Add trust firewall proxy hooks for TrustedModules auto-reshim.

Co-authored-by: Cursor 

Author: coreybutler

build.zig

@@ -153,6 +153,20 @@ pub fn build(b: *std.Build) void {
     if (std.mem.eql(u8, app, "proxy")) {
         exe.root_module.addImport("install_safety", install_safety_module);
         exe.root_module.addImport("wintrust", wintrust_module);
+        const module_firewall_module = b.createModule(.{
+            .root_source_file = b.path("shared/module_firewall.zig"),
+            .target = target,
+            .optimize = optimize,
+        });
+        module_firewall_module.addImport("config", config_module);
+        module_firewall_module.addImport("registry", registry_module);
+        exe.root_module.addImport("module_firewall", module_firewall_module);
+        const module_firewall_tests = b.addTest(.{
+            .root_module = module_firewall_module,
+        });
+        module_firewall_tests.root_module.linkSystemLibrary("advapi32", .{});
+        const run_module_firewall_tests = b.addRunArtifact(module_firewall_tests);
+        test_step.dependOn(&run_module_firewall_tests.step);
     }
 
     exe.root_module.addImport("errors", b.createModule(.{

proxy/main.zig

@@ -7,6 +7,9 @@ const errors = @import("errors");
 const shimintegrity = @import("shimintegrity");
 const verifycache = @import("verifycache");
 const install_safety = @import("install_safety");
+const module_firewall = @import("module_firewall");
+const config = @import("config");
+const registry = @import("registry");
 
 const ParsedArgs = struct {
     override_version: ?[]const u8,
@@ -226,6 +229,8 @@ pub fn main() !void {
 
     const needs_reshim = detectReshimNeeded(command_name, parsed_args.forwarded);
 
+    const digest_before = hashFileOptional(allocator, command_path);
+
     const process_exit_code = runDelegatedCommand(
         allocator,
         node_install_dir_abs,
@@ -245,6 +250,8 @@ pub fn main() !void {
     if (needs_reshim) {
         eventlog.writeInfo(allocator, "proxy", "reshim scheduled");
         runReshim(allocator, cfg.root, node_install_dir_abs);
+    } else {
+        try maybeReshimAfterSelfUpdate(allocator, cfg.root, node_install_dir_abs, command_name, command_path, digest_before);
     }
 
     std.process.exit(process_exit_code);
@@ -1020,6 +1027,123 @@ fn parseArgs(allocator: std.mem.Allocator, args: []const []const u8) !ParsedArgs
     };
 }
 
+fn hashFileOptional(allocator: std.mem.Allocator, path: []const u8) ?[32]u8 {
+    _ = allocator;
+    var file = std.fs.openFileAbsolute(path, .{}) catch return null;
+    defer file.close();
+    var hasher = std.crypto.hash.sha2.Sha256.init(.{});
+    var buf: [8192]u8 = undefined;
+    while (true) {
+        const n = file.read(&buf) catch return null;
+        if (n == 0) break;
+        hasher.update(buf[0..n]);
+    }
+    var out: [32]u8 = undefined;
+    hasher.final(&out);
+    return out;
+}
+
+fn digestsEqual(a: ?[32]u8, b: ?[32]u8) bool {
+    if (a == null or b == null) return true; // skip trust path if unreadable
+    return std.mem.eql(u8, &a.?, &b.?);
+}
+
+fn loadTrustedModules(allocator: std.mem.Allocator) ![]const []const u8 {
+    const rules = module_firewall.loadMultiSzPolicy(allocator, module_firewall.reg_value_trusted_modules) catch &[_][]const u8{};
+    if (rules.len == 0) {
+        // Default NOT ALL
+        var out = try allocator.alloc([]const u8, 1);
+        out[0] = try allocator.dupe(u8, "NOT ALL");
+        return out;
+    }
+    return rules;
+}
+
+fn untrustedHandlerIsPrompt(allocator: std.mem.Allocator) bool {
+    const raw = registry.queryStringWithFallback(allocator, registry.preferenceHives(), config.preference_registry_root, module_firewall.reg_value_untrusted_handler) catch {
+        return false;
+    };
+    defer allocator.free(raw);
+    return std.ascii.eqlIgnoreCase(std.mem.trim(u8, raw, " \t"), "prompt");
+}
+
+fn promptTrustChange(allocator: std.mem.Allocator, command_name: []const u8) bool {
+    const nvm_path = nodeversion.resolveNvmExePath(allocator) catch {
+        return promptTrustChangeConsoleOnly(allocator, command_name);
+    };
+    defer allocator.free(nvm_path);
+
+    var child = std.process.Child.init(&.{ nvm_path, "firewall", "prompt-trust", command_name }, allocator);
+    child.stdin_behavior = .Inherit;
+    child.stdout_behavior = .Inherit;
+    child.stderr_behavior = .Inherit;
+    const term = child.spawnAndWait() catch {
+        return promptTrustChangeConsoleOnly(allocator, command_name);
+    };
+    return switch (term) {
+        .Exited => |code| code == 0,
+        else => false,
+    };
+}
+
+fn promptTrustChangeConsoleOnly(allocator: std.mem.Allocator, command_name: []const u8) bool {
+    const msg = std.fmt.allocPrint(allocator, "Untrusted module '{s}' changed after running. Approve and reshim? [y/N]: ", .{command_name}) catch {
+        return false;
+    };
+    defer allocator.free(msg);
+    std.debug.print("{s}", .{msg});
+    var stdin_buffer: [16]u8 = undefined;
+    const stdin = std.fs.File.stdin();
+    const n = stdin.read(stdin_buffer[0..]) catch return false;
+    if (n == 0) return false;
+    const answer = std.mem.trim(u8, stdin_buffer[0..n], " \t\r\n");
+    return answer.len > 0 and (answer[0] == 'y' or answer[0] == 'Y');
+}
+
+fn maybeReshimAfterSelfUpdate(
+    allocator: std.mem.Allocator,
+    install_root: []const u8,
+    node_install_dir: []const u8,
+    command_name: []const u8,
+    command_path: []const u8,
+    digest_before: ?[32]u8,
+) !void {
+    const digest_after = hashFileOptional(allocator, command_path);
+    if (digestsEqual(digest_before, digest_after)) return;
+
+    // Package managers already handled via needs_reshim.
+    if (std.ascii.eqlIgnoreCase(command_name, "npm") or
+        std.ascii.eqlIgnoreCase(command_name, "npx") or
+        std.ascii.eqlIgnoreCase(command_name, "pnpm") or
+        std.ascii.eqlIgnoreCase(command_name, "yarn") or
+        std.ascii.eqlIgnoreCase(command_name, "corepack") or
+        std.ascii.eqlIgnoreCase(command_name, "vlt"))
+    {
+        return;
+    }
+
+    const rules = try loadTrustedModules(allocator);
+    defer module_firewall.freeMultiSz(allocator, rules);
+
+    const pkg = module_firewall.PackageSpec{ .name = command_name, .version = "", .raw = command_name };
+    const trusted = module_firewall.isPackageAllowed(pkg, rules) orelse false;
+    if (trusted) {
+        eventlog.writeInfo(allocator, "proxy", "firewall trusted module changed; scheduling reshim");
+        runReshim(allocator, install_root, node_install_dir);
+        return;
+    }
+    if (untrustedHandlerIsPrompt(allocator)) {
+        if (promptTrustChange(allocator, command_name)) {
+            eventlog.writeInfo(allocator, "proxy", "firewall trust prompt accepted; scheduling reshim");
+            runReshim(allocator, install_root, node_install_dir);
+        } else {
+            eventlog.writeInfo(allocator, "proxy", "firewall trust prompt declined; VerifyCache left stale");
+        }
+        return;
+    }
+    eventlog.writeInfo(allocator, "proxy", "firewall untrusted module changed; reshim not scheduled (deny)");
+}
+
 /// Returns true when the invoked package manager command is likely to install
 /// or remove a globally-visible executable that reshim needs to reconcile.
 fn detectReshimNeeded(command_name: []const u8, args: []const []const u8) bool {

shared/module_firewall.zig

@@ -0,0 +1,170 @@
+const std = @import("std");
+const config = @import("config");
+const registry = @import("registry");
+
+pub const reg_value_trusted_modules = "TrustedModules";
+pub const reg_value_approved_modules = "ApprovedModules";
+pub const reg_value_approved_global_modules = "ApprovedGlobalModules";
+pub const reg_value_untrusted_handler = "UntrustedModuleHandlerAction";
+
+pub const PackageSpec = struct {
+    name: []const u8,
+    version: []const u8,
+    raw: []const u8,
+};
+
+fn trimAscii(s: []const u8) []const u8 {
+    return std.mem.trim(u8, s, " \t\r\n");
+}
+
+fn eqlIgnoreCase(a: []const u8, b: []const u8) bool {
+    return std.ascii.eqlIgnoreCase(a, b);
+}
+
+fn startsWithIgnoreCase(hay: []const u8, needle: []const u8) bool {
+    if (hay.len < needle.len) return false;
+    return eqlIgnoreCase(hay[0..needle.len], needle);
+}
+
+pub fn splitNameVersion(spec: []const u8) struct { name: []const u8, version: []const u8 } {
+    const s = trimAscii(spec);
+    if (s.len == 0) return .{ .name = "", .version = "" };
+    if (s[0] == '@') {
+        if (std.mem.indexOfScalar(u8, s[1..], '/')) |slash_rel| {
+            const slash = slash_rel + 1;
+            const after = s[slash + 1 ..];
+            if (std.mem.indexOfScalar(u8, after, '@')) |at| {
+                return .{ .name = s[0 .. slash + 1 + at], .version = after[at + 1 ..] };
+            }
+            return .{ .name = s, .version = "" };
+        }
+        return .{ .name = s, .version = "" };
+    }
+    if (std.mem.indexOfScalar(u8, s, '@')) |at| {
+        return .{ .name = s[0..at], .version = s[at + 1 ..] };
+    }
+    return .{ .name = s, .version = "" };
+}
+
+fn normalizeRule(raw: []const u8) struct { entry: []const u8, negated: bool } {
+    var entry = trimAscii(raw);
+    var negated = false;
+    if (startsWithIgnoreCase(entry, "not ") or startsWithIgnoreCase(entry, "not\t")) {
+        negated = true;
+        entry = trimAscii(entry[3..]);
+    } else if (entry.len > 0 and entry[0] == '!') {
+        negated = true;
+        entry = trimAscii(entry[1..]);
+    }
+    return .{ .entry = entry, .negated = negated };
+}
+
+fn nameMatches(pattern: []const u8, pkg_name: []const u8) bool {
+    if (eqlIgnoreCase(pattern, "all")) return true;
+    if (std.mem.endsWith(u8, pattern, "/*")) {
+        const org = pattern[0 .. pattern.len - 2];
+        if (pkg_name.len <= org.len) return false;
+        if (!eqlIgnoreCase(pkg_name[0..org.len], org)) return false;
+        return pkg_name[org.len] == '/';
+    }
+    return eqlIgnoreCase(pattern, pkg_name);
+}
+
+fn versionMatches(pattern_ver: []const u8, pkg_ver: []const u8) bool {
+    if (pattern_ver.len == 0) return true;
+    if (pkg_ver.len == 0) return true;
+    if (std.mem.endsWith(u8, pattern_ver, ".*")) {
+        const prefix = pattern_ver[0 .. pattern_ver.len - 2];
+        if (eqlIgnoreCase(pkg_ver, prefix)) return true;
+        if (pkg_ver.len > prefix.len and eqlIgnoreCase(pkg_ver[0..prefix.len], prefix) and pkg_ver[prefix.len] == '.') return true;
+        return false;
+    }
+    // Exact or prefix equality for MVP ranges like >= are handled loosely: exact match only in Zig;
+    // full semver ranges evaluated in Go path / HTTPS. For common 1.0.0 pins:
+    return eqlIgnoreCase(pattern_ver, pkg_ver) or startsWithIgnoreCase(pattern_ver, ">=") or startsWithIgnoreCase(pattern_ver, "^") or startsWithIgnoreCase(pattern_ver, "~");
+}
+
+fn ruleMatches(rule_entry: []const u8, pkg: PackageSpec) bool {
+    if (eqlIgnoreCase(rule_entry, "all")) return true;
+    const nv = splitNameVersion(rule_entry);
+    if (!nameMatches(nv.name, pkg.name)) return false;
+    // For range operators in Zig MVP, treat as name match (policy still useful); exact pins enforced.
+    if (nv.version.len > 0 and (nv.version[0] == '>' or nv.version[0] == '^' or nv.version[0] == '~' or nv.version[0] == '<')) {
+        return true;
+    }
+    return versionMatches(nv.version, pkg.version);
+}
+
+/// True when policy list contains an https:// URL (remote evaluation mode).
+pub fn listHasHttps(rules: []const []const u8) bool {
+    for (rules) |r| {
+        const e = trimAscii(r);
+        if (startsWithIgnoreCase(e, "https://")) return true;
+    }
+    return false;
+}
+
+/// Local-list evaluation (VersionAllowList-compatible). HTTPS URL lists return null (caller does remote).
+pub fn isPackageAllowed(pkg: PackageSpec, rules: []const []const u8) ?bool {
+    if (listHasHttps(rules)) return null;
+
+    var not_all = false;
+    var has_exclusive = false;
+    var i: usize = 0;
+    while (i < rules.len) : (i += 1) {
+        const norm = normalizeRule(rules[i]);
+        if (norm.entry.len == 0) continue;
+        if (norm.negated and eqlIgnoreCase(norm.entry, "all")) not_all = true;
+        if (!norm.negated and !eqlIgnoreCase(norm.entry, "all")) has_exclusive = true;
+    }
+
+    if (not_all) {
+        i = 0;
+        while (i < rules.len) : (i += 1) {
+            const norm = normalizeRule(rules[i]);
+            if (norm.negated) continue;
+            if (ruleMatches(norm.entry, pkg)) return true;
+        }
+        return false;
+    }
+
+    i = 0;
+    while (i < rules.len) : (i += 1) {
+        const norm = normalizeRule(rules[i]);
+        if (!norm.negated) continue;
+        if (ruleMatches(norm.entry, pkg)) return false;
+    }
+    i = 0;
+    while (i < rules.len) : (i += 1) {
+        const norm = normalizeRule(rules[i]);
+        if (norm.negated) continue;
+        if (ruleMatches(norm.entry, pkg)) return true;
+    }
+    if (has_exclusive) return false;
+    return true;
+}
+
+pub fn loadMultiSzPolicy(allocator: std.mem.Allocator, value_name: []const u8) ![]const []const u8 {
+    const policy_hives = [_]registry.Hive{ .hkey_local_machine, .hkey_current_user };
+    if (registry.queryMultiStringOptionalWithFallback(allocator, &policy_hives, config.policy_registry_root, value_name) catch null) |vals| {
+        return vals;
+    }
+    if (registry.queryMultiStringOptionalWithFallback(allocator, registry.preferenceHives(), config.preference_registry_root, value_name) catch null) |vals| {
+        return vals;
+    }
+    return &[_][]const u8{};
+}
+
+pub fn freeMultiSz(allocator: std.mem.Allocator, vals: []const []const u8) void {
+    if (vals.len == 0) return;
+    for (vals) |v| allocator.free(v);
+    allocator.free(vals);
+}
+
+test "not all with exception" {
+    const rules = [_][]const u8{ "NOT ALL", "porthog" };
+    const ok = isPackageAllowed(.{ .name = "porthog", .version = "", .raw = "porthog" }, &rules);
+    try std.testing.expect(ok != null and ok.?);
+    const deny = isPackageAllowed(.{ .name = "eslint", .version = "", .raw = "eslint" }, &rules);
+    try std.testing.expect(deny != null and !deny.?);
+}