@solongate/proxy 0.59.0 → 0.59.2

package/hooks/guard.bundled.mjs

@@ -6535,7 +6535,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 30;
+var HOOK_VERSION = 31;
 function localLogsOnly(security) {
   const l = security && security.localLogs;
   return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
@@ -7443,7 +7443,7 @@ function extractWasmFromBundle(buf) {
   }
   throw new Error("Unknown OPA bundle format");
 }
-var OPA_WASM_TTL_MS = 3e4;
+var OPA_WASM_TTL_MS = 24 * 60 * 60 * 1e3;
 async function getOpaWasmBytes(policy) {
   if (!policy || !policy.id)
     return null;
@@ -7466,7 +7466,7 @@ async function getOpaWasmBytes(policy) {
   try {
     const res = await fetch(
       API_URL + "/api/v1/policies/" + encodeURIComponent(policy.id) + "/wasm",
-      { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8e3) }
+      { headers: AUTH_HEADERS, signal: AbortSignal.timeout(2500) }
     );
     if (!res.ok)
       return stale;
@@ -7646,12 +7646,15 @@ process.stdin.on("end", async () => {
     let securityCfg = null;
     const agentKey = (AGENT_ID || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
     const policyCacheFile = join(resolve(homedir(), ".solongate"), ".policy-cache-" + agentKey + ".json");
-    const POLICY_TTL_MS = 3e3;
+    const POLICY_TTL_MS = 1e4;
     try {
       let dashboardPolicy = null;
+      let staleCache = null;
       try {
         if (existsSync(policyCacheFile)) {
           const cached = JSON.parse(readFileSync(policyCacheFile, "utf-8"));
+          if (cached && cached.policy)
+            staleCache = cached;
           if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
             if (cached.policy)
               dashboardPolicy = cached.policy;
@@ -7667,7 +7670,7 @@ process.stdin.on("end", async () => {
       }
       if (!dashboardPolicy) {
         try {
-          const res = await fetch(API_URL + "/api/v1/policies/active?agent_id=" + encodeURIComponent(AGENT_ID || "") + "&hv=" + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8e3) });
+          const res = await fetch(API_URL + "/api/v1/policies/active?agent_id=" + encodeURIComponent(AGENT_ID || "") + "&hv=" + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(2e3) });
           if (res.ok) {
             const body = await res.json();
             if (typeof body?.self_protection_enabled === "boolean")
@@ -7685,6 +7688,15 @@ process.stdin.on("end", async () => {
           }
         } catch {
         }
+        if (!dashboardPolicy && staleCache) {
+          dashboardPolicy = staleCache.policy;
+          if (typeof staleCache.selfProtect === "boolean")
+            selfProtectEnabled = staleCache.selfProtect;
+          if (staleCache.security !== void 0)
+            securityCfg = staleCache.security;
+          if (staleCache.hookVersions)
+            CLOUD_HOOK_VERSIONS = staleCache.hookVersions;
+        }
       }
       if (process.env.SOLONGATE_DEBUG) {
       }

package/hooks/guard.mjs

@@ -31,7 +31,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 30;
+const HOOK_VERSION = 31;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -1138,7 +1138,12 @@ function extractWasmFromBundle(buf) {
 // Fetches the compiled WASM for this policy from the API, with a local cache
 // keyed by a fingerprint of the policy so updates propagate. Returns the raw
 // policy.wasm bytes (Uint8Array) or null when unavailable.
-const OPA_WASM_TTL_MS = 30_000;
+// The WASM cache is keyed by `fp`, a fingerprint of the policy rules+mode, so a
+// real policy change invalidates it immediately regardless of age. The TTL is
+// therefore only a backstop for a server-side recompile that keeps the same
+// rules — a rare event — so we keep it long (24h) instead of re-downloading the
+// bundle every 30s on the hot path.
+const OPA_WASM_TTL_MS = 24 * 60 * 60 * 1000;
 async function getOpaWasmBytes(policy) {
   if (!policy || !policy.id) return null;
   const fp = djb2(JSON.stringify(policy.rules || []) + '|' + (policy.mode || ''));
@@ -1165,7 +1170,7 @@ async function getOpaWasmBytes(policy) {
   try {
     const res = await fetch(
       API_URL + '/api/v1/policies/' + encodeURIComponent(policy.id) + '/wasm',
-      { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) },
+      { headers: AUTH_HEADERS, signal: AbortSignal.timeout(2500) },
     );
     if (!res.ok) return stale; // API has no compiled WASM right now → last known good
     const bundle = Buffer.from(await res.arrayBuffer());
@@ -1426,13 +1431,26 @@ process.stdin.on('end', async () => {
     // don't share a stale cached policy.
     const agentKey = (AGENT_ID || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
     const policyCacheFile = join(resolve(homedir(), '.solongate'), '.policy-cache-' + agentKey + '.json');
-    const POLICY_TTL_MS = 3_000;
+    // Serve the cached policy without any network for TTL seconds. This is a HOT
+    // PATH — it runs before every tool call. The original 3s TTL was slow not
+    // because of the number but because it paired an 8s-timeout blocking fetch
+    // with an every-3s cadence (and stacked behind the WASM fetch + a shared
+    // rate limit). With those fixed — 2s timeout, WASM decoupled (24h/fp),
+    // last-known-good stale fallback — a short TTL is cheap again: one small
+    // ~200ms GET on a single call per window, others read the cache with no
+    // network. So keep freshness tight (10s propagation) at negligible cost.
+    const POLICY_TTL_MS = 10_000;
     try {
       let dashboardPolicy = null;
+      // Last-known-good cache, kept even past the TTL so we can fall back on it
+      // when the API is slow/unreachable instead of blocking or dropping the
+      // policy. `fresh` gates whether we skip the network entirely.
+      let staleCache = null;
       // Try cache first
       try {
         if (existsSync(policyCacheFile)) {
           const cached = JSON.parse(readFileSync(policyCacheFile, 'utf-8'));
+          if (cached && cached.policy) staleCache = cached;
           if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
             if (cached.policy) dashboardPolicy = cached.policy;
             if (typeof cached.selfProtect === 'boolean') selfProtectEnabled = cached.selfProtect;
@@ -1445,8 +1463,10 @@ process.stdin.on('end', async () => {
       if (!dashboardPolicy) {
         try {
           // Report our installed version (hv) so the dashboard can show whether
-          // this guard is on the latest build.
-          const res = await fetch(API_URL + '/api/v1/policies/active?agent_id=' + encodeURIComponent(AGENT_ID || '') + '&hv=' + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) });
+          // this guard is on the latest build. Short timeout: a stale cached
+          // policy (below) is a safe fallback, so there's no reason to block the
+          // tool for 8s waiting on a slow cloud — fail fast to last-known-good.
+          const res = await fetch(API_URL + '/api/v1/policies/active?agent_id=' + encodeURIComponent(AGENT_ID || '') + '&hv=' + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(2000) });
           if (res.ok) {
             const body = await res.json();
             // Capture the self-protection flag even when no cloud policy is set.
@@ -1457,6 +1477,14 @@ process.stdin.on('end', async () => {
             try { writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: dashboardPolicy || null, selfProtect: selfProtectEnabled, security: securityCfg, hookVersions: CLOUD_HOOK_VERSIONS })); } catch {}
           }
         } catch {}
+        // API slow/unreachable → keep enforcing the last-known-good policy rather
+        // than blocking or silently falling through to the local default.
+        if (!dashboardPolicy && staleCache) {
+          dashboardPolicy = staleCache.policy;
+          if (typeof staleCache.selfProtect === 'boolean') selfProtectEnabled = staleCache.selfProtect;
+          if (staleCache.security !== undefined) securityCfg = staleCache.security;
+          if (staleCache.hookVersions) CLOUD_HOOK_VERSIONS = staleCache.hookVersions;
+        }
       }
 
       if (process.env.SOLONGATE_DEBUG) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.59.0",
+  "version": "0.59.2",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {