@solongate/proxy 0.81.2 → 0.81.3

package/hooks/audit.mjs

@@ -531,7 +531,12 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
     // on the write's flush callback (and on the fire-and-forget audit POST).
     let flushed = (typeof EMITTED_PAYLOAD !== 'string');
     let fetchDone = false;
-    const maybeExit = () => { if (flushed && fetchDone) process.exit(0); };
+    // Defer the exit by one loop tick (setImmediate). Calling process.exit() in the
+    // same tick the audit-log fetch settled aborts on Windows + Node 24 with
+    // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c`
+    // — a threadpool worker is still mid-uv_async_send when exit() closes the loop's
+    // async handle. One tick lets libuv drain that completion; we then still hard-exit.
+    const maybeExit = () => { if (flushed && fetchDone) { process.exitCode = 0; setImmediate(() => { try { process.exit(0); } catch {} }); } };
     if (typeof EMITTED_PAYLOAD === 'string') {
       try { process.stdout.write(EMITTED_PAYLOAD, () => { flushed = true; maybeExit(); }); }
       catch { flushed = true; }
@@ -581,9 +586,11 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
         signal: AbortSignal.timeout(5000),
       }).catch(() => {}).finally(() => { fetchDone = true; maybeExit(); });
     }
-    // Hard backstop: exit even if the write callback or fetch never settles.
-    setTimeout(() => process.exit(0), 3000);
+    // Hard backstop: exit even if the write callback or fetch never settles. By 3s
+    // the threadpool has long drained, so a direct exit here is safe.
+    setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 3000);
   } catch {
-    process.exit(0);
+    // Defer one tick in case an error was thrown while a fetch was still settling.
+    try { setImmediate(() => { try { process.exit(0); } catch {} }); } catch { try { process.exit(0); } catch {} }
   }
 })();

package/hooks/guard.bundled.mjs

@@ -6757,7 +6757,44 @@ async function refreshPolicyCache() {
   }
 }
 if (REFRESH_MODE) {
-  refreshPolicyCache().finally(() => process.exit(0));
+  refreshPolicyCache().finally(() => {
+    process.exitCode = 0;
+    try {
+      setImmediate(() => {
+        try {
+          process.exit(0);
+        } catch {
+        }
+      });
+    } catch {
+      try {
+        process.exit(0);
+      } catch {
+      }
+    }
+  });
+}
+var SG_DONE = Symbol("sg-done");
+var _sgDone = false;
+function sgFinish(code) {
+  if (!_sgDone) {
+    _sgDone = true;
+    process.exitCode = code;
+    try {
+      setImmediate(() => {
+        try {
+          process.exit(process.exitCode || 0);
+        } catch {
+        }
+      });
+    } catch {
+      try {
+        process.exit(code);
+      } catch {
+      }
+    }
+  }
+  throw SG_DONE;
 }
 function blockTool(reason) {
   if (AGENT_TYPE === "gemini-cli") {
@@ -6765,23 +6802,23 @@ function blockTool(reason) {
       decision: "deny",
       reason: `[SolonGate] ${reason}`
     }));
-    process.exit(0);
+    sgFinish(0);
   } else {
     process.stderr.write(reason);
-    process.exit(2);
+    sgFinish(2);
   }
 }
 function allowTool() {
   if (AGENT_TYPE === "gemini-cli") {
     process.stdout.write(JSON.stringify({ decision: "allow" }));
   }
-  process.exit(0);
+  sgFinish(0);
 }
 function rewriteTool(updatedInput) {
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput }
   }));
-  process.exit(0);
+  sgFinish(0);
 }
 function writeDenyFlag(toolName) {
   try {
@@ -7661,246 +7698,252 @@ if (!REFRESH_MODE) {
   }
 }
 (async () => {
-  if (REFRESH_MODE)
-    return;
-  if (process.env.SOLONGATE_DEBUG) {
-  }
-  if (!API_KEY) {
-    allowTool();
-    return;
-  }
-  const _evalStart = Date.now();
   try {
-    const raw = JSON.parse(input);
+    if (REFRESH_MODE)
+      return;
     if (process.env.SOLONGATE_DEBUG) {
-      try {
-        const { appendFileSync: afs, mkdirSync: mds } = await import("node:fs");
-        mds(resolve(".solongate"), { recursive: true });
-        const debugLine = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), hook: "guard", argv: process.argv.slice(2), tool_name: raw.tool_name || raw.toolName || raw.command, agent_id: AGENT_ID }) + "\n";
-        afs(resolve(".solongate", ".debug-guard-log"), debugLine);
-      } catch {
-      }
     }
-    let mappedToolName = raw.tool_name || raw.toolName || "";
-    let mappedToolInput = raw.tool_input || raw.toolInput || raw.params || {};
-    const data = {
-      ...raw,
-      tool_name: mappedToolName,
-      tool_input: mappedToolInput,
-      tool_response: raw.tool_response || raw.toolResponse || {},
-      cwd: raw.cwd || process.cwd(),
-      session_id: raw.session_id || raw.sessionId || raw.conversation_id || ""
-    };
-    const args = data.tool_input;
-    const toolName = data.tool_name || "";
-    const hookCwd = data.cwd || process.cwd();
-    let policy;
-    let selfProtectEnabled = true;
-    let securityCfg = null;
-    const agentKey = (AGENT_ID || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
-    const policyCacheFile = join(resolve(homedir(), ".solongate"), ".policy-cache-" + agentKey + ".json");
-    const POLICY_TTL_MS = 1e4;
+    if (!API_KEY) {
+      allowTool();
+      return;
+    }
+    const _evalStart = Date.now();
     try {
-      let dashboardPolicy = null;
-      let staleCache = null;
-      let refreshDue = true;
+      const raw = JSON.parse(input);
+      if (process.env.SOLONGATE_DEBUG) {
+        try {
+          const { appendFileSync: afs, mkdirSync: mds } = await import("node:fs");
+          mds(resolve(".solongate"), { recursive: true });
+          const debugLine = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), hook: "guard", argv: process.argv.slice(2), tool_name: raw.tool_name || raw.toolName || raw.command, agent_id: AGENT_ID }) + "\n";
+          afs(resolve(".solongate", ".debug-guard-log"), debugLine);
+        } catch {
+        }
+      }
+      let mappedToolName = raw.tool_name || raw.toolName || "";
+      let mappedToolInput = raw.tool_input || raw.toolInput || raw.params || {};
+      const data = {
+        ...raw,
+        tool_name: mappedToolName,
+        tool_input: mappedToolInput,
+        tool_response: raw.tool_response || raw.toolResponse || {},
+        cwd: raw.cwd || process.cwd(),
+        session_id: raw.session_id || raw.sessionId || raw.conversation_id || ""
+      };
+      const args = data.tool_input;
+      const toolName = data.tool_name || "";
+      const hookCwd = data.cwd || process.cwd();
+      let policy;
+      let selfProtectEnabled = true;
+      let securityCfg = null;
+      const agentKey = (AGENT_ID || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
+      const policyCacheFile = join(resolve(homedir(), ".solongate"), ".policy-cache-" + agentKey + ".json");
+      const POLICY_TTL_MS = 1e4;
       try {
-        if (existsSync(policyCacheFile)) {
-          const cached = JSON.parse(readFileSync(policyCacheFile, "utf-8"));
-          if (cached && cached.policy)
-            staleCache = cached;
-          if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
-            refreshDue = false;
-            if (cached.policy)
-              dashboardPolicy = cached.policy;
-            if (typeof cached.selfProtect === "boolean")
-              selfProtectEnabled = cached.selfProtect;
-            if (cached.security !== void 0)
-              securityCfg = cached.security;
-            if (cached.hookVersions)
-              CLOUD_HOOK_VERSIONS = cached.hookVersions;
+        let dashboardPolicy = null;
+        let staleCache = null;
+        let refreshDue = true;
+        try {
+          if (existsSync(policyCacheFile)) {
+            const cached = JSON.parse(readFileSync(policyCacheFile, "utf-8"));
+            if (cached && cached.policy)
+              staleCache = cached;
+            if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
+              refreshDue = false;
+              if (cached.policy)
+                dashboardPolicy = cached.policy;
+              if (typeof cached.selfProtect === "boolean")
+                selfProtectEnabled = cached.selfProtect;
+              if (cached.security !== void 0)
+                securityCfg = cached.security;
+              if (cached.hookVersions)
+                CLOUD_HOOK_VERSIONS = cached.hookVersions;
+            }
           }
+        } catch {
         }
-      } catch {
-      }
-      if (refreshDue) {
-        if (!dashboardPolicy && staleCache) {
-          dashboardPolicy = staleCache.policy;
-          if (typeof staleCache.selfProtect === "boolean")
-            selfProtectEnabled = staleCache.selfProtect;
-          if (staleCache.security !== void 0)
-            securityCfg = staleCache.security;
-          if (staleCache.hookVersions)
-            CLOUD_HOOK_VERSIONS = staleCache.hookVersions;
-        }
-        if (API_KEY) {
-          try {
-            const lock = join(resolve(homedir(), ".solongate"), ".policy-refresh-" + agentKey + ".lock");
-            const due = !existsSync(lock) || Date.now() - statSync(lock).mtimeMs > 3e3;
-            if (due) {
+        if (refreshDue) {
+          if (!dashboardPolicy && staleCache) {
+            dashboardPolicy = staleCache.policy;
+            if (typeof staleCache.selfProtect === "boolean")
+              selfProtectEnabled = staleCache.selfProtect;
+            if (staleCache.security !== void 0)
+              securityCfg = staleCache.security;
+            if (staleCache.hookVersions)
+              CLOUD_HOOK_VERSIONS = staleCache.hookVersions;
+          }
+          if (API_KEY) {
+            try {
+              const lock = join(resolve(homedir(), ".solongate"), ".policy-refresh-" + agentKey + ".lock");
+              const due = !existsSync(lock) || Date.now() - statSync(lock).mtimeMs > 3e3;
+              if (due) {
+                try {
+                  writeFileSync(lock, String(Date.now()));
+                } catch {
+                }
+                spawn(process.execPath, [process.argv[1], AGENT_TYPE, AGENT_NAME, "--sg-refresh-policy"], { detached: true, stdio: "ignore", env: process.env }).unref();
+              }
+            } catch {
+            }
+          }
+        }
+        if (process.env.SOLONGATE_DEBUG) {
+        }
+        if (dashboardPolicy) {
+          policy = dashboardPolicy;
+        } else {
+          const candidates = [
+            join(resolve(homedir(), ".solongate"), "policy.json"),
+            resolve(hookCwd, "policy.json")
+          ];
+          for (const p of candidates) {
+            if (existsSync(p)) {
               try {
-                writeFileSync(lock, String(Date.now()));
+                policy = JSON.parse(readFileSync(p, "utf-8"));
+                break;
               } catch {
               }
-              spawn(process.execPath, [process.argv[1], AGENT_TYPE, AGENT_NAME, "--sg-refresh-policy"], { detached: true, stdio: "ignore", env: process.env }).unref();
             }
-          } catch {
           }
         }
+      } catch {
       }
       if (process.env.SOLONGATE_DEBUG) {
       }
-      if (dashboardPolicy) {
-        policy = dashboardPolicy;
-      } else {
-        const candidates = [
-          join(resolve(homedir(), ".solongate"), "policy.json"),
-          resolve(hookCwd, "policy.json")
-        ];
-        for (const p of candidates) {
-          if (existsSync(p)) {
-            try {
-              policy = JSON.parse(readFileSync(p, "utf-8"));
-              break;
-            } catch {
-            }
-          }
+      {
+        const scope = policy && Array.isArray(policy.agents) && policy.agents.length > 0 ? policy.agents : ["*"];
+        if (!scope.includes("*") && !scope.includes(AGENT_TYPE)) {
+          allowTool();
+          return;
         }
       }
-    } catch {
-    }
-    if (process.env.SOLONGATE_DEBUG) {
-    }
-    {
-      const scope = policy && Array.isArray(policy.agents) && policy.agents.length > 0 ? policy.agents : ["*"];
-      if (!scope.includes("*") && !scope.includes(AGENT_TYPE)) {
-        allowTool();
-        return;
-      }
-    }
-    if (process.env.SOLONGATE_DEBUG) {
-    }
-    let reason = selfProtectEnabled ? tamperCheck(toolName, args) : null;
-    if (!reason && securityCfg && securityCfg.ghost) {
-      const ghostHit = ghostBlock(toolName, args, securityCfg.ghost);
-      if (ghostHit) {
-        try {
-          writeDenyFlag(toolName);
-        } catch {
-        }
-        writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), tool: toolName, arguments: args, decision: "DENY", reason: "ghost path (hidden from agent)", permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: data.session_id || "", evaluation_time_ms: Date.now() - _evalStart });
-        try {
-          if (!localLogsOnly(securityCfg))
-            await fetch(API_URL + "/api/v1/audit-logs", {
-              method: "POST",
-              headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-              body: JSON.stringify({
-                tool: toolName,
-                arguments: args,
-                decision: "DENY",
-                reason: "ghost path (hidden from agent)",
-                permission: guessPermission(toolName),
-                source: `${AGENT_TYPE}-guard`,
-                agent_id: AGENT_TYPE,
-                agent_name: AGENT_NAME,
-                session_id: data.session_id || "",
-                evaluation_time_ms: Date.now() - _evalStart
-              }),
-              signal: AbortSignal.timeout(3e3)
-            });
-        } catch {
-        }
-        await maybeSelfUpdate();
-        if (AGENT_TYPE === "gemini-cli") {
-          process.stdout.write(JSON.stringify({ decision: "deny", reason: ghostHit }));
-          process.exit(0);
-        }
-        process.stderr.write(ghostHit);
-        process.exit(2);
+      if (process.env.SOLONGATE_DEBUG) {
       }
-      if (AGENT_TYPE !== "gemini-cli" && toolName === "Bash") {
-        const rw = ghostListingRewrite(args, securityCfg.ghost);
-        if (rw) {
+      let reason = selfProtectEnabled ? tamperCheck(toolName, args) : null;
+      if (!reason && securityCfg && securityCfg.ghost) {
+        const ghostHit = ghostBlock(toolName, args, securityCfg.ghost);
+        if (ghostHit) {
+          try {
+            writeDenyFlag(toolName);
+          } catch {
+          }
+          writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), tool: toolName, arguments: args, decision: "DENY", reason: "ghost path (hidden from agent)", permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: data.session_id || "", evaluation_time_ms: Date.now() - _evalStart });
+          try {
+            if (!localLogsOnly(securityCfg))
+              await fetch(API_URL + "/api/v1/audit-logs", {
+                method: "POST",
+                headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+                body: JSON.stringify({
+                  tool: toolName,
+                  arguments: args,
+                  decision: "DENY",
+                  reason: "ghost path (hidden from agent)",
+                  permission: guessPermission(toolName),
+                  source: `${AGENT_TYPE}-guard`,
+                  agent_id: AGENT_TYPE,
+                  agent_name: AGENT_NAME,
+                  session_id: data.session_id || "",
+                  evaluation_time_ms: Date.now() - _evalStart
+                }),
+                signal: AbortSignal.timeout(3e3)
+              });
+          } catch {
+          }
           await maybeSelfUpdate();
-          rewriteTool({ command: rw });
+          if (AGENT_TYPE === "gemini-cli") {
+            process.stdout.write(JSON.stringify({ decision: "deny", reason: ghostHit }));
+            sgFinish(0);
+          }
+          process.stderr.write(ghostHit);
+          sgFinish(2);
+        }
+        if (AGENT_TYPE !== "gemini-cli" && toolName === "Bash") {
+          const rw = ghostListingRewrite(args, securityCfg.ghost);
+          if (rw) {
+            await maybeSelfUpdate();
+            rewriteTool({ command: rw });
+          }
         }
       }
-    }
-    if (!reason)
-      reason = securityLayerCheck(toolName, args, securityCfg, agentKey);
-    if (process.env.SOLONGATE_DEBUG) {
-    }
-    let opaRoute = "white";
-    if (reason) {
-      opaRoute = "black";
-    } else if (policy && policy.rules) {
-      const opaResult = await evaluateWithOpa(policy, args, toolName, hookCwd);
-      if (opaResult === void 0) {
-        const legacy = evaluate(policy, args, toolName);
-        if (typeof legacy === "string") {
-          reason = legacy;
+      if (!reason)
+        reason = securityLayerCheck(toolName, args, securityCfg, agentKey);
+      if (process.env.SOLONGATE_DEBUG) {
+      }
+      let opaRoute = "white";
+      if (reason) {
+        opaRoute = "black";
+      } else if (policy && policy.rules) {
+        const opaResult = await evaluateWithOpa(policy, args, toolName, hookCwd);
+        if (opaResult === void 0) {
+          const legacy = evaluate(policy, args, toolName);
+          if (typeof legacy === "string") {
+            reason = legacy;
+            opaRoute = "black";
+          } else {
+            opaRoute = "white";
+          }
+        } else if (typeof opaResult === "string") {
+          reason = opaResult;
           opaRoute = "black";
         } else {
           opaRoute = "white";
         }
-      } else if (typeof opaResult === "string") {
-        reason = opaResult;
-        opaRoute = "black";
-      } else {
-        opaRoute = "white";
       }
-    }
-    process.stderr.write(`[SolonGate ROUTE] ${opaRoute.toUpperCase()} (${reason ? "block" : "allow"})
+      process.stderr.write(`[SolonGate ROUTE] ${opaRoute.toUpperCase()} (${reason ? "block" : "allow"})
 `);
-    try {
-      const _fd = resolve(".solongate");
-      mkdirSync(_fd, { recursive: true });
-      const _rec = { ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || "" };
-      writeFileSync(join(_fd, ".last-eval"), JSON.stringify(_rec));
       try {
-        const ring = join(_fd, ".eval-ring.jsonl");
-        appendFileSync(ring, JSON.stringify(_rec) + "\n");
+        const _fd = resolve(".solongate");
+        mkdirSync(_fd, { recursive: true });
+        const _rec = { ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || "" };
+        writeFileSync(join(_fd, ".last-eval"), JSON.stringify(_rec));
         try {
-          if (statSync(ring).size > 16384)
-            writeFileSync(ring, readFileSync(ring, "utf-8").split("\n").filter(Boolean).slice(-50).join("\n") + "\n");
+          const ring = join(_fd, ".eval-ring.jsonl");
+          appendFileSync(ring, JSON.stringify(_rec) + "\n");
+          try {
+            if (statSync(ring).size > 16384)
+              writeFileSync(ring, readFileSync(ring, "utf-8").split("\n").filter(Boolean).slice(-50).join("\n") + "\n");
+          } catch {
+          }
         } catch {
         }
       } catch {
       }
-    } catch {
-    }
-    if (reason) {
-      if (true) {
-        try {
-          const logEntry = {
-            tool: toolName,
-            arguments: args,
-            decision: "DENY",
-            reason,
-            permission: guessPermission(toolName),
-            source: `${AGENT_TYPE}-guard`,
-            agent_id: AGENT_TYPE,
-            agent_name: AGENT_NAME,
-            session_id: data.session_id || "",
-            evaluation_time_ms: Date.now() - _evalStart
-          };
-          writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), ...logEntry });
-          if (!localLogsOnly(securityCfg))
-            await fetch(API_URL + "/api/v1/audit-logs", {
-              method: "POST",
-              headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-              body: JSON.stringify(logEntry),
-              signal: AbortSignal.timeout(3e3)
-            });
-        } catch {
+      if (reason) {
+        if (true) {
+          try {
+            const logEntry = {
+              tool: toolName,
+              arguments: args,
+              decision: "DENY",
+              reason,
+              permission: guessPermission(toolName),
+              source: `${AGENT_TYPE}-guard`,
+              agent_id: AGENT_TYPE,
+              agent_name: AGENT_NAME,
+              session_id: data.session_id || "",
+              evaluation_time_ms: Date.now() - _evalStart
+            };
+            writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), ...logEntry });
+            if (!localLogsOnly(securityCfg))
+              await fetch(API_URL + "/api/v1/audit-logs", {
+                method: "POST",
+                headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+                body: JSON.stringify(logEntry),
+                signal: AbortSignal.timeout(3e3)
+              });
+          } catch {
+          }
         }
+        writeDenyFlag(toolName);
+        await maybeSelfUpdate();
+        blockTool(reason);
       }
-      writeDenyFlag(toolName);
-      await maybeSelfUpdate();
-      blockTool(reason);
+    } catch {
+    }
+    await maybeSelfUpdate();
+    allowTool();
+  } catch (e) {
+    if (e !== SG_DONE) {
+      process.exitCode = process.exitCode || 0;
     }
-  } catch {
   }
-  await maybeSelfUpdate();
-  allowTool();
 })();

package/hooks/guard.mjs

@@ -281,24 +281,52 @@ async function refreshPolicyCache() {
     try { writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions })); } catch {}
   } catch {}
 }
-if (REFRESH_MODE) { refreshPolicyCache().finally(() => process.exit(0)); }
+if (REFRESH_MODE) { refreshPolicyCache().finally(() => { process.exitCode = 0; try { setImmediate(() => { try { process.exit(0); } catch {} }); } catch { try { process.exit(0); } catch {} } }); }
 
 // ── Per-tool block/allow output ──
 // Response format depends on the agent:
 // Claude Code:  exit 2 + stderr = BLOCK, exit 0 = ALLOW
 // Gemini CLI:   {"decision": "deny/allow", "reason": "..."}
 
+// Terminate the hook WITHOUT forcing process.exit(). On Windows + Node 24, calling
+// process.exit() right after a fetch() (the cloud audit-log POST) aborts with
+// `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c`:
+// the fetch's DNS/socket teardown is still settling in libuv's threadpool and
+// exit() double-closes the loop's async handle. The abort replaces exit code 2, so
+// Claude Code sees a non-blocking hook failure and runs the tool anyway — the guard
+// computes DENY but never blocks. Instead set process.exitCode and let the event
+// loop drain and exit on its own. A latch preserves the FIRST code (so a later
+// allowTool() reached on fall-through can't overwrite a block), SG_DONE unwinds the
+// stack, and an unref'd backstop force-exits only if a handle is stuck — by then
+// the threadpool has drained, so exit() is safe.
+const SG_DONE = Symbol('sg-done');
+let _sgDone = false;
+function sgFinish(code) {
+  if (!_sgDone) {
+    _sgDone = true;
+    process.exitCode = code;
+    // Defer the real exit by ONE loop tick. process.exit() called synchronously in
+    // the same tick a fetch just settled aborts on Windows: a threadpool worker is
+    // still mid-uv_async_send when exit() closes the loop's async handle. setImmediate
+    // lets libuv drain that completion first, then we exit — ~0ms, and it still hard-
+    // exits (killing undici keep-alive sockets) instead of waiting on them.
+    try { setImmediate(() => { try { process.exit(process.exitCode || 0); } catch {} }); }
+    catch { try { process.exit(code); } catch {} }
+  }
+  throw SG_DONE;
+}
+
 function blockTool(reason) {
   if (AGENT_TYPE === 'gemini-cli') {
     process.stdout.write(JSON.stringify({
       decision: 'deny',
       reason: `[SolonGate] ${reason}`,
     }));
-    process.exit(0);
+    sgFinish(0);
   } else {
     // Claude Code — exit code 2
     process.stderr.write(reason);
-    process.exit(2);
+    sgFinish(2);
   }
 }
 
@@ -306,7 +334,7 @@ function allowTool() {
   if (AGENT_TYPE === 'gemini-cli') {
     process.stdout.write(JSON.stringify({ decision: 'allow' }));
   }
-  process.exit(0);
+  sgFinish(0);
 }
 
 // Allow the tool but REPLACE its input (Claude Code `updatedInput`). Used by the
@@ -316,7 +344,7 @@ function rewriteTool(updatedInput) {
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', updatedInput },
   }));
-  process.exit(0);
+  sgFinish(0);
 }
 
 // Write flag file so stop.mjs knows a tool call (DENY) happened and doesn't log extra ALLOW
@@ -1412,6 +1440,7 @@ function readReferencedFiles(args, cwd) {
 // inside a stream callback, so the loop tears down cleanly.
 if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
 ;(async () => {
+ try {
   // Background-refresh invocation has no tool call to evaluate — it already ran
   // refreshPolicyCache() at startup; do nothing on the (empty) stdin.
   if (REFRESH_MODE) return;
@@ -1604,9 +1633,9 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
           });
         } catch {}
         await maybeSelfUpdate();
-        if (AGENT_TYPE === 'gemini-cli') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); process.exit(0); }
+        if (AGENT_TYPE === 'gemini-cli') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); sgFinish(0); }
         process.stderr.write(ghostHit);
-        process.exit(2);
+        sgFinish(2);
       }
       // No direct hit: if this is a listing command, rewrite it so hidden
       // entries are filtered out of its output (Claude Code only).
@@ -1717,4 +1746,9 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
   } catch {}
   await maybeSelfUpdate();
   allowTool();
+ } catch (e) {
+  // SG_DONE is the normal terminator (exitCode already set); anything else is an
+  // unexpected error — fail OPEN (exit 0) so a hook bug never wedges the agent.
+  if (e !== SG_DONE) { process.exitCode = process.exitCode || 0; }
+ }
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.2",
+  "version": "0.81.3",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {