fix: make custom policies authoritative

Author: bhdicaire

defaults/public/_headers

@@ -36,6 +36,10 @@
   Cache-Control: no-store
   X-Robots-Tag: noindex, nofollow
 
+/v8s-blocklist.json
+  Cache-Control: no-store
+  X-Robots-Tag: noindex, nofollow
+
 /redirect-targets.json
   Cache-Control: no-store
   X-Robots-Tag: noindex, nofollow

defaults/public/de/index.html

@@ -63,7 +63,7 @@ <h1 id="brand-title"><span>Vanity</span><span>URLs</span></h1>
 
   <noscript>
     <p>JavaScript ist deaktiviert</p>
-    <p><span>Kurzlink öffnens directly in the address bar, for example:</span> <a href="/test">/test</a></p>
+    <p><span>Öffne Kurzlinks direkt in der Adressleiste, zum Beispiel:</span> <a href="/test">/test</a></p>
   </noscript>
 
   <script src="/script.js"></script>

defaults/public/es/index.html

@@ -63,7 +63,7 @@ <h1 id="brand-title"><span>Vanity</span><span>URLs</span></h1>
 
   <noscript>
     <p>JavaScript está desactivado</p>
-    <p><span>Abrir enlace cortos directly in the address bar, for example:</span> <a href="/test">/test</a></p>
+    <p><span>Abre los enlaces cortos directamente en la barra de direcciones, por ejemplo:</span> <a href="/test">/test</a></p>
   </noscript>
 
   <script src="/script.js"></script>

defaults/public/fr/index.html

@@ -63,7 +63,7 @@ <h1 id="brand-title"><span>Vanity</span><span>URLs</span></h1>
 
   <noscript>
     <p>JavaScript est désactivé</p>
-    <p><span>Ouvrir le lien courts directly in the address bar, for example:</span> <a href="/test">/test</a></p>
+    <p><span>Ouvrez les liens courts directement dans la barre d'adresse, par exemple :</span> <a href="/test">/test</a></p>
   </noscript>
 
   <script src="/script.js"></script>

defaults/public/it/index.html

@@ -63,7 +63,7 @@ <h1 id="brand-title"><span>Vanity</span><span>URLs</span></h1>
 
   <noscript>
     <p>JavaScript è disattivato</p>
-    <p><span>Apri link breves directly in the address bar, for example:</span> <a href="/test">/test</a></p>
+    <p><span>Apri i link brevi direttamente nella barra degli indirizzi, ad esempio:</span> <a href="/test">/test</a></p>
   </noscript>
 
   <script src="/script.js"></script>

defaults/v8s-policies.json

@@ -80,22 +80,6 @@
       "source": "runtime-scanner-policy",
       "added_at": "2026-05-05"
     },
-    {
-      "keyword": "/wp-",
-      "category": "scanner-probe",
-      "severity": "low",
-      "reason": "Common WordPress scanner probe prefix",
-      "source": "runtime-scanner-policy",
-      "added_at": "2026-05-07"
-    },
-    {
-      "keyword": "/wp-content/",
-      "category": "scanner-probe",
-      "severity": "low",
-      "reason": "Common WordPress content directory scanner probe",
-      "source": "runtime-scanner-policy",
-      "added_at": "2026-05-07"
-    },
     {
       "keyword": "/wp-includes/",
       "category": "scanner-probe",

scripts/blocklist-policy.mjs

@@ -12,13 +12,12 @@ export function loadBlocklistPolicy(path = DEFAULT_POLICY_PATH) {
   const raw = fs.existsSync(resolvedPath) ? JSON.parse(fs.readFileSync(resolvedPath, "utf8")) : {};
   const isDefaultPolicy = path === DEFAULT_POLICY_PATH || path === LEGACY_POLICY_PATH;
   const customPath = resolvePolicyPath(DEFAULT_CUSTOM_POLICY_PATH, LEGACY_CUSTOM_POLICY_PATH);
-  const custom = isDefaultPolicy && fs.existsSync(customPath)
-    ? JSON.parse(fs.readFileSync(customPath, "utf8"))
-    : {};
+  const hasCustom = isDefaultPolicy && fs.existsSync(customPath);
+  const custom = hasCustom ? JSON.parse(fs.readFileSync(customPath, "utf8")) : {};
   const generated = isDefaultPolicy && fs.existsSync(DEFAULT_GENERATED_POLICY_PATH)
     ? JSON.parse(fs.readFileSync(DEFAULT_GENERATED_POLICY_PATH, "utf8"))
     : {};
-  const ownerPolicy = isDefaultPolicy ? mergePolicy(custom, raw) : raw;
+  const ownerPolicy = isDefaultPolicy && hasCustom ? custom : raw;
 
   return normalizePolicy(mergePolicy(ownerPolicy, generated));
 }

scripts/build.mjs

@@ -104,11 +104,10 @@ function copyRuntimeBlocklist() {
     path.join(CUSTOM_DIR, "v8s-policies.json"),
     path.join(CUSTOM_DIR, "v8s-blocklist.json")
   );
-  const base = readJsonFile(defaultPath);
-  const custom = readJsonFile(customPath);
-  const merged = mergeRuntimeBlocklist(base, custom);
+  const policyPath = fs.existsSync(customPath) ? customPath : defaultPath;
+  const policy = readJsonFile(policyPath);
 
-  fs.writeFileSync(RUNTIME_BLOCKLIST_PATH, `${JSON.stringify(merged, null, 2)}\n`);
+  fs.writeFileSync(RUNTIME_BLOCKLIST_PATH, `${JSON.stringify(policy, null, 2)}\n`);
 }
 
 function readJsonFile(filePath) {
@@ -120,57 +119,6 @@ function firstExistingPath(...paths) {
   return paths.find((filePath) => fs.existsSync(filePath)) || paths[0];
 }
 
-function mergeRuntimeBlocklist(base, custom) {
-  return {
-    ...base,
-    ...custom,
-    defaults: {
-      ...(base.defaults || {}),
-      ...(custom.defaults || {}),
-      allowed_protocols: mergeArray(
-        base.defaults?.allowed_protocols,
-        custom.defaults?.allowed_protocols
-      ),
-      blocked_file_extensions: mergeArray(
-        base.defaults?.blocked_file_extensions,
-        custom.defaults?.blocked_file_extensions
-      )
-    },
-    generated_sources: {
-      ...(base.generated_sources || {}),
-      ...(custom.generated_sources || {})
-    },
-    allow_domains: mergeEntries(base.allow_domains, custom.allow_domains, "domain"),
-    blocked_keywords: mergeEntries(base.blocked_keywords, custom.blocked_keywords, "keyword"),
-    block_domains: mergeEntries(base.block_domains, custom.block_domains, "domain")
-  };
-}
-
-function mergeArray(first = [], second = []) {
-  return [...new Set([...asArray(first), ...asArray(second)])];
-}
-
-function mergeEntries(first = [], second = [], key) {
-  const merged = new Map();
-
-  for (const entry of [...asArray(first), ...asArray(second)]) {
-    if (!entry || typeof entry !== "object") continue;
-    const value = String(entry[key] || "").trim().toLowerCase();
-    if (!value) continue;
-
-    merged.set(value, {
-      ...entry,
-      [key]: value
-    });
-  }
-
-  return [...merged.values()];
-}
-
-function asArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-
 function buildRedirectTargets() {
   log("Building v8s.json");
 

scripts/generate-blocklist.mjs

@@ -58,10 +58,12 @@ function loadGeneratedSources() {
 }
 
 function loadPolicy() {
-  const basePolicy = readJsonFile(resolvePath(POLICY_PATH, LEGACY_POLICY_PATH));
-  const customPolicy = readJsonFile(resolvePath(CUSTOM_POLICY_PATH, LEGACY_CUSTOM_POLICY_PATH));
+  const customPolicyPath = resolvePath(CUSTOM_POLICY_PATH, LEGACY_CUSTOM_POLICY_PATH);
+  if (fs.existsSync(customPolicyPath)) {
+    return readJsonFile(customPolicyPath);
+  }
 
-  return mergePolicy(customPolicy, basePolicy);
+  return readJsonFile(resolvePath(POLICY_PATH, LEGACY_POLICY_PATH));
 }
 
 function loadCategories() {
@@ -88,41 +90,13 @@ function resolvePath(primary, legacy) {
   return primary;
 }
 
-function mergePolicy(localPolicy, basePolicy) {
-  const localDefaults = localPolicy.defaults || {};
-  const baseDefaults = basePolicy.defaults || {};
-
-  return {
-    ...basePolicy,
-    ...localPolicy,
-    defaults: {
-      ...baseDefaults,
-      ...localDefaults,
-      allowed_protocols: mergeArray(baseDefaults.allowed_protocols, localDefaults.allowed_protocols),
-      blocked_file_extensions: mergeArray(baseDefaults.blocked_file_extensions, localDefaults.blocked_file_extensions)
-    },
-    generated_sources: mergeObject(basePolicy.generated_sources, localPolicy.generated_sources),
-    allow_domains: mergeArray(basePolicy.allow_domains, localPolicy.allow_domains),
-    blocked_keywords: mergeArray(basePolicy.blocked_keywords, localPolicy.blocked_keywords),
-    block_domains: mergeArray(basePolicy.block_domains, localPolicy.block_domains)
-  };
-}
-
 function mergeObject(first = {}, second = {}) {
   return {
     ...(first || {}),
     ...(second || {})
   };
 }
 
-function mergeArray(first = [], second = []) {
-  return [...asArray(first), ...asArray(second)];
-}
-
-function asArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-
 function normalizeAllowDomainEntry(entry) {
   if (typeof entry === "string") {
     return {