@solongate/proxy 0.82.48 → 0.82.50

package/dist/index.js

@@ -9222,6 +9222,8 @@ function PoliciesPanel({ focused }) {
   const [editing, setEditing] = useState4(false);
   const [editVal, setEditVal] = useState4("");
   const [status, setStatus] = useState4(null);
+  const [pendingDel, setPendingDel] = useState4(null);
+  const [permCursor, setPermCursor] = useState4(0);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
   useEffect4(() => {
@@ -9244,6 +9246,11 @@ function PoliciesPanel({ focused }) {
   };
   const save = async () => {
     if (!selected || !detail.data) return;
+    const blanket = rules.findIndex(isBlanketRule);
+    if (blanket !== -1) {
+      setStatus(`\u2717 rule ${blanket + 1} matches EVERYTHING \u2014 pick a Constraint + Match value, or narrow Permissions`);
+      return;
+    }
     setStatus("Saving\u2026");
     try {
       const res = await api.policies.update(selected.id, {
@@ -9292,9 +9299,13 @@ function PoliciesPanel({ focused }) {
         return;
       }
       if (view === "list") {
-        if (key.upArrow) setPi((n) => Math.max(0, n - 1));
-        else if (key.downArrow) setPi((n) => Math.min(policies.length - 1, n + 1));
-        else if (key.return || key.rightArrow) {
+        if (key.upArrow) {
+          setPendingDel(null);
+          setPi((n) => Math.max(0, n - 1));
+        } else if (key.downArrow) {
+          setPendingDel(null);
+          setPi((n) => Math.min(policies.length - 1, n + 1));
+        } else if (key.return || key.rightArrow) {
           setStatus(null);
           setView("rules");
         } else if (input === "a") {
@@ -9314,6 +9325,22 @@ function PoliciesPanel({ focused }) {
             setStatus("\u2713 active policy: NONE \u2014 no rules enforced, w/b grants are refused");
             activeQ.reload();
           }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
+        } else if (input === "d") {
+          if (!selected) return;
+          if (pendingDel !== selected.id) {
+            setPendingDel(selected.id);
+            setStatus(`\u26A0 d again to DELETE policy "${selected.name}" \u2014 cannot be undone`);
+            return;
+          }
+          setPendingDel(null);
+          setStatus("Deleting\u2026");
+          const name = selected.name;
+          void api.policies.remove(selected.id).then(() => {
+            setStatus(`\u2713 deleted policy "${name}"`);
+            setPi(0);
+            list5.reload();
+            activeQ.reload();
+          }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
         }
         return;
       }
@@ -9329,7 +9356,7 @@ function PoliciesPanel({ focused }) {
         } else if (input === " ") {
           if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
         } else if (input === "e") {
-          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? migrateEffect(r, r.effect === "ALLOW" ? "DENY" : "ALLOW") : r));
         } else if (input === "d") {
           if (rules[ri]) {
             const next = rules.filter((_, i) => i !== ri);
@@ -9339,7 +9366,7 @@ function PoliciesPanel({ focused }) {
         } else if (input === "m") {
           mutate(rules, mode === "denylist" ? "whitelist" : "denylist");
         } else if (input === "n") {
-          const nr = { id: `rule-${Date.now()}`, description: "", effect: "DENY", priority: 100, toolPattern: "*", minimumTrustLevel: "UNTRUSTED", enabled: true };
+          const nr = { id: `rule-${Date.now()}`, description: "", effect: "DENY", priority: 100, toolPattern: "*", minimumTrustLevel: "UNTRUSTED", enabled: true, commandConstraints: { denied: [] } };
           mutate([nr, ...rules]);
           setRi(0);
           setFi(0);
@@ -9360,13 +9387,28 @@ function PoliciesPanel({ focused }) {
       else if (key.upArrow) setFi((n) => Math.max(0, n - 1));
       else if (key.downArrow) setFi((n) => Math.min(FIELDS.length - 1, n + 1));
       else if (field.kind === "effect" && (input === " " || key.rightArrow)) {
-        mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+        mutate(rules.map((r, i) => i === ri ? migrateEffect(r, r.effect === "ALLOW" ? "DENY" : "ALLOW") : r));
       } else if (field.kind === "enabled" && (input === " " || key.rightArrow)) {
         mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
+      } else if (field.kind === "ctype" && (input === " " || key.rightArrow || key.leftArrow)) {
+        const dir = key.leftArrow ? -1 : 1;
+        const nextT = CTYPES[(CTYPES.indexOf(currentCType(rule2)) + dir + CTYPES.length) % CTYPES.length];
+        mutate(rules.map((r, i) => i === ri ? setCType(r, nextT) : r));
+      } else if (field.kind === "perms" && key.leftArrow) {
+        setPermCursor((n) => (n + PERMS.length - 1) % PERMS.length);
+      } else if (field.kind === "perms" && key.rightArrow) {
+        setPermCursor((n) => (n + 1) % PERMS.length);
+      } else if (field.kind === "perms" && input === " ") {
+        const p = PERMS[permCursor % PERMS.length];
+        mutate(rules.map((rr, i) => i === ri ? togglePerm(rr, p) : rr));
+      } else if (field.kind === "match" && input === "[") {
+        mutate(rules.map((rr, i) => i === ri ? toggleStar(rr, "left") : rr));
+      } else if (field.kind === "match" && input === "]") {
+        mutate(rules.map((rr, i) => i === ri ? toggleStar(rr, "right") : rr));
       } else if (field.kind === "priority" && (key.rightArrow || key.leftArrow)) {
         const d = key.rightArrow ? 1 : -1;
         mutate(rules.map((r, i) => i === ri ? { ...r, priority: Math.max(0, r.priority + d) } : r));
-      } else if (field.kind === "text" && key.return) {
+      } else if ((field.kind === "text" || field.kind === "match") && key.return) {
         setEditVal(field.get(rule2));
         setEditing(true);
       } else if (input === "s") void save();
@@ -9392,7 +9434,7 @@ function PoliciesPanel({ focused }) {
           /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: activeBy ? ` (${activeBy})` : "" })
         ] }) : /* @__PURE__ */ jsx4(Text4, { color: theme.bad, bold: true, children: "\u25CB NONE \u2014 nothing enforced, grants refused" })
       ] }),
-      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 select \xB7 enter open \xB7 n new policy \xB7 a activate \xB7 x deactivate \xB7 ^R refresh${lAbove ? ` \xB7 \u25B2${lAbove}` : ""}${lBelow ? ` \xB7 \u25BC${lBelow}` : ""}` : "press \u2192 to browse" }),
+      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 select \xB7 enter open \xB7 n new \xB7 a activate \xB7 x deactivate \xB7 d delete \xB7 ^R refresh${lAbove ? ` \xB7 \u25B2${lAbove}` : ""}${lBelow ? ` \xB7 \u25BC${lBelow}` : ""}` : "press \u2192 to browse" }),
       creating !== null ? /* @__PURE__ */ jsxs4(Box4, { children: [
         /* @__PURE__ */ jsx4(Text4, { color: theme.warn, children: "new policy name: " }),
         /* @__PURE__ */ jsx4(TextInput3, { value: creating, onChange: setCreating, onSubmit: commitNewPolicy })
@@ -9467,12 +9509,53 @@ function PoliciesPanel({ focused }) {
       /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: rule?.id ?? "" }),
       dirtyTag
     ] }),
-    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit text \xB7 space/\u2192 toggle \xB7 s save \xB7 \u2190 back" }),
+    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit \xB7 space toggle \xB7 \u2190\u2192 move/pick \xB7 [ ] wildcards \xB7 s save \xB7 \u2190 back" }),
     /* @__PURE__ */ jsx4(Box4, { marginTop: 1, flexDirection: "column", children: FIELDS.map((f, i) => {
-      const val = rule ? f.get(rule) : "";
       const active2 = i === fi;
+      const label = /* @__PURE__ */ jsx4(Text4, { color: active2 ? theme.accentBright : void 0, children: (active2 ? "\u25B8 " : "  ") + f.label.padEnd(13) });
+      if (f.kind === "perms" && rule) {
+        return /* @__PURE__ */ jsxs4(Box4, { children: [
+          label,
+          PERMS.map((p, pi2) => {
+            const on = permList(rule).includes(p);
+            const cur = active2 && pi2 === permCursor % PERMS.length;
+            return /* @__PURE__ */ jsxs4(Text4, { color: on ? theme.ok : theme.bad, inverse: cur, children: [
+              p,
+              pi2 < PERMS.length - 1 ? "  " : ""
+            ] }, p);
+          })
+        ] }, f.label);
+      }
+      if (f.kind === "match" && rule) {
+        if (active2 && editing) {
+          return /* @__PURE__ */ jsxs4(Box4, { children: [
+            label,
+            /* @__PURE__ */ jsx4(
+              TextInput3,
+              {
+                value: editVal,
+                onChange: setEditVal,
+                onSubmit: (v2) => {
+                  if (f.set) mutate(rules.map((r, idx) => idx === ri ? f.set(r, v2) : r));
+                  setEditing(false);
+                }
+              }
+            )
+          ] }, f.label);
+        }
+        const v = f.get(rule);
+        const lOn = starActive(rule, "left");
+        const rOn = starActive(rule, "right");
+        return /* @__PURE__ */ jsxs4(Box4, { children: [
+          label,
+          /* @__PURE__ */ jsx4(Text4, { color: lOn ? theme.ok : theme.dim, children: lOn ? "\u2731 " : "\xB7 " }),
+          /* @__PURE__ */ jsx4(Text4, { dimColor: !v, children: v || "\u2014" }),
+          /* @__PURE__ */ jsx4(Text4, { color: rOn ? theme.ok : theme.dim, children: rOn ? " \u2731" : " \xB7" })
+        ] }, f.label);
+      }
+      const val = rule ? f.get(rule) : "";
       return /* @__PURE__ */ jsxs4(Box4, { children: [
-        /* @__PURE__ */ jsx4(Text4, { color: active2 ? theme.accentBright : void 0, children: (active2 ? "\u25B8 " : "  ") + f.label.padEnd(13) }),
+        label,
         active2 && editing && f.kind === "text" ? /* @__PURE__ */ jsx4(
           TextInput3,
           {
@@ -9493,10 +9576,11 @@ function PoliciesPanel({ focused }) {
         )
       ] }, f.label);
     }) }),
+    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "  * = wildcard (matches any run of chars). On Match: [ toggles a leading *, ] a trailing *  \xB7  e.g. *ping* matches any command containing ping" }),
     status ? /* @__PURE__ */ jsx4(Text4, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
   ] });
 }
-var constr, setConstr, FIELDS;
+var CTYPES, CTYPE_GROUP, currentCType, clearConstraints, setCType, cValue, setCValue, matchItems, starActive, toggleStar, migrateEffect, PERMS, permList, permIsAny, togglePerm, permDisplay, ruleHasValues, isBlanketRule, FIELDS;
 var init_Policies = __esm({
   "src/tui/panels/Policies.tsx"() {
     "use strict";
@@ -9506,25 +9590,99 @@ var init_Policies = __esm({
     init_components();
     init_hooks();
     init_theme();
-    constr = (r, g, side) => (r[g]?.[side] ?? []).join(", ");
-    setConstr = (r, g, side, val) => {
+    CTYPES = ["none", "command", "path", "filename", "url"];
+    CTYPE_GROUP = {
+      command: "commandConstraints",
+      path: "pathConstraints",
+      filename: "filenameConstraints",
+      url: "urlConstraints"
+    };
+    currentCType = (r) => {
+      if (r.filenameConstraints) return "filename";
+      if (r.urlConstraints) return "url";
+      if (r.commandConstraints) return "command";
+      if (r.pathConstraints) return "path";
+      return "none";
+    };
+    clearConstraints = (r) => ({
+      ...r,
+      commandConstraints: void 0,
+      pathConstraints: void 0,
+      filenameConstraints: void 0,
+      urlConstraints: void 0
+    });
+    setCType = (r, t) => {
+      const base = clearConstraints(r);
+      if (t === "none") return base;
+      const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+      return { ...base, [CTYPE_GROUP[t]]: { [listKey]: [] } };
+    };
+    cValue = (r) => {
+      const t = currentCType(r);
+      if (t === "none") return "";
+      const c2 = r[CTYPE_GROUP[t]];
+      return [...c2?.allowed ?? [], ...c2?.denied ?? []].join(", ");
+    };
+    setCValue = (r, val) => {
+      const t = currentCType(r);
+      if (t === "none") return r;
       const arr = val.split(",").map((s) => s.trim()).filter(Boolean);
-      const prev = r[g] ?? {};
-      return { ...r, [g]: { ...prev, [side]: arr } };
+      const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+      return { ...r, [CTYPE_GROUP[t]]: { [listKey]: arr } };
+    };
+    matchItems = (r) => {
+      const t = currentCType(r);
+      if (t === "none") return [];
+      const c2 = r[CTYPE_GROUP[t]];
+      return [...c2?.allowed ?? [], ...c2?.denied ?? []];
+    };
+    starActive = (r, side) => {
+      const items = matchItems(r);
+      return items.length > 0 && items.every((v) => side === "left" ? v.startsWith("*") : v.endsWith("*"));
+    };
+    toggleStar = (r, side) => {
+      const t = currentCType(r);
+      if (t === "none") return r;
+      const on = starActive(r, side);
+      const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+      const items = matchItems(r).map(
+        (v) => side === "left" ? on ? v.replace(/^\*+/, "") : "*" + v : on ? v.replace(/\*+$/, "") : v + "*"
+      );
+      return { ...r, [CTYPE_GROUP[t]]: { [listKey]: items } };
+    };
+    migrateEffect = (r, nextEffect) => {
+      const flipped = { ...r, effect: nextEffect };
+      const t = currentCType(r);
+      if (t === "none") return flipped;
+      const c2 = r[CTYPE_GROUP[t]];
+      const items = [...c2?.allowed ?? [], ...c2?.denied ?? []];
+      const listKey = nextEffect === "ALLOW" ? "allowed" : "denied";
+      return { ...flipped, [CTYPE_GROUP[t]]: { [listKey]: items } };
+    };
+    PERMS = ["READ", "WRITE", "EXECUTE", "NETWORK"];
+    permList = (r) => !r.permission ? [...PERMS] : Array.isArray(r.permission) ? r.permission : [r.permission];
+    permIsAny = (r) => PERMS.every((p) => permList(r).includes(p));
+    togglePerm = (r, p) => {
+      const cur = permList(r);
+      let next = cur.includes(p) ? cur.filter((x) => x !== p) : [...cur, p];
+      if (next.length === 0) next = [p];
+      return { ...r, permission: PERMS.every((x) => next.includes(x)) ? void 0 : next };
+    };
+    permDisplay = (r) => permIsAny(r) ? "any (READ WRITE EXECUTE NETWORK)" : permList(r).join(" ");
+    ruleHasValues = (r) => {
+      const t = currentCType(r);
+      if (t === "none") return false;
+      const c2 = r[CTYPE_GROUP[t]];
+      return (c2?.allowed?.length ?? 0) + (c2?.denied?.length ?? 0) > 0;
     };
+    isBlanketRule = (r) => !ruleHasValues(r) && permIsAny(r);
     FIELDS = [
       { label: "Effect", kind: "effect", get: (r) => r.effect },
-      { label: "Enabled", kind: "enabled", get: (r) => r.enabled ? "yes" : "no" },
+      { label: "Constraint", kind: "ctype", get: (r) => currentCType(r) },
+      { label: "Permissions", kind: "perms", get: permDisplay },
       { label: "Priority", kind: "priority", get: (r) => String(r.priority) },
       { label: "Description", kind: "text", get: (r) => r.description ?? "", set: (r, v) => ({ ...r, description: v }) },
-      { label: "Cmd allow", kind: "text", get: (r) => constr(r, "commandConstraints", "allowed"), set: (r, v) => setConstr(r, "commandConstraints", "allowed", v) },
-      { label: "Cmd deny", kind: "text", get: (r) => constr(r, "commandConstraints", "denied"), set: (r, v) => setConstr(r, "commandConstraints", "denied", v) },
-      { label: "Path allow", kind: "text", get: (r) => constr(r, "pathConstraints", "allowed"), set: (r, v) => setConstr(r, "pathConstraints", "allowed", v) },
-      { label: "Path deny", kind: "text", get: (r) => constr(r, "pathConstraints", "denied"), set: (r, v) => setConstr(r, "pathConstraints", "denied", v) },
-      { label: "File allow", kind: "text", get: (r) => constr(r, "filenameConstraints", "allowed"), set: (r, v) => setConstr(r, "filenameConstraints", "allowed", v) },
-      { label: "File deny", kind: "text", get: (r) => constr(r, "filenameConstraints", "denied"), set: (r, v) => setConstr(r, "filenameConstraints", "denied", v) },
-      { label: "URL allow", kind: "text", get: (r) => constr(r, "urlConstraints", "allowed"), set: (r, v) => setConstr(r, "urlConstraints", "allowed", v) },
-      { label: "URL deny", kind: "text", get: (r) => constr(r, "urlConstraints", "denied"), set: (r, v) => setConstr(r, "urlConstraints", "denied", v) }
+      { label: "Match", kind: "match", get: cValue, set: setCValue }
     ];
   }
 });

package/dist/tui/index.js

@@ -2420,25 +2420,99 @@ function onSectionRequest(fn) {
 
 // src/tui/panels/Policies.tsx
 import { Fragment as Fragment3, jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
-var constr = (r, g, side) => (r[g]?.[side] ?? []).join(", ");
-var setConstr = (r, g, side, val) => {
+var CTYPES = ["none", "command", "path", "filename", "url"];
+var CTYPE_GROUP = {
+  command: "commandConstraints",
+  path: "pathConstraints",
+  filename: "filenameConstraints",
+  url: "urlConstraints"
+};
+var currentCType = (r) => {
+  if (r.filenameConstraints) return "filename";
+  if (r.urlConstraints) return "url";
+  if (r.commandConstraints) return "command";
+  if (r.pathConstraints) return "path";
+  return "none";
+};
+var clearConstraints = (r) => ({
+  ...r,
+  commandConstraints: void 0,
+  pathConstraints: void 0,
+  filenameConstraints: void 0,
+  urlConstraints: void 0
+});
+var setCType = (r, t) => {
+  const base = clearConstraints(r);
+  if (t === "none") return base;
+  const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+  return { ...base, [CTYPE_GROUP[t]]: { [listKey]: [] } };
+};
+var cValue = (r) => {
+  const t = currentCType(r);
+  if (t === "none") return "";
+  const c2 = r[CTYPE_GROUP[t]];
+  return [...c2?.allowed ?? [], ...c2?.denied ?? []].join(", ");
+};
+var setCValue = (r, val) => {
+  const t = currentCType(r);
+  if (t === "none") return r;
   const arr = val.split(",").map((s) => s.trim()).filter(Boolean);
-  const prev = r[g] ?? {};
-  return { ...r, [g]: { ...prev, [side]: arr } };
+  const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+  return { ...r, [CTYPE_GROUP[t]]: { [listKey]: arr } };
+};
+var matchItems = (r) => {
+  const t = currentCType(r);
+  if (t === "none") return [];
+  const c2 = r[CTYPE_GROUP[t]];
+  return [...c2?.allowed ?? [], ...c2?.denied ?? []];
+};
+var starActive = (r, side) => {
+  const items = matchItems(r);
+  return items.length > 0 && items.every((v) => side === "left" ? v.startsWith("*") : v.endsWith("*"));
 };
+var toggleStar = (r, side) => {
+  const t = currentCType(r);
+  if (t === "none") return r;
+  const on = starActive(r, side);
+  const listKey = r.effect === "ALLOW" ? "allowed" : "denied";
+  const items = matchItems(r).map(
+    (v) => side === "left" ? on ? v.replace(/^\*+/, "") : "*" + v : on ? v.replace(/\*+$/, "") : v + "*"
+  );
+  return { ...r, [CTYPE_GROUP[t]]: { [listKey]: items } };
+};
+var migrateEffect = (r, nextEffect) => {
+  const flipped = { ...r, effect: nextEffect };
+  const t = currentCType(r);
+  if (t === "none") return flipped;
+  const c2 = r[CTYPE_GROUP[t]];
+  const items = [...c2?.allowed ?? [], ...c2?.denied ?? []];
+  const listKey = nextEffect === "ALLOW" ? "allowed" : "denied";
+  return { ...flipped, [CTYPE_GROUP[t]]: { [listKey]: items } };
+};
+var PERMS = ["READ", "WRITE", "EXECUTE", "NETWORK"];
+var permList = (r) => !r.permission ? [...PERMS] : Array.isArray(r.permission) ? r.permission : [r.permission];
+var permIsAny = (r) => PERMS.every((p) => permList(r).includes(p));
+var togglePerm = (r, p) => {
+  const cur = permList(r);
+  let next = cur.includes(p) ? cur.filter((x) => x !== p) : [...cur, p];
+  if (next.length === 0) next = [p];
+  return { ...r, permission: PERMS.every((x) => next.includes(x)) ? void 0 : next };
+};
+var permDisplay = (r) => permIsAny(r) ? "any (READ WRITE EXECUTE NETWORK)" : permList(r).join(" ");
+var ruleHasValues = (r) => {
+  const t = currentCType(r);
+  if (t === "none") return false;
+  const c2 = r[CTYPE_GROUP[t]];
+  return (c2?.allowed?.length ?? 0) + (c2?.denied?.length ?? 0) > 0;
+};
+var isBlanketRule = (r) => !ruleHasValues(r) && permIsAny(r);
 var FIELDS = [
   { label: "Effect", kind: "effect", get: (r) => r.effect },
-  { label: "Enabled", kind: "enabled", get: (r) => r.enabled ? "yes" : "no" },
+  { label: "Constraint", kind: "ctype", get: (r) => currentCType(r) },
+  { label: "Permissions", kind: "perms", get: permDisplay },
   { label: "Priority", kind: "priority", get: (r) => String(r.priority) },
   { label: "Description", kind: "text", get: (r) => r.description ?? "", set: (r, v) => ({ ...r, description: v }) },
-  { label: "Cmd allow", kind: "text", get: (r) => constr(r, "commandConstraints", "allowed"), set: (r, v) => setConstr(r, "commandConstraints", "allowed", v) },
-  { label: "Cmd deny", kind: "text", get: (r) => constr(r, "commandConstraints", "denied"), set: (r, v) => setConstr(r, "commandConstraints", "denied", v) },
-  { label: "Path allow", kind: "text", get: (r) => constr(r, "pathConstraints", "allowed"), set: (r, v) => setConstr(r, "pathConstraints", "allowed", v) },
-  { label: "Path deny", kind: "text", get: (r) => constr(r, "pathConstraints", "denied"), set: (r, v) => setConstr(r, "pathConstraints", "denied", v) },
-  { label: "File allow", kind: "text", get: (r) => constr(r, "filenameConstraints", "allowed"), set: (r, v) => setConstr(r, "filenameConstraints", "allowed", v) },
-  { label: "File deny", kind: "text", get: (r) => constr(r, "filenameConstraints", "denied"), set: (r, v) => setConstr(r, "filenameConstraints", "denied", v) },
-  { label: "URL allow", kind: "text", get: (r) => constr(r, "urlConstraints", "allowed"), set: (r, v) => setConstr(r, "urlConstraints", "allowed", v) },
-  { label: "URL deny", kind: "text", get: (r) => constr(r, "urlConstraints", "denied"), set: (r, v) => setConstr(r, "urlConstraints", "denied", v) }
+  { label: "Match", kind: "match", get: cValue, set: setCValue }
 ];
 function ruleSummary(r) {
   const bits = [];
@@ -2466,6 +2540,8 @@ function PoliciesPanel({ focused }) {
   const [editing, setEditing] = useState4(false);
   const [editVal, setEditVal] = useState4("");
   const [status, setStatus] = useState4(null);
+  const [pendingDel, setPendingDel] = useState4(null);
+  const [permCursor, setPermCursor] = useState4(0);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
   useEffect4(() => {
@@ -2488,6 +2564,11 @@ function PoliciesPanel({ focused }) {
   };
   const save = async () => {
     if (!selected || !detail.data) return;
+    const blanket = rules.findIndex(isBlanketRule);
+    if (blanket !== -1) {
+      setStatus(`\u2717 rule ${blanket + 1} matches EVERYTHING \u2014 pick a Constraint + Match value, or narrow Permissions`);
+      return;
+    }
     setStatus("Saving\u2026");
     try {
       const res = await api.policies.update(selected.id, {
@@ -2536,9 +2617,13 @@ function PoliciesPanel({ focused }) {
         return;
       }
       if (view === "list") {
-        if (key.upArrow) setPi((n) => Math.max(0, n - 1));
-        else if (key.downArrow) setPi((n) => Math.min(policies.length - 1, n + 1));
-        else if (key.return || key.rightArrow) {
+        if (key.upArrow) {
+          setPendingDel(null);
+          setPi((n) => Math.max(0, n - 1));
+        } else if (key.downArrow) {
+          setPendingDel(null);
+          setPi((n) => Math.min(policies.length - 1, n + 1));
+        } else if (key.return || key.rightArrow) {
           setStatus(null);
           setView("rules");
         } else if (input === "a") {
@@ -2558,6 +2643,22 @@ function PoliciesPanel({ focused }) {
             setStatus("\u2713 active policy: NONE \u2014 no rules enforced, w/b grants are refused");
             activeQ.reload();
           }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
+        } else if (input === "d") {
+          if (!selected) return;
+          if (pendingDel !== selected.id) {
+            setPendingDel(selected.id);
+            setStatus(`\u26A0 d again to DELETE policy "${selected.name}" \u2014 cannot be undone`);
+            return;
+          }
+          setPendingDel(null);
+          setStatus("Deleting\u2026");
+          const name = selected.name;
+          void api.policies.remove(selected.id).then(() => {
+            setStatus(`\u2713 deleted policy "${name}"`);
+            setPi(0);
+            list5.reload();
+            activeQ.reload();
+          }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
         }
         return;
       }
@@ -2573,7 +2674,7 @@ function PoliciesPanel({ focused }) {
         } else if (input === " ") {
           if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
         } else if (input === "e") {
-          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? migrateEffect(r, r.effect === "ALLOW" ? "DENY" : "ALLOW") : r));
         } else if (input === "d") {
           if (rules[ri]) {
             const next = rules.filter((_, i) => i !== ri);
@@ -2583,7 +2684,7 @@ function PoliciesPanel({ focused }) {
         } else if (input === "m") {
           mutate(rules, mode === "denylist" ? "whitelist" : "denylist");
         } else if (input === "n") {
-          const nr = { id: `rule-${Date.now()}`, description: "", effect: "DENY", priority: 100, toolPattern: "*", minimumTrustLevel: "UNTRUSTED", enabled: true };
+          const nr = { id: `rule-${Date.now()}`, description: "", effect: "DENY", priority: 100, toolPattern: "*", minimumTrustLevel: "UNTRUSTED", enabled: true, commandConstraints: { denied: [] } };
           mutate([nr, ...rules]);
           setRi(0);
           setFi(0);
@@ -2604,13 +2705,28 @@ function PoliciesPanel({ focused }) {
       else if (key.upArrow) setFi((n) => Math.max(0, n - 1));
       else if (key.downArrow) setFi((n) => Math.min(FIELDS.length - 1, n + 1));
       else if (field.kind === "effect" && (input === " " || key.rightArrow)) {
-        mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+        mutate(rules.map((r, i) => i === ri ? migrateEffect(r, r.effect === "ALLOW" ? "DENY" : "ALLOW") : r));
       } else if (field.kind === "enabled" && (input === " " || key.rightArrow)) {
         mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
+      } else if (field.kind === "ctype" && (input === " " || key.rightArrow || key.leftArrow)) {
+        const dir = key.leftArrow ? -1 : 1;
+        const nextT = CTYPES[(CTYPES.indexOf(currentCType(rule2)) + dir + CTYPES.length) % CTYPES.length];
+        mutate(rules.map((r, i) => i === ri ? setCType(r, nextT) : r));
+      } else if (field.kind === "perms" && key.leftArrow) {
+        setPermCursor((n) => (n + PERMS.length - 1) % PERMS.length);
+      } else if (field.kind === "perms" && key.rightArrow) {
+        setPermCursor((n) => (n + 1) % PERMS.length);
+      } else if (field.kind === "perms" && input === " ") {
+        const p = PERMS[permCursor % PERMS.length];
+        mutate(rules.map((rr, i) => i === ri ? togglePerm(rr, p) : rr));
+      } else if (field.kind === "match" && input === "[") {
+        mutate(rules.map((rr, i) => i === ri ? toggleStar(rr, "left") : rr));
+      } else if (field.kind === "match" && input === "]") {
+        mutate(rules.map((rr, i) => i === ri ? toggleStar(rr, "right") : rr));
       } else if (field.kind === "priority" && (key.rightArrow || key.leftArrow)) {
         const d = key.rightArrow ? 1 : -1;
         mutate(rules.map((r, i) => i === ri ? { ...r, priority: Math.max(0, r.priority + d) } : r));
-      } else if (field.kind === "text" && key.return) {
+      } else if ((field.kind === "text" || field.kind === "match") && key.return) {
         setEditVal(field.get(rule2));
         setEditing(true);
       } else if (input === "s") void save();
@@ -2636,7 +2752,7 @@ function PoliciesPanel({ focused }) {
           /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: activeBy ? ` (${activeBy})` : "" })
         ] }) : /* @__PURE__ */ jsx4(Text4, { color: theme.bad, bold: true, children: "\u25CB NONE \u2014 nothing enforced, grants refused" })
       ] }),
-      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 select \xB7 enter open \xB7 n new policy \xB7 a activate \xB7 x deactivate \xB7 ^R refresh${lAbove ? ` \xB7 \u25B2${lAbove}` : ""}${lBelow ? ` \xB7 \u25BC${lBelow}` : ""}` : "press \u2192 to browse" }),
+      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 select \xB7 enter open \xB7 n new \xB7 a activate \xB7 x deactivate \xB7 d delete \xB7 ^R refresh${lAbove ? ` \xB7 \u25B2${lAbove}` : ""}${lBelow ? ` \xB7 \u25BC${lBelow}` : ""}` : "press \u2192 to browse" }),
       creating !== null ? /* @__PURE__ */ jsxs4(Box4, { children: [
         /* @__PURE__ */ jsx4(Text4, { color: theme.warn, children: "new policy name: " }),
         /* @__PURE__ */ jsx4(TextInput3, { value: creating, onChange: setCreating, onSubmit: commitNewPolicy })
@@ -2711,12 +2827,53 @@ function PoliciesPanel({ focused }) {
       /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: rule?.id ?? "" }),
       dirtyTag
     ] }),
-    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit text \xB7 space/\u2192 toggle \xB7 s save \xB7 \u2190 back" }),
+    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit \xB7 space toggle \xB7 \u2190\u2192 move/pick \xB7 [ ] wildcards \xB7 s save \xB7 \u2190 back" }),
     /* @__PURE__ */ jsx4(Box4, { marginTop: 1, flexDirection: "column", children: FIELDS.map((f, i) => {
-      const val = rule ? f.get(rule) : "";
       const active2 = i === fi;
+      const label = /* @__PURE__ */ jsx4(Text4, { color: active2 ? theme.accentBright : void 0, children: (active2 ? "\u25B8 " : "  ") + f.label.padEnd(13) });
+      if (f.kind === "perms" && rule) {
+        return /* @__PURE__ */ jsxs4(Box4, { children: [
+          label,
+          PERMS.map((p, pi2) => {
+            const on = permList(rule).includes(p);
+            const cur = active2 && pi2 === permCursor % PERMS.length;
+            return /* @__PURE__ */ jsxs4(Text4, { color: on ? theme.ok : theme.bad, inverse: cur, children: [
+              p,
+              pi2 < PERMS.length - 1 ? "  " : ""
+            ] }, p);
+          })
+        ] }, f.label);
+      }
+      if (f.kind === "match" && rule) {
+        if (active2 && editing) {
+          return /* @__PURE__ */ jsxs4(Box4, { children: [
+            label,
+            /* @__PURE__ */ jsx4(
+              TextInput3,
+              {
+                value: editVal,
+                onChange: setEditVal,
+                onSubmit: (v2) => {
+                  if (f.set) mutate(rules.map((r, idx) => idx === ri ? f.set(r, v2) : r));
+                  setEditing(false);
+                }
+              }
+            )
+          ] }, f.label);
+        }
+        const v = f.get(rule);
+        const lOn = starActive(rule, "left");
+        const rOn = starActive(rule, "right");
+        return /* @__PURE__ */ jsxs4(Box4, { children: [
+          label,
+          /* @__PURE__ */ jsx4(Text4, { color: lOn ? theme.ok : theme.dim, children: lOn ? "\u2731 " : "\xB7 " }),
+          /* @__PURE__ */ jsx4(Text4, { dimColor: !v, children: v || "\u2014" }),
+          /* @__PURE__ */ jsx4(Text4, { color: rOn ? theme.ok : theme.dim, children: rOn ? " \u2731" : " \xB7" })
+        ] }, f.label);
+      }
+      const val = rule ? f.get(rule) : "";
       return /* @__PURE__ */ jsxs4(Box4, { children: [
-        /* @__PURE__ */ jsx4(Text4, { color: active2 ? theme.accentBright : void 0, children: (active2 ? "\u25B8 " : "  ") + f.label.padEnd(13) }),
+        label,
         active2 && editing && f.kind === "text" ? /* @__PURE__ */ jsx4(
           TextInput3,
           {
@@ -2737,6 +2894,7 @@ function PoliciesPanel({ focused }) {
         )
       ] }, f.label);
     }) }),
+    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "  * = wildcard (matches any run of chars). On Match: [ toggles a leading *, ] a trailing *  \xB7  e.g. *ping* matches any command containing ping" }),
     status ? /* @__PURE__ */ jsx4(Text4, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
   ] });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.48",
+  "version": "0.82.50",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {