@solongate/proxy 0.81.3 → 0.81.5

package/hooks/audit.mjs

@@ -399,6 +399,10 @@ let input = '';
 // EOF avoids creating that handle, so the exits below tear down cleanly.
 try { input += readFileSync(0, 'utf-8'); } catch {}
 ;(async () => {
+  // Safety backstop ONLY: the normal path exits by natural drain. Force-exit if the
+  // loop fails to drain — 8s > the 5s fetch timeout, so the threadpool is idle and
+  // exit() can't hit the Windows UV_HANDLE_CLOSING abort.
+  try { setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 8000).unref(); } catch {}
   try {
     const data = JSON.parse(input);
     let EMITTED_PAYLOAD = null;
@@ -531,12 +535,13 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
     // on the write's flush callback (and on the fire-and-forget audit POST).
     let flushed = (typeof EMITTED_PAYLOAD !== 'string');
     let fetchDone = false;
-    // Defer the exit by one loop tick (setImmediate). Calling process.exit() in the
-    // same tick the audit-log fetch settled aborts on Windows + Node 24 with
-    // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c`
-    // — a threadpool worker is still mid-uv_async_send when exit() closes the loop's
-    // async handle. One tick lets libuv drain that completion; we then still hard-exit.
-    const maybeExit = () => { if (flushed && fetchDone) { process.exitCode = 0; setImmediate(() => { try { process.exit(0); } catch {} }); } };
+    // Set the exit code and let the event loop drain naturally — do NOT call
+    // process.exit(). On Windows + Node 24, process.exit() in the same tick the
+    // audit-log fetch settled aborts with `Assertion failed: !(handle->flags &
+    // UV_HANDLE_CLOSING), file src\win\async.c` (a threadpool DNS worker is still
+    // mid-uv_async_send when exit() force-closes the loop's async handle). undici
+    // unrefs idle sockets, so Node exits on its own ~1ms after the fetch settles.
+    const maybeExit = () => { if (flushed && fetchDone) { process.exitCode = 0; } };
     if (typeof EMITTED_PAYLOAD === 'string') {
       try { process.stdout.write(EMITTED_PAYLOAD, () => { flushed = true; maybeExit(); }); }
       catch { flushed = true; }
@@ -586,11 +591,11 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
         signal: AbortSignal.timeout(5000),
       }).catch(() => {}).finally(() => { fetchDone = true; maybeExit(); });
     }
-    // Hard backstop: exit even if the write callback or fetch never settles. By 3s
-    // the threadpool has long drained, so a direct exit here is safe.
-    setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 3000);
+    // Safety backstop ONLY (unref'd, 8s > the 5s fetch timeout): the normal path
+    // exits by natural drain ~1ms after the fetch settles. This fires only if the
+    // loop somehow fails to drain — by 8s the threadpool is idle, so exit() is safe.
+    try { setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 8000).unref(); } catch {}
   } catch {
-    // Defer one tick in case an error was thrown while a fetch was still settling.
-    try { setImmediate(() => { try { process.exit(0); } catch {} }); } catch { try { process.exit(0); } catch {} }
+    process.exitCode = 0;
   }
 })();

package/hooks/guard.bundled.mjs

@@ -6757,21 +6757,17 @@ async function refreshPolicyCache() {
   }
 }
 if (REFRESH_MODE) {
-  refreshPolicyCache().finally(() => {
-    process.exitCode = 0;
-    try {
-      setImmediate(() => {
-        try {
-          process.exit(0);
-        } catch {
-        }
-      });
-    } catch {
+  try {
+    setTimeout(() => {
       try {
-        process.exit(0);
+        process.exit(process.exitCode || 0);
       } catch {
       }
-    }
+    }, 8e3).unref();
+  } catch {
+  }
+  refreshPolicyCache().finally(() => {
+    process.exitCode = 0;
   });
 }
 var SG_DONE = Symbol("sg-done");
@@ -6780,19 +6776,6 @@ function sgFinish(code) {
   if (!_sgDone) {
     _sgDone = true;
     process.exitCode = code;
-    try {
-      setImmediate(() => {
-        try {
-          process.exit(process.exitCode || 0);
-        } catch {
-        }
-      });
-    } catch {
-      try {
-        process.exit(code);
-      } catch {
-      }
-    }
   }
   throw SG_DONE;
 }
@@ -6804,8 +6787,14 @@ function blockTool(reason) {
     }));
     sgFinish(0);
   } else {
-    process.stderr.write(reason);
-    sgFinish(2);
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason
+      }
+    }));
+    sgFinish(0);
   }
 }
 function allowTool() {
@@ -7698,6 +7687,15 @@ if (!REFRESH_MODE) {
   }
 }
 (async () => {
+  try {
+    setTimeout(() => {
+      try {
+        process.exit(process.exitCode || 0);
+      } catch {
+      }
+    }, 8e3).unref();
+  } catch {
+  }
   try {
     if (REFRESH_MODE)
       return;
@@ -7853,8 +7851,8 @@ if (!REFRESH_MODE) {
             process.stdout.write(JSON.stringify({ decision: "deny", reason: ghostHit }));
             sgFinish(0);
           }
-          process.stderr.write(ghostHit);
-          sgFinish(2);
+          process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: ghostHit } }));
+          sgFinish(0);
         }
         if (AGENT_TYPE !== "gemini-cli" && toolName === "Bash") {
           const rw = ghostListingRewrite(args, securityCfg.ghost);

package/hooks/guard.mjs

@@ -281,7 +281,7 @@ async function refreshPolicyCache() {
     try { writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions })); } catch {}
   } catch {}
 }
-if (REFRESH_MODE) { refreshPolicyCache().finally(() => { process.exitCode = 0; try { setImmediate(() => { try { process.exit(0); } catch {} }); } catch { try { process.exit(0); } catch {} } }); }
+if (REFRESH_MODE) { try { setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 8000).unref(); } catch {} refreshPolicyCache().finally(() => { process.exitCode = 0; }); }
 
 // ── Per-tool block/allow output ──
 // Response format depends on the agent:
@@ -301,18 +301,20 @@ if (REFRESH_MODE) { refreshPolicyCache().finally(() => { process.exitCode = 0; t
 // the threadpool has drained, so exit() is safe.
 const SG_DONE = Symbol('sg-done');
 let _sgDone = false;
+// Terminate WITHOUT ever calling process.exit() on the hot path. On Windows + Node
+// 24, process.exit() called in (or right after) the same tick a cloud fetch()
+// settled aborts with `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING),
+// file src\win\async.c`: a libuv threadpool worker (DNS) is still mid-uv_async_send
+// when exit() force-closes the loop's async handle. The abort replaces exit code 2,
+// so Claude Code sees a non-blocking hook failure and runs the tool anyway (guard
+// logs DENY, never blocks). Instead we just set process.exitCode and let the event
+// loop drain — undici unrefs idle sockets, so Node exits on its own within ~1ms of
+// the work finishing, cleanly (no forced teardown → no abort). A latch preserves
+// the FIRST code so a later allowTool() on fall-through can't overwrite a block; an
+// unref'd backstop armed at the top of the handler is the only place exit() may run,
+// and only long after every fetch has settled.
 function sgFinish(code) {
-  if (!_sgDone) {
-    _sgDone = true;
-    process.exitCode = code;
-    // Defer the real exit by ONE loop tick. process.exit() called synchronously in
-    // the same tick a fetch just settled aborts on Windows: a threadpool worker is
-    // still mid-uv_async_send when exit() closes the loop's async handle. setImmediate
-    // lets libuv drain that completion first, then we exit — ~0ms, and it still hard-
-    // exits (killing undici keep-alive sockets) instead of waiting on them.
-    try { setImmediate(() => { try { process.exit(process.exitCode || 0); } catch {} }); }
-    catch { try { process.exit(code); } catch {} }
-  }
+  if (!_sgDone) { _sgDone = true; process.exitCode = code; }
   throw SG_DONE;
 }
 
@@ -324,9 +326,20 @@ function blockTool(reason) {
     }));
     sgFinish(0);
   } else {
-    // Claude Code — exit code 2
-    process.stderr.write(reason);
-    sgFinish(2);
+    // Claude Code — signal the block via the JSON PreToolUse protocol on stdout,
+    // NOT exit code 2. On Windows the hook runs through PowerShell, which does not
+    // reliably propagate a native process's exit code back to Claude Code, so an
+    // `exit 2` block was being seen as a "non-blocking status code" and the tool ran
+    // anyway. Claude only processes this JSON on exit 0 (JSON is ignored if you exit
+    // 2), so we MUST exit 0 here. This is shell-independent and works everywhere.
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: reason,
+      },
+    }));
+    sgFinish(0);
   }
 }
 
@@ -1440,6 +1453,10 @@ function readReferencedFiles(args, cwd) {
 // inside a stream callback, so the loop tears down cleanly.
 if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
 ;(async () => {
+ // Safety backstop ONLY: the normal path exits by natural drain (~1ms after work
+ // finishes). If the loop somehow fails to drain, force-exit — 8s is well past every
+ // fetch timeout (≤3s) so the threadpool is idle and exit() can't hit the abort.
+ try { setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 8000).unref(); } catch {}
  try {
   // Background-refresh invocation has no tool call to evaluate — it already ran
   // refreshPolicyCache() at startup; do nothing on the (empty) stdin.
@@ -1634,8 +1651,10 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         } catch {}
         await maybeSelfUpdate();
         if (AGENT_TYPE === 'gemini-cli') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); sgFinish(0); }
-        process.stderr.write(ghostHit);
-        sgFinish(2);
+        // Claude Code: JSON deny on stdout + exit 0 (see blockTool — exit codes are
+        // not reliable through PowerShell on Windows; JSON is ignored on exit 2).
+        process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: ghostHit } }));
+        sgFinish(0);
       }
       // No direct hit: if this is a listing command, rewrite it so hidden
       // entries are filtered out of its output (Claude Code only).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.3",
+  "version": "0.81.5",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {