npm - @gethelio/proxy - Versions diffs - 0.7.0 → 0.9.0 - Mend

@gethelio/proxy 0.7.0 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/cli.js +182 -19
package/dist/dashboard-assets/assets/{index-DgywE2WQ.js → index-0ylAcvX3.js} +11 -11
package/dist/dashboard-assets/index.html +1 -1
package/dist/index.d.ts +62 -4
package/dist/index.js +163 -12
package/package.json +1 -1

package/dist/dashboard-assets/index.html CHANGED Viewed

@@ -6,7 +6,7 @@
     <meta name="referrer" content="no-referrer" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <title>Helio Dashboard</title>
-    <script type="module" crossorigin src="/assets/index-DgywE2WQ.js"></script>
+    <script type="module" crossorigin src="/assets/index-0ylAcvX3.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DZKoV0Vx.css">
   </head>
   <body>

package/dist/index.d.ts CHANGED Viewed

@@ -921,7 +921,7 @@ interface AuditQueryFilters {
 }
 /** Pagination options for list queries. */
 interface AuditPaginationOptions {
-    /** Maximum number of records to return (default: 50, max: 1000). */
+    /** Maximum number of records to return (default: 50, max: 1,000 — `LIST_MAX_PAGE_SIZE`). */
     readonly limit?: number;
     /** Number of records to skip (default: 0). */
     readonly offset?: number;
@@ -946,7 +946,7 @@ interface AuditTimeBucket {
 interface AuditAggregateStats {
     /** Total number of records in the time range. */
     readonly total: number;
-    /** Total records that resolved without a block (`block_reason IS NULL`). */
+    /** Total records that resolved without a block (`block_reason IS NULL`), excluding drift events. */
     readonly allowed_total: number;
     /** Total records that resolved with a block (`block_reason IS NOT NULL`). */
     readonly blocked_total: number;
@@ -986,6 +986,17 @@ interface AuditStoreOptions {
     readonly cleanupIntervalMs?: number;
 }
+/**
+ * Maximum records a single bulk export may return. Shared by the dashboard
+ * export route schema and the CLI export command so the advertised cap and
+ * the store's actual cap cannot diverge.
+ */
+declare const EXPORT_MAX_RECORDS = 10000;
+/**
+ * Maximum page size for paginated `list()` reads. Shared with the dashboard
+ * audit route schema for the same reason as {@link EXPORT_MAX_RECORDS}.
+ */
+declare const LIST_MAX_PAGE_SIZE = 1000;
 /**
  * SQLite-backed audit record store.
  *
@@ -1032,8 +1043,16 @@ declare class AuditStore {
     insertBatch(records: ReadonlyArray<Omit<AuditRecord, 'id' | 'created_at'>>, onError?: (record: Omit<AuditRecord, 'id' | 'created_at'>, err: unknown) => void, ids?: ReadonlyArray<string>, onPersist?: (record: Omit<AuditRecord, 'id' | 'created_at'>, id: string) => void): number;
     /** Get a single record by ID, or undefined if not found. */
     get(id: string): AuditRecord | undefined;
-    /** Query records with filters and pagination. */
+    /** Query records with filters and pagination. Capped at 1,000 per page. */
     list(filters?: AuditQueryFilters, pagination?: AuditPaginationOptions): AuditListResult;
+    /**
+     * Query records for bulk export. Unlike `list()`, which enforces the
+     * dashboard's 1,000-row page cap, this path allows up to
+     * {@link EXPORT_MAX_RECORDS} in a single call. Always oldest-first
+     * (ascending `created_at`), so a capped export keeps the earliest records.
+     */
+    listForExport(filters?: AuditQueryFilters, limit?: number): AuditListResult;
+    private query;
     /** Count records matching the given filters. */
     count(filters?: AuditQueryFilters): number;
     /** Get aggregate statistics for a time range. */
@@ -1962,6 +1981,17 @@ interface ServiceResult {
     readonly status: number;
     readonly body: Record<string, unknown>;
 }
+/**
+ * Per-origin adapter liveness, wire-ready for the dashboard's
+ * `GET /api/adapters` (issue #126). ISO-8601 timestamps; `adapter_version`
+ * stays null until an /evaluate supplies one.
+ */
+interface AdapterLivenessEntry {
+    readonly origin: string;
+    readonly adapter_version: string | null;
+    readonly first_seen: string;
+    readonly last_seen: string;
+}
 interface GovernanceServiceOptions {
     readonly policy: CompiledPolicy;
     readonly environment?: string;
@@ -2001,6 +2031,13 @@ declare class GovernanceService {
     private readonly maxSenderKeys;
     /** Distinct sender_id limit keys with live state (reservation registry, issue #13). */
     private readonly senderKeys;
+    /**
+     * Per-origin adapter liveness (issue #126). New origins are inserted ONLY on
+     * the /evaluate path, which sits behind the MAX_ORIGINS cache gate — every
+     * other path updates existing entries and skips unknown origins, so the
+     * registry shares the origin cap instead of adding a second growth vector.
+     */
+    private readonly adapters;
     private readonly pending;
     private readonly tombstones;
     private readonly caches;
@@ -2031,6 +2068,19 @@ declare class GovernanceService {
     installScan(req: InstallScanInput): ServiceResult;
     /** First-match-wins evaluation of the compiled install policy (issue #13). */
     private evaluateInstall;
+    /** Wire-ready liveness entries, most recently seen first. */
+    listAdapters(): AdapterLivenessEntry[];
+    /** Insert-or-refresh on the /evaluate path (the only insert site). */
+    private recordAdapterSeen;
+    /** Refresh-only for paths without an origin budget gate (install-scan, audit). */
+    private touchAdapter;
+    /**
+     * Log a version sighting/change, capped per origin per boot. Both origin and
+     * version are caller-controlled free text, so both are JSON-escaped — a
+     * newline or control character must not be able to forge extra log lines
+     * (the route's origin regex does not protect direct embedders).
+     */
+    private logVersionEvent;
     resolveApproval(ticketId: string, req: ResolveApprovalInput): ServiceResult;
     sweep(): void;
     /**
@@ -2338,6 +2388,14 @@ interface DashboardAppDeps {
     readonly spendLimiter: SpendLimiter;
     readonly evidenceStore: EvidenceStore;
     readonly eventBus: DashboardEventBus;
+    /**
+     * Adapter liveness source for `GET /api/adapters` (issue #126) — a narrow
+     * view of the SDK sideband's GovernanceService. Absent when the SDK
+     * sideband is disabled; the endpoint then serves an empty list.
+     */
+    readonly adapterLiveness?: {
+        listAdapters(): AdapterLivenessEntry[];
+    };
 }
 /** Options for the dashboard API. */
 interface DashboardAppOptions {
@@ -2356,4 +2414,4 @@ interface DashboardAppOptions {
  */
 declare function createDashboardApp(deps: DashboardAppDeps, options?: DashboardAppOptions): Hono;
-export { type ApprovalAppOptions, type ApprovalChannel, type ApprovalOutcome, ApprovalQueue, type ApprovalQueueOptions, ApprovalRouter, type ApprovalRouterOptions, type ApprovalStatus, type ApprovalTicket, type AuditAggregateStats, type AuditInput, type AuditListResult, type AuditPaginationOptions, type AuditQueryFilters, type AuditRecord, AuditStore, type AuditStoreOptions, type AuditTimeBucket, AuditWriter, type AuditWriterOptions, type CompilePoliciesResult, type CompiledPolicy, type CompiledPolicyRule, ConfigError, type CreateAppOptions, type DashboardAppDeps, type DashboardAppOptions, DashboardEventBus, type DashboardEventType, type DashboardEvents, type EvaluateInput, type EvidenceEntry, EvidenceStore, type EvidenceStoreOptions, GovernanceConfigError, GovernanceService, type GovernanceServiceOptions, GovernedForwarder, type GovernedForwarderOptions, type HelioConfig, type InstallScanInput, type MatchContext, type PolicyDecision, PolicyParseError, QueueChannel, type RateLimitCheckParams, type RateLimitKeyState, type RateLimitResult, RateLimiter, type RateLimiterOptions, type ResolveApprovalInput, type ServerHandle, type SessionState, type SlackActionAppOptions, SlackChannel, type SlackChannelOptions, type SpendLimitCheckParams, type SpendLimitKeyState, type SpendLimitResult, SpendLimiter, type SpendLimiterOptions, SseUpstreamForwarder, type SseUpstreamForwarderOptions, StdioForwarder, type StdioForwarderOptions, StreamableHttpForwarder, type StreamableHttpForwarderOptions, UpstreamForwarder, type UpstreamForwarderOptions, VERSION, WebhookChannel, type WebhookChannelOptions, type WireDecision, compilePolicies, createApp, createApprovalApp, createChannels, createDashboardApp, createSidebandApp, createSlackActionApp, evaluatePolicy, loadConfig, matchRule, startServer, startSidebandServer };
+export { type AdapterLivenessEntry, type ApprovalAppOptions, type ApprovalChannel, type ApprovalOutcome, ApprovalQueue, type ApprovalQueueOptions, ApprovalRouter, type ApprovalRouterOptions, type ApprovalStatus, type ApprovalTicket, type AuditAggregateStats, type AuditInput, type AuditListResult, type AuditPaginationOptions, type AuditQueryFilters, type AuditRecord, AuditStore, type AuditStoreOptions, type AuditTimeBucket, AuditWriter, type AuditWriterOptions, type CompilePoliciesResult, type CompiledPolicy, type CompiledPolicyRule, ConfigError, type CreateAppOptions, type DashboardAppDeps, type DashboardAppOptions, DashboardEventBus, type DashboardEventType, type DashboardEvents, EXPORT_MAX_RECORDS, type EvaluateInput, type EvidenceEntry, EvidenceStore, type EvidenceStoreOptions, GovernanceConfigError, GovernanceService, type GovernanceServiceOptions, GovernedForwarder, type GovernedForwarderOptions, type HelioConfig, type InstallScanInput, LIST_MAX_PAGE_SIZE, type MatchContext, type PolicyDecision, PolicyParseError, QueueChannel, type RateLimitCheckParams, type RateLimitKeyState, type RateLimitResult, RateLimiter, type RateLimiterOptions, type ResolveApprovalInput, type ServerHandle, type SessionState, type SlackActionAppOptions, SlackChannel, type SlackChannelOptions, type SpendLimitCheckParams, type SpendLimitKeyState, type SpendLimitResult, SpendLimiter, type SpendLimiterOptions, SseUpstreamForwarder, type SseUpstreamForwarderOptions, StdioForwarder, type StdioForwarderOptions, StreamableHttpForwarder, type StreamableHttpForwarderOptions, UpstreamForwarder, type UpstreamForwarderOptions, VERSION, WebhookChannel, type WebhookChannelOptions, type WireDecision, compilePolicies, createApp, createApprovalApp, createChannels, createDashboardApp, createSidebandApp, createSlackActionApp, evaluatePolicy, loadConfig, matchRule, startServer, startSidebandServer };

package/dist/index.js CHANGED Viewed

@@ -3141,6 +3141,7 @@ var GovernedForwarder = class {
     let result;
     let approvalOutcome;
     let approvalWaitMs = 0;
+    let approvalContext;
     let rateLimitResult;
     let spendLimitResult;
     let forwardingError;
@@ -3170,6 +3171,7 @@ var GovernedForwarder = class {
           result = approvalResult.result;
           approvalOutcome = approvalResult.outcome;
           approvalWaitMs = approvalResult.approvalWaitMs;
+          approvalContext = approvalResult.approvalContext;
         }
       } else if (decision.action === "rate_limit") {
         if (!this.rateLimiter) {
@@ -3222,6 +3224,7 @@ var GovernedForwarder = class {
       dependencyResult,
       evidenceBlocked,
       approvalOutcome,
+      approvalContext,
       rateLimitResult,
       spendLimitResult,
       isDryRun,
@@ -3243,6 +3246,16 @@ var GovernedForwarder = class {
       request.signal
     );
     const approvalWaitMs = performance.now() - approvalStart;
+    const ticket = outcome.ticketId ? router.getTicket(outcome.ticketId) : void 0;
+    const denialReason = outcome.status === "denied" && outcome.reason ? outcome.reason : void 0;
+    const approvalContext = outcome.ticketId && (denialReason || ticket?.escalated_at) ? {
+      ticket_id: outcome.ticketId,
+      ...denialReason ? { denial_reason: denialReason } : {},
+      ...ticket?.escalated_at ? {
+        escalated_at: ticket.escalated_at,
+        escalated_to: [...ticket.escalated_to ?? []]
+      } : {}
+    } : void 0;
     let result;
     if (outcome.status === "approved" || outcome.status === "break_glass") {
       if (request.signal?.aborted) {
@@ -3271,7 +3284,7 @@ var GovernedForwarder = class {
         result = makeErrorResult(request, POLICY_DENIED, message, { ...feedback });
       }
     }
-    return { result, outcome, approvalWaitMs };
+    return { result, outcome, approvalWaitMs, approvalContext };
   }
   async handleRateLimit(request, decision, toolName) {
     const limiter = this.rateLimiter;
@@ -3451,7 +3464,7 @@ var GovernedForwarder = class {
   wasForwardedUpstream(decision, approvalOutcome, rateLimitResult, spendLimitResult) {
     return decision.action === "allow" || approvalOutcome?.status === "approved" || approvalOutcome?.status === "break_glass" || approvalOutcome?.status === "timeout" && this.approvalRouter?.defaultOnTimeout === "allow" || rateLimitResult?.allowed === true || spendLimitResult?.allowed === true;
   }
-  writeAuditRecord(request, timestamp, toolName, toolArguments, decision, result, totalDurationMs, approvalWaitMs, flaggedDestructive, evidenceResult, dependencyResult, evidenceBlocked, approvalOutcome, rateLimitResult, spendLimitResult, isDryRun, forwardingError, drift) {
+  writeAuditRecord(request, timestamp, toolName, toolArguments, decision, result, totalDurationMs, approvalWaitMs, flaggedDestructive, evidenceResult, dependencyResult, evidenceBlocked, approvalOutcome, approvalContext, rateLimitResult, spendLimitResult, isDryRun, forwardingError, drift) {
     if (!this.auditWriter) return;
     const wasForwarded = this.wasForwardedUpstream(
       decision,
@@ -3486,6 +3499,12 @@ var GovernedForwarder = class {
         }
       };
     }
+    if (approvalContext) {
+      evidenceChain = {
+        ...evidenceChain ?? {},
+        approval: { ...approvalContext }
+      };
+    }
     if (rateLimitResult) {
       evidenceChain = {
         ...evidenceChain ?? {},
@@ -4536,6 +4555,7 @@ var EvidenceStore = class _EvidenceStore {
 // src/evidence/api.ts
 import { Hono as Hono5 } from "hono";
 import { bodyLimit } from "hono/body-limit";
+import { HTTPException } from "hono/http-exception";
 import { z as z5 } from "zod";
 // src/auth/bearer.ts
@@ -4736,6 +4756,11 @@ function createSidebandApp(store, options = {}) {
   const app = new Hono5();
   const sdkToken = options.token && options.token.length > 0 ? options.token : void 0;
   const adapterToken = options.adapterToken && options.adapterToken.length > 0 ? options.adapterToken : void 0;
+  app.onError((err, c) => {
+    if (err instanceof HTTPException) return err.getResponse();
+    console.error("[helio] Unhandled sideband API error:", err);
+    return c.json({ error: "Internal server error" }, 500);
+  });
   app.use("*", async (c, next) => {
     const origin = c.req.header("origin");
     if (origin) {
@@ -4848,6 +4873,7 @@ var MAX_PENDING_BYTES = 64 * 1024 * 1024;
 var MAX_SENDER_KEYS = 5e4;
 var MAX_EVIDENCE_ENTRIES = 16;
 var MAX_EVIDENCE_BYTES = 64 * 1024;
+var MAX_VERSION_LOG_LINES_PER_ORIGIN = 5;
 var SWEEP_INTERVAL_MS2 = 3e4;
 var GovernanceService = class {
   policy;
@@ -4865,6 +4891,13 @@ var GovernanceService = class {
   maxSenderKeys;
   /** Distinct sender_id limit keys with live state (reservation registry, issue #13). */
   senderKeys = /* @__PURE__ */ new Set();
+  /**
+   * Per-origin adapter liveness (issue #126). New origins are inserted ONLY on
+   * the /evaluate path, which sits behind the MAX_ORIGINS cache gate — every
+   * other path updates existing entries and skips unknown origins, so the
+   * registry shares the origin cap instead of adding a second growth vector.
+   */
+  adapters = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   tombstones = /* @__PURE__ */ new Map();
   caches = /* @__PURE__ */ new Map();
@@ -4922,6 +4955,7 @@ var GovernanceService = class {
       return { status: 503, body: { error: "evaluation_backlog_full" } };
     }
     const cache = this.cacheFor(req.origin);
+    this.recordAdapterSeen(req.origin, req.adapter_version);
     const toolName = req.tool.name;
     const hasDefinition = definitionProvided(req.tool);
     if (hasDefinition) {
@@ -5113,6 +5147,7 @@ var GovernanceService = class {
     }
     let approvalStatus = null;
     let approvedBy = null;
+    let approvalContext;
     if (entry.approvalTicketId) {
       const ticket = this.getTicketStatus(entry.approvalTicketId);
       const status = ticket?.status;
@@ -5121,6 +5156,16 @@ var GovernanceService = class {
       }
       approvalStatus = status;
       approvedBy = ticket.resolved_by ?? null;
+      if (ticket.denial_reason || ticket.escalated_at) {
+        approvalContext = {
+          ticket_id: entry.approvalTicketId,
+          ...ticket.denial_reason ? { denial_reason: ticket.denial_reason } : {},
+          ...ticket.escalated_at ? {
+            escalated_at: ticket.escalated_at,
+            escalated_to: [...ticket.escalated_to ?? []]
+          } : {}
+        };
+      }
     }
     if (req.actual_amount !== void 0) {
       if (!Number.isFinite(req.actual_amount) || req.actual_amount < 0) {
@@ -5157,6 +5202,7 @@ var GovernanceService = class {
       limitsChain,
       approvalStatus,
       approvedBy,
+      approvalContext,
       upstreamError: req.status === "error" ? req.error ?? "tool call failed" : null,
       upstreamResponse: req.result ?? null,
       upstreamLatencyMs: req.duration_ms ?? null
@@ -5168,6 +5214,7 @@ var GovernanceService = class {
       finalizedBy: "audit",
       expiresAtMs: this.now() + this.ttlMs
     });
+    this.touchAdapter(entry.origin);
     const body = { ok: true, audit_record_id: auditId };
     if (evidenceOutcomes) body["evidence"] = evidenceOutcomes;
     return { status: 201, body };
@@ -5233,6 +5280,7 @@ var GovernanceService = class {
     if (reserved) {
       return { status: 400, body: { error: "reserved_metadata_key", key: reserved } };
     }
+    this.touchAdapter(req.origin);
     const evaluationId = randomUUID2();
     const toolName = `install:${req.package.source ?? "pkg"}:${req.package.name}`;
     const verdict = this.evaluateInstall(req);
@@ -5297,6 +5345,65 @@ var GovernanceService = class {
     };
   }
   // -------------------------------------------------------------------------
+  // Adapter liveness registry (issue #126)
+  // -------------------------------------------------------------------------
+  /** Wire-ready liveness entries, most recently seen first. */
+  listAdapters() {
+    return [...this.adapters.entries()].sort(([oa, a], [ob, b]) => b.lastSeenMs - a.lastSeenMs || oa.localeCompare(ob)).map(([origin, state]) => ({
+      origin,
+      adapter_version: state.adapterVersion,
+      first_seen: new Date(state.firstSeenMs).toISOString(),
+      last_seen: new Date(state.lastSeenMs).toISOString()
+    }));
+  }
+  /** Insert-or-refresh on the /evaluate path (the only insert site). */
+  recordAdapterSeen(origin, version) {
+    const normalized = version && version.length <= 64 ? version : void 0;
+    const now = this.now();
+    const existing = this.adapters.get(origin);
+    if (!existing) {
+      const state = {
+        adapterVersion: normalized ?? null,
+        firstSeenMs: now,
+        lastSeenMs: now,
+        versionLogCount: 0
+      };
+      this.adapters.set(origin, state);
+      if (normalized !== void 0) this.logVersionEvent(origin, state, null, normalized);
+      return;
+    }
+    existing.lastSeenMs = Math.max(existing.lastSeenMs, now);
+    if (normalized !== void 0 && normalized !== existing.adapterVersion) {
+      this.logVersionEvent(origin, existing, existing.adapterVersion, normalized);
+      existing.adapterVersion = normalized;
+    }
+  }
+  /** Refresh-only for paths without an origin budget gate (install-scan, audit). */
+  touchAdapter(origin) {
+    const existing = this.adapters.get(origin);
+    if (!existing) return;
+    existing.lastSeenMs = Math.max(existing.lastSeenMs, this.now());
+  }
+  /**
+   * Log a version sighting/change, capped per origin per boot. Both origin and
+   * version are caller-controlled free text, so both are JSON-escaped — a
+   * newline or control character must not be able to forge extra log lines
+   * (the route's origin regex does not protect direct embedders).
+   */
+  logVersionEvent(origin, state, from, to) {
+    if (state.versionLogCount > MAX_VERSION_LOG_LINES_PER_ORIGIN) return;
+    state.versionLogCount += 1;
+    if (state.versionLogCount > MAX_VERSION_LOG_LINES_PER_ORIGIN) {
+      console.error(
+        `[helio] adapter origin ${JSON.stringify(origin)}: suppressing further version logs after ${String(MAX_VERSION_LOG_LINES_PER_ORIGIN)}`
+      );
+      return;
+    }
+    console.error(
+      from === null ? `[helio] adapter origin ${JSON.stringify(origin)} reports version ${JSON.stringify(to)}` : `[helio] adapter origin ${JSON.stringify(origin)} version changed ${JSON.stringify(from)} -> ${JSON.stringify(to)}`
+    );
+  }
+  // -------------------------------------------------------------------------
   // POST /approval/:id/resolve
   // -------------------------------------------------------------------------
   resolveApproval(ticketId, req) {
@@ -5398,6 +5505,7 @@ var GovernanceService = class {
     this.tombstones.clear();
     this.caches.clear();
     this.senderKeys.clear();
+    this.adapters.clear();
     this.pendingBytes = 0;
   }
   // -------------------------------------------------------------------------
@@ -5562,6 +5670,9 @@ var GovernanceService = class {
     if (args.sidebandUnreported) {
       evidenceChain = { ...evidenceChain ?? {}, sideband: { unreported: true } };
     }
+    if (args.approvalContext) {
+      evidenceChain = { ...evidenceChain ?? {}, approval: { ...args.approvalContext } };
+    }
     const record = {
       timestamp: args.timestampIso,
       session_id: args.sessionId,
@@ -5748,6 +5859,8 @@ function clampInt(value, fallback, min, max) {
 // src/audit/store.ts
 var DRIFT_EVENT_DECISIONS_SQL = "('tool_drift', 'tool_drift_reverted')";
+var EXPORT_MAX_RECORDS = 1e4;
+var LIST_MAX_PAGE_SIZE = 1e3;
 var CREATE_TABLE_DDL = `
 CREATE TABLE IF NOT EXISTS audit_records (
   id                TEXT PRIMARY KEY,
@@ -6051,15 +6164,28 @@ var AuditStore = class {
     const row = this.db.prepare("SELECT * FROM audit_records WHERE id = ?").get(id);
     return row ? deserializeRow(row) : void 0;
   }
-  /** Query records with filters and pagination. */
+  /** Query records with filters and pagination. Capped at 1,000 per page. */
   list(filters = {}, pagination = {}) {
-    const { clause, params } = buildWhereClause(filters);
-    const limit = clamp(pagination.limit ?? 50, 1, 1e3);
+    const limit = clamp(pagination.limit ?? 50, 1, LIST_MAX_PAGE_SIZE);
     const offset = Math.max(pagination.offset ?? 0, 0);
     const order = pagination.order === "asc" ? "ASC" : "DESC";
+    return this.query(filters, limit, offset, order);
+  }
+  /**
+   * Query records for bulk export. Unlike `list()`, which enforces the
+   * dashboard's 1,000-row page cap, this path allows up to
+   * {@link EXPORT_MAX_RECORDS} in a single call. Always oldest-first
+   * (ascending `created_at`), so a capped export keeps the earliest records.
+   */
+  listForExport(filters = {}, limit) {
+    const clamped = clamp(limit ?? EXPORT_MAX_RECORDS, 1, EXPORT_MAX_RECORDS);
+    return this.query(filters, clamped, 0, "ASC");
+  }
+  query(filters, limit, offset, order) {
+    const { clause, params } = buildWhereClause(filters);
     const { total } = this.db.prepare(`SELECT COUNT(*) as total FROM audit_records ${clause}`).get(...params);
     const rows = this.db.prepare(
-      `SELECT * FROM audit_records ${clause} ORDER BY created_at ${order} LIMIT ? OFFSET ?`
+      `SELECT * FROM audit_records ${clause} ORDER BY created_at ${order}, rowid ${order} LIMIT ? OFFSET ?`
     ).all(...params, limit, offset);
     return {
       records: rows.map(deserializeRow),
@@ -7231,6 +7357,7 @@ import { readFileSync } from "fs";
 import { join } from "path";
 import { randomUUID as randomUUID6 } from "crypto";
 import { Hono as Hono8 } from "hono";
+import { HTTPException as HTTPException2 } from "hono/http-exception";
 import { z as z8 } from "zod";
 import { cors } from "hono/cors";
 import { serveStatic } from "@hono/node-server/serve-static";
@@ -7261,7 +7388,10 @@ var CSV_HEADERS = [
   "dry_run",
   "created_at",
   "environment",
-  "matched_rule_index"
+  "matched_rule_index",
+  "record_kind",
+  "origin",
+  "metadata"
 ];
 var FORMULA_PREFIXES = /^[=+\-@\t\r]/;
 function csvEscape(value) {
@@ -7407,7 +7537,7 @@ var feedQuerySchema = z8.object({
 });
 var auditExportQuerySchema = z8.object({
   format: z8.preprocess((value) => value === "csv" ? "csv" : "json", z8.enum(["json", "csv"])),
-  limit: clampedQueryInt(1e4, 1, 1e4),
+  limit: clampedQueryInt(EXPORT_MAX_RECORDS, 1, EXPORT_MAX_RECORDS),
   tool: optionalQueryString,
   decision: optionalQueryString,
   reason: optionalQueryString,
@@ -7425,7 +7555,7 @@ var auditExportQuerySchema = z8.object({
   sender_id: optionalQueryString
 });
 var auditQuerySchema = z8.object({
-  limit: clampedQueryInt(50, 1, 1e3),
+  limit: clampedQueryInt(50, 1, LIST_MAX_PAGE_SIZE),
   offset: clampedQueryInt(0, 0, Number.MAX_SAFE_INTEGER),
   tool: optionalQueryString,
   decision: optionalQueryString,
@@ -7497,6 +7627,16 @@ function shouldSetSecureCookie(url, xForwardedProto) {
   if (xForwardedProto?.toLowerCase() === "https") return true;
   return new URL(url).protocol === "https:";
 }
+function isPrivateIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!match) return false;
+  const a = Number(match[1]);
+  const b = Number(match[2]);
+  const c = Number(match[3]);
+  const d = Number(match[4]);
+  if (a > 255 || b > 255 || c > 255 || d > 255) return false;
+  return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
 function createDashboardAppWithLifecycle(deps, options) {
   const {
     auditStore,
@@ -7505,11 +7645,17 @@ function createDashboardAppWithLifecycle(deps, options) {
     rateLimiter,
     spendLimiter,
     evidenceStore,
-    eventBus
+    eventBus,
+    adapterLiveness
   } = deps;
   const apiSecret = options?.apiSecret;
   const sessionStore = apiSecret ? new DashboardSessionStore({ secret: apiSecret, ttlMs: SESSION_TTL_MS }) : void 0;
   const app = new Hono8();
+  app.onError((err, c) => {
+    if (err instanceof HTTPException2) return err.getResponse();
+    console.error("[helio] Unhandled dashboard API error:", err);
+    return c.json({ error: "Internal server error" }, 500);
+  });
   app.use(
     "*",
     cors({
@@ -7519,7 +7665,7 @@ function createDashboardAppWithLifecycle(deps, options) {
           const url = new URL(origin);
           const h = url.hostname;
           if (h === "localhost" || h === "127.0.0.1" || h === "0.0.0.0") return origin;
-          if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(h)) return origin;
+          if (isPrivateIpv4(h)) return origin;
         } catch {
         }
         return null;
@@ -7655,7 +7801,7 @@ function createDashboardAppWithLifecycle(deps, options) {
       channel_id: query.channel_id,
       sender_id: query.sender_id
     };
-    const result = auditStore.list(filters, { limit, order: "asc" });
+    const result = auditStore.listForExport(filters, limit);
     if (format === "csv") {
       const csv = recordsToCsv(result.records);
       return new Response(csv, {
@@ -7719,6 +7865,9 @@ function createDashboardAppWithLifecycle(deps, options) {
       spend_limits: spendLimiter.listKeyStates()
     });
   });
+  app.get("/api/adapters", (c) => {
+    return c.json({ adapters: adapterLiveness?.listAdapters() ?? [] });
+  });
   app.get("/api/analytics", (c) => {
     const query = analyticsQuerySchema.parse(c.req.query());
     const now = /* @__PURE__ */ new Date();
@@ -7889,10 +8038,12 @@ export {
   AuditWriter,
   ConfigError,
   DashboardEventBus,
+  EXPORT_MAX_RECORDS,
   EvidenceStore,
   GovernanceConfigError,
   GovernanceService,
   GovernedForwarder,
+  LIST_MAX_PAGE_SIZE,
   PolicyParseError,
   QueueChannel,
   RateLimiter,

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@gethelio/proxy",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "Open-source MCP governance proxy for AI agents",
   "license": "Apache-2.0",