Add nvm firewall trust module CLI and prompt-trust helper.

Co-authored-by: Cursor 

Author: coreybutler

src/commands/firewall/helpers.go

@@ -0,0 +1,73 @@
+package firewall
+
+import (
+	"bufio"
+	"common/notify"
+	"common/settings"
+	"fmt"
+	"nvm/log"
+	"os"
+	"strings"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// PromptTrust dual-channel (console + desktop MessageBox + toast). Either Yes advances.
+type PromptTrust struct {
+	Module string `arg:"" name:"module" help:"Module / command name that changed."`
+}
+
+func (p *PromptTrust) Run() error {
+	name := strings.TrimSpace(p.Module)
+	if name == "" {
+		return fmt.Errorf("module name required")
+	}
+	msg := fmt.Sprintf("Untrusted module '%s' changed after running. Approve and reshim?", name)
+	_ = notify.Send(settings.AppId, "NVM Firewall", msg+" Answer Yes in the dialog or type y in the console.")
+
+	result := make(chan bool, 2)
+
+	go func() {
+		fmt.Printf("%s [y/N]: ", msg)
+		reader := bufio.NewReader(os.Stdin)
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			result <- false
+			return
+		}
+		line = strings.TrimSpace(line)
+		result <- len(line) > 0 && (line[0] == 'y' || line[0] == 'Y')
+	}()
+
+	go func() {
+		result <- messageBoxYesNo("NVM Firewall", msg)
+	}()
+
+	ok := <-result
+	if ok {
+		log.LogStructured("firewall.trust_prompt_accepted", map[string]any{"module": name}, CodePolicyMutate)
+		return nil
+	}
+	log.LogStructured("firewall.trust_prompt_declined", map[string]any{"module": name}, CodePolicyMutate)
+	os.Exit(1)
+	return nil
+}
+
+func messageBoxYesNo(title, body string) bool {
+	user32 := windows.NewLazySystemDLL("user32.dll")
+	proc := user32.NewProc("MessageBoxW")
+	t, err1 := syscall.UTF16PtrFromString(title)
+	b, err2 := syscall.UTF16PtrFromString(body)
+	if err1 != nil || err2 != nil {
+		return false
+	}
+	const mbYesNo = 0x00000004
+	const mbIconQuestion = 0x00000020
+	const mbSetForeground = 0x00010000
+	const mbTopmost = 0x00040000
+	const idYes = 6
+	r, _, _ := proc.Call(0, uintptr(unsafe.Pointer(b)), uintptr(unsafe.Pointer(t)), uintptr(mbYesNo|mbIconQuestion|mbSetForeground|mbTopmost))
+	return r == idYes
+}

src/commands/firewall/root.go

@@ -0,0 +1,93 @@
+package firewall
+
+import (
+	"common/modulefirewall"
+	"common/settings"
+	"common/system"
+	"fmt"
+	"nvm/log"
+	"strings"
+)
+
+// Event codes (NVM44xx firewall range).
+const (
+	CodePolicyMutate      = 4401
+	CodeElevationRequired = 4404
+	CodeInvalidRule       = 4405
+)
+
+type Root struct {
+	Trust       TrustRoot   `cmd:"trust" help:"Manage TrustedModules for self-updating global CLIs."`
+	PromptTrust PromptTrust `cmd:"prompt-trust" hidden:"true" help:"Internal: dual-channel trust prompt for proxy."`
+}
+
+type TrustRoot struct {
+	Module TrustModule `cmd:"module" help:"Manage TrustedModules (self-update auto-reshim allow list)."`
+}
+
+type TrustModule struct {
+	Entries []string `arg:"" name:"entry" help:"Module patterns to trust for auto-reshim (or NOT  to revoke)."`
+}
+
+func requireMachine() error {
+	if err := system.RequireAdministrator(); err != nil {
+		log.ErrorStructured("firewall.elevation_required", map[string]any{
+			"error": err.Error(),
+		}, CodeElevationRequired)
+		return fmt.Errorf("firewall policy changes require an elevated administrator prompt (NVM%d): %w", CodeElevationRequired, err)
+	}
+	return nil
+}
+
+func appendSettingsList(cfgKey, regLabel string, add []string, negate bool) error {
+	if err := requireMachine(); err != nil {
+		return err
+	}
+	cur, _ := settings.Get(cfgKey)
+	var list []string
+	switch v := cur.(type) {
+	case []string:
+		list = append([]string{}, v...)
+	case string:
+		if strings.TrimSpace(v) != "" {
+			list = []string{v}
+		}
+	}
+	for _, e := range add {
+		e = strings.TrimSpace(e)
+		if e == "" {
+			continue
+		}
+		if negate && !strings.HasPrefix(strings.ToLower(e), "not ") && !strings.HasPrefix(e, "!") {
+			e = "NOT " + e
+		}
+		if err := modulefirewall.ValidateRuleEntry(e); err != nil {
+			log.ErrorStructured("firewall.invalid_rule", map[string]any{
+				"key":   cfgKey,
+				"entry": e,
+				"error": err.Error(),
+			}, CodeInvalidRule)
+			return fmt.Errorf("invalid firewall entry %q (NVM%d): %w", e, CodeInvalidRule, err)
+		}
+		list = append(list, e)
+	}
+	if err := settings.PutMachine(cfgKey, list); err != nil {
+		log.ErrorStructured("firewall.policy_mutate_failed", map[string]any{
+			"key":   cfgKey,
+			"error": err.Error(),
+		}, CodePolicyMutate)
+		return err
+	}
+	log.Logf("firewall: updated %s (+%d entries)", regLabel, len(add))
+	log.LogStructured("firewall.policy_mutated", map[string]any{
+		"key":    cfgKey,
+		"added":  add,
+		"negate": negate,
+		"action": "append",
+	}, CodePolicyMutate)
+	return nil
+}
+
+func (t *TrustModule) Run() error {
+	return appendSettingsList("trusted_modules", "TrustedModules", t.Entries, false)
+}

src/commands/root.go

@@ -4,6 +4,7 @@ import (
 	"nvm/commands/alias"
 	"nvm/commands/cache"
 	"nvm/commands/cfg"
+	"nvm/commands/firewall"
 	"nvm/commands/install"
 	"nvm/commands/license"
 	"nvm/commands/list"
@@ -26,6 +27,7 @@ type RootCommand struct {
 	Env          Env           `cmd:"env" help:"Display ${app} environment details."`
 	Cache        cache.Root    `cmd:"cache" help:"View and manage the ${app} cache."`
 	Config       cfg.Root      `cmd:"config" aliases:"cfg" help:"View and manage the ${app} configuration."`
+	Firewall     firewall.Root `cmd:"firewall" help:"Manage NVM trust firewall policy."`
 	On           Toggle        `cmd:"on" help:"Manage Node.js with ${app}."`
 	Off          Toggle        `cmd:"off" help:"Stop managing Node.js with ${app}."`
 	Doctor       Doctor        `cmd:"doctor" help:"Detect and fix common ${app} issues." hidden:"true"`

src/go.mod

@@ -44,6 +44,8 @@ replace common/cose v1.0.0 => ../../common/cose
 
 replace common/license v1.0.0 => ../../common/licensing
 
+replace common/modulefirewall v1.0.0 => ../../common/modulefirewall
+
 require (
 	common/acl v1.0.0
 	common/config v1.0.0
@@ -53,6 +55,7 @@ require (
 	common/inspect v1.0.0
 	common/license v1.0.0
 	common/mirrorauth v1.0.0
+	common/modulefirewall v1.0.0
 	common/notify v1.0.0
 	common/preferences v1.0.0
 	common/registry v1.0.0