@solongate/proxy 0.82.47 → 0.82.49

package/dist/index.js

@@ -9222,6 +9222,7 @@ function PoliciesPanel({ focused }) {
   const [editing, setEditing] = useState4(false);
   const [editVal, setEditVal] = useState4("");
   const [status, setStatus] = useState4(null);
+  const [pendingDel, setPendingDel] = useState4(null);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
   useEffect4(() => {
@@ -9244,6 +9245,11 @@ function PoliciesPanel({ focused }) {
   };
   const save = async () => {
     if (!selected || !detail.data) return;
+    const blanket = rules.findIndex(isBlanketRule);
+    if (blanket !== -1) {
+      setStatus(`\u2717 rule ${blanket + 1} matches EVERYTHING \u2014 pick a Constraint + Match value, or narrow Permissions`);
+      return;
+    }
     setStatus("Saving\u2026");
     try {
       const res = await api.policies.update(selected.id, {
@@ -9292,9 +9298,13 @@ function PoliciesPanel({ focused }) {
         return;
       }
       if (view === "list") {
-        if (key.upArrow) setPi((n) => Math.max(0, n - 1));
-        else if (key.downArrow) setPi((n) => Math.min(policies.length - 1, n + 1));
-        else if (key.return || key.rightArrow) {
+        if (key.upArrow) {
+          setPendingDel(null);
+          setPi((n) => Math.max(0, n - 1));
+        } else if (key.downArrow) {
+          setPendingDel(null);
+          setPi((n) => Math.min(policies.length - 1, n + 1));
+        } else if (key.return || key.rightArrow) {
           setStatus(null);
           setView("rules");
         } else if (input === "a") {
@@ -9314,6 +9324,22 @@ function PoliciesPanel({ focused }) {
             setStatus("\u2713 active policy: NONE \u2014 no rules enforced, w/b grants are refused");
             activeQ.reload();
           }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
+        } else if (input === "d") {
+          if (!selected) return;
+          if (pendingDel !== selected.id) {
+            setPendingDel(selected.id);
+            setStatus(`\u26A0 d again to DELETE policy "${selected.name}" \u2014 cannot be undone`);
+            return;
+          }
+          setPendingDel(null);
+          setStatus("Deleting\u2026");
+          const name = selected.name;
+          void api.policies.remove(selected.id).then(() => {
+            setStatus(`\u2713 deleted policy "${name}"`);
+            setPi(0);
+            list5.reload();
+            activeQ.reload();
+          }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
         }
         return;
       }
@@ -9329,7 +9355,7 @@ function PoliciesPanel({ focused }) {
         } else if (input === " ") {
           if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
         } else if (input === "e") {
-          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? migrateEffect(r, r.effect === "ALLOW" ? "DENY" : "ALLOW") : r));
         } else if (input === "d") {
           if (rules[ri]) {
             const next = rules.filter((_, i) => i !== ri);
@@ -9360,9 +9386,16 @@ function PoliciesPanel({ focused }) {
       else if (key.upArrow) setFi((n) => Math.max(0, n - 1));
       else if (key.downArrow) setFi((n) => Math.min(FIELDS.length - 1, n + 1));
       else if (field.kind === "effect" && (input === " " || key.rightArrow)) {
-        mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+        mutate(rules.map((r, i) => i === ri ? migrateEffect(r, r.effect === "ALLOW" ? "DENY" : "ALLOW") : r));
       } else if (field.kind === "enabled" && (input === " " || key.rightArrow)) {
         mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
+      } else if (field.kind === "ctype" && (input === " " || key.rightArrow || key.leftArrow)) {
+        const dir = key.leftArrow ? -1 : 1;
+        const nextT = CTYPES[(CTYPES.indexOf(currentCType(rule2)) + dir + CTYPES.length) % CTYPES.length];
+        mutate(rules.map((r, i) => i === ri ? setCType(r, nextT) : r));
+      } else if (field.kind === "perms" && (input === "r" || input === "w" || input === "e" || input === "n")) {
+        const p = { r: "READ", w: "WRITE", e: "EXECUTE", n: "NETWORK" }[input];
+        mutate(rules.map((rr, i) => i === ri ? togglePerm(rr, p) : rr));
       } else if (field.kind === "priority" && (key.rightArrow || key.leftArrow)) {
         const d = key.rightArrow ? 1 : -1;
         mutate(rules.map((r, i) => i === ri ? { ...r, priority: Math.max(0, r.priority + d) } : r));
@@ -9392,7 +9425,7 @@ function PoliciesPanel({ focused }) {
           /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: activeBy ? ` (${activeBy})` : "" })
         ] }) : /* @__PURE__ */ jsx4(Text4, { color: theme.bad, bold: true, children: "\u25CB NONE \u2014 nothing enforced, grants refused" })
       ] }),
-      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 select \xB7 enter open \xB7 n new policy \xB7 a activate \xB7 x deactivate \xB7 ^R refresh${lAbove ? ` \xB7 \u25B2${lAbove}` : ""}${lBelow ? ` \xB7 \u25BC${lBelow}` : ""}` : "press \u2192 to browse" }),
+      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 select \xB7 enter open \xB7 n new \xB7 a activate \xB7 x deactivate \xB7 d delete \xB7 ^R refresh${lAbove ? ` \xB7 \u25B2${lAbove}` : ""}${lBelow ? ` \xB7 \u25BC${lBelow}` : ""}` : "press \u2192 to browse" }),
       creating !== null ? /* @__PURE__ */ jsxs4(Box4, { children: [
         /* @__PURE__ */ jsx4(Text4, { color: theme.warn, children: "new policy name: " }),
         /* @__PURE__ */ jsx4(TextInput3, { value: creating, onChange: setCreating, onSubmit: commitNewPolicy })
@@ -9467,7 +9500,7 @@ function PoliciesPanel({ focused }) {
       /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: rule?.id ?? "" }),
       dirtyTag
     ] }),
-    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit text \xB7 space/\u2192 toggle \xB7 s save \xB7 \u2190 back" }),
+    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit text \xB7 space/\u2192 toggle \xB7 r/w/e/n perms \xB7 s save \xB7 \u2190 back" }),
     /* @__PURE__ */ jsx4(Box4, { marginTop: 1, flexDirection: "column", children: FIELDS.map((f, i) => {
       const val = rule ? f.get(rule) : "";
       const active2 = i === fi;
@@ -9496,7 +9529,7 @@ function PoliciesPanel({ focused }) {
     status ? /* @__PURE__ */ jsx4(Text4, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
   ] });
 }
-var constr, setConstr, FIELDS;
+var CTYPES, CTYPE_GROUP, currentCType, clearConstraints, setCType, cValue, setCValue, migrateEffect, PERMS, permList, permIsAny, togglePerm, permDisplay, ruleHasValues, isBlanketRule, FIELDS;
 var init_Policies = __esm({
   "src/tui/panels/Policies.tsx"() {
     "use strict";
@@ -9506,26 +9539,79 @@ var init_Policies = __esm({
     init_components();
     init_hooks();
     init_theme();
-    constr = (r, g, side) => (r[g]?.[side] ?? []).join(", ");
-    setConstr = (r, g, side, val) => {
+    CTYPES = ["none", "command", "path", "filename", "url"];
+    CTYPE_GROUP = {
+      command: "commandConstraints",
+      path: "pathConstraints",
+      filename: "filenameConstraints",
+      url: "urlConstraints"
+    };
+    currentCType = (r) => {
+      if (r.filenameConstraints) return "filename";
+      if (r.urlConstraints) return "url";
+      if (r.commandConstraints) return "command";
+      if (r.pathConstraints) return "path";
+      return "none";
+    };
+    clearConstraints = (r) => ({
+      ...r,
+      commandConstraints: void 0,
+      pathConstraints: void 0,
+      filenameConstraints: void 0,
+      urlConstraints: void 0
+    });
+    setCType = (r, t) => {
+      const base = clearConstraints(r);
+      if (t === "none") return base;
+      const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+      return { ...base, [CTYPE_GROUP[t]]: { [listKey]: [] } };
+    };
+    cValue = (r) => {
+      const t = currentCType(r);
+      if (t === "none") return "";
+      const c2 = r[CTYPE_GROUP[t]];
+      return [...c2?.allowed ?? [], ...c2?.denied ?? []].join(", ");
+    };
+    setCValue = (r, val) => {
+      const t = currentCType(r);
+      if (t === "none") return r;
       const arr = val.split(",").map((s) => s.trim()).filter(Boolean);
-      const prev = r[g] ?? {};
-      return { ...r, [g]: { ...prev, [side]: arr } };
+      const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+      return { ...r, [CTYPE_GROUP[t]]: { [listKey]: arr } };
+    };
+    migrateEffect = (r, nextEffect) => {
+      const flipped = { ...r, effect: nextEffect };
+      const t = currentCType(r);
+      if (t === "none") return flipped;
+      const c2 = r[CTYPE_GROUP[t]];
+      const items = [...c2?.allowed ?? [], ...c2?.denied ?? []];
+      const listKey = nextEffect === "ALLOW" ? "allowed" : "denied";
+      return { ...flipped, [CTYPE_GROUP[t]]: { [listKey]: items } };
     };
+    PERMS = ["READ", "WRITE", "EXECUTE", "NETWORK"];
+    permList = (r) => !r.permission ? [...PERMS] : Array.isArray(r.permission) ? r.permission : [r.permission];
+    permIsAny = (r) => PERMS.every((p) => permList(r).includes(p));
+    togglePerm = (r, p) => {
+      const cur = permList(r);
+      let next = cur.includes(p) ? cur.filter((x) => x !== p) : [...cur, p];
+      if (next.length === 0) next = [p];
+      return { ...r, permission: PERMS.every((x) => next.includes(x)) ? void 0 : next };
+    };
+    permDisplay = (r) => permIsAny(r) ? "any (READ WRITE EXECUTE NETWORK)" : permList(r).join(" ");
+    ruleHasValues = (r) => {
+      const t = currentCType(r);
+      if (t === "none") return false;
+      const c2 = r[CTYPE_GROUP[t]];
+      return (c2?.allowed?.length ?? 0) + (c2?.denied?.length ?? 0) > 0;
+    };
+    isBlanketRule = (r) => !ruleHasValues(r) && permIsAny(r);
     FIELDS = [
       { label: "Effect", kind: "effect", get: (r) => r.effect },
-      { label: "Enabled", kind: "enabled", get: (r) => r.enabled ? "yes" : "no" },
+      { label: "Constraint", kind: "ctype", get: (r) => currentCType(r) },
+      { label: "Permissions", kind: "perms", get: permDisplay },
       { label: "Priority", kind: "priority", get: (r) => String(r.priority) },
-      { label: "Tool pattern", kind: "text", get: (r) => r.toolPattern, set: (r, v) => ({ ...r, toolPattern: v || "*" }) },
       { label: "Description", kind: "text", get: (r) => r.description ?? "", set: (r, v) => ({ ...r, description: v }) },
-      { label: "Cmd allow", kind: "text", get: (r) => constr(r, "commandConstraints", "allowed"), set: (r, v) => setConstr(r, "commandConstraints", "allowed", v) },
-      { label: "Cmd deny", kind: "text", get: (r) => constr(r, "commandConstraints", "denied"), set: (r, v) => setConstr(r, "commandConstraints", "denied", v) },
-      { label: "Path allow", kind: "text", get: (r) => constr(r, "pathConstraints", "allowed"), set: (r, v) => setConstr(r, "pathConstraints", "allowed", v) },
-      { label: "Path deny", kind: "text", get: (r) => constr(r, "pathConstraints", "denied"), set: (r, v) => setConstr(r, "pathConstraints", "denied", v) },
-      { label: "File allow", kind: "text", get: (r) => constr(r, "filenameConstraints", "allowed"), set: (r, v) => setConstr(r, "filenameConstraints", "allowed", v) },
-      { label: "File deny", kind: "text", get: (r) => constr(r, "filenameConstraints", "denied"), set: (r, v) => setConstr(r, "filenameConstraints", "denied", v) },
-      { label: "URL allow", kind: "text", get: (r) => constr(r, "urlConstraints", "allowed"), set: (r, v) => setConstr(r, "urlConstraints", "allowed", v) },
-      { label: "URL deny", kind: "text", get: (r) => constr(r, "urlConstraints", "denied"), set: (r, v) => setConstr(r, "urlConstraints", "denied", v) }
+      { label: "Match", kind: "text", get: cValue, set: setCValue }
     ];
   }
 });
@@ -13476,13 +13562,20 @@ function analyzeSecurityWarnings(policySet) {
   const allowRules = policySet.rules.filter(
     (r) => r.effect === "ALLOW" && r.enabled
   );
-  const wildcardAllows = allowRules.filter((r) => r.toolPattern === "*");
+  const hasNoConstraint = (r) => {
+    const groups = ["commandConstraints", "pathConstraints", "filenameConstraints", "urlConstraints"];
+    return !groups.some((g) => {
+      const c2 = r[g];
+      return c2 ? (c2.allowed?.length ?? 0) + (c2.denied?.length ?? 0) > 0 : false;
+    });
+  };
+  const wildcardAllows = allowRules.filter(hasNoConstraint);
   if (wildcardAllows.length > 0) {
     warnings.push({
       level: "CRITICAL",
       code: "WILDCARD_ALLOW",
       message: UNSAFE_CONFIGURATION_WARNINGS.WILDCARD_ALLOW,
-      recommendation: "Replace wildcard ALLOW rules with specific tool patterns."
+      recommendation: "Add command or path constraints so an ALLOW rule does not permit everything."
     });
   }
   return warnings;

package/dist/lib.js

@@ -7019,13 +7019,20 @@ function analyzeSecurityWarnings(policySet) {
   const allowRules = policySet.rules.filter(
     (r) => r.effect === "ALLOW" && r.enabled
   );
-  const wildcardAllows = allowRules.filter((r) => r.toolPattern === "*");
+  const hasNoConstraint = (r) => {
+    const groups = ["commandConstraints", "pathConstraints", "filenameConstraints", "urlConstraints"];
+    return !groups.some((g) => {
+      const c = r[g];
+      return c ? (c.allowed?.length ?? 0) + (c.denied?.length ?? 0) > 0 : false;
+    });
+  };
+  const wildcardAllows = allowRules.filter(hasNoConstraint);
   if (wildcardAllows.length > 0) {
     warnings.push({
       level: "CRITICAL",
       code: "WILDCARD_ALLOW",
       message: UNSAFE_CONFIGURATION_WARNINGS.WILDCARD_ALLOW,
-      recommendation: "Replace wildcard ALLOW rules with specific tool patterns."
+      recommendation: "Add command or path constraints so an ALLOW rule does not permit everything."
     });
   }
   return warnings;

package/dist/policy-engine/defaults.d.ts

@@ -11,8 +11,9 @@ export declare function createDefaultDenyPolicySet(): PolicySet;
  */
 export declare function createPermissivePolicySet(): PolicySet;
 /**
- * Creates a read-only policy set for a specific tool pattern.
- * Allows reads for VERIFIED requests only.
+ * Internal helper. Builds a read-only policy set scoped by an internal tool
+ * selector — fixed to "*" in the shipped product; no UI or CLI exposes it, so
+ * users can neither see nor change it. Allows reads for VERIFIED requests only.
  */
 export declare function createReadOnlyPolicySet(toolPattern: string): PolicySet;
 /**

package/dist/tui/index.js

@@ -2420,26 +2420,79 @@ function onSectionRequest(fn) {
 
 // src/tui/panels/Policies.tsx
 import { Fragment as Fragment3, jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
-var constr = (r, g, side) => (r[g]?.[side] ?? []).join(", ");
-var setConstr = (r, g, side, val) => {
+var CTYPES = ["none", "command", "path", "filename", "url"];
+var CTYPE_GROUP = {
+  command: "commandConstraints",
+  path: "pathConstraints",
+  filename: "filenameConstraints",
+  url: "urlConstraints"
+};
+var currentCType = (r) => {
+  if (r.filenameConstraints) return "filename";
+  if (r.urlConstraints) return "url";
+  if (r.commandConstraints) return "command";
+  if (r.pathConstraints) return "path";
+  return "none";
+};
+var clearConstraints = (r) => ({
+  ...r,
+  commandConstraints: void 0,
+  pathConstraints: void 0,
+  filenameConstraints: void 0,
+  urlConstraints: void 0
+});
+var setCType = (r, t) => {
+  const base = clearConstraints(r);
+  if (t === "none") return base;
+  const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+  return { ...base, [CTYPE_GROUP[t]]: { [listKey]: [] } };
+};
+var cValue = (r) => {
+  const t = currentCType(r);
+  if (t === "none") return "";
+  const c2 = r[CTYPE_GROUP[t]];
+  return [...c2?.allowed ?? [], ...c2?.denied ?? []].join(", ");
+};
+var setCValue = (r, val) => {
+  const t = currentCType(r);
+  if (t === "none") return r;
   const arr = val.split(",").map((s) => s.trim()).filter(Boolean);
-  const prev = r[g] ?? {};
-  return { ...r, [g]: { ...prev, [side]: arr } };
+  const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+  return { ...r, [CTYPE_GROUP[t]]: { [listKey]: arr } };
+};
+var migrateEffect = (r, nextEffect) => {
+  const flipped = { ...r, effect: nextEffect };
+  const t = currentCType(r);
+  if (t === "none") return flipped;
+  const c2 = r[CTYPE_GROUP[t]];
+  const items = [...c2?.allowed ?? [], ...c2?.denied ?? []];
+  const listKey = nextEffect === "ALLOW" ? "allowed" : "denied";
+  return { ...flipped, [CTYPE_GROUP[t]]: { [listKey]: items } };
+};
+var PERMS = ["READ", "WRITE", "EXECUTE", "NETWORK"];
+var permList = (r) => !r.permission ? [...PERMS] : Array.isArray(r.permission) ? r.permission : [r.permission];
+var permIsAny = (r) => PERMS.every((p) => permList(r).includes(p));
+var togglePerm = (r, p) => {
+  const cur = permList(r);
+  let next = cur.includes(p) ? cur.filter((x) => x !== p) : [...cur, p];
+  if (next.length === 0) next = [p];
+  return { ...r, permission: PERMS.every((x) => next.includes(x)) ? void 0 : next };
+};
+var permDisplay = (r) => permIsAny(r) ? "any (READ WRITE EXECUTE NETWORK)" : permList(r).join(" ");
+var ruleHasValues = (r) => {
+  const t = currentCType(r);
+  if (t === "none") return false;
+  const c2 = r[CTYPE_GROUP[t]];
+  return (c2?.allowed?.length ?? 0) + (c2?.denied?.length ?? 0) > 0;
 };
+var isBlanketRule = (r) => !ruleHasValues(r) && permIsAny(r);
 var FIELDS = [
   { label: "Effect", kind: "effect", get: (r) => r.effect },
-  { label: "Enabled", kind: "enabled", get: (r) => r.enabled ? "yes" : "no" },
+  { label: "Constraint", kind: "ctype", get: (r) => currentCType(r) },
+  { label: "Permissions", kind: "perms", get: permDisplay },
   { label: "Priority", kind: "priority", get: (r) => String(r.priority) },
-  { label: "Tool pattern", kind: "text", get: (r) => r.toolPattern, set: (r, v) => ({ ...r, toolPattern: v || "*" }) },
   { label: "Description", kind: "text", get: (r) => r.description ?? "", set: (r, v) => ({ ...r, description: v }) },
-  { label: "Cmd allow", kind: "text", get: (r) => constr(r, "commandConstraints", "allowed"), set: (r, v) => setConstr(r, "commandConstraints", "allowed", v) },
-  { label: "Cmd deny", kind: "text", get: (r) => constr(r, "commandConstraints", "denied"), set: (r, v) => setConstr(r, "commandConstraints", "denied", v) },
-  { label: "Path allow", kind: "text", get: (r) => constr(r, "pathConstraints", "allowed"), set: (r, v) => setConstr(r, "pathConstraints", "allowed", v) },
-  { label: "Path deny", kind: "text", get: (r) => constr(r, "pathConstraints", "denied"), set: (r, v) => setConstr(r, "pathConstraints", "denied", v) },
-  { label: "File allow", kind: "text", get: (r) => constr(r, "filenameConstraints", "allowed"), set: (r, v) => setConstr(r, "filenameConstraints", "allowed", v) },
-  { label: "File deny", kind: "text", get: (r) => constr(r, "filenameConstraints", "denied"), set: (r, v) => setConstr(r, "filenameConstraints", "denied", v) },
-  { label: "URL allow", kind: "text", get: (r) => constr(r, "urlConstraints", "allowed"), set: (r, v) => setConstr(r, "urlConstraints", "allowed", v) },
-  { label: "URL deny", kind: "text", get: (r) => constr(r, "urlConstraints", "denied"), set: (r, v) => setConstr(r, "urlConstraints", "denied", v) }
+  { label: "Match", kind: "text", get: cValue, set: setCValue }
 ];
 function ruleSummary(r) {
   const bits = [];
@@ -2467,6 +2520,7 @@ function PoliciesPanel({ focused }) {
   const [editing, setEditing] = useState4(false);
   const [editVal, setEditVal] = useState4("");
   const [status, setStatus] = useState4(null);
+  const [pendingDel, setPendingDel] = useState4(null);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
   useEffect4(() => {
@@ -2489,6 +2543,11 @@ function PoliciesPanel({ focused }) {
   };
   const save = async () => {
     if (!selected || !detail.data) return;
+    const blanket = rules.findIndex(isBlanketRule);
+    if (blanket !== -1) {
+      setStatus(`\u2717 rule ${blanket + 1} matches EVERYTHING \u2014 pick a Constraint + Match value, or narrow Permissions`);
+      return;
+    }
     setStatus("Saving\u2026");
     try {
       const res = await api.policies.update(selected.id, {
@@ -2537,9 +2596,13 @@ function PoliciesPanel({ focused }) {
         return;
       }
       if (view === "list") {
-        if (key.upArrow) setPi((n) => Math.max(0, n - 1));
-        else if (key.downArrow) setPi((n) => Math.min(policies.length - 1, n + 1));
-        else if (key.return || key.rightArrow) {
+        if (key.upArrow) {
+          setPendingDel(null);
+          setPi((n) => Math.max(0, n - 1));
+        } else if (key.downArrow) {
+          setPendingDel(null);
+          setPi((n) => Math.min(policies.length - 1, n + 1));
+        } else if (key.return || key.rightArrow) {
           setStatus(null);
           setView("rules");
         } else if (input === "a") {
@@ -2559,6 +2622,22 @@ function PoliciesPanel({ focused }) {
             setStatus("\u2713 active policy: NONE \u2014 no rules enforced, w/b grants are refused");
             activeQ.reload();
           }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
+        } else if (input === "d") {
+          if (!selected) return;
+          if (pendingDel !== selected.id) {
+            setPendingDel(selected.id);
+            setStatus(`\u26A0 d again to DELETE policy "${selected.name}" \u2014 cannot be undone`);
+            return;
+          }
+          setPendingDel(null);
+          setStatus("Deleting\u2026");
+          const name = selected.name;
+          void api.policies.remove(selected.id).then(() => {
+            setStatus(`\u2713 deleted policy "${name}"`);
+            setPi(0);
+            list5.reload();
+            activeQ.reload();
+          }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
         }
         return;
       }
@@ -2574,7 +2653,7 @@ function PoliciesPanel({ focused }) {
         } else if (input === " ") {
           if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
         } else if (input === "e") {
-          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? migrateEffect(r, r.effect === "ALLOW" ? "DENY" : "ALLOW") : r));
         } else if (input === "d") {
           if (rules[ri]) {
             const next = rules.filter((_, i) => i !== ri);
@@ -2605,9 +2684,16 @@ function PoliciesPanel({ focused }) {
       else if (key.upArrow) setFi((n) => Math.max(0, n - 1));
       else if (key.downArrow) setFi((n) => Math.min(FIELDS.length - 1, n + 1));
       else if (field.kind === "effect" && (input === " " || key.rightArrow)) {
-        mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+        mutate(rules.map((r, i) => i === ri ? migrateEffect(r, r.effect === "ALLOW" ? "DENY" : "ALLOW") : r));
       } else if (field.kind === "enabled" && (input === " " || key.rightArrow)) {
         mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
+      } else if (field.kind === "ctype" && (input === " " || key.rightArrow || key.leftArrow)) {
+        const dir = key.leftArrow ? -1 : 1;
+        const nextT = CTYPES[(CTYPES.indexOf(currentCType(rule2)) + dir + CTYPES.length) % CTYPES.length];
+        mutate(rules.map((r, i) => i === ri ? setCType(r, nextT) : r));
+      } else if (field.kind === "perms" && (input === "r" || input === "w" || input === "e" || input === "n")) {
+        const p = { r: "READ", w: "WRITE", e: "EXECUTE", n: "NETWORK" }[input];
+        mutate(rules.map((rr, i) => i === ri ? togglePerm(rr, p) : rr));
       } else if (field.kind === "priority" && (key.rightArrow || key.leftArrow)) {
         const d = key.rightArrow ? 1 : -1;
         mutate(rules.map((r, i) => i === ri ? { ...r, priority: Math.max(0, r.priority + d) } : r));
@@ -2637,7 +2723,7 @@ function PoliciesPanel({ focused }) {
           /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: activeBy ? ` (${activeBy})` : "" })
         ] }) : /* @__PURE__ */ jsx4(Text4, { color: theme.bad, bold: true, children: "\u25CB NONE \u2014 nothing enforced, grants refused" })
       ] }),
-      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 select \xB7 enter open \xB7 n new policy \xB7 a activate \xB7 x deactivate \xB7 ^R refresh${lAbove ? ` \xB7 \u25B2${lAbove}` : ""}${lBelow ? ` \xB7 \u25BC${lBelow}` : ""}` : "press \u2192 to browse" }),
+      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 select \xB7 enter open \xB7 n new \xB7 a activate \xB7 x deactivate \xB7 d delete \xB7 ^R refresh${lAbove ? ` \xB7 \u25B2${lAbove}` : ""}${lBelow ? ` \xB7 \u25BC${lBelow}` : ""}` : "press \u2192 to browse" }),
       creating !== null ? /* @__PURE__ */ jsxs4(Box4, { children: [
         /* @__PURE__ */ jsx4(Text4, { color: theme.warn, children: "new policy name: " }),
         /* @__PURE__ */ jsx4(TextInput3, { value: creating, onChange: setCreating, onSubmit: commitNewPolicy })
@@ -2712,7 +2798,7 @@ function PoliciesPanel({ focused }) {
       /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: rule?.id ?? "" }),
       dirtyTag
     ] }),
-    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit text \xB7 space/\u2192 toggle \xB7 s save \xB7 \u2190 back" }),
+    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit text \xB7 space/\u2192 toggle \xB7 r/w/e/n perms \xB7 s save \xB7 \u2190 back" }),
     /* @__PURE__ */ jsx4(Box4, { marginTop: 1, flexDirection: "column", children: FIELDS.map((f, i) => {
       const val = rule ? f.get(rule) : "";
       const active2 = i === fi;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.47",
+  "version": "0.82.49",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {