@rulemetric/proxy 0.7.38 → 0.7.40

package/addon/reporter.py

@@ -171,11 +171,19 @@ def _get_api_url() -> str:
     # env > env-file > prod (NOT a dead localhost). Mirrors api-client.ts:70 and
     # _config.sh:78 so the proxy agrees with the CLI + hooks. Dev still opts into
     # localhost by exporting RULEMETRIC_API_URL.
-    return (
-        os.environ.get("RULEMETRIC_API_URL")
-        or _env_file_values().get("RULEMETRIC_API_URL")
-        or "https://rulemetric.com"
+    configured = os.environ.get("RULEMETRIC_API_URL") or _env_file_values().get(
+        "RULEMETRIC_API_URL"
     )
+    if configured:
+        return configured
+    # L1.2: strict-local refuses the cloud default — the reporter goes dark
+    # rather than shipping captured context to rulemetric.com.
+    strict = os.environ.get("RULEMETRIC_STRICT_LOCAL") or _env_file_values().get(
+        "RULEMETRIC_STRICT_LOCAL"
+    )
+    if strict == "1":
+        return ""
+    return "https://rulemetric.com"
 
 
 def _get_auth_headers(prefer_file: bool = False) -> dict[str, str]:
@@ -475,6 +483,10 @@ def _replay_envelope(envelope: dict) -> tuple[bool, bool]:
         return False, True
 
     api_url = _get_api_url()
+    if not api_url:
+        # Strict-local: reporting disabled — drop the line as permanent so the
+        # drainer doesn't spin on a spool it is forbidden to deliver.
+        return False, True
     if kind == "event":
         url = f"{api_url}/api/sessions/{session_id}/events"
     elif kind == "snapshot":
@@ -663,6 +675,8 @@ def start_drainer() -> None:
 def _post_event(session_id: str, event: dict) -> None:
     """Synchronous POST for session events — called from a background thread."""
     api_url = _get_api_url()
+    if not api_url:
+        return  # strict-local: reporting disabled
     url = f"{api_url}/api/sessions/{session_id}/events"
     headers = _get_auth_headers()
     data = json.dumps(event).encode("utf-8")
@@ -683,6 +697,8 @@ def _post_event(session_id: str, event: dict) -> None:
 def _post_snapshot(session_id: str, snapshot: dict) -> None:
     """Synchronous POST — called from a background thread."""
     api_url = _get_api_url()
+    if not api_url:
+        return  # strict-local: reporting disabled
     url = f"{api_url}/api/sessions/{session_id}/context-snapshots"
     headers = _get_auth_headers()
     data = json.dumps(snapshot).encode("utf-8")
@@ -716,6 +732,8 @@ def _trigger_link_instructions(session_id: str) -> None:
     (whole-account scans are gated behind an explicit backfill flag).
     """
     api_url = _get_api_url()
+    if not api_url:
+        return  # strict-local: reporting disabled
     url = f"{api_url}/api/sessions/link-instructions"
     headers = _get_auth_headers()
     data = json.dumps({"sessionId": session_id}).encode("utf-8")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/proxy",
-  "version": "0.7.38",
+  "version": "0.7.40",
   "type": "module",
   "publishConfig": {
     "access": "public"