@suveren/gateway 0.12.0 → 0.13.0

package/dist/control-plane/index.mjs

@@ -5,8 +5,8 @@ import {
 
 // src/index.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync11, renameSync as renameSync2 } from "fs";
-import { dirname as dirname8, join as join11 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync12, renameSync as renameSync2 } from "fs";
+import { dirname as dirname8, join as join12 } from "path";
 import { homedir as homedir7 } from "os";
 import express from "express";
 import { createProxyMiddleware } from "http-proxy-middleware";
@@ -732,9 +732,138 @@ import { canonicalize } from "@hap/core";
 // src/lib/as-tls-pin.ts
 import { createHash as createHash3 } from "crypto";
 import { checkServerIdentity as defaultCheckServerIdentity, rootCertificates } from "tls";
-import { Agent as HttpsAgent } from "https";
+import { Agent as HttpsAgent2 } from "https";
 import { readFileSync as readFileSync4 } from "fs";
-import { Agent, fetch as undiciFetch } from "undici";
+import { Agent, ProxyAgent, fetch as undiciFetch } from "undici";
+
+// src/lib/proxy-env.ts
+function isLoopbackHostname(hostname) {
+  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (h === "localhost") return true;
+  if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
+  return /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.test(h);
+}
+function readProxyEnv() {
+  const http = process.env.http_proxy || process.env.HTTP_PROXY || void 0;
+  const https = process.env.https_proxy || process.env.HTTPS_PROXY || void 0;
+  const noProxy = process.env.no_proxy ?? process.env.NO_PROXY ?? "";
+  return { http, https, noProxy };
+}
+function matchesNoProxy(hostname, port2, noProxy) {
+  const entries = noProxy.split(/[,\s]+/).filter(Boolean);
+  if (entries.length === 0) return false;
+  if (entries.includes("*")) return true;
+  const h = hostname.toLowerCase();
+  for (const raw of entries) {
+    const m = raw.match(/^(.+):(\d+)$/);
+    const entryHost = (m ? m[1] : raw).replace(/^\*?\./, "").toLowerCase();
+    const entryPort = m ? Number(m[2]) : 0;
+    if (entryPort && entryPort !== port2) continue;
+    if (h === entryHost || h.endsWith(`.${entryHost}`)) return true;
+  }
+  return false;
+}
+function selectProxyUrl(targetUrl) {
+  const url = typeof targetUrl === "string" ? new URL(targetUrl) : targetUrl;
+  if (isLoopbackHostname(url.hostname)) return void 0;
+  const { http, https, noProxy } = readProxyEnv();
+  const port2 = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+  if (matchesNoProxy(url.hostname, port2, noProxy)) return void 0;
+  return url.protocol === "https:" ? https ?? http : http;
+}
+
+// src/lib/proxy-https-agent.ts
+import { Agent as HttpsAgent } from "https";
+import { connect as netConnect } from "net";
+import { connect as tlsConnect } from "tls";
+var MAX_CONNECT_RESPONSE_BYTES = 64 * 1024;
+function openConnectTunnel(proxyUrl, host, port2) {
+  return new Promise((resolve2, reject) => {
+    const socket = netConnect({ host: proxyUrl.hostname, port: Number(proxyUrl.port) || 80 });
+    const onSocketError = (err) => {
+      socket.removeListener("data", onData);
+      reject(err);
+    };
+    socket.once("error", onSocketError);
+    socket.once("connect", () => {
+      const authHeader = proxyUrl.username ? `Proxy-Authorization: Basic ${Buffer.from(
+        `${decodeURIComponent(proxyUrl.username)}:${decodeURIComponent(proxyUrl.password)}`
+      ).toString("base64")}\r
+` : "";
+      socket.write(
+        `CONNECT ${host}:${port2} HTTP/1.1\r
+Host: ${host}:${port2}\r
+${authHeader}Proxy-Connection: Keep-Alive\r
+\r
+`
+      );
+    });
+    let buffered = Buffer.alloc(0);
+    const onData = (chunk) => {
+      buffered = Buffer.concat([buffered, chunk]);
+      const headerEnd = buffered.indexOf("\r\n\r\n");
+      if (headerEnd === -1) {
+        if (buffered.length > MAX_CONNECT_RESPONSE_BYTES) {
+          socket.removeListener("error", onSocketError);
+          socket.destroy();
+          reject(new Error(`Proxy CONNECT response to ${host}:${port2} exceeded ${MAX_CONNECT_RESPONSE_BYTES} bytes without completing`));
+        }
+        return;
+      }
+      socket.removeListener("data", onData);
+      socket.removeListener("error", onSocketError);
+      const statusLine = buffered.subarray(0, buffered.indexOf("\r\n")).toString("latin1");
+      const statusCode = Number(statusLine.split(" ")[1]);
+      if (statusCode !== 200) {
+        socket.destroy();
+        reject(new Error(`Proxy CONNECT to ${host}:${port2} failed: ${statusLine.trim() || `unexpected status ${statusCode}`}`));
+        return;
+      }
+      const extra = buffered.subarray(headerEnd + 4);
+      if (extra.length > 0) socket.unshift(extra);
+      resolve2(socket);
+    };
+    socket.on("data", onData);
+  });
+}
+var ConnectTunnelHttpsAgent = class extends HttpsAgent {
+  proxyUrl;
+  constructor(options) {
+    const { proxyUrl, ...agentOptions } = options;
+    super(agentOptions);
+    this.proxyUrl = new URL(proxyUrl);
+  }
+  /**
+   * Matches `https.Agent`'s own `createConnection` signature exactly (see
+   * `node:https`'s type definitions) so this remains a true override — the
+   * base type's `callback` parameter is optional (a from-scratch `Agent`
+   * subclass is allowed to connect synchronously and return the stream
+   * directly instead), but every real caller in this codebase (Node's own
+   * HTTP client machinery) always supplies one, since a CONNECT tunnel is
+   * inherently asynchronous. The explicit runtime check turns a theoretical
+   * synchronous caller into a clear error instead of a silent no-op.
+   */
+  createConnection(options, callback) {
+    if (!callback) {
+      throw new Error("ConnectTunnelHttpsAgent.createConnection requires a callback (synchronous connection creation is not supported)");
+    }
+    const host = options.host ?? "localhost";
+    const port2 = options.port != null ? Number(options.port) : 443;
+    openConnectTunnel(this.proxyUrl, host, port2).then((tunnelSocket) => {
+      const tlsSocket = tlsConnect({
+        ...this.options,
+        ...options,
+        socket: tunnelSocket
+      });
+      tlsSocket.once("close", () => tunnelSocket.destroy());
+      tlsSocket.once("secureConnect", () => callback(null, tlsSocket));
+      tlsSocket.once("error", (err) => callback(err, tlsSocket));
+    }).catch((err) => callback(err, void 0));
+    return void 0;
+  }
+};
+
+// src/lib/as-tls-pin.ts
 function effectiveCa() {
   const path = process.env.NODE_EXTRA_CA_CERTS;
   if (!path) return void 0;
@@ -794,42 +923,47 @@ function pinnedCheckServerIdentity(pinnedSpkiHex) {
     return void 0;
   };
 }
-function buildPinnedDispatcher(pinnedSpkiHex) {
-  return new Agent({
-    connect: {
-      ca: effectiveCa(),
-      checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
-    }
+function buildTlsDispatcher(url, connectOpts) {
+  const proxyUrl = selectProxyUrl(url);
+  if (proxyUrl) {
+    return new ProxyAgent({ uri: proxyUrl, requestTls: connectOpts });
+  }
+  return new Agent({ connect: connectOpts });
+}
+function buildPinnedDispatcher(pinnedSpkiHex, url) {
+  return buildTlsDispatcher(url, {
+    ca: effectiveCa(),
+    checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
   });
 }
-function buildCapturingDispatcher() {
+function buildCapturingDispatcher(url) {
   let captured;
-  const dispatcher = new Agent({
-    connect: {
-      ca: effectiveCa(),
-      checkServerIdentity: (hostname, cert) => {
-        captured = cert;
-        const defaultErr = defaultCheckServerIdentity(hostname, cert);
-        return defaultErr ? taggedCheckError(defaultErr) : void 0;
-      }
+  const dispatcher = buildTlsDispatcher(url, {
+    ca: effectiveCa(),
+    checkServerIdentity: (hostname, cert) => {
+      captured = cert;
+      const defaultErr = defaultCheckServerIdentity(hostname, cert);
+      return defaultErr ? taggedCheckError(defaultErr) : void 0;
     }
   });
   return { dispatcher, getCapturedCert: () => captured };
 }
-function buildPinnedHttpsAgent(getPinning) {
-  return new HttpsAgent({
-    checkServerIdentity: (hostname, cert) => {
-      const pinning = getPinning();
-      if (!pinning.enforce) return defaultCheckServerIdentity(hostname, cert);
-      if (!pinning.pinnedSpkiHex) {
-        return taggedCheckError(new Error(
-          `pin-tls is on but no certificate is pinned yet for ${hostname} \u2014 sign in again to establish it (re-pairing required).`
-        ));
-      }
-      return pinnedCheckServerIdentity(pinning.pinnedSpkiHex)(hostname, cert);
-    },
-    ca: effectiveCa()
-  });
+function buildPinnedHttpsAgent(getPinning, asUrl) {
+  const checkServerIdentity = (hostname, cert) => {
+    const pinning = getPinning();
+    if (!pinning.enforce) return defaultCheckServerIdentity(hostname, cert);
+    if (!pinning.pinnedSpkiHex) {
+      return taggedCheckError(new Error(
+        `pin-tls is on but no certificate is pinned yet for ${hostname} \u2014 sign in again to establish it (re-pairing required).`
+      ));
+    }
+    return pinnedCheckServerIdentity(pinning.pinnedSpkiHex)(hostname, cert);
+  };
+  const proxyUrl = selectProxyUrl(asUrl);
+  if (proxyUrl) {
+    return new ConnectTunnelHttpsAgent({ proxyUrl, checkServerIdentity, ca: effectiveCa() });
+  }
+  return new HttpsAgent2({ checkServerIdentity, ca: effectiveCa() });
 }
 var DEFAULT_AS_FETCH_TIMEOUT_MS = 15e3;
 function withBoundedSignal(init) {
@@ -837,6 +971,34 @@ function withBoundedSignal(init) {
   const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
   return { ...init, signal };
 }
+var UNKNOWN_ISSUER_CODES = /* @__PURE__ */ new Set([
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "CERT_UNTRUSTED"
+]);
+function tlsErrorCode(err) {
+  if (!(err instanceof Error)) return void 0;
+  const cause = err.cause;
+  const withCode = cause instanceof Error ? cause : err;
+  return withCode.code;
+}
+function isUnknownIssuerError(err) {
+  const code = tlsErrorCode(err);
+  return !!code && UNKNOWN_ISSUER_CODES.has(code);
+}
+function rethrowWithIssuerHint(err, url) {
+  if (isUnknownIssuerError(err)) {
+    const hinted = new Error(
+      `Could not verify the certificate presented for ${url} \u2014 its issuer is not trusted (${tlsErrorCode(err)}). This is the typical signature of a company network that inspects HTTPS traffic with its own root certificate: trust it with \`suveren-gateway config set ca-file <path-to-company-root.pem>\` (or --ca-file / NODE_EXTRA_CA_CERTS), then try again. Original error: ${describeFetchError(err)}`
+    );
+    hinted.cause = err;
+    throw hinted;
+  }
+  throw err;
+}
 function closeAfter(dispatcher, pending) {
   pending.catch(() => {
   }).finally(() => {
@@ -846,8 +1008,24 @@ function closeAfter(dispatcher, pending) {
 }
 async function fetchAs(url, init, pinning) {
   if (!pinning.enforce && !pinning.capture) {
-    const res2 = await fetch(url, withBoundedSignal(init));
-    return { res: res2 };
+    const proxyUrl = selectProxyUrl(url);
+    if (!proxyUrl) {
+      try {
+        const res2 = await fetch(url, withBoundedSignal(init));
+        return { res: res2 };
+      } catch (err) {
+        rethrowWithIssuerHint(err, url);
+      }
+    }
+    const dispatcher2 = new ProxyAgent({ uri: proxyUrl, requestTls: { ca: effectiveCa() } });
+    const pending2 = undiciFetch(url, { ...withBoundedSignal(init), dispatcher: dispatcher2 });
+    closeAfter(dispatcher2, pending2);
+    try {
+      const res2 = await pending2;
+      return { res: res2 };
+    } catch (err) {
+      rethrowWithIssuerHint(err, url);
+    }
   }
   if (pinning.enforce && !pinning.capture && !pinning.pinnedSpkiHex) {
     throw new AsTlsMismatchError(
@@ -855,27 +1033,27 @@ async function fetchAs(url, init, pinning) {
     );
   }
   if (pinning.pinnedSpkiHex && (pinning.enforce || !pinning.capture)) {
-    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex);
+    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex, url);
     const pending2 = undiciFetch(url, { ...withBoundedSignal(init), dispatcher: dispatcher2 });
     closeAfter(dispatcher2, pending2);
     try {
       const res2 = await pending2;
       return { res: res2 };
     } catch (err) {
-      if (!isPinCheckError(err)) throw err;
+      if (!isPinCheckError(err)) rethrowWithIssuerHint(err, url);
       throw new AsTlsMismatchError(
-        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. If the Authority Server's certificate changed intentionally (a new key, not just renewal), an operator must clear the pairing and sign in again to re-pin it.`
+        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. Two things produce this: (1) the Authority Server's TLS certificate genuinely changed (a new signing key, not just a renewal) \u2014 clear the pairing and sign in again to re-pin it; or (2) a TLS-inspecting proxy on this network is re-signing traffic with its own certificate \u2014 ask network/IT to exempt the Authority Server's host from TLS inspection (pin-tls refusing this, even with a trusted --ca-file, is working as intended).`
       );
     }
   }
-  const { dispatcher, getCapturedCert } = buildCapturingDispatcher();
+  const { dispatcher, getCapturedCert } = buildCapturingDispatcher(url);
   const pending = undiciFetch(url, { ...withBoundedSignal(init), dispatcher });
   closeAfter(dispatcher, pending);
   let res;
   try {
     res = await pending;
   } catch (err) {
-    if (!isPinCheckError(err)) throw err;
+    if (!isPinCheckError(err)) rethrowWithIssuerHint(err, url);
     throw new AsTlsMismatchError(
       `could not verify the Authority Server at ${url} while establishing its TLS pin \u2014 ${describeFetchError(err)}.`
     );
@@ -994,18 +1172,237 @@ async function verifyAsHoldsKey(asUrl, publicKeyHex, pinning = { enforce: false,
 }
 
 // src/lib/as-config.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3, join as join5 } from "path";
+
+// src/lib/policy.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { join as join4 } from "path";
+import { spawnSync } from "child_process";
+var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod"];
+var DEFAULT_REGISTRY_BASE_KEY = "SOFTWARE\\Policies\\Suveren\\Gateway";
+function registryKeyPath(hive) {
+  const baseKey = process.env.SUVEREN_POLICY_REGISTRY_KEY || DEFAULT_REGISTRY_BASE_KEY;
+  return `${hive}\\${baseKey}`;
+}
+function validateAsUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+  if (parsed.protocol !== "https:" && !isLocalHttp) {
+    return {
+      ok: false,
+      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
+    };
+  }
+  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
+    normalized = normalized.slice(0, -1);
+  } else if (normalized === `${parsed.origin}/`) {
+    normalized = parsed.origin;
+  }
+  return { ok: true, url: normalized };
+}
+function validateCaFile(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The CA file path is empty." };
+  if (!existsSync3(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
+  return { ok: true, path: trimmed };
+}
+function validateProxyUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The proxy URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return { ok: false, error: `"${trimmed}" must use http:// or https://.` };
+  }
+  return { ok: true, url: trimmed };
+}
+function coerceBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (value === 0) return false;
+    if (value === 1) return true;
+    return void 0;
+  }
+  if (typeof value === "string") {
+    const v = value.trim().toLowerCase();
+    if (v === "true" || v === "1") return true;
+    if (v === "false" || v === "0") return false;
+  }
+  return void 0;
+}
+function parseRegQueryOutput(stdout) {
+  const out = {};
+  const lineRe = /^ {4}(\S+)\s+(REG_SZ|REG_EXPAND_SZ|REG_DWORD|REG_QWORD|REG_BINARY|REG_MULTI_SZ)\s+(.*)$/;
+  for (const line of stdout.split(/\r?\n/)) {
+    const m = lineRe.exec(line);
+    if (!m) continue;
+    const [, name, type, rawValue] = m;
+    if (!POLICY_KEYS.includes(name)) continue;
+    const key = name;
+    if (type === "REG_DWORD" || type === "REG_QWORD") {
+      out[key] = parseInt(rawValue, 16);
+    } else {
+      out[key] = rawValue;
+    }
+  }
+  return out;
+}
+function readRegistryHive(hive) {
+  const path = registryKeyPath(hive);
+  const source = `the registry policy (${path})`;
+  if (process.env.SUVEREN_POLICY_REGISTRY === "off") return { values: {}, source };
+  if (process.platform !== "win32") return { values: {}, source };
+  let result;
+  try {
+    result = spawnSync("reg", ["query", path], { encoding: "utf8" });
+  } catch {
+    return { values: {}, source };
+  }
+  if (!result || result.status !== 0 || !result.stdout) return { values: {}, source };
+  return { values: parseRegQueryOutput(result.stdout), source };
+}
+function policyFilePath() {
+  if (process.env.SUVEREN_POLICY_FILE) return process.env.SUVEREN_POLICY_FILE;
+  if (process.platform === "win32") {
+    const programData = process.env.ProgramData || process.env.PROGRAMDATA || "C:\\ProgramData";
+    return join4(programData, "Suveren", "gateway-policy.json");
+  }
+  if (process.platform === "darwin") {
+    return "/Library/Application Support/Suveren/gateway-policy.json";
+  }
+  return "/etc/suveren/gateway-policy.json";
+}
+function readPolicyFile() {
+  const path = policyFilePath();
+  const source = `the policy file (${path})`;
+  if (!existsSync3(path)) return { values: {}, source };
+  let data;
+  try {
+    data = JSON.parse(readFileSync5(path, "utf8"));
+  } catch (err) {
+    throw new Error(`Could not parse policy file ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const values = {};
+  for (const key of POLICY_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(data, key)) {
+      values[key] = data[key];
+    }
+  }
+  return { values, source };
+}
+function mergeBySource(entries) {
+  const merged = {};
+  const sourceOf = {};
+  for (const key of POLICY_KEYS) {
+    for (const entry of entries) {
+      if (Object.prototype.hasOwnProperty.call(entry.values, key) && entry.values[key] !== void 0) {
+        merged[key] = entry.values[key];
+        sourceOf[key] = entry.source;
+        break;
+      }
+    }
+  }
+  return { merged, sourceOf };
+}
+var cached = null;
+function readPolicy() {
+  if (cached) return cached;
+  const hklm = readRegistryHive("HKLM");
+  const hkcu = readRegistryHive("HKCU");
+  const file = readPolicyFile();
+  const { merged, sourceOf } = mergeBySource([hklm, hkcu, file]);
+  const policy = {};
+  const locked = /* @__PURE__ */ new Set();
+  if (merged.AsUrl !== void 0) {
+    const v = validateAsUrl(String(merged.AsUrl));
+    if (!v.ok) {
+      throw new Error(`Invalid policy AsUrl ("${merged.AsUrl}") from ${sourceOf.AsUrl}: ${v.error}`);
+    }
+    policy.asUrl = v.url;
+    locked.add("asUrl");
+  }
+  if (merged.CaFile !== void 0) {
+    const v = validateCaFile(String(merged.CaFile));
+    if (!v.ok) {
+      throw new Error(`Invalid policy CaFile ("${merged.CaFile}") from ${sourceOf.CaFile}: ${v.error}`);
+    }
+    policy.caFile = v.path;
+    locked.add("caFile");
+  }
+  if (merged.PinTls !== void 0) {
+    const b = coerceBoolean(merged.PinTls);
+    if (b === void 0) {
+      throw new Error(
+        `Invalid policy PinTls ("${String(merged.PinTls)}") from ${sourceOf.PinTls}: must be a boolean or 0/1.`
+      );
+    }
+    policy.pinTls = b;
+    locked.add("pinTls");
+  }
+  if (merged.Proxy !== void 0) {
+    const v = validateProxyUrl(String(merged.Proxy));
+    if (!v.ok) {
+      throw new Error(`Invalid policy Proxy ("${String(merged.Proxy)}") from ${sourceOf.Proxy}: ${v.error}`);
+    }
+    policy.proxy = v.url;
+    locked.add("proxy");
+  }
+  if (merged.NoProxy !== void 0) {
+    const raw = String(merged.NoProxy).trim();
+    if (!raw) {
+      throw new Error(`Invalid policy NoProxy ("${String(merged.NoProxy)}") from ${sourceOf.NoProxy}: must not be empty.`);
+    }
+    policy.noProxy = raw;
+    locked.add("noProxy");
+  }
+  if (merged.Simulation !== void 0) {
+    const b = coerceBoolean(merged.Simulation);
+    if (b === void 0) {
+      throw new Error(
+        `Invalid policy Simulation ("${String(merged.Simulation)}") from ${sourceOf.Simulation}: must be a boolean or 0/1.`
+      );
+    }
+    policy.simulation = b;
+    locked.add("simulation");
+  }
+  if (merged.InstallMethod !== void 0) {
+    const raw = String(merged.InstallMethod).trim().toLowerCase();
+    if (raw !== "managed") {
+      throw new Error(
+        `Invalid policy InstallMethod ("${String(merged.InstallMethod)}") from ${sourceOf.InstallMethod}: only "managed" is supported.`
+      );
+    }
+    policy.installMethod = "managed";
+    locked.add("installMethod");
+  }
+  cached = { policy, locked };
+  return cached;
+}
+
+// src/lib/as-config.ts
 var DEFAULT_AS_URL = "https://www.suveren.ai";
 function configPath(dataDir) {
-  return join4(dataDir, "config.json");
+  return join5(dataDir, "config.json");
 }
 function readAsConfigStrict(dataDir) {
   const path = configPath(dataDir);
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   let data;
   try {
-    data = JSON.parse(readFileSync5(path, "utf-8"));
+    data = JSON.parse(readFileSync6(path, "utf-8"));
   } catch (err) {
     throw new Error(
       `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -1020,9 +1417,9 @@ function readAsConfigStrict(dataDir) {
 }
 function readAsConfig(dataDir) {
   const path = configPath(dataDir);
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   try {
-    const data = JSON.parse(readFileSync5(path, "utf-8"));
+    const data = JSON.parse(readFileSync6(path, "utf-8"));
     const out = {};
     if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
     if (typeof data.caFile === "string") out.caFile = data.caFile;
@@ -1040,7 +1437,7 @@ function writeAsConfig(dataDir, patch) {
   writeFileSync3(path, JSON.stringify(merged, null, 2), { encoding: "utf-8", mode: 384 });
   return merged;
 }
-function validateAsUrl(candidate) {
+function validateAsUrl2(candidate) {
   const trimmed = candidate.trim();
   if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
   let parsed;
@@ -1065,26 +1462,30 @@ function validateAsUrl(candidate) {
   return { ok: true, url: normalized };
 }
 function resolveAsUrl(dataDir, flag) {
+  const policyUrl = readPolicy().policy.asUrl;
+  if (policyUrl) return policyUrl;
   if (flag) {
-    const v = validateAsUrl(flag);
+    const v = validateAsUrl2(flag);
     if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
     return v.url;
   }
   const envUrl = process.env.SUVEREN_AS_URL;
   if (envUrl) {
-    const v = validateAsUrl(envUrl);
+    const v = validateAsUrl2(envUrl);
     if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
     return v.url;
   }
   const saved = readAsConfigStrict(dataDir).asUrl;
   if (saved) {
-    const v = validateAsUrl(saved);
+    const v = validateAsUrl2(saved);
     if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir}/config.json: ${v.error}`);
     return v.url;
   }
   return DEFAULT_AS_URL;
 }
 function resolvePinTls(dataDir) {
+  const policyPinTls = readPolicy().policy.pinTls;
+  if (policyPinTls !== void 0) return policyPinTls;
   return readAsConfig(dataDir).pinTls === true;
 }
 function validatePinTlsForUrl(pinTls, asUrl) {
@@ -1107,7 +1508,7 @@ function clearPinTlsExpectedFingerprint(dataDir) {
 var DEFAULT_SP_URL = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
 async function fetchAsPublicKey(asUrl) {
   try {
-    const res = await fetch(`${asUrl}/api/as/pubkey`, { signal: AbortSignal.timeout(5e3) });
+    const { res } = await fetchAs(`${asUrl}/api/as/pubkey`, { signal: AbortSignal.timeout(5e3) }, { enforce: false });
     if (!res.ok) {
       return {
         ok: false,
@@ -1465,6 +1866,21 @@ function credentialView(cred, textFields) {
   };
 }
 
+// src/lib/proxied-fetch.ts
+import { ProxyAgent as ProxyAgent2, fetch as undiciFetch2 } from "undici";
+function proxiedFetch(url, init) {
+  const proxyUrl = selectProxyUrl(url);
+  if (!proxyUrl) return fetch(url, init);
+  const dispatcher = new ProxyAgent2({ uri: proxyUrl });
+  const pending = undiciFetch2(url, { ...init, dispatcher });
+  pending.catch(() => {
+  }).finally(() => {
+    void dispatcher.close().catch(() => {
+    });
+  });
+  return pending;
+}
+
 // src/routes/vault.ts
 var manifestCache = null;
 async function cachedManifests() {
@@ -1573,12 +1989,12 @@ function createVaultRouter(vault2) {
         const headers = {};
         if (cred.apiKey) headers["Authorization"] = `Bearer ${cred.apiKey}`;
         if (cred.provider === "ollama") {
-          const r = await fetch(`${cred.endpoint}/api/tags`, {
+          const r = await proxiedFetch(`${cred.endpoint}/api/tags`, {
             signal: AbortSignal.timeout(3e3)
           });
           if (!r.ok) throw new Error(`Ollama: ${r.status}`);
         } else {
-          const r = await fetch(`${cred.endpoint}/models`, {
+          const r = await proxiedFetch(`${cred.endpoint}/models`, {
             headers,
             signal: AbortSignal.timeout(3e3)
           });
@@ -1697,7 +2113,7 @@ ${contextParts.join("\n")}` : "",
   try {
     let suggestion;
     if (config.provider === "ollama") {
-      const response = await fetch(`${config.endpoint}/api/chat`, {
+      const response = await proxiedFetch(`${config.endpoint}/api/chat`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -1714,7 +2130,7 @@ ${contextParts.join("\n")}` : "",
     } else {
       const headers = { "Content-Type": "application/json" };
       if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
-      const response = await fetch(`${config.endpoint}/chat/completions`, {
+      const response = await proxiedFetch(`${config.endpoint}/chat/completions`, {
         method: "POST",
         headers,
         body: JSON.stringify({
@@ -1827,7 +2243,7 @@ async function getAIChatResponse(config, request) {
   try {
     let reply;
     if (config.provider === "ollama") {
-      const response = await fetch(`${config.endpoint}/api/chat`, {
+      const response = await proxiedFetch(`${config.endpoint}/api/chat`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -1851,7 +2267,7 @@ async function getAIChatResponse(config, request) {
     } else {
       const headers = { "Content-Type": "application/json" };
       if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
-      const response = await fetch(`${config.endpoint}/chat/completions`, {
+      const response = await proxiedFetch(`${config.endpoint}/chat/completions`, {
         method: "POST",
         headers,
         body: JSON.stringify({
@@ -1889,7 +2305,7 @@ async function getAIChatResponse(config, request) {
 }
 async function callModel(config, messages, opts) {
   if (config.provider === "ollama") {
-    const response2 = await fetch(`${config.endpoint}/api/chat`, {
+    const response2 = await proxiedFetch(`${config.endpoint}/api/chat`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -1906,7 +2322,7 @@ async function callModel(config, messages, opts) {
   }
   const headers = { "Content-Type": "application/json" };
   if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
-  const response = await fetch(`${config.endpoint}/chat/completions`, {
+  const response = await proxiedFetch(`${config.endpoint}/chat/completions`, {
     method: "POST",
     headers,
     body: JSON.stringify({ model: config.model, messages, temperature: opts.temperature, max_tokens: opts.maxTokens }),
@@ -1968,7 +2384,7 @@ async function getIntentReview(config, request) {
 async function listAIModels(config) {
   try {
     if (config.provider === "ollama") {
-      const res2 = await fetch(`${config.endpoint}/api/tags`, {
+      const res2 = await proxiedFetch(`${config.endpoint}/api/tags`, {
         signal: AbortSignal.timeout(5e3)
       });
       if (!res2.ok) throw new Error(`Ollama: ${res2.status}`);
@@ -1978,7 +2394,7 @@ async function listAIModels(config) {
     }
     const headers = {};
     if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
-    const res = await fetch(`${config.endpoint}/models`, {
+    const res = await proxiedFetch(`${config.endpoint}/models`, {
       headers,
       signal: AbortSignal.timeout(8e3)
     });
@@ -2000,7 +2416,7 @@ async function listAIModels(config) {
 async function testAIConnectivity(config) {
   try {
     if (config.provider === "ollama") {
-      const res = await fetch(`${config.endpoint}/api/tags`, {
+      const res = await proxiedFetch(`${config.endpoint}/api/tags`, {
         signal: AbortSignal.timeout(3e3)
       });
       if (!res.ok) throw new Error(`Ollama: ${res.status}`);
@@ -2008,7 +2424,7 @@ async function testAIConnectivity(config) {
     } else {
       const headers = {};
       if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
-      const res = await fetch(`${config.endpoint}/models`, {
+      const res = await proxiedFetch(`${config.endpoint}/models`, {
         headers,
         signal: AbortSignal.timeout(3e3)
       });
@@ -2021,18 +2437,18 @@ async function testAIConnectivity(config) {
 }
 
 // src/lib/agent-brief-store.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var AGENT_CONTEXT_MAX_BYTES = 16 * 1024;
 function agentBriefPath() {
-  const dataDir = process.env.SUVEREN_DATA_DIR ?? join5(homedir2(), ".suveren");
-  return join5(dataDir, "context.md");
+  const dataDir = process.env.SUVEREN_DATA_DIR ?? join6(homedir2(), ".suveren");
+  return join6(dataDir, "context.md");
 }
 function readAgentBrief() {
   const filePath = agentBriefPath();
-  if (!existsSync4(filePath)) return "";
-  return readFileSync6(filePath, "utf-8");
+  if (!existsSync5(filePath)) return "";
+  return readFileSync7(filePath, "utf-8");
 }
 
 // src/routes/ai.ts
@@ -2396,7 +2812,7 @@ function createMCPRouter() {
 // src/routes/autostart.ts
 import { Router as Router6 } from "express";
 import { execFile } from "child_process";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { dirname as pathDirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
@@ -2417,7 +2833,7 @@ function findCli(dirname9 = MODULE_DIR) {
     // resolves differently between a shell and a login service — and it would
     // mask a genuinely missing CLI whenever the cwd happened to be the repo.
   ];
-  return candidates.find(existsSync5) ?? null;
+  return candidates.find(existsSync6) ?? null;
 }
 async function cli(args) {
   const bin = findCli();
@@ -2495,18 +2911,18 @@ function createAutostartRouter() {
 }
 
 // src/lib/desktop-notify.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn, spawnSync as spawnSync2 } from "child_process";
 
 // src/lib/notifier-icon.ts
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync6 } from "fs";
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync7 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join6, dirname as dirname4 } from "path";
+import { join as join7, dirname as dirname4 } from "path";
 var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
 function ensureNotifierIcon(dataDir) {
   try {
-    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join6(homedir3(), ".suveren");
-    const path = join6(dir, "notifier-icon.png");
-    if (!existsSync6(path)) {
+    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join7(homedir3(), ".suveren");
+    const path = join7(dir, "notifier-icon.png");
+    if (!existsSync7(path)) {
       mkdirSync4(dirname4(path), { recursive: true });
       writeFileSync4(path, Buffer.from(ICON_BASE64, "base64"));
     }
@@ -2600,7 +3016,7 @@ var terminalNotifierCache = null;
 function hasTerminalNotifier() {
   if (terminalNotifierCache !== null) return terminalNotifierCache;
   try {
-    const probe = spawnSync("terminal-notifier", ["-help"], { stdio: "ignore" });
+    const probe = spawnSync2("terminal-notifier", ["-help"], { stdio: "ignore" });
     terminalNotifierCache = probe.error === void 0;
   } catch {
     terminalNotifierCache = false;
@@ -2710,17 +3126,17 @@ import { Router as Router9 } from "express";
 
 // src/routes/approved-intents.ts
 import { Router as Router8 } from "express";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync7, mkdirSync as mkdirSync5 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, existsSync as existsSync8, mkdirSync as mkdirSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
-var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
-var FILE_PATH = join7(SUVEREN_DATA_DIR, "approved-intents.enc.json");
+import { join as join8 } from "path";
+var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join8(homedir4(), ".suveren");
+var FILE_PATH = join8(SUVEREN_DATA_DIR, "approved-intents.enc.json");
 function readFile() {
-  if (!existsSync7(FILE_PATH)) {
+  if (!existsSync8(FILE_PATH)) {
     return { version: 1, entries: {} };
   }
   try {
-    return JSON.parse(readFileSync7(FILE_PATH, "utf-8"));
+    return JSON.parse(readFileSync8(FILE_PATH, "utf-8"));
   } catch {
     return { version: 1, entries: {} };
   }
@@ -3025,12 +3441,12 @@ async function forceCheck() {
   }
 }
 async function ghcrToken() {
-  const res = await fetch(`https://ghcr.io/token?scope=repository:${GHCR_IMAGE}:pull`);
+  const res = await proxiedFetch(`https://ghcr.io/token?scope=repository:${GHCR_IMAGE}:pull`);
   const data = await res.json();
   return data.token;
 }
 async function ghcrDigest(tag, token) {
-  const res = await fetch(`https://ghcr.io/v2/${GHCR_IMAGE}/manifests/${tag}`, {
+  const res = await proxiedFetch(`https://ghcr.io/v2/${GHCR_IMAGE}/manifests/${tag}`, {
     method: "HEAD",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -3050,7 +3466,7 @@ async function checkDocker() {
   lastCheckedAt = Date.now();
 }
 async function checkNpm() {
-  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(NPM_PACKAGE)}/latest`);
+  const res = await proxiedFetch(`https://registry.npmjs.org/${encodeURIComponent(NPM_PACKAGE)}/latest`);
   if (!res.ok) return;
   const data = await res.json();
   latestVersion = data.version;
@@ -3093,7 +3509,7 @@ async function check() {
       checkDev();
       return;
     }
-    if (installMethod === "npm") {
+    if (installMethod === "npm" || installMethod === "managed") {
       await checkNpm();
       return;
     }
@@ -3143,19 +3559,19 @@ data: ${data}
 import { Router as Router12 } from "express";
 
 // src/lib/gateway-settings.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join8, dirname as dirname6 } from "path";
+import { join as join9, dirname as dirname6 } from "path";
 var DEFAULT_SETTINGS = {
   desktopNotifications: true
 };
 function settingsPath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join8(homedir5(), ".suveren");
-  return join8(dir, "settings.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join9(homedir5(), ".suveren");
+  return join9(dir, "settings.json");
 }
 function readSettings(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync8(settingsPath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync9(settingsPath(dataDir), "utf8"));
     return {
       desktopNotifications: typeof raw.desktopNotifications === "boolean" ? raw.desktopNotifications : DEFAULT_SETTINGS.desktopNotifications
     };
@@ -3202,20 +3618,20 @@ function createGatewaySettingsRouter() {
 import { Router as Router13 } from "express";
 
 // src/lib/archived-mandates-store.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join9, dirname as dirname7 } from "path";
+import { join as join10, dirname as dirname7 } from "path";
 var ID_PATTERN = /^[A-Za-z0-9_.:-]{1,200}$/;
 function isValidMandateId(id) {
   return typeof id === "string" && ID_PATTERN.test(id);
 }
 function storePath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join9(homedir6(), ".suveren");
-  return join9(dir, "archived-mandates.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join10(homedir6(), ".suveren");
+  return join10(dir, "archived-mandates.json");
 }
 function readArchived(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync9(storePath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync10(storePath(dataDir), "utf8"));
     if (!Array.isArray(raw.archived)) return [];
     return [...new Set(raw.archived.filter(isValidMandateId))];
   } catch {
@@ -3521,17 +3937,17 @@ function buildSessionHealth(vault2) {
 }
 
 // src/lib/denials-reader.ts
-import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync11 } from "fs";
+import { join as join11 } from "path";
 function loadDenials(dataDir, decrypt) {
-  const encPath = join10(dataDir, "denials.enc.json");
-  const plainPath = join10(dataDir, "denials.json");
-  if (existsSync8(encPath)) {
-    const { blob } = JSON.parse(readFileSync10(encPath, "utf-8"));
+  const encPath = join11(dataDir, "denials.enc.json");
+  const plainPath = join11(dataDir, "denials.json");
+  if (existsSync9(encPath)) {
+    const { blob } = JSON.parse(readFileSync11(encPath, "utf-8"));
     return JSON.parse(decrypt(blob)).records ?? [];
   }
-  if (existsSync8(plainPath)) {
-    return JSON.parse(readFileSync10(plainPath, "utf-8")).records ?? [];
+  if (existsSync9(plainPath)) {
+    return JSON.parse(readFileSync11(plainPath, "utf-8")).records ?? [];
   }
   return [];
 }
@@ -3547,15 +3963,17 @@ function selectDenials(records, opts = {}) {
 
 // src/lib/simulation-mode.ts
 function isSimulationMode() {
+  const policySimulation = readPolicy().policy.simulation;
+  if (policySimulation !== void 0) return policySimulation;
   return process.env.SUVEREN_SIMULATION === "1";
 }
 
 // src/index.ts
 (function migrateDataDir() {
   if (process.env.SUVEREN_DATA_DIR) return;
-  const oldDir = join11(homedir7(), ".hap");
-  const newDir = join11(homedir7(), ".suveren");
-  if (!existsSync9(newDir) && existsSync9(oldDir)) {
+  const oldDir = join12(homedir7(), ".hap");
+  const newDir = join12(homedir7(), ".suveren");
+  if (!existsSync10(newDir) && existsSync10(oldDir)) {
     try {
       renameSync2(oldDir, newDir);
       console.error(`[Control Plane] Migrated data directory: ${oldDir} \u2192 ${newDir}`);
@@ -3565,12 +3983,14 @@ function isSimulationMode() {
     }
   }
 })();
-var DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join11(homedir7(), ".suveren");
+var DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join12(homedir7(), ".suveren");
 var SP_URL = resolveAsUrl(DATA_DIR);
 validatePinTlsForUrl(resolvePinTls(DATA_DIR), SP_URL);
+var POLICY_LOCKED = [...readPolicy().locked];
+var POLICY_LOCKED_INSTALL_METHOD = readPolicy().policy.installMethod;
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
-var UI_DIST = process.env.HAP_UI_DIST ?? join11(import.meta.dirname ?? __dirname, "../../ui/dist");
+var UI_DIST = process.env.HAP_UI_DIST ?? join12(import.meta.dirname ?? __dirname, "../../ui/dist");
 var vault = new Vault(DATA_DIR);
 (function repairIfAsUrlChanged() {
   const pairing = readPairing(DATA_DIR);
@@ -3984,12 +4404,17 @@ app.get("/as-pairing", authGuard, (_req, res) => {
     // key (formatPinFingerprint mirrors fingerprintOf's grouping), applied
     // to the already-computed SPKI digest rather than re-hashing a key.
     pinTlsEnabled: resolvePinTls(DATA_DIR),
-    tlsPinFingerprint: paired && pairing.tlsSpkiPinHex ? formatPinFingerprint(pairing.tlsSpkiPinHex) : null
+    tlsPinFingerprint: paired && pairing.tlsSpkiPinHex ? formatPinFingerprint(pairing.tlsSpkiPinHex) : null,
+    // IT policy (see lib/policy.ts) — read-only flags so Settings can show
+    // "set by your IT" instead of the "change it via the CLI" hint, which
+    // would be actively misleading for a locked value.
+    asUrlLockedByPolicy: POLICY_LOCKED.includes("asUrl"),
+    pinTlsLockedByPolicy: POLICY_LOCKED.includes("pinTls")
   });
 });
 app.get("/denials", authGuard, (req, res) => {
   try {
-    const dataDir = process.env.SUVEREN_DATA_DIR ?? join11(homedir7(), ".suveren");
+    const dataDir = process.env.SUVEREN_DATA_DIR ?? join12(homedir7(), ".suveren");
     const all = loadDenials(dataDir, (blob) => vault.decrypt(blob));
     const since = Number(req.query.since);
     const limit = Number(req.query.limit);
@@ -4059,7 +4484,7 @@ var pinnedProxyAgent = SP_URL.startsWith("https:") ? buildPinnedHttpsAgent(() =>
     enforce: resolvePinTls(DATA_DIR),
     pinnedSpkiHex: pin && pin.asUrl === SP_URL ? pin.tlsSpkiPinHex : void 0
   };
-}) : void 0;
+}, SP_URL) : void 0;
 app.use(
   createProxyMiddleware({
     target: SP_URL,
@@ -4120,12 +4545,13 @@ app.use(
   })
 );
 function detectInstallMethod() {
-  if (existsSync9("/.dockerenv")) return "docker";
+  if (process.env.SUVEREN_INSTALL_METHOD === "managed" || POLICY_LOCKED_INSTALL_METHOD === "managed") return "managed";
+  if (existsSync10("/.dockerenv")) return "docker";
   const dir = import.meta.dirname ?? __dirname;
   if (dir.includes("/node_modules/@suveren/gateway/")) return "npm";
   let cursor = dir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync9(join11(cursor, ".git"))) return "dev";
+    if (existsSync10(join12(cursor, ".git"))) return "dev";
     const parent = dirname8(cursor);
     if (parent === cursor) break;
     cursor = parent;
@@ -4138,10 +4564,10 @@ function detectRunningVersion() {
     return process.env.HAP_BUILD_SHA ?? "dev";
   }
   const dir = import.meta.dirname ?? __dirname;
-  const bundlePkg = join11(dir, "..", "..", "package.json");
-  if (existsSync9(bundlePkg)) {
+  const bundlePkg = join12(dir, "..", "..", "package.json");
+  if (existsSync10(bundlePkg)) {
     try {
-      const pkg = JSON.parse(readFileSync11(bundlePkg, "utf8"));
+      const pkg = JSON.parse(readFileSync12(bundlePkg, "utf8"));
       if (pkg.name === "@suveren/gateway" && typeof pkg.version === "string") {
         return pkg.version;
       }
@@ -4167,13 +4593,20 @@ app.get("/health", async (req, res) => {
     // Purely local — the Authority Server never learns this. UI reads it to
     // show a gateway-wide banner ("real systems are blocked").
     simulation: isSimulationMode(),
+    // Settings IT has locked centrally (Windows registry policy, or a
+    // policy file — see lib/policy.ts). Read-only here: there is no API
+    // route that lets the UI change any of these (as-url/ca-file/pin-tls
+    // are CLI-only; simulation has no UI control either), so this exists
+    // purely so Settings can render "set by your IT" instead of controls
+    // that would silently do nothing.
+    policyLocked: POLICY_LOCKED,
     session: buildSessionHealth(vault),
     security: {
       note: "Gateway secures tool execution. Agent host isolation is the user's responsibility."
     }
   });
 });
-if (existsSync9(UI_DIST)) {
+if (existsSync10(UI_DIST)) {
   app.use(express.static(UI_DIST, {
     setHeaders: (res, filePath) => {
       if (filePath.endsWith("index.html")) {
@@ -4183,7 +4616,7 @@ if (existsSync9(UI_DIST)) {
   }));
   app.get("*", (_req, res) => {
     res.setHeader("Cache-Control", "no-store, must-revalidate");
-    res.sendFile(join11(UI_DIST, "index.html"));
+    res.sendFile(join12(UI_DIST, "index.html"));
   });
 } else {
   app.get("/", (_req, res) => {