Method refreshPolicyOnce

src/node/services/policyService.ts:358–461

(options: { isStartup: boolean })

  }

  private async refreshPolicyOnce(options: { isStartup: boolean }): Promise<Result<void, string>> {
    const policySource = this.getActivePolicySource();
    if (policySource.kind === "none") {
      // Policy is opt-in.
      this.updateState({ source: "none", status: { state: "disabled" }, policy: null });
      return Ok(undefined);
    }

    const schemaSource: PolicySource = policySource.kind === "env" ? "env" : "governor";

    try {
      const [clientVersion, fileText] = await Promise.all([
        getClientVersion(),
        policySource.kind === "env"
          ? loadPolicyText(policySource.value)
          : loadGovernorPolicyText({
              governorOrigin: policySource.origin,
              token: policySource.token,
            }),
      ]);

      const raw = parsePolicyFile(fileText);
      const parsed = PolicyFileSchema.parse(raw);

      // Version gates
      if (parsed.minimum_client_version) {
        const min = parsed.minimum_client_version;
        if (compareVersions(clientVersion, min) < 0) {
          this.updateState({
            source: schemaSource,
            status: {
              state: "blocked",
              reason: `Mux ${clientVersion} is below required minimum_client_version ${min}`,
            },
            policy: null,
          });
          return Ok(undefined);
        }
      }

      const providerAccess = (() => {
        const list = parsed.provider_access;
        if (!list || list.length === 0) {
          return null;
        }

        return list.map((p) => {
          const forcedBaseUrl = normalizeForcedBaseUrl(p.base_url);

          const models = p.model_access;
          if (!models || models.length === 0) {
            return { id: p.id, forcedBaseUrl, allowedModels: null };
          }

          // Normalize + drop empties. An empty list means "allow all".
          const normalized = models.map((m) => m.trim()).filter(Boolean);
          if (normalized.length === 0) {
            return { id: p.id, forcedBaseUrl, allowedModels: null };