimitResult, spendLimitResult, isDryRun, forwardingError, drift) {
     if (!this.auditWriter) return;
     const wasForwarded = this.wasForwardedUpstream(
       decision,
@@ -3486,6 +3499,12 @@ var GovernedForwarder = class {
         }
       };
     }
+    if (approvalContext) {
+      evidenceChain = {
+        ...evidenceChain ?? {},
+        approval: { ...approvalContext }
+      };
+    }
     if (rateLimitResult) {
       evidenceChain = {
         ...evidenceChain ?? {},
@@ -4536,6 +4555,7 @@ var EvidenceStore = class _EvidenceStore {
 // src/evidence/api.ts
 import { Hono as Hono5 } from "hono";
 import { bodyLimit } from "hono/body-limit";
+import { HTTPException } from "hono/http-exception";
 import { z as z5 } from "zod";
 // src/auth/bearer.ts
@@ -4736,6 +4756,11 @@ function createSidebandApp(store, options = {}) {
   const app = new Hono5();
   const sdkToken = options.token && options.token.length > 0 ? options.token : void 0;
   const adapterToken = options.adapterToken && options.adapterToken.length > 0 ? options.adapterToken : void 0;
+  app.onError((err, c) => {
+    if (err instanceof HTTPException) return err.getResponse();
+    console.error("[helio] Unhandled sideband API error:", err);
+    return c.json({ error: "Internal server error" }, 500);
+  });
   app.use("*", async (c, next) => {
     const origin = c.req.header("origin");
     if (origin) {
@@ -5113,6 +5138,7 @@ var GovernanceService = class {
     }
     let approvalStatus = null;
     let approvedBy = null;
+    let approvalContext;
     if (entry.approvalTicketId) {
       const ticket = this.getTicketStatus(entry.approvalTicketId);
       const status = ticket?.status;
@@ -5121,6 +5147,16 @@ var GovernanceService = class {
       }
       approvalStatus = status;
       approvedBy = ticket.resolved_by ?? null;
+      if (ticket.denial_reason || ticket.escalated_at) {
+        approvalContext = {
+          ticket_id: entry.approvalTicketId,
+          ...ticket.denial_reason ? { denial_reason: ticket.denial_reason } : {},
+          ...ticket.escalated_at ? {
+            escalated_at: ticket.escalated_at,
+            escalated_to: [...ticket.escalated_to ?? []]
+          } : {}
+        };
+      }
     }
     if (req.actual_amount !== void 0) {
       if (!Number.isFinite(req.actual_amount) || req.actual_amount < 0) {
@@ -5157,6 +5193,7 @@ var GovernanceService = class {
       limitsChain,
       approvalStatus,
       approvedBy,
+      approvalContext,
       upstreamError: req.status === "error" ? req.error ?? "tool call failed" : null,
       upstreamResponse: req.result ?? null,
       upstreamLatencyMs: req.duration_ms ?? null
@@ -5562,6 +5599,9 @@ var GovernanceService = class {
     if (args.sidebandUnreported) {
       evidenceChain = { ...evidenceChain ?? {}, sideband: { unreported: true } };
     }
+    if (args.approvalContext) {
+      evidenceChain = { ...evidenceChain ?? {}, approval: { ...args.approvalContext } };
+    }
     const record = {
       timestamp: args.timestampIso,
       session_id: args.sessionId,
@@ -7231,6 +7271,7 @@ import { readFileSync } from "fs";
 import { join } from "path";
 import { randomUUID as randomUUID6 } from "crypto";
 import { Hono as Hono8 } from "hono";
+import { HTTPException as HTTPException2 } from "hono/http-exception";
 import { z as z8 } from "zod";
 import { cors } from "hono/cors";
 import { serveStatic } from "@hono/node-server/serve-static";
@@ -7497,6 +7538,16 @@ function shouldSetSecureCookie(url, xForwardedProto) {
   if (xForwardedProto?.toLowerCase() === "https") return true;
   return new URL(url).protocol === "https:";
 }
+function isPrivateIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!match) return false;
+  const a = Number(match[1]);
+  const b = Number(match[2]);
+  const c = Number(match[3]);
+  const d = Number(match[4]);
+  if (a > 255 || b > 255 || c > 255 || d > 255) return false;
+  return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
 function createDashboardAppWithLifecycle(deps, options) {
   const {
     auditStore,
@@ -7510,6 +7561,11 @@ function createDashboardAppWithLifecycle(deps, options) {
   const apiSecret = options?.apiSecret;
   const sessionStore = apiSecret ? new DashboardSessionStore({ secret: apiSecret, ttlMs: SESSION_TTL_MS }) : void 0;
   const app = new Hono8();
+  app.onError((err, c) => {
+    if (err instanceof HTTPException2) return err.getResponse();
+    console.error("[helio] Unhandled dashboard API error:", err);
+    return c.json({ error: "Internal server error" }, 500);
+  });
   app.use(
     "*",
     cors({
@@ -7519,7 +7575,7 @@ function createDashboardAppWithLifecycle(deps, options) {
           const url = new URL(origin);
           const h = url.hostname;
           if (h === "localhost" || h === "127.0.0.1" || h === "0.0.0.0") return origin;
-          if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(h)) return origin;
+          if (isPrivateIpv4(h)) return origin;
         } catch {
         }
         return null;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@gethelio/proxy",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "description": "Open-source MCP governance proxy for AI agents",
   "license": "Apache-2.0",