@solongate/proxy 0.59.4 → 0.60.0

package/dist/tui/panels/Agents.d.ts

@@ -0,0 +1,3 @@
+export declare function AgentsPanel({ active }: {
+    active: boolean;
+}): JSX.Element;

package/dist/tui/panels/Audit.d.ts

@@ -0,0 +1,4 @@
+export declare function AuditPanel({ active, focused }: {
+    active: boolean;
+    focused: boolean;
+}): JSX.Element;

package/dist/tui/panels/Dlp.d.ts

@@ -0,0 +1,4 @@
+export declare function DlpPanel({ focused }: {
+    active: boolean;
+    focused: boolean;
+}): JSX.Element;

package/dist/tui/panels/Policies.d.ts

@@ -0,0 +1,4 @@
+export declare function PoliciesPanel({ focused }: {
+    active: boolean;
+    focused: boolean;
+}): JSX.Element;

package/dist/tui/panels/RateLimit.d.ts

@@ -0,0 +1,4 @@
+export declare function RateLimitPanel({ focused }: {
+    active: boolean;
+    focused: boolean;
+}): JSX.Element;

package/dist/tui/panels/Stats.d.ts

@@ -0,0 +1,3 @@
+export declare function StatsPanel({ active }: {
+    active: boolean;
+}): JSX.Element;

package/dist/tui/theme.d.ts

@@ -0,0 +1,16 @@
+/** Shared colors + small helpers for the Ink TUI. */
+export declare const theme: {
+    readonly accent: "cyan";
+    readonly accentBright: "#5a8ce6";
+    readonly ok: "green";
+    readonly warn: "yellow";
+    readonly bad: "red";
+    readonly dim: "gray";
+};
+/** Ink `color` for a decision string. */
+export declare function decisionColor(decision: string): string;
+/** Ink `color` for a layer/agent mode/status. */
+export declare function modeColor(m: string): string;
+export declare function sparkline(values: number[], width?: number): string;
+export declare function truncate(s: string, n: number): string;
+export declare function ago(ts: string | number): string;

package/hooks/audit.mjs

@@ -11,7 +11,7 @@ import { homedir } from 'node:os';
 // Bump on every audit.mjs change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 14;
+const HOOK_VERSION = 15;
 
 function loadEnvKey(dir) {
   try {
@@ -46,20 +46,39 @@ function loadGlobalCloudConfig() {
 // instead of a stale-TTL zero. Returns null when no matching measurement exists —
 // an unknown eval time must be stored as null, not a fake 0 that drags averages.
 function readLastEvalMs(toolName, sessionId) {
+  // Prefer the ring: average the recent same-session eval records. When several
+  // tool calls run in PARALLEL they all land here within a moment, so each one
+  // reports the burst's arithmetic-mean eval time instead of a blank (the single
+  // .last-eval flag would be overwritten / half-read under that concurrency). A
+  // lone sequential call has only itself in the window → it reports its own time.
+  try {
+    const ring = resolve('.solongate', '.eval-ring.jsonl');
+    if (existsSync(ring)) {
+      const now = Date.now();
+      const recent = [];
+      for (const line of readFileSync(ring, 'utf-8').split('\n')) {
+        if (!line) continue;
+        let r; try { r = JSON.parse(line); } catch { continue; }
+        if (!r || typeof r.ms !== 'number' || typeof r.ts !== 'number') continue;
+        if (now - r.ts > 2500) continue; // recent burst only
+        if (r.session && sessionId && r.session !== sessionId) continue;
+        recent.push(r.ms);
+      }
+      if (recent.length) return Math.max(0, Math.round(recent.reduce((a, b) => a + b, 0) / recent.length));
+    }
+  } catch {}
+  // Fallback: the single-value flag (original behavior).
   try {
     const p = resolve('.solongate', '.last-eval');
     if (!existsSync(p)) return null;
     const c = JSON.parse(readFileSync(p, 'utf-8'));
     if (!c || typeof c.ms !== 'number' || typeof c.ts !== 'number') return null;
     if (typeof c.tool === 'string') {
-      // New flag format: match this invocation (tool + session when both known);
-      // 2h ceiling only guards against a truly abandoned flag file.
       if (c.tool !== toolName) return null;
       if (c.session && sessionId && c.session !== sessionId) return null;
       if (Date.now() - c.ts > 2 * 3600 * 1000) return null;
       return Math.max(0, Math.round(c.ms));
     }
-    // Legacy flag (no tool info): keep the old conservative 30s freshness rule.
     if (Date.now() - c.ts < 30000) return Math.max(0, Math.round(c.ms));
     return null;
   } catch { return null; }

package/hooks/guard.bundled.mjs

@@ -34,9 +34,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js
 var require_json = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js"(exports, module) {
     function isValidJSON(str) {
       if (typeof str !== "string") {
         return;
@@ -57,9 +57,9 @@ var require_json = __commonJS({
   }
 });
 
-// node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js
+// ../../node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js
 var require_sprintf = __commonJS({
-  "node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js"(exports) {
+  "../../node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js"(exports) {
     !function() {
       "use strict";
       var re = {
@@ -260,26 +260,26 @@ var require_sprintf = __commonJS({
   }
 });
 
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js
 var require_strings = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js"(exports, module) {
     var vsprintf = require_sprintf().vsprintf;
     var sprintf = (s, values) => vsprintf(s, values);
     module.exports = { sprintf };
   }
 });
 
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/regex.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/regex.js
 var require_regex = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/regex.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/regex.js"(exports, module) {
     var regexSplit = (pattern, s) => s.split(RegExp(pattern));
     module.exports = { "regex.split": regexSplit };
   }
 });
 
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/PlainValue-516d5bc2.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/PlainValue-516d5bc2.js
 var require_PlainValue_516d5bc2 = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/PlainValue-516d5bc2.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/PlainValue-516d5bc2.js"(exports) {
     "use strict";
     var Char = {
       ANCHOR: "&",
@@ -1042,9 +1042,9 @@ ${ctx}
   }
 });
 
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/parse-cst.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/parse-cst.js
 var require_parse_cst = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/parse-cst.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/parse-cst.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     var BlankLine = class extends PlainValue.Node {
@@ -2535,9 +2535,9 @@ var require_parse_cst = __commonJS({
   }
 });
 
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/resolveSeq-95613e94.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/resolveSeq-95613e94.js
 var require_resolveSeq_95613e94 = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/resolveSeq-95613e94.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/resolveSeq-95613e94.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     function addCommentBefore(str, indent, comment) {
@@ -4512,9 +4512,9 @@ ${ca}` : ca;
   }
 });
 
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/warnings-793925ce.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/warnings-793925ce.js
 var require_warnings_793925ce = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/warnings-793925ce.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/warnings-793925ce.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     var resolveSeq = require_resolveSeq_95613e94();
@@ -4879,9 +4879,9 @@ ${pair.comment}` : item.comment;
   }
 });
 
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Schema-bcc6c2d7.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Schema-bcc6c2d7.js
 var require_Schema_bcc6c2d7 = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Schema-bcc6c2d7.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Schema-bcc6c2d7.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     var resolveSeq = require_resolveSeq_95613e94();
@@ -5345,9 +5345,9 @@ var require_Schema_bcc6c2d7 = __commonJS({
   }
 });
 
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Document-a8d0fbf9.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Document-a8d0fbf9.js
 var require_Document_a8d0fbf9 = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Document-a8d0fbf9.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/Document-a8d0fbf9.js"(exports) {
     "use strict";
     var PlainValue = require_PlainValue_516d5bc2();
     var resolveSeq = require_resolveSeq_95613e94();
@@ -6028,9 +6028,9 @@ ${cbNode.commentBefore}` : cb;
   }
 });
 
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/index.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/index.js
 var require_dist = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/index.js"(exports) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/dist/index.js"(exports) {
     "use strict";
     var parseCst = require_parse_cst();
     var Document$1 = require_Document_a8d0fbf9();
@@ -6099,16 +6099,16 @@ var require_dist = __commonJS({
   }
 });
 
-// node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/index.js
+// ../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/index.js
 var require_yaml = __commonJS({
-  "node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/index.js"(exports, module) {
+  "../../node_modules/.pnpm/yaml@1.10.3/node_modules/yaml/index.js"(exports, module) {
     module.exports = require_dist().YAML;
   }
 });
 
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/yaml.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/yaml.js
 var require_yaml2 = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/yaml.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/yaml.js"(exports, module) {
     var yaml = require_yaml();
     var errors = /* @__PURE__ */ new Set([
       "YAMLReferenceError",
@@ -6143,9 +6143,9 @@ var require_yaml2 = __commonJS({
   }
 });
 
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/index.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/index.js
 var require_builtins = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/index.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/index.js"(exports, module) {
     var json = require_json();
     var strings = require_strings();
     var regex = require_regex();
@@ -6159,9 +6159,9 @@ var require_builtins = __commonJS({
   }
 });
 
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/opa.js
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/opa.js
 var require_opa = __commonJS({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/opa.js"(exports, module) {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/opa.js"(exports, module) {
     var builtIns = require_builtins();
     function stringDecoder(mem) {
       return function(addr) {
@@ -6514,7 +6514,7 @@ var require_opa = __commonJS({
   }
 });
 
-// node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/index.mjs
+// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/index.mjs
 var src_exports = {};
 __export(src_exports, {
   default: () => src_default,
@@ -6522,21 +6522,21 @@ __export(src_exports, {
 });
 var import_opa, loadPolicy, src_default;
 var init_src = __esm({
-  "node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/index.mjs"() {
+  "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/index.mjs"() {
     import_opa = __toESM(require_opa(), 1);
     loadPolicy = import_opa.default.loadPolicy;
     src_default = import_opa.default;
   }
 });
 
-// packages/proxy/hooks/guard.mjs
+// hooks/guard.mjs
 import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 33;
+var HOOK_VERSION = 34;
 function localLogsOnly(security) {
   const l = security && security.localLogs;
   return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
@@ -7850,7 +7850,18 @@ process.stdin.on("end", async () => {
     try {
       const _fd = resolve(".solongate");
       mkdirSync(_fd, { recursive: true });
-      writeFileSync(join(_fd, ".last-eval"), JSON.stringify({ ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || "" }));
+      const _rec = { ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || "" };
+      writeFileSync(join(_fd, ".last-eval"), JSON.stringify(_rec));
+      try {
+        const ring = join(_fd, ".eval-ring.jsonl");
+        appendFileSync(ring, JSON.stringify(_rec) + "\n");
+        try {
+          if (statSync(ring).size > 16384)
+            writeFileSync(ring, readFileSync(ring, "utf-8").split("\n").filter(Boolean).slice(-50).join("\n") + "\n");
+        } catch {
+        }
+      } catch {
+      }
     } catch {
     }
     if (reason) {

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 33;
+const HOOK_VERSION = 34;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -1661,7 +1661,21 @@ process.stdin.on('end', async () => {
     // ALLOW path and can't time the guard itself, so it reads this file back.
     // Keyed by tool + session so the audit hook can match THIS invocation even
     // when the tool itself runs for minutes (a bare timestamp TTL lost those).
-    try { const _fd = resolve('.solongate'); mkdirSync(_fd, { recursive: true }); writeFileSync(join(_fd, '.last-eval'), JSON.stringify({ ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || '' })); } catch {}
+    try {
+      const _fd = resolve('.solongate'); mkdirSync(_fd, { recursive: true });
+      const _rec = { ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || '' };
+      writeFileSync(join(_fd, '.last-eval'), JSON.stringify(_rec));
+      // Also append to a short ring. When many tool calls run in PARALLEL they all
+      // race on the single .last-eval above (overwrite / torn read → blank eval
+      // time in the log). appendFileSync lines are atomic, so the PostToolUse
+      // audit hook can recover a value by averaging the recent same-session
+      // records — a parallel burst then shares one arithmetic-mean eval time.
+      try {
+        const ring = join(_fd, '.eval-ring.jsonl');
+        appendFileSync(ring, JSON.stringify(_rec) + '\n');
+        try { if (statSync(ring).size > 16384) writeFileSync(ring, readFileSync(ring, 'utf-8').split('\n').filter(Boolean).slice(-50).join('\n') + '\n'); } catch {}
+      } catch {}
+    } catch {}
 
     // Only log DENY decisions from guard hook.
     // ALLOW decisions are logged by the audit hook (PostToolUse) to avoid double-counting.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.59.4",
+  "version": "0.60.0",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {
@@ -60,12 +60,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
+    "ink": "^5.0.1",
+    "ink-spinner": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    "react": "^18.3.1",
     "zod": "^3.25.0"
   },
   "devDependencies": {
     "@open-policy-agent/opa-wasm": "^1.10.0",
-    "chalk": "^5.3.0",
     "@solongate/tsconfig": "workspace:*",
+    "@types/react": "^18.3.12",
+    "chalk": "^5.3.0",
     "esbuild": "^0.19.12",
     "tsup": "^8.3.0",
     "tsx": "^4.19.0",