npm - @solongate/proxy - Versions diffs - 0.59.3 → 0.59.5 - Mend

@solongate/proxy 0.59.3 → 0.59.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/dist/audit/index.js +0 -1
package/dist/index.js +80 -123
package/dist/inject.js +4 -4
package/dist/lib.js +3 -31
package/dist/proxy.d.ts +0 -7
package/dist/pull-push.js +2 -1
package/hooks/audit.mjs +23 -4
package/hooks/guard.bundled.mjs +107 -54
package/hooks/guard.mjs +72 -21
package/package.json +1 -1

package/dist/audit/index.js CHANGED Viewed

@@ -3164,7 +3164,6 @@ function exportHTML({ data, results }) {
   return filePath;
 }
 function exportPDF(payload) {
-  const { data, results } = payload;
   const htmlPath = exportHTML(payload);
   const pdfHtml = `<!DOCTYPE html>
 <html><head>

package/dist/index.js CHANGED Viewed

@@ -41,8 +41,8 @@ function loginCredential() {
   try {
     const p = join(homedir(), ".solongate", "cloud-guard.json");
     if (!existsSync(p)) return {};
-    const c3 = JSON.parse(readFileSync(p, "utf-8"));
-    return c3 && typeof c3 === "object" ? c3 : {};
+    const c2 = JSON.parse(readFileSync(p, "utf-8"));
+    return c2 && typeof c2 === "object" ? c2 : {};
   } catch {
     return {};
   }
@@ -78,6 +78,7 @@ async function fetchCloudPolicy(apiKey, apiUrl, policyId) {
   return {
     id: String(data.id ?? "cloud"),
     name: String(data.name ?? "Cloud Policy"),
+    description: String(data.description ?? ""),
     version: Number(data._version ?? 1),
     rules: data.rules ?? [],
     createdAt: String(data._created_at ?? ""),
@@ -197,21 +198,6 @@ function parseArgs(argv) {
   let separatorIndex = args.indexOf("--");
   const flags = separatorIndex >= 0 ? args.slice(0, separatorIndex) : args;
   let upstreamArgs = separatorIndex >= 0 ? args.slice(separatorIndex + 1) : [];
-  const flagsWithValue = /* @__PURE__ */ new Set([
-    "--policy",
-    "--name",
-    "--rate-limit",
-    "--global-rate-limit",
-    "--config",
-    "--api-key",
-    "--api-url",
-    "--upstream-url",
-    "--upstream-transport",
-    "--port",
-    "--policy-id",
-    "--id",
-    "--agent-name"
-  ]);
   for (let i = 0; i < flags.length; i++) {
     if (!flags[i].startsWith("--")) {
       if (upstreamArgs.length === 0) {
@@ -1447,9 +1433,9 @@ var require_parse_cst = __commonJS({
           offset = this.node.range.end;
         } else {
           if (inlineComment) {
-            const c3 = comments[0];
-            this.props.push(c3);
-            offset = c3.end;
+            const c2 = comments[0];
+            this.props.push(c2);
+            offset = c2.end;
           } else {
             offset = PlainValue.Node.endOfLine(src, start + 1);
           }
@@ -3190,8 +3176,8 @@ ${ctx.indent}`;
       } else if (node instanceof Collection) {
         let count = 0;
         for (const item of node.items) {
-          const c3 = getAliasCount(item, anchors);
-          if (c3 > count) count = c3;
+          const c2 = getAliasCount(item, anchors);
+          if (c2 > count) count = c2;
         }
         return count;
       } else if (node instanceof Pair) {
@@ -6580,14 +6566,14 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync4 } from "fs";
-import { resolve as resolve3, join as join4, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3 } from "fs";
+import { resolve as resolve3, join as join4, dirname } from "path";
 import { homedir as homedir2 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
 function lockFile(file) {
-  if (!existsSync4(file)) return;
+  if (!existsSync3(file)) return;
   try {
     if (process.platform === "win32") {
       try {
@@ -6613,7 +6599,7 @@ function lockFile(file) {
   }
 }
 function unlockFile(file) {
-  if (!existsSync4(file)) return;
+  if (!existsSync3(file)) return;
   try {
     if (process.platform === "win32") {
       try {
@@ -6675,11 +6661,11 @@ function globalPaths() {
   };
 }
 function readHook(filename) {
-  return readFileSync5(join4(HOOKS_DIR, filename), "utf-8");
+  return readFileSync4(join4(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
   const bundled = join4(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync4(bundled) ? readFileSync5(bundled, "utf-8") : readHook("guard.mjs");
+  return existsSync3(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -6692,12 +6678,12 @@ function runGlobalRestore() {
   const p = globalPaths();
   unlockProtected();
   removeClaudeShim();
-  if (existsSync4(p.backupPath)) {
-    writeFileSync3(p.settingsPath, readFileSync5(p.backupPath, "utf-8"));
+  if (existsSync3(p.backupPath)) {
+    writeFileSync3(p.settingsPath, readFileSync4(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
-  } else if (existsSync4(p.settingsPath)) {
+  } else if (existsSync3(p.settingsPath)) {
     try {
-      const s = JSON.parse(readFileSync5(p.settingsPath, "utf-8"));
+      const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
       delete s.hooks;
       writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
       console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
@@ -6733,17 +6719,17 @@ function shimTargets() {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join4(homedir2(), f)).filter((f) => existsSync4(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join4(homedir2(), f)).filter((f) => existsSync3(f));
 }
 function writeShimBlock(file, block) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync4(file) ? readFileSync5(file, "utf-8") : "";
+  let content = existsSync3(file) ? readFileSync4(file, "utf-8") : "";
   content = content.replace(re, "");
   if (block) {
     if (content.length && !content.endsWith("\n")) content += "\n";
     content += block + "\n";
   }
-  mkdirSync4(dirname2(file), { recursive: true });
+  mkdirSync3(dirname(file), { recursive: true });
   writeFileSync3(file, content);
 }
 function installClaudeShim(shieldPath) {
@@ -6788,7 +6774,7 @@ async function runGlobalInstall(opts = {}) {
   let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
   if (!apiKey || apiKey === "sg_live_your_key_here") {
     try {
-      const cfg = JSON.parse(readFileSync5(p.configPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
       if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
     } catch {
     }
@@ -6801,8 +6787,8 @@ async function runGlobalInstall(opts = {}) {
     process.exit(1);
   }
   const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync4(p.hooksDir, { recursive: true });
-  mkdirSync4(p.claudeDir, { recursive: true });
+  mkdirSync3(p.hooksDir, { recursive: true });
+  mkdirSync3(p.claudeDir, { recursive: true });
   unlockProtected();
   writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
   writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
@@ -6813,9 +6799,9 @@ async function runGlobalInstall(opts = {}) {
   writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
-  if (existsSync4(p.settingsPath)) {
-    const raw = readFileSync5(p.settingsPath, "utf-8");
-    if (!existsSync4(p.backupPath)) {
+  if (existsSync3(p.settingsPath)) {
+    const raw = readFileSync4(p.settingsPath, "utf-8");
+    if (!existsSync3(p.backupPath)) {
       writeFileSync3(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
@@ -6851,7 +6837,7 @@ var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
 var init_global_install = __esm({
   "src/global-install.ts"() {
     "use strict";
-    __dirname = dirname2(fileURLToPath(import.meta.url));
+    __dirname = dirname(fileURLToPath(import.meta.url));
     HOOKS_DIR = resolve3(__dirname, "..", "hooks");
     SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
     SHIM_END = "# <<< SolonGate shield <<<";
@@ -7017,7 +7003,7 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn as spawn2 } from "child_process";
 import { URL as URL2 } from "url";
-import { readFileSync as readFileSync6, existsSync as existsSync5, readdirSync, statSync } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync4, readdirSync, statSync } from "fs";
 import { resolve as resolve4 } from "path";
 import { homedir as homedir3 } from "os";
 function findCacheFile() {
@@ -7025,7 +7011,7 @@ function findCacheFile() {
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
     const f = resolve4(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync5(f)) return f;
+    if (existsSync4(f)) return f;
   }
   let best = null, bestTs = -1;
   try {
@@ -7046,10 +7032,10 @@ function findCacheFile() {
 function loadCfg() {
   try {
     const f = findCacheFile();
-    if (f && existsSync5(f)) {
-      const c3 = JSON.parse(readFileSync6(f, "utf-8"));
-      const d = c3?.security?.dlpRedact;
-      const g = c3?.security?.ghost;
+    if (f && existsSync4(f)) {
+      const c2 = JSON.parse(readFileSync5(f, "utf-8"));
+      const d = c2?.security?.dlpRedact;
+      const g = c2?.security?.ghost;
       const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
       if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [], ghost };
       return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost };
@@ -7061,15 +7047,15 @@ function loadCfg() {
 function ghostGlobToRegExp(glob) {
   let re = "";
   for (let i = 0; i < glob.length; i++) {
-    const c3 = glob[i];
-    if (c3 === "*") {
+    const c2 = glob[i];
+    if (c2 === "*") {
       if (glob[i + 1] === "*") {
         re += ".*";
         i++;
       } else re += "[^/]*";
-    } else if (c3 === "?") re += "[^/]";
-    else if ("\\^$.|+()[]{}".indexOf(c3) !== -1) re += "\\" + c3;
-    else re += c3;
+    } else if (c2 === "?") re += "[^/]";
+    else if ("\\^$.|+()[]{}".indexOf(c2) !== -1) re += "\\" + c2;
+    else re += c2;
   }
   try {
     return new RegExp("^" + re + "$");
@@ -7162,9 +7148,9 @@ function redactString(s, cfg) {
   const allow = new Set(cfg.patterns);
   let out = s;
   for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
-  for (const c3 of cfg.custom) {
+  for (const c2 of cfg.custom) {
     try {
-      out = out.replace(dlpGlobToRe(c3.re, "g"), `[REDACTED: ${c3.name || "custom"}]`);
+      out = out.replace(dlpGlobToRe(c2.re, "g"), `[REDACTED: ${c2.name || "custom"}]`);
     } catch {
     }
   }
@@ -7201,7 +7187,7 @@ function startProxy(upstream) {
   const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
   const server = createServer((req, res) => {
     const chunks = [];
-    req.on("data", (c3) => chunks.push(c3));
+    req.on("data", (c2) => chunks.push(c2));
     req.on("end", () => {
       let body = Buffer.concat(chunks);
       try {
@@ -7323,7 +7309,7 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer as createServer2 } from "http";
-import { readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync6, statSync as statSync2 } from "fs";
 import { resolve as resolve5, join as join5, isAbsolute } from "path";
 import { homedir as homedir4 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
@@ -7350,8 +7336,8 @@ async function findLogDir() {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c3 = JSON.parse(readFileSync7(join5(base, f), "utf-8"));
-        const p = c3?.security?.localLogs?.path;
+        const c2 = JSON.parse(readFileSync6(join5(base, f), "utf-8"));
+        const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
       }
@@ -7359,7 +7345,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync7(join5(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync6(join5(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -7449,7 +7435,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync7(info.file, "utf-8");
+        const text = readFileSync6(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -7501,7 +7487,7 @@ var init_logs_server = __esm({
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync4, existsSync as existsSync7, copyFileSync } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync5, copyFileSync } from "fs";
 import { resolve as resolve6 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -7559,9 +7545,9 @@ WHAT IT DOES
 `);
 }
 function detectProject() {
-  if (!existsSync7(resolve6("package.json"))) return false;
+  if (!existsSync5(resolve6("package.json"))) return false;
   try {
-    const pkg = JSON.parse(readFileSync8(resolve6("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(resolve6("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     return !!(allDeps["@modelcontextprotocol/sdk"] || allDeps["@modelcontextprotocol/server"]);
   } catch {
@@ -7570,18 +7556,18 @@ function detectProject() {
 }
 function findTsEntryFile() {
   try {
-    const pkg = JSON.parse(readFileSync8(resolve6("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(resolve6("package.json"), "utf-8"));
     if (pkg.bin) {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync7(resolve6(srcPath))) return resolve6(srcPath);
-        if (existsSync7(resolve6(binPath))) return resolve6(binPath);
+        if (existsSync5(resolve6(srcPath))) return resolve6(srcPath);
+        if (existsSync5(resolve6(binPath))) return resolve6(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync7(resolve6(srcPath))) return resolve6(srcPath);
+      if (existsSync5(resolve6(srcPath))) return resolve6(srcPath);
     }
   } catch {
   }
@@ -7593,11 +7579,11 @@ function findTsEntryFile() {
     "server.ts",
     "main.ts"
   ];
-  for (const c3 of candidates) {
-    const full = resolve6(c3);
-    if (existsSync7(full)) {
+  for (const c2 of candidates) {
+    const full = resolve6(c2);
+    if (existsSync5(full)) {
       try {
-        const content = readFileSync8(full, "utf-8");
+        const content = readFileSync7(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
           return full;
         }
@@ -7605,19 +7591,19 @@ function findTsEntryFile() {
       }
     }
   }
-  for (const c3 of candidates) {
-    if (existsSync7(resolve6(c3))) return resolve6(c3);
+  for (const c2 of candidates) {
+    if (existsSync5(resolve6(c2))) return resolve6(c2);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync7(resolve6("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync7(resolve6("yarn.lock"))) return "yarn";
+  if (existsSync5(resolve6("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync5(resolve6("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
   try {
-    const pkg = JSON.parse(readFileSync8(resolve6("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(resolve6("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (allDeps["@solongate/proxy"]) {
       log3("  @solongate/proxy already installed");
@@ -7638,7 +7624,7 @@ function installSdk() {
   }
 }
 function injectTypeScript(filePath) {
-  const original = readFileSync8(filePath, "utf-8");
+  const original = readFileSync7(filePath, "utf-8");
   const changes = [];
   let modified = original;
   if (modified.includes("SecureMcpServer")) {
@@ -7755,7 +7741,7 @@ async function main2() {
   }
   log3("  Language: TypeScript");
   const entryFile = opts.file ? resolve6(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync7(entryFile)) {
+  if (!entryFile || !existsSync5(entryFile)) {
     log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
     log3("");
     log3("  Specify it manually: --file <path>");
@@ -7768,7 +7754,7 @@ async function main2() {
   log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync7(backupPath)) {
+    if (!existsSync5(backupPath)) {
       log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -7804,7 +7790,7 @@ async function main2() {
     log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync7(backupPath)) {
+  if (!existsSync5(backupPath)) {
     copyFileSync(entryFile, backupPath);
     log3("");
     log3(`  Backup: ${backupPath}`);
@@ -7838,7 +7824,7 @@ var init_inject = __esm({
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "fs";
 import { resolve as resolve7, join as join6 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
@@ -7969,7 +7955,7 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync5(join6(dir, "src"), { recursive: true });
+  mkdirSync4(join6(dir, "src"), { recursive: true });
   writeFileSync5(
     join6(dir, "src", "index.ts"),
     `#!/usr/bin/env node
@@ -8050,12 +8036,12 @@ async function main3() {
   const opts = parseCreateArgs(process.argv);
   const dir = resolve7(opts.name);
   printBanner("Create MCP Server");
-  if (existsSync8(dir)) {
+  if (existsSync6(dir)) {
     log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
   withSpinner(`Setting up ${opts.name}...`, () => {
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
     createProject(dir, opts.name, opts.policy);
   });
   if (!opts.noInstall) {
@@ -8129,14 +8115,14 @@ var init_create = __esm({
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
 import { resolve as resolve8 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
   const envPath = resolve8(".env");
-  if (!existsSync9(envPath)) return;
+  if (!existsSync7(envPath)) return;
   try {
-    const content = readFileSync9(envPath, "utf-8");
+    const content = readFileSync8(envPath, "utf-8");
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -8233,7 +8219,7 @@ async function list(apiKey, policyId) {
     )
   );
   for (const { policy, rules } of fullPolicies) {
-    printPolicySummary(policy, rules);
+    printPolicySummary(policy, [...rules]);
   }
   log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   log5("");
@@ -8336,7 +8322,7 @@ async function pull(apiKey, file, policyId) {
   log5("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync9(file)) {
+  if (!existsSync7(file)) {
     log5(red(`ERROR: File not found: ${file}`));
     process.exit(1);
   }
@@ -8353,7 +8339,7 @@ async function push(apiKey, file, policyId) {
     log5("  solongate-proxy list");
     process.exit(1);
   }
-  const content = readFileSync9(file, "utf-8");
+  const content = readFileSync8(file, "utf-8");
   let policy;
   try {
     policy = JSON.parse(content);
@@ -8467,7 +8453,7 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import { createServer as createHttpServer } from "http";
 import { resolve as resolve2, join as join3 } from "path";
-import { mkdirSync as mkdirSync3, appendFileSync } from "fs";
+import { mkdirSync as mkdirSync2, appendFileSync } from "fs";
 // src/core/errors.ts
 var SolonGateError = class extends Error {
@@ -9677,7 +9663,7 @@ var PolicyStore = class {
 // src/policy-engine/opa/rego-compiler.ts
 import { execFileSync } from "child_process";
-import { writeFileSync, readFileSync as readFileSync2, mkdirSync as mkdirSync2, rmSync } from "fs";
+import { writeFileSync, readFileSync as readFileSync2, mkdirSync, rmSync } from "fs";
 import { join as join2 } from "path";
 import { tmpdir } from "os";
 import { randomUUID } from "crypto";
@@ -10914,8 +10900,6 @@ var SolonGateProxy = class {
   /** Agent identity for trust map — resolved from CLI flag, HTTP headers, or MCP clientInfo */
   agentId = null;
   agentName = null;
-  /** Per-session agent info for HTTP mode (keyed by session ID) */
-  httpAgentInfo = /* @__PURE__ */ new Map();
   /** Per-request sub-agent info from HTTP headers (transient, overwritten per request) */
   httpSubAgent = null;
   constructor(config) {
@@ -11121,7 +11105,7 @@ var SolonGateProxy = class {
             pid: process.pid
           };
           const debugDir = resolve2(".solongate");
-          mkdirSync3(debugDir, { recursive: true });
+          mkdirSync2(debugDir, { recursive: true });
           appendFileSync(join3(debugDir, ".debug-proxy"), JSON.stringify(debugInfo) + "\n");
         } catch {
         }
@@ -11397,33 +11381,6 @@ ${msg.content.text}`;
   /**
    * Extract protected filenames from policy DENY rules (filenameConstraints.denied).
    */
-  extractProtectedFiles() {
-    const files = /* @__PURE__ */ new Set();
-    for (const rule of this.config.policy.rules) {
-      if (rule.effect === "DENY" && rule.enabled !== false) {
-        const denied = rule.filenameConstraints?.denied;
-        if (denied) {
-          for (const f of denied) files.add(f);
-        }
-      }
-    }
-    return [...files];
-  }
-  /**
-   * Extract protected paths from policy DENY rules (pathConstraints.denied).
-   */
-  extractProtectedPaths() {
-    const paths = /* @__PURE__ */ new Set();
-    for (const rule of this.config.policy.rules) {
-      if (rule.effect === "DENY" && rule.enabled !== false) {
-        const denied = rule.pathConstraints?.denied;
-        if (denied) {
-          for (const p of denied) paths.add(p);
-        }
-      }
-    }
-    return [...paths];
-  }
   startPolicySync() {
     const apiKey = this.config.apiKey;
     if (!apiKey) return;

package/dist/inject.js CHANGED Viewed

@@ -137,8 +137,8 @@ function findTsEntryFile() {
     "server.ts",
     "main.ts"
   ];
-  for (const c3 of candidates) {
-    const full = resolve(c3);
+  for (const c2 of candidates) {
+    const full = resolve(c2);
     if (existsSync(full)) {
       try {
         const content = readFileSync(full, "utf-8");
@@ -149,8 +149,8 @@ function findTsEntryFile() {
       }
     }
   }
-  for (const c3 of candidates) {
-    if (existsSync(resolve(c3))) return resolve(c3);
+  for (const c2 of candidates) {
+    if (existsSync(resolve(c2))) return resolve(c2);
   }
   return null;
 }

package/dist/lib.js CHANGED Viewed

@@ -8991,7 +8991,7 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import { createServer as createHttpServer } from "http";
 import { resolve as resolve2, join as join3 } from "path";
-import { mkdirSync as mkdirSync3, appendFileSync } from "fs";
+import { mkdirSync as mkdirSync2, appendFileSync } from "fs";
 // src/config.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
@@ -9030,6 +9030,7 @@ async function fetchCloudPolicy(apiKey, apiUrl, policyId) {
   return {
     id: String(data.id ?? "cloud"),
     name: String(data.name ?? "Cloud Policy"),
+    description: String(data.description ?? ""),
     version: Number(data._version ?? 1),
     rules: data.rules ?? [],
     createdAt: String(data._created_at ?? ""),
@@ -9364,8 +9365,6 @@ var SolonGateProxy = class {
   /** Agent identity for trust map — resolved from CLI flag, HTTP headers, or MCP clientInfo */
   agentId = null;
   agentName = null;
-  /** Per-session agent info for HTTP mode (keyed by session ID) */
-  httpAgentInfo = /* @__PURE__ */ new Map();
   /** Per-request sub-agent info from HTTP headers (transient, overwritten per request) */
   httpSubAgent = null;
   constructor(config) {
@@ -9571,7 +9570,7 @@ var SolonGateProxy = class {
             pid: process.pid
           };
           const debugDir = resolve2(".solongate");
-          mkdirSync3(debugDir, { recursive: true });
+          mkdirSync2(debugDir, { recursive: true });
           appendFileSync(join3(debugDir, ".debug-proxy"), JSON.stringify(debugInfo) + "\n");
         } catch {
         }
@@ -9847,33 +9846,6 @@ ${msg.content.text}`;
   /**
    * Extract protected filenames from policy DENY rules (filenameConstraints.denied).
    */
-  extractProtectedFiles() {
-    const files = /* @__PURE__ */ new Set();
-    for (const rule of this.config.policy.rules) {
-      if (rule.effect === "DENY" && rule.enabled !== false) {
-        const denied = rule.filenameConstraints?.denied;
-        if (denied) {
-          for (const f of denied) files.add(f);
-        }
-      }
-    }
-    return [...files];
-  }
-  /**
-   * Extract protected paths from policy DENY rules (pathConstraints.denied).
-   */
-  extractProtectedPaths() {
-    const paths = /* @__PURE__ */ new Set();
-    for (const rule of this.config.policy.rules) {
-      if (rule.effect === "DENY" && rule.enabled !== false) {
-        const denied = rule.pathConstraints?.denied;
-        if (denied) {
-          for (const p of denied) paths.add(p);
-        }
-      }
-    }
-    return [...paths];
-  }
   startPolicySync() {
     const apiKey = this.config.apiKey;
     if (!apiKey) return;

package/dist/proxy.d.ts CHANGED Viewed

@@ -24,8 +24,6 @@ export declare class SolonGateProxy {
     /** Agent identity for trust map — resolved from CLI flag, HTTP headers, or MCP clientInfo */
     private agentId;
     private agentName;
-    /** Per-session agent info for HTTP mode (keyed by session ID) */
-    private httpAgentInfo;
     /** Per-request sub-agent info from HTTP headers (transient, overwritten per request) */
     private httpSubAgent;
     constructor(config: ProxyConfig);
@@ -74,11 +72,6 @@ export declare class SolonGateProxy {
     /**
      * Extract protected filenames from policy DENY rules (filenameConstraints.denied).
      */
-    private extractProtectedFiles;
-    /**
-     * Extract protected paths from policy DENY rules (pathConstraints.denied).
-     */
-    private extractProtectedPaths;
     private startPolicySync;
     /**
      * Start serving downstream.

package/dist/pull-push.js CHANGED Viewed

@@ -40,6 +40,7 @@ async function fetchCloudPolicy(apiKey, apiUrl, policyId) {
   return {
     id: String(data.id ?? "cloud"),
     name: String(data.name ?? "Cloud Policy"),
+    description: String(data.description ?? ""),
     version: Number(data._version ?? 1),
     rules: data.rules ?? [],
     createdAt: String(data._created_at ?? ""),
@@ -161,7 +162,7 @@ async function list(apiKey, policyId) {
     )
   );
   for (const { policy, rules } of fullPolicies) {
-    printPolicySummary(policy, rules);
+    printPolicySummary(policy, [...rules]);
   }
   log(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   log("");

package/hooks/audit.mjs CHANGED Viewed

@@ -11,7 +11,7 @@ import { homedir } from 'node:os';
 // Bump on every audit.mjs change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 14;
+const HOOK_VERSION = 15;
 function loadEnvKey(dir) {
   try {
@@ -46,20 +46,39 @@ function loadGlobalCloudConfig() {
 // instead of a stale-TTL zero. Returns null when no matching measurement exists —
 // an unknown eval time must be stored as null, not a fake 0 that drags averages.
 function readLastEvalMs(toolName, sessionId) {
+  // Prefer the ring: average the recent same-session eval records. When several
+  // tool calls run in PARALLEL they all land here within a moment, so each one
+  // reports the burst's arithmetic-mean eval time instead of a blank (the single
+  // .last-eval flag would be overwritten / half-read under that concurrency). A
+  // lone sequential call has only itself in the window → it reports its own time.
+  try {
+    const ring = resolve('.solongate', '.eval-ring.jsonl');
+    if (existsSync(ring)) {
+      const now = Date.now();
+      const recent = [];
+      for (const line of readFileSync(ring, 'utf-8').split('\n')) {
+        if (!line) continue;
+        let r; try { r = JSON.parse(line); } catch { continue; }
+        if (!r || typeof r.ms !== 'number' || typeof r.ts !== 'number') continue;
+        if (now - r.ts > 2500) continue; // recent burst only
+        if (r.session && sessionId && r.session !== sessionId) continue;
+        recent.push(r.ms);
+      }
+      if (recent.length) return Math.max(0, Math.round(recent.reduce((a, b) => a + b, 0) / recent.length));
+    }
+  } catch {}
+  // Fallback: the single-value flag (original behavior).
   try {
     const p = resolve('.solongate', '.last-eval');
     if (!existsSync(p)) return null;
     const c = JSON.parse(readFileSync(p, 'utf-8'));
     if (!c || typeof c.ms !== 'number' || typeof c.ts !== 'number') return null;
     if (typeof c.tool === 'string') {
-      // New flag format: match this invocation (tool + session when both known);
-      // 2h ceiling only guards against a truly abandoned flag file.
       if (c.tool !== toolName) return null;
       if (c.session && sessionId && c.session !== sessionId) return null;
       if (Date.now() - c.ts > 2 * 3600 * 1000) return null;
       return Math.max(0, Math.round(c.ms));
     }
-    // Legacy flag (no tool info): keep the old conservative 30s freshness rule.
     if (Date.now() - c.ts < 30000) return Math.max(0, Math.round(c.ms));
     return null;
   } catch { return null; }

package/hooks/guard.bundled.mjs CHANGED Viewed

@@ -34,9 +34,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js
 var require_json = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js"(exports, module) {
     function isValidJSON(str) {
       if (typeof str !== "string") {
         return;
@@ -57,9 +57,9 @@ var require_json = __commonJS({
   }
 });
-// node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js
+// ../../node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js
 var require_sprintf = __commonJS({
-  "node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js"(exports) {
+  "../../node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js"(exports) {
     !function() {
       "use strict";
       var re = {
@@ -260,26 +260,26 @@ var require_sprintf = __commonJS({
   }
 });
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js
 var require_strings = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js"(exports, module) {
     var vsprintf = require_sprintf().vsprintf;
     var sprintf = (s, values) => vsprintf(s, values);
     module.exports = { sprintf };
   }
 });
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/regex.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/regex.js
 var require_regex = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/regex.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/regex.js"(exports, module) {
     var regexSplit = (pattern, s) => s.split(RegExp(pattern));
     module.exports = { "regex.split": regexSplit };
   }
 });
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/PlainValue-516d5bc2.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/PlainValue-516d5bc2.js
 var require_PlainValue_516d5bc2 = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/PlainValue-516d5bc2.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/PlainValue-516d5bc2.js"(exports) {
     "use strict";
     var Char = {
       ANCHOR: "&",
@@ -1042,9 +1042,9 @@ ${ctx}
   }
 });
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/parse-cst.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/parse-cst.js
 var require_parse_cst = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/parse-cst.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/parse-cst.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     var BlankLine = class extends PlainValue.Node {
@@ -2535,9 +2535,9 @@ var require_parse_cst = __commonJS({
   }
 });
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/resolveSeq-95613e94.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/resolveSeq-95613e94.js
 var require_resolveSeq_95613e94 = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/resolveSeq-95613e94.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/resolveSeq-95613e94.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     function addCommentBefore(str, indent, comment) {
@@ -4512,9 +4512,9 @@ ${ca}` : ca;
   }
 });
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/warnings-793925ce.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/warnings-793925ce.js
 var require_warnings_793925ce = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/warnings-793925ce.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/warnings-793925ce.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     var resolveSeq = require_resolveSeq_95613e94();
@@ -4879,9 +4879,9 @@ ${pair.comment}` : item.comment;
   }
 });
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Schema-bcc6c2d7.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Schema-bcc6c2d7.js
 var require_Schema_bcc6c2d7 = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Schema-bcc6c2d7.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Schema-bcc6c2d7.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     var resolveSeq = require_resolveSeq_95613e94();
@@ -5345,9 +5345,9 @@ var require_Schema_bcc6c2d7 = __commonJS({
   }
 });
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Document-a8d0fbf9.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Document-a8d0fbf9.js
 var require_Document_a8d0fbf9 = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Document-a8d0fbf9.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Document-a8d0fbf9.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     var resolveSeq = require_resolveSeq_95613e94();
@@ -6028,9 +6028,9 @@ ${cbNode.commentBefore}` : cb;
   }
 });
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/index.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/index.js
 var require_dist = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/index.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/index.js"(exports) {
     "use strict";
     var parseCst = require_parse_cst();
     var Document$1 = require_Document_a8d0fbf9();
@@ -6099,16 +6099,16 @@ var require_dist = __commonJS({
   }
 });
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/index.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/index.js
 var require_yaml = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/index.js"(exports, module) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/index.js"(exports, module) {
     module.exports = require_dist().YAML;
   }
 });
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/yaml.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/yaml.js
 var require_yaml2 = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/yaml.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/yaml.js"(exports, module) {
     var yaml = require_yaml();
     var errors = /* @__PURE__ */ new Set([
       "YAMLReferenceError",
@@ -6143,9 +6143,9 @@ var require_yaml2 = __commonJS({
   }
 });
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/index.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/index.js
 var require_builtins = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/index.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/index.js"(exports, module) {
     var json = require_json();
     var strings = require_strings();
     var regex = require_regex();
@@ -6159,9 +6159,9 @@ var require_builtins = __commonJS({
   }
 });
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/opa.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/opa.js
 var require_opa = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/opa.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/opa.js"(exports, module) {
     var builtIns = require_builtins();
     function stringDecoder(mem) {
       return function(addr) {
@@ -6514,7 +6514,7 @@ var require_opa = __commonJS({
   }
 });
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/index.mjs
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/index.mjs
 var src_exports = {};
 __export(src_exports, {
   default: () => src_default,
@@ -6522,20 +6522,21 @@ __export(src_exports, {
 });
 var import_opa, loadPolicy, src_default;
 var init_src = __esm({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/index.mjs"() {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/index.mjs"() {
     import_opa = __toESM(require_opa(), 1);
     loadPolicy = import_opa.default.loadPolicy;
     src_default = import_opa.default;
   }
 });
-// packages/proxy/hooks/guard.mjs
+// hooks/guard.mjs
 import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from "node:fs";
+import { spawn } from "node:child_process";
 import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 32;
+var HOOK_VERSION = 34;
 function localLogsOnly(security) {
   const l = security && security.localLogs;
   return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
@@ -6713,6 +6714,51 @@ var AGENT_TYPE = process.argv[2] || "claude-code";
 var POLICY_SELECTOR = process.env.SOLONGATE_AGENT_ID || "";
 var AGENT_ID = POLICY_SELECTOR || AGENT_TYPE;
 var AGENT_NAME = process.env.SOLONGATE_AGENT_NAME || process.argv[3] || AGENT_TYPE;
+var REFRESH_MODE = process.argv.includes("--sg-refresh-policy");
+async function refreshPolicyCache() {
+  try {
+    const agentKey = (AGENT_ID || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
+    const cacheFile = join(resolve(homedir(), ".solongate"), ".policy-cache-" + agentKey + ".json");
+    let selfProtect = true, security = null, hookVersions = null, policy = null;
+    try {
+      if (existsSync(cacheFile)) {
+        const c = JSON.parse(readFileSync(cacheFile, "utf-8"));
+        if (c) {
+          policy = c.policy ?? null;
+          if (typeof c.selfProtect === "boolean")
+            selfProtect = c.selfProtect;
+          if (c.security !== void 0)
+            security = c.security;
+          if (c.hookVersions)
+            hookVersions = c.hookVersions;
+        }
+      }
+    } catch {
+    }
+    try {
+      const res = await fetch(API_URL + "/api/v1/policies/active?agent_id=" + encodeURIComponent(AGENT_ID || "") + "&hv=" + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8e3) });
+      if (res.ok) {
+        const body = await res.json();
+        if (typeof body?.self_protection_enabled === "boolean")
+          selfProtect = body.self_protection_enabled;
+        if (body?.security !== void 0)
+          security = body.security;
+        if (body?.hook_versions && typeof body.hook_versions === "object")
+          hookVersions = body.hook_versions;
+        policy = body && body.policy ? body.policy : null;
+      }
+    } catch {
+    }
+    try {
+      writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions }));
+    } catch {
+    }
+  } catch {
+  }
+}
+if (REFRESH_MODE) {
+  refreshPolicyCache().finally(() => process.exit(0));
+}
 function blockTool(reason) {
   if (AGENT_TYPE === "gemini-cli") {
     process.stdout.write(JSON.stringify({
@@ -7610,6 +7656,8 @@ function readReferencedFiles(args, cwd) {
 }
 process.stdin.on("data", (c) => input += c);
 process.stdin.on("end", async () => {
+  if (REFRESH_MODE)
+    return;
   if (process.env.SOLONGATE_DEBUG) {
   }
   if (!API_KEY) {
@@ -7671,21 +7719,6 @@ process.stdin.on("end", async () => {
       } catch {
       }
       if (refreshDue) {
-        try {
-          const res = await fetch(API_URL + "/api/v1/policies/active?agent_id=" + encodeURIComponent(AGENT_ID || "") + "&hv=" + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(2e3) });
-          if (res.ok) {
-            const body = await res.json();
-            if (typeof body?.self_protection_enabled === "boolean")
-              selfProtectEnabled = body.self_protection_enabled;
-            if (body?.security !== void 0)
-              securityCfg = body.security;
-            if (body?.hook_versions && typeof body.hook_versions === "object")
-              CLOUD_HOOK_VERSIONS = body.hook_versions;
-            if (body && body.policy)
-              dashboardPolicy = body.policy;
-          }
-        } catch {
-        }
         if (!dashboardPolicy && staleCache) {
           dashboardPolicy = staleCache.policy;
           if (typeof staleCache.selfProtect === "boolean")
@@ -7695,10 +7728,19 @@ process.stdin.on("end", async () => {
           if (staleCache.hookVersions)
             CLOUD_HOOK_VERSIONS = staleCache.hookVersions;
         }
-        const keepPolicy = dashboardPolicy || staleCache && staleCache.policy || null;
-        try {
-          writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: keepPolicy, selfProtect: selfProtectEnabled, security: securityCfg, hookVersions: CLOUD_HOOK_VERSIONS }));
-        } catch {
+        if (API_KEY) {
+          try {
+            const lock = join(resolve(homedir(), ".solongate"), ".policy-refresh-" + agentKey + ".lock");
+            const due = !existsSync(lock) || Date.now() - statSync(lock).mtimeMs > 3e3;
+            if (due) {
+              try {
+                writeFileSync(lock, String(Date.now()));
+              } catch {
+              }
+              spawn(process.execPath, [process.argv[1], AGENT_TYPE, AGENT_NAME, "--sg-refresh-policy"], { detached: true, stdio: "ignore", env: process.env }).unref();
+            }
+          } catch {
+          }
         }
       }
       if (process.env.SOLONGATE_DEBUG) {
@@ -7808,7 +7850,18 @@ process.stdin.on("end", async () => {
     try {
       const _fd = resolve(".solongate");
       mkdirSync(_fd, { recursive: true });
-      writeFileSync(join(_fd, ".last-eval"), JSON.stringify({ ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || "" }));
+      const _rec = { ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || "" };
+      writeFileSync(join(_fd, ".last-eval"), JSON.stringify(_rec));
+      try {
+        const ring = join(_fd, ".eval-ring.jsonl");
+        appendFileSync(ring, JSON.stringify(_rec) + "\n");
+        try {
+          if (statSync(ring).size > 16384)
+            writeFileSync(ring, readFileSync(ring, "utf-8").split("\n").filter(Boolean).slice(-50).join("\n") + "\n");
+        } catch {
+        }
+      } catch {
+      }
     } catch {
     }
     if (reason) {

package/hooks/guard.mjs CHANGED Viewed

@@ -22,6 +22,7 @@
  * Auto-installed by: npx @solongate/proxy init --global
  */
 import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from 'node:fs';
+import { spawn } from 'node:child_process';
 import { resolve, join, dirname, isAbsolute } from 'node:path';
 import { homedir } from 'node:os';
 import { gunzipSync } from 'node:zlib';
@@ -31,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 32;
+const HOOK_VERSION = 34;
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -248,6 +249,40 @@ const POLICY_SELECTOR = process.env.SOLONGATE_AGENT_ID || '';
 const AGENT_ID = POLICY_SELECTOR || AGENT_TYPE;
 const AGENT_NAME = process.env.SOLONGATE_AGENT_NAME || process.argv[3] || AGENT_TYPE;
+// ── Background policy refresh (stale-while-revalidate) ──
+// The hot path NEVER blocks on the network: when the policy cache is stale it
+// serves the cached (or local) policy INSTANTLY and spawns this detached mode to
+// fetch a fresh policy and rewrite the cache for the NEXT call. Result: fast tool
+// calls AND ~one-call propagation of policy changes — no long-TTL tradeoff.
+const REFRESH_MODE = process.argv.includes('--sg-refresh-policy');
+async function refreshPolicyCache() {
+  try {
+    const agentKey = (AGENT_ID || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const cacheFile = join(resolve(homedir(), '.solongate'), '.policy-cache-' + agentKey + '.json');
+    // Preserve existing fields so a failed fetch never erases the last-known-good.
+    let selfProtect = true, security = null, hookVersions = null, policy = null;
+    try {
+      if (existsSync(cacheFile)) {
+        const c = JSON.parse(readFileSync(cacheFile, 'utf-8'));
+        if (c) { policy = c.policy ?? null; if (typeof c.selfProtect === 'boolean') selfProtect = c.selfProtect; if (c.security !== undefined) security = c.security; if (c.hookVersions) hookVersions = c.hookVersions; }
+      }
+    } catch {}
+    try {
+      const res = await fetch(API_URL + '/api/v1/policies/active?agent_id=' + encodeURIComponent(AGENT_ID || '') + '&hv=' + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) });
+      if (res.ok) {
+        const body = await res.json();
+        if (typeof body?.self_protection_enabled === 'boolean') selfProtect = body.self_protection_enabled;
+        if (body?.security !== undefined) security = body.security;
+        if (body?.hook_versions && typeof body.hook_versions === 'object') hookVersions = body.hook_versions;
+        policy = (body && body.policy) ? body.policy : null;
+      }
+    } catch {}
+    // Always advance _ts (success or failure) so the hot path backs off between refreshes.
+    try { writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions })); } catch {}
+  } catch {}
+}
+if (REFRESH_MODE) { refreshPolicyCache().finally(() => process.exit(0)); }
 // ── Per-tool block/allow output ──
 // Response format depends on the agent:
 // Claude Code:  exit 2 + stderr = BLOCK, exit 0 = ALLOW
@@ -1369,6 +1404,9 @@ function readReferencedFiles(args, cwd) {
 process.stdin.on('data', c => input += c);
 process.stdin.on('end', async () => {
+  // Background-refresh invocation has no tool call to evaluate — it already ran
+  // refreshPolicyCache() at startup; do nothing on the (empty) stdin.
+  if (REFRESH_MODE) return;
   // No policy selected => no enforcement. A plain launch (no SOLONGATE_AGENT_ID)
   // is intentionally unrestricted.
   if (process.env.SOLONGATE_DEBUG) {
@@ -1466,32 +1504,31 @@ process.stdin.on('end', async () => {
           }
         }
       } catch {}
-      // Refresh from the API at most once per TTL window.
+      // Cache stale → DO NOT block the tool on the network. Serve the last-known-good
+      // policy right now (or the local policy.json fallback below if there is none)
+      // and kick off a DETACHED background refresh that rewrites the cache for the
+      // NEXT call. Stale-while-revalidate: tool calls stay instant (~ms), yet a
+      // policy change still lands within ~one call, because the fetch runs in
+      // parallel instead of on the hot path.
       if (refreshDue) {
-        try {
-          const res = await fetch(API_URL + '/api/v1/policies/active?agent_id=' + encodeURIComponent(AGENT_ID || '') + '&hv=' + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(2000) });
-          if (res.ok) {
-            const body = await res.json();
-            if (typeof body?.self_protection_enabled === 'boolean') selfProtectEnabled = body.self_protection_enabled;
-            if (body?.security !== undefined) securityCfg = body.security;
-            if (body?.hook_versions && typeof body.hook_versions === 'object') CLOUD_HOOK_VERSIONS = body.hook_versions;
-            if (body && body.policy) dashboardPolicy = body.policy;
-          }
-        } catch {}
-        // API slow/unreachable → keep enforcing the last-known-good policy.
         if (!dashboardPolicy && staleCache) {
           dashboardPolicy = staleCache.policy;
           if (typeof staleCache.selfProtect === 'boolean') selfProtectEnabled = staleCache.selfProtect;
           if (staleCache.security !== undefined) securityCfg = staleCache.security;
           if (staleCache.hookVersions) CLOUD_HOOK_VERSIONS = staleCache.hookVersions;
         }
-        // ALWAYS advance _ts after an attempt — success, stale fallback, or even a
-        // cold miss with no policy — so a slow/down endpoint is retried at most
-        // once per TTL (≈2s per 10s worst case, not 2s per call). Keep the
-        // last-known-good policy in the cache so a failed attempt never erases it;
-        // when nothing is available, enforcement falls back to ~/.solongate/policy.json below.
-        const keepPolicy = dashboardPolicy || (staleCache && staleCache.policy) || null;
-        try { writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: keepPolicy, selfProtect: selfProtectEnabled, security: securityCfg, hookVersions: CLOUD_HOOK_VERSIONS })); } catch {}
+        // Debounce: at most one background refresh in flight per ~3s, so a burst of
+        // stale calls (or several agents sharing this cache) doesn't spawn a swarm.
+        if (API_KEY) {
+          try {
+            const lock = join(resolve(homedir(), '.solongate'), '.policy-refresh-' + agentKey + '.lock');
+            const due = !existsSync(lock) || (Date.now() - statSync(lock).mtimeMs) > 3000;
+            if (due) {
+              try { writeFileSync(lock, String(Date.now())); } catch {}
+              spawn(process.execPath, [process.argv[1], AGENT_TYPE, AGENT_NAME, '--sg-refresh-policy'], { detached: true, stdio: 'ignore', env: process.env }).unref();
+            }
+          } catch {}
+        }
       }
       if (process.env.SOLONGATE_DEBUG) {
@@ -1624,7 +1661,21 @@ process.stdin.on('end', async () => {
     // ALLOW path and can't time the guard itself, so it reads this file back.
     // Keyed by tool + session so the audit hook can match THIS invocation even
     // when the tool itself runs for minutes (a bare timestamp TTL lost those).
-    try { const _fd = resolve('.solongate'); mkdirSync(_fd, { recursive: true }); writeFileSync(join(_fd, '.last-eval'), JSON.stringify({ ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || '' })); } catch {}
+    try {
+      const _fd = resolve('.solongate'); mkdirSync(_fd, { recursive: true });
+      const _rec = { ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || '' };
+      writeFileSync(join(_fd, '.last-eval'), JSON.stringify(_rec));
+      // Also append to a short ring. When many tool calls run in PARALLEL they all
+      // race on the single .last-eval above (overwrite / torn read → blank eval
+      // time in the log). appendFileSync lines are atomic, so the PostToolUse
+      // audit hook can recover a value by averaging the recent same-session
+      // records — a parallel burst then shares one arithmetic-mean eval time.
+      try {
+        const ring = join(_fd, '.eval-ring.jsonl');
+        appendFileSync(ring, JSON.stringify(_rec) + '\n');
+        try { if (statSync(ring).size > 16384) writeFileSync(ring, readFileSync(ring, 'utf-8').split('\n').filter(Boolean).slice(-50).join('\n') + '\n'); } catch {}
+      } catch {}
+    } catch {}
     // Only log DENY decisions from guard hook.
     // ALLOW decisions are logged by the audit hook (PostToolUse) to avoid double-counting.

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.59.3",
+  "version": "0.59.5",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {