@i4ctime/q-ring 0.13.0 → 0.14.0

package/dist/{chunk-CWV3WTPF.js → chunk-NNIEXAW5.js}

@@ -177,7 +177,7 @@ function recordAccess(envelope) {
 
 // src/core/collapse.ts
 import { execSync } from "child_process";
-import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync2, statSync } from "fs";
 import { join as join2 } from "path";
 var BRANCH_ENV_MAP = {
   main: "prod",
@@ -191,28 +191,49 @@ var BRANCH_ENV_MAP = {
   test: "test",
   testing: "test"
 };
+var BRANCH_CACHE_TTL_MS = 2e3;
+var branchCache = null;
 function detectGitBranch(cwd) {
+  const dir = cwd ?? process.cwd();
+  const now = Date.now();
+  if (branchCache && branchCache.cwd === dir && now - branchCache.at < BRANCH_CACHE_TTL_MS) {
+    return branchCache.branch;
+  }
+  let branch = null;
   try {
-    const branch = execSync("git rev-parse --abbrev-ref HEAD", {
-      cwd: cwd ?? process.cwd(),
+    const out = execSync("git rev-parse --abbrev-ref HEAD", {
+      cwd: dir,
       stdio: ["pipe", "pipe", "pipe"],
       encoding: "utf8",
       timeout: 3e3
     }).trim();
-    return branch || null;
+    branch = out || null;
   } catch {
-    return null;
   }
+  branchCache = { cwd: dir, at: now, branch };
+  return branch;
 }
+var configCache = null;
 function readProjectConfig(projectPath) {
   const configPath = join2(projectPath ?? process.cwd(), ".q-ring.json");
+  let mtimeMs = 0;
   try {
-    if (existsSync(configPath)) {
-      return JSON.parse(readFileSync2(configPath, "utf8"));
-    }
+    mtimeMs = statSync(configPath).mtimeMs;
   } catch {
   }
-  return null;
+  if (configCache && configCache.path === configPath && configCache.mtimeMs === mtimeMs) {
+    return configCache.config;
+  }
+  let config = null;
+  if (mtimeMs > 0) {
+    try {
+      config = JSON.parse(readFileSync2(configPath, "utf8"));
+    } catch {
+      config = null;
+    }
+  }
+  configCache = { path: configPath, mtimeMs, config };
+  return config;
 }
 function collapseEnvironment(ctx = {}) {
   if (ctx.explicit) {
@@ -266,38 +287,137 @@ function mapEnvName(raw) {
 
 // src/core/observer.ts
 import {
-  existsSync as existsSync2,
-  mkdirSync,
+  existsSync,
+  mkdirSync as mkdirSync2,
   appendFileSync,
-  readFileSync as readFileSync3,
+  chmodSync,
+  readFileSync as readFileSync4,
   openSync,
   fstatSync,
   readSync,
   closeSync,
-  statSync
+  statSync as statSync3
+} from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir2 } from "os";
+import { createHash, createHmac, randomBytes } from "crypto";
+import { Entry } from "@napi-rs/keyring";
+
+// src/utils/file-lock.ts
+import {
+  mkdirSync,
+  writeFileSync,
+  unlinkSync,
+  readFileSync as readFileSync3,
+  statSync as statSync2
 } from "fs";
 import { join as join3 } from "path";
 import { homedir } from "os";
-import { createHash } from "crypto";
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function withFileLock(name, fn, opts = {}) {
+  const lockDir = join3(homedir(), ".config", "q-ring", opts.dir ?? "locks");
+  mkdirSync(lockDir, { recursive: true, mode: 448 });
+  const safe = Buffer.from(name, "utf8").toString("base64url");
+  const lockPath = join3(lockDir, `${safe}.lock`);
+  const deadline = Date.now() + (opts.timeoutMs ?? 8e3);
+  const staleMs = opts.staleMs ?? 3e4;
+  while (Date.now() < deadline) {
+    try {
+      writeFileSync(lockPath, `${process.pid}
+`, { flag: "wx", mode: 384 });
+      try {
+        return fn();
+      } finally {
+        try {
+          unlinkSync(lockPath);
+        } catch {
+        }
+      }
+    } catch {
+      try {
+        const holderPid = parseInt(readFileSync3(lockPath, "utf8").trim(), 10);
+        const ageMs = Date.now() - statSync2(lockPath).mtimeMs;
+        const stale = Number.isInteger(holderPid) && holderPid > 0 && !isProcessAlive(holderPid) || ageMs > staleMs;
+        if (stale) {
+          unlinkSync(lockPath);
+          continue;
+        }
+      } catch {
+      }
+      sleepSync(15);
+    }
+  }
+  throw new Error(`Could not acquire lock "${name}" (timeout)`);
+}
+
+// src/core/observer.ts
+var AUDIT_KEYRING_SERVICE = "qring-audit-chain";
+var AUDIT_KEY_ACCOUNT = "hmac-key";
+var AUDIT_ANCHOR_ACCOUNT = "chain-head";
+var warnedNoKeyring = false;
+function getAuditKey() {
+  try {
+    const entry = new Entry(AUDIT_KEYRING_SERVICE, AUDIT_KEY_ACCOUNT);
+    const stored = entry.getPassword();
+    if (stored) return Buffer.from(stored, "base64");
+    const key = randomBytes(32);
+    entry.setPassword(key.toString("base64"));
+    return key;
+  } catch {
+    if (!warnedNoKeyring) {
+      console.error(
+        "q-ring: WARNING \u2014 OS keyring unavailable; the audit chain has no keyed anchor on this host and is NOT tamper-evident against truncation or full-file rewrite. (In-file SHA-256 chaining still detects edits.)"
+      );
+      warnedNoKeyring = true;
+    }
+    return null;
+  }
+}
+function headAnchor(line, key) {
+  return createHmac("sha256", key).update(line).digest("hex");
+}
+function readStoredAnchor() {
+  try {
+    return new Entry(AUDIT_KEYRING_SERVICE, AUDIT_ANCHOR_ACCOUNT).getPassword() ?? null;
+  } catch {
+    return null;
+  }
+}
+function writeStoredAnchor(hash) {
+  try {
+    new Entry(AUDIT_KEYRING_SERVICE, AUDIT_ANCHOR_ACCOUNT).setPassword(hash);
+  } catch {
+  }
+}
 function getAuditDir() {
   if (process.env.QRING_AUDIT_DIR) {
-    if (!existsSync2(process.env.QRING_AUDIT_DIR)) {
-      mkdirSync(process.env.QRING_AUDIT_DIR, { recursive: true });
+    if (!existsSync(process.env.QRING_AUDIT_DIR)) {
+      mkdirSync2(process.env.QRING_AUDIT_DIR, { recursive: true, mode: 448 });
     }
     return process.env.QRING_AUDIT_DIR;
   }
-  const dir = join3(homedir(), ".config", "q-ring");
-  if (!existsSync2(dir)) {
-    mkdirSync(dir, { recursive: true });
+  const dir = join4(homedir2(), ".config", "q-ring");
+  if (!existsSync(dir)) {
+    mkdirSync2(dir, { recursive: true, mode: 448 });
   }
   return dir;
 }
 function getAuditPath() {
-  return join3(getAuditDir(), "audit.jsonl");
+  return join4(getAuditDir(), "audit.jsonl");
 }
 function getLastLineHash() {
   const path = getAuditPath();
-  if (!existsSync2(path)) return void 0;
+  if (!existsSync(path)) return void 0;
   try {
     const fd = openSync(path, "r");
     const stat = fstatSync(fd);
@@ -319,24 +439,38 @@ function getLastLineHash() {
   }
 }
 function logAudit(event) {
-  const prevHash = getLastLineHash();
-  const full = {
-    ...event,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    pid: process.pid,
-    prevHash
-  };
   try {
-    appendFileSync(getAuditPath(), JSON.stringify(full) + "\n");
+    withFileLock(
+      "audit-chain",
+      () => {
+        const prevHash = getLastLineHash();
+        const full = {
+          ...event,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          pid: process.pid,
+          prevHash
+        };
+        const line = JSON.stringify(full);
+        const path = getAuditPath();
+        appendFileSync(path, line + "\n", { mode: 384 });
+        try {
+          chmodSync(path, 384);
+        } catch {
+        }
+        const key = getAuditKey();
+        if (key) writeStoredAnchor(headAnchor(line, key));
+      },
+      { timeoutMs: 5e3 }
+    );
   } catch {
   }
 }
 var MAX_AUDIT_BYTES = 12 * 1024 * 1024;
 function queryAudit(query = {}) {
   const path = getAuditPath();
-  if (!existsSync2(path)) return [];
+  if (!existsSync(path)) return [];
   try {
-    const st = statSync(path);
+    const st = statSync3(path);
     const readStart = st.size > MAX_AUDIT_BYTES ? st.size - MAX_AUDIT_BYTES : 0;
     const readLen = st.size > MAX_AUDIT_BYTES ? MAX_AUDIT_BYTES : st.size;
     const buf = Buffer.alloc(readLen);
@@ -375,10 +509,10 @@ function queryAudit(query = {}) {
 }
 function verifyAuditChain() {
   const path = getAuditPath();
-  if (!existsSync2(path)) {
+  if (!existsSync(path)) {
     return { totalEvents: 0, validEvents: 0, intact: true };
   }
-  const lines = readFileSync3(path, "utf8").split("\n").filter((l) => l.trim());
+  const lines = readFileSync4(path, "utf8").split("\n").filter((l) => l.trim());
   if (lines.length === 0) {
     return { totalEvents: 0, validEvents: 0, intact: true };
   }
@@ -411,12 +545,26 @@ function verifyAuditChain() {
     }
     validEvents++;
   }
+  const key = getAuditKey();
+  const anchor = key ? readStoredAnchor() : null;
+  if (key && anchor !== null) {
+    const head = headAnchor(lines[lines.length - 1], key);
+    if (head !== anchor) {
+      return {
+        totalEvents: lines.length,
+        validEvents,
+        brokenAt: lines.length - 1,
+        intact: false,
+        reason: "audit head does not match the keyed anchor in the OS keyring \u2014 the log was truncated or rewritten"
+      };
+    }
+  }
   return { totalEvents: lines.length, validEvents, intact: true };
 }
 function exportAudit(opts = {}) {
   const path = getAuditPath();
-  if (!existsSync2(path)) return opts.format === "json" ? "[]" : "";
-  const lines = readFileSync3(path, "utf8").split("\n").filter((l) => l.trim());
+  if (!existsSync(path)) return opts.format === "json" ? "[]" : "";
+  const lines = readFileSync4(path, "utf8").split("\n").filter((l) => l.trim());
   let events = lines.map((l) => {
     try {
       return JSON.parse(l);
@@ -481,48 +629,62 @@ function detectAnomalies(key) {
 }
 
 // src/core/entanglement.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync, mkdirSync as mkdirSync2 } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+
+// src/utils/registry.ts
+import { existsSync as existsSync2, readFileSync as readFileSync5, renameSync } from "fs";
+function loadJsonRegistry(path, empty) {
+  if (!existsSync2(path)) return empty;
+  const raw = readFileSync5(path, "utf8");
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const backup = `${path}.corrupt-${stamp}`;
+    try {
+      renameSync(path, backup);
+    } catch {
+      throw new Error(
+        `q-ring: registry ${path} is corrupt (${reason}) and could not be moved aside \u2014 refusing to continue so a later write cannot overwrite it. Inspect or remove the file manually.`
+      );
+    }
+    console.error(
+      `q-ring: WARNING \u2014 registry ${path} was corrupt (${reason}); moved it to ${backup} and reinitialized from empty. Previous entries are preserved in the backup file.`
+    );
+    return empty;
+  }
+}
+
+// src/core/entanglement.ts
+var REGISTRY_VERSION = 1;
 function getRegistryPath() {
-  const dir = join4(homedir2(), ".config", "q-ring");
+  const dir = join5(homedir3(), ".config", "q-ring");
   if (!existsSync3(dir)) {
-    mkdirSync2(dir, { recursive: true });
+    mkdirSync3(dir, { recursive: true, mode: 448 });
   }
-  return join4(dir, "entanglement.json");
+  return join5(dir, "entanglement.json");
 }
 function loadRegistry() {
-  const path = getRegistryPath();
-  if (!existsSync3(path)) {
-    return { pairs: [] };
-  }
-  try {
-    return JSON.parse(readFileSync4(path, "utf8"));
-  } catch {
-    return { pairs: [] };
-  }
+  return loadJsonRegistry(getRegistryPath(), { pairs: [] });
 }
 function saveRegistry(registry2) {
-  writeFileSync(getRegistryPath(), JSON.stringify(registry2, null, 2), {
+  registry2.version = REGISTRY_VERSION;
+  writeFileSync2(getRegistryPath(), JSON.stringify(registry2, null, 2), {
     mode: 384
   });
 }
-function entangle(source, target) {
+function entangle(source, target, createdBy) {
   const registry2 = loadRegistry();
   const exists = registry2.pairs.some(
     (p) => p.source.service === source.service && p.source.key === source.key && p.target.service === target.service && p.target.key === target.key
   );
   if (!exists) {
-    registry2.pairs.push({
-      source,
-      target,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    registry2.pairs.push({
-      source: target,
-      target: source,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
+    const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+    registry2.pairs.push({ source, target, createdAt, createdBy });
+    registry2.pairs.push({ source: target, target: source, createdAt, createdBy });
     saveRegistry(registry2);
   }
 }
@@ -544,9 +706,9 @@ function listEntanglements() {
 }
 
 // src/core/hooks.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
-import { join as join5 } from "path";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
+import { join as join6 } from "path";
+import { homedir as homedir4 } from "os";
 import { execFile, spawn } from "child_process";
 import { randomUUID } from "crypto";
 
@@ -559,6 +721,7 @@ import { lookup } from "dns/promises";
 import * as dns from "dns";
 import { lookup as dnsLookup } from "dns";
 import { isIPv4, isIPv6 } from "net";
+import ipaddr from "ipaddr.js";
 function lookupAddressesSync(hostname2) {
   const lookupSync2 = dns.lookupSync;
   return lookupSync2(hostname2, { all: true });
@@ -570,21 +733,32 @@ function isHostnameIpLiteral(hostname2) {
   }
   return isIPv6(hostname2);
 }
+var BLOCKED_IPV4_RANGES = /* @__PURE__ */ new Set([
+  "unspecified",
+  "broadcast",
+  "linkLocal",
+  "loopback",
+  "carrierGradeNat",
+  "private"
+]);
 function isPrivateIP(ip) {
-  const octet = "(?:25[0-5]|2[0-4]\\d|1?\\d{1,2})";
-  const ipv4Re = new RegExp(`^::ffff:(${octet}\\.${octet}\\.${octet}\\.${octet})$`, "i");
-  const ipv4Mapped = ip.match(ipv4Re);
-  if (ipv4Mapped) return isPrivateIP(ipv4Mapped[1]);
-  if (/^127\./.test(ip)) return true;
-  if (/^10\./.test(ip)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(ip)) return true;
-  if (/^192\.168\./.test(ip)) return true;
-  if (/^169\.254\./.test(ip)) return true;
-  if (ip === "0.0.0.0") return true;
-  if (ip === "::1" || ip === "::") return true;
-  if (/^f[cd][0-9a-f]{2}:/i.test(ip)) return true;
-  if (/^fe80:/i.test(ip)) return true;
-  return false;
+  let addr;
+  try {
+    addr = ipaddr.parse(ip);
+  } catch {
+    return false;
+  }
+  if (addr.kind() === "ipv6") {
+    const v6 = addr;
+    if (v6.isIPv4MappedAddress()) {
+      return isBlockedIPv4(v6.toIPv4Address());
+    }
+    return v6.range() !== "unicast";
+  }
+  return isBlockedIPv4(addr);
+}
+function isBlockedIPv4(addr) {
+  return BLOCKED_IPV4_RANGES.has(addr.range());
 }
 async function checkSSRF(url) {
   if (process.env.Q_RING_ALLOW_PRIVATE_HOOKS === "1") return null;
@@ -758,25 +932,17 @@ function httpRequest(opts) {
 
 // src/core/hooks.ts
 function getRegistryPath2() {
-  const dir = join5(homedir3(), ".config", "q-ring");
+  const dir = join6(homedir4(), ".config", "q-ring");
   if (!existsSync4(dir)) {
-    mkdirSync3(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true, mode: 448 });
   }
-  return join5(dir, "hooks.json");
+  return join6(dir, "hooks.json");
 }
 function loadRegistry2() {
-  const path = getRegistryPath2();
-  if (!existsSync4(path)) {
-    return { hooks: [] };
-  }
-  try {
-    return JSON.parse(readFileSync5(path, "utf8"));
-  } catch {
-    return { hooks: [] };
-  }
+  return loadJsonRegistry(getRegistryPath2(), { hooks: [] });
 }
 function saveRegistry2(registry2) {
-  writeFileSync2(getRegistryPath2(), JSON.stringify(registry2, null, 2), {
+  writeFileSync3(getRegistryPath2(), JSON.stringify(registry2, null, 2), {
     mode: 384
   });
 }
@@ -1023,19 +1189,19 @@ async function fireHooks(payload, tags) {
 }
 
 // src/core/approval.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5 } from "fs";
+import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
+import { createHmac as createHmac2, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 function getHmacSecret() {
-  const dir = join6(homedir4(), ".config", "q-ring");
-  const secretPath = join6(dir, ".approval-key");
-  if (!existsSync5(dir)) mkdirSync4(dir, { recursive: true, mode: 448 });
+  const dir = join7(homedir5(), ".config", "q-ring");
+  const secretPath = join7(dir, ".approval-key");
+  if (!existsSync5(dir)) mkdirSync5(dir, { recursive: true, mode: 448 });
   if (existsSync5(secretPath)) {
     return readFileSync6(secretPath, "utf8").trim();
   }
-  const secret = randomBytes(32).toString("hex");
-  writeFileSync3(secretPath, secret, { mode: 384 });
+  const secret = randomBytes2(32).toString("hex");
+  writeFileSync4(secretPath, secret, { mode: 384 });
   return secret;
 }
 function computeHmac(entry) {
@@ -1043,6 +1209,7 @@ function computeHmac(entry) {
     entry.id,
     entry.key,
     entry.scope,
+    entry.service ?? "",
     entry.reason,
     entry.grantedBy,
     entry.grantedAt,
@@ -1050,7 +1217,7 @@ function computeHmac(entry) {
     entry.workspace ?? "",
     entry.sessionId ?? ""
   ].join("|");
-  return createHmac("sha256", getHmacSecret()).update(payload).digest("hex");
+  return createHmac2("sha256", getHmacSecret()).update(payload).digest("hex");
 }
 function verifyHmac(entry) {
   const expected = computeHmac(entry);
@@ -1064,27 +1231,19 @@ function verifyHmac(entry) {
   }
 }
 function getRegistryPath3() {
-  const dir = join6(homedir4(), ".config", "q-ring");
+  const dir = join7(homedir5(), ".config", "q-ring");
   if (!existsSync5(dir)) {
-    mkdirSync4(dir, { recursive: true, mode: 448 });
+    mkdirSync5(dir, { recursive: true, mode: 448 });
   }
-  return join6(dir, "approvals.json");
+  return join7(dir, "approvals.json");
 }
 function loadRegistry3() {
-  const path = getRegistryPath3();
-  if (!existsSync5(path)) {
-    return { approvals: [] };
-  }
-  try {
-    return JSON.parse(readFileSync6(path, "utf8"));
-  } catch {
-    return { approvals: [] };
-  }
+  return loadJsonRegistry(getRegistryPath3(), { approvals: [] });
 }
-function hasApproval(key, scope) {
+function hasApproval(key, scope, service) {
   const registry2 = loadRegistry3();
   const entry = registry2.approvals.find(
-    (a) => a.key === key && a.scope === scope
+    (a) => a.key === key && a.scope === scope && a.service === service
   );
   if (!entry) return false;
   if (new Date(entry.expiresAt).getTime() < Date.now()) return false;
@@ -1102,20 +1261,54 @@ function listApprovals() {
 }
 
 // src/core/policy.ts
-import { statSync as statSync2 } from "fs";
-import { join as join7 } from "path";
+import { statSync as statSync4 } from "fs";
+import { join as join8 } from "path";
+import { z as z2 } from "zod";
+var stringArray = z2.array(z2.string());
+var mcpPolicySchema = z2.object({
+  allowTools: stringArray.optional(),
+  denyTools: stringArray.optional(),
+  readableKeys: stringArray.optional(),
+  deniedKeys: stringArray.optional(),
+  deniedTags: stringArray.optional()
+}).strict();
+var execPolicySchema = z2.object({
+  allowCommands: stringArray.optional(),
+  denyCommands: stringArray.optional(),
+  maxRuntimeSeconds: z2.number().optional(),
+  allowNetwork: z2.boolean().optional()
+}).strict();
+var secretsPolicySchema = z2.object({
+  requireApprovalForTags: stringArray.optional(),
+  requireRotationFormatForTags: stringArray.optional(),
+  maxTtlSeconds: z2.number().optional()
+}).strict();
+var policySchema = z2.object({
+  mcp: mcpPolicySchema.optional(),
+  exec: execPolicySchema.optional(),
+  secrets: secretsPolicySchema.optional()
+}).strict();
+var PolicyConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PolicyConfigError";
+  }
+};
 var cachedPolicy = null;
 var policyRoot = null;
 function setPolicyRoot(root) {
   policyRoot = root;
   cachedPolicy = null;
 }
+function getPolicyRoot() {
+  return policyRoot;
+}
 function resolvePolicyPath(projectPath) {
   return policyRoot ?? projectPath ?? process.cwd();
 }
 function configMtime(pp) {
   try {
-    return statSync2(join7(pp, ".q-ring.json")).mtimeMs;
+    return statSync4(join8(pp, ".q-ring.json")).mtimeMs;
   } catch {
     return 0;
   }
@@ -1124,12 +1317,28 @@ function loadPolicy(projectPath) {
   const pp = resolvePolicyPath(projectPath);
   const mtimeMs = configMtime(pp);
   if (cachedPolicy && cachedPolicy.path === pp && cachedPolicy.mtimeMs === mtimeMs) {
+    if (cachedPolicy.error) throw cachedPolicy.error;
     return cachedPolicy.policy;
   }
   const config = readProjectConfig(pp);
-  const policy = config?.policy ?? {};
-  cachedPolicy = { path: pp, mtimeMs, policy };
-  return policy;
+  const rawPolicy = config?.policy;
+  if (rawPolicy === void 0 || rawPolicy === null) {
+    const policy = {};
+    cachedPolicy = { path: pp, mtimeMs, policy };
+    return policy;
+  }
+  const parsed = policySchema.safeParse(rawPolicy);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((i) => `policy${i.path.length ? "." + i.path.join(".") : ""}: ${i.message}`).join("; ");
+    const error = new PolicyConfigError(
+      `Invalid policy in ${join8(pp, ".q-ring.json")} \u2014 refusing to run under an unparseable security policy (fail closed). Fix these and retry: ${issues}`
+    );
+    console.error(`q-ring: ${error.message}`);
+    cachedPolicy = { path: pp, mtimeMs, error };
+    throw error;
+  }
+  cachedPolicy = { path: pp, mtimeMs, policy: parsed.data };
+  return parsed.data;
 }
 function checkToolPolicy(toolName, projectPath) {
   const policy = loadPolicy(projectPath);
@@ -1258,10 +1467,7 @@ function getPolicySummary(projectPath) {
 }
 
 // src/core/keyring.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, unlinkSync } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join8 } from "path";
-import { Entry, findCredentials } from "@napi-rs/keyring";
+import { Entry as Entry2, findCredentials } from "@napi-rs/keyring";
 
 // src/utils/hash.ts
 import { createHash as createHash2 } from "crypto";
@@ -1314,22 +1520,25 @@ function resolveScope(opts) {
   chain.push({ scope: "global", service: globalService() });
   return chain;
 }
+function serviceForScope(scope, opts = {}) {
+  return resolveScope({ ...opts, scope })[0].service;
+}
 
 // src/core/provision.ts
 import { execFileSync, spawnSync } from "child_process";
-import { z as z2 } from "zod";
-var AwsStsConfigSchema = z2.object({
-  roleArn: z2.string(),
-  sessionName: z2.string().optional(),
-  durationSeconds: z2.number().optional()
+import { z as z3 } from "zod";
+var AwsStsConfigSchema = z3.object({
+  roleArn: z3.string(),
+  sessionName: z3.string().optional(),
+  durationSeconds: z3.number().optional()
 });
-var HttpJitConfigSchema = z2.object({
-  url: z2.string(),
-  method: z2.string().optional(),
-  valuePath: z2.string().optional(),
-  expiresInSeconds: z2.number().optional(),
-  headers: z2.record(z2.string(), z2.string()).optional(),
-  body: z2.unknown().optional()
+var HttpJitConfigSchema = z3.object({
+  url: z3.string(),
+  method: z3.string().optional(),
+  valuePath: z3.string().optional(),
+  expiresInSeconds: z3.number().optional(),
+  headers: z3.record(z3.string(), z3.string()).optional(),
+  body: z3.unknown().optional()
 });
 var ProvisionRegistry = class {
   providers = /* @__PURE__ */ new Map();
@@ -1464,40 +1673,17 @@ registry.register(httpProvider);
 
 // src/core/keyring.ts
 function withJitEnvelopeLock(service, key, fn) {
-  const dir = join8(homedir5(), ".config", "q-ring", "jit-locks");
-  mkdirSync5(dir, { recursive: true });
-  const safe = Buffer.from(`${service}\0${key}`, "utf8").toString("base64url");
-  const lockPath = join8(dir, `${safe}.lock`);
-  const deadline = Date.now() + 8e3;
-  while (Date.now() < deadline) {
-    try {
-      writeFileSync4(lockPath, `${process.pid}
-`, { flag: "wx", mode: 384 });
-      try {
-        return fn();
-      } finally {
-        try {
-          unlinkSync(lockPath);
-        } catch {
-        }
-      }
-    } catch {
-      const start = Date.now();
-      while (Date.now() - start < 15) {
-      }
-    }
-  }
-  throw new Error("Could not acquire JIT envelope lock (timeout)");
+  return withFileLock(`${service}\0${key}`, fn, { dir: "jit-locks" });
 }
 function readEnvelope(service, key) {
-  const entry = new Entry(service, key);
+  const entry = new Entry2(service, key);
   const raw = entry.getPassword();
   if (raw === null) return null;
   const envelope = parseEnvelope(raw);
   return envelope ?? wrapLegacy(raw);
 }
 function writeEnvelope(service, key, envelope) {
-  const entry = new Entry(service, key);
+  const entry = new Entry2(service, key);
   entry.setPassword(serializeEnvelope(envelope));
 }
 function resolveEnv(opts) {
@@ -1565,7 +1751,7 @@ function getSecret(key, opts = {}) {
       continue;
     }
     if (envelope.meta.requiresApproval && source === "mcp") {
-      if (!hasApproval(key, scope)) {
+      if (!hasApproval(key, scope, service)) {
         if (!opts.silent) {
           logAudit({
             action: "read",
@@ -1615,8 +1801,8 @@ function getSecret(key, opts = {}) {
     }
     value = resolveTemplates(value, { ...opts, _seen: nextSeen }, nextSeen);
     if (!opts.silent) {
-      const updated = recordAccess(envelope);
-      writeEnvelope(service, key, updated);
+      const latest = readEnvelope(service, key) ?? envelope;
+      writeEnvelope(service, key, recordAccess(latest));
       logAudit({ action: "read", key, scope, env, source });
     }
     return value;
@@ -1702,6 +1888,19 @@ function setSecret(key, value, opts = {}) {
   const entangled = findEntangled({ service, key });
   for (const target of entangled) {
     try {
+      if (source === "mcp") {
+        const decision = checkKeyReadPolicy(target.key, void 0, opts.projectPath);
+        if (!decision.allowed) {
+          logAudit({
+            action: "entangle",
+            key: target.key,
+            scope: "global",
+            source,
+            detail: `blocked propagation from ${key}: ${decision.reason}`
+          });
+          continue;
+        }
+      }
       const targetEnvelope = readEnvelope(target.service, target.key);
       if (targetEnvelope) {
         if (opts.states) {
@@ -1742,7 +1941,7 @@ function deleteSecret(key, opts = {}) {
   }
   let deleted = false;
   for (const { service, scope } of scopes) {
-    const entry = new Entry(service, key);
+    const entry = new Entry2(service, key);
     try {
       if (entry.deleteCredential()) {
         deleted = true;
@@ -1851,7 +2050,7 @@ function exportSecrets(opts = {}) {
     if (entry.envelope) {
       const decay = checkDecay(entry.envelope);
       if (decay.isExpired) continue;
-      if (source === "mcp" && entry.envelope.meta.requiresApproval && !hasApproval(entry.key, entry.scope)) {
+      if (source === "mcp" && entry.envelope.meta.requiresApproval && !hasApproval(entry.key, entry.scope, serviceForScope(entry.scope, opts))) {
         logAudit({
           action: "read",
           key: entry.key,
@@ -1896,7 +2095,10 @@ function entangleSecrets(sourceKey, sourceOpts, targetKey, targetOpts) {
   const targetScopes = resolveScope({ ...targetOpts, scope: targetOpts.scope ?? "global" });
   const source = { service: sourceScopes[0].service, key: sourceKey };
   const target = { service: targetScopes[0].service, key: targetKey };
-  entangle(source, target);
+  entangle(source, target, {
+    source: sourceOpts.source ?? "cli",
+    policyRoot: getPolicyRoot()
+  });
   logAudit({
     action: "entangle",
     key: sourceKey,
@@ -1919,7 +2121,7 @@ function disentangleSecrets(sourceKey, sourceOpts, targetKey, targetOpts) {
 }
 
 // src/core/tunnel.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var tunnelStore = /* @__PURE__ */ new Map();
 var cleanupInterval = null;
 function ensureCleanup() {
@@ -1941,7 +2143,7 @@ function ensureCleanup() {
   }
 }
 function tunnelCreate(value, opts = {}) {
-  const id = `tun_${Date.now().toString(36)}_${randomBytes2(6).toString("base64url")}`;
+  const id = `tun_${Date.now().toString(36)}_${randomBytes3(6).toString("base64url")}`;
   const now = Date.now();
   tunnelStore.set(id, {
     value,
@@ -1991,43 +2193,72 @@ function tunnelList() {
 }
 
 // src/core/memory.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6, chmodSync as chmodSync2 } from "fs";
 import { join as join9 } from "path";
 import { homedir as homedir6, hostname, userInfo } from "os";
-import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes3 } from "crypto";
-import { Entry as Entry2 } from "@napi-rs/keyring";
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash as createHash3,
+  randomBytes as randomBytes4,
+  pbkdf2Sync
+} from "crypto";
+import { Entry as Entry3 } from "@napi-rs/keyring";
 var MEMORY_FILE = "agent-memory.enc";
 var KEYRING_SERVICE = "qring-memory-key";
 var KEYRING_ACCOUNT = "encryption-key";
 function getMemoryDir() {
   const dir = join9(homedir6(), ".config", "q-ring");
   if (!existsSync6(dir)) {
-    mkdirSync6(dir, { recursive: true });
+    mkdirSync6(dir, { recursive: true, mode: 448 });
   }
   return dir;
 }
+function writeMemoryFile(path, data) {
+  writeFileSync5(path, data, { mode: 384 });
+  try {
+    chmodSync2(path, 384);
+  } catch {
+  }
+}
 function getMemoryPath() {
   return join9(getMemoryDir(), MEMORY_FILE);
 }
+var PBKDF2_ITERATIONS = 21e4;
+var KEY_LENGTH = 32;
+var PASSPHRASE_ENV = "QRING_MEMORY_PASSPHRASE";
+var V2_PREFIX = "qmem2";
+var MemoryKeyUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MemoryKeyUnavailableError";
+  }
+};
 function deriveLegacyKey() {
   const fingerprint = `qring-memory:${hostname()}:${userInfo().username}`;
   return createHash3("sha256").update(fingerprint).digest();
 }
-function getOrCreateKey() {
+function passphrase() {
+  const p = process.env[PASSPHRASE_ENV];
+  return p && p.length > 0 ? p : void 0;
+}
+function derivePassphraseKey(salt) {
+  return pbkdf2Sync(passphrase(), salt, PBKDF2_ITERATIONS, KEY_LENGTH, "sha512");
+}
+function keyringKey() {
   try {
-    const entry = new Entry2(KEYRING_SERVICE, KEYRING_ACCOUNT);
+    const entry = new Entry3(KEYRING_SERVICE, KEYRING_ACCOUNT);
     const stored = entry.getPassword();
     if (stored) return Buffer.from(stored, "base64");
-    const key = randomBytes3(32);
+    const key = randomBytes4(KEY_LENGTH);
     entry.setPassword(key.toString("base64"));
     return key;
   } catch {
-    console.warn("[q-ring] OS keyring unavailable for memory key \u2014 falling back to machine-derived key");
-    return deriveLegacyKey();
+    return null;
   }
 }
 function encryptWith(data, key) {
-  const iv = randomBytes3(12);
+  const iv = randomBytes4(12);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
   const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
@@ -2044,18 +2275,44 @@ function decryptWith(blob, key) {
   return decipher.update(encrypted) + decipher.final("utf8");
 }
 function encrypt(data) {
-  return encryptWith(data, getOrCreateKey());
+  const kk = keyringKey();
+  if (kk) return encryptWith(data, kk);
+  if (passphrase()) {
+    const salt = randomBytes4(16);
+    const key = derivePassphraseKey(salt);
+    return `${V2_PREFIX}:${salt.toString("base64")}:${encryptWith(data, key)}`;
+  }
+  throw new MemoryKeyUnavailableError(
+    `Cannot persist agent memory: the OS keyring is unavailable and ${PASSPHRASE_ENV} is not set. Refusing to encrypt with a machine-derivable key (any local process could recompute it and read your memory). Set ${PASSPHRASE_ENV} to a strong passphrase, or run on a host with an OS keyring.`
+  );
 }
 function decrypt(blob) {
-  const key = getOrCreateKey();
-  try {
-    return decryptWith(blob, key);
-  } catch {
-    const legacy = deriveLegacyKey();
-    const plain = decryptWith(blob, legacy);
-    writeFileSync5(getMemoryPath(), encryptWith(plain, key), "utf8");
-    return plain;
+  if (blob.startsWith(`${V2_PREFIX}:`)) {
+    if (!passphrase()) {
+      throw new MemoryKeyUnavailableError(
+        `Agent memory was encrypted with ${PASSPHRASE_ENV} but it is not set \u2014 cannot decrypt.`
+      );
+    }
+    const rest = blob.slice(V2_PREFIX.length + 1);
+    const sep = rest.indexOf(":");
+    const salt = Buffer.from(rest.slice(0, sep), "base64");
+    return decryptWith(rest.slice(sep + 1), derivePassphraseKey(salt));
+  }
+  const kk = keyringKey();
+  if (kk) {
+    try {
+      return decryptWith(blob, kk);
+    } catch {
+    }
+  }
+  const plain = decryptWith(blob, deriveLegacyKey());
+  if (kk) {
+    try {
+      writeMemoryFile(getMemoryPath(), encryptWith(plain, kk));
+    } catch {
+    }
   }
+  return plain;
 }
 function loadStore() {
   const path = getMemoryPath();
@@ -2066,14 +2323,17 @@ function loadStore() {
     const raw = readFileSync7(path, "utf8");
     const decrypted = decrypt(raw);
     return JSON.parse(decrypted);
-  } catch {
+  } catch (err) {
+    if (err instanceof MemoryKeyUnavailableError) {
+      console.error(`q-ring: ${err.message}`);
+    }
     return { entries: {} };
   }
 }
 function saveStore(store) {
   const json = JSON.stringify(store);
   const encrypted = encrypt(json);
-  writeFileSync5(getMemoryPath(), encrypted, "utf8");
+  writeMemoryFile(getMemoryPath(), encrypted);
 }
 function remember(key, value) {
   const store = loadStore();
@@ -2147,4 +2407,4 @@ export {
   listMemory,
   forget
 };
-//# sourceMappingURL=chunk-CWV3WTPF.js.map
+//# sourceMappingURL=chunk-NNIEXAW5.js.map