@solongate/proxy 0.81.59 → 0.81.61

package/dist/api-client/settings.d.ts

@@ -70,12 +70,6 @@ export declare function updateAlert(id: string, patch: {
 }): Promise<{
     rule: AlertRule;
 }>;
-export declare function sendTestAlert(id: string): Promise<{
-    delivered: {
-        telegram: boolean;
-        email: boolean;
-    };
-}>;
 export interface DenialWebhook {
     id: string;
     url: string;

package/dist/commands/index.js

@@ -221,7 +221,6 @@ __export(settings_exports, {
   getSecurityLayers: () => getSecurityLayers,
   getSelfProtection: () => getSelfProtection,
   getWebhooks: () => getWebhooks,
-  sendTestAlert: () => sendTestAlert,
   sendTestWebhook: () => sendTestWebhook,
   setAlertEnabled: () => setAlertEnabled,
   setLocalLogs: () => setLocalLogs,
@@ -272,9 +271,6 @@ function setAlertEnabled(id, enabled) {
 function updateAlert(id, patch) {
   return request("PATCH", "/settings/denial-alerts", { query: { id }, body: patch });
 }
-function sendTestAlert(id) {
-  return request("POST", "/settings/denial-alerts/send-test", { body: { id } });
-}
 function getWebhooks() {
   return request("GET", "/settings/denial-webhook");
 }

package/dist/index.js

@@ -7408,7 +7408,6 @@ __export(settings_exports, {
   getSecurityLayers: () => getSecurityLayers,
   getSelfProtection: () => getSelfProtection,
   getWebhooks: () => getWebhooks,
-  sendTestAlert: () => sendTestAlert,
   sendTestWebhook: () => sendTestWebhook,
   setAlertEnabled: () => setAlertEnabled,
   setLocalLogs: () => setLocalLogs,
@@ -7459,9 +7458,6 @@ function setAlertEnabled(id, enabled) {
 function updateAlert(id, patch) {
   return request("PATCH", "/settings/denial-alerts", { query: { id }, body: patch });
 }
-function sendTestAlert(id) {
-  return request("POST", "/settings/denial-alerts/send-test", { body: { id } });
-}
 function getWebhooks() {
   return request("GET", "/settings/denial-webhook");
 }
@@ -10239,16 +10235,6 @@ function SettingsPanel({
     if (id) run12("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
     else run12(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "dataroom alert", ...body }), alertQ.reload);
   };
-  const testAlert = (rule) => {
-    run12(
-      "alert test sent \u2014 check your " + (alertChannel(rule) ?? "channel"),
-      () => api.settings.sendTestAlert(rule.id).then((r) => {
-        if (!r.delivered.telegram && !r.delivered.email) throw new Error("no channel on this rule");
-      }),
-      () => {
-      }
-    );
-  };
   const activate = (r) => {
     if (r.kind === "acct") {
       setViewCredentials({ apiKey: r.acc.apiKey, apiUrl: r.acc.apiUrl });
@@ -10327,11 +10313,6 @@ function SettingsPanel({
           setEditing("alert-target");
           return;
         }
-        if (inp === "t" && editor.id) {
-          const rule = alerts.find((a) => a.id === editor.id);
-          if (rule) testAlert(rule);
-          return;
-        }
         if (key.return) {
           saveEditor();
           return;
@@ -10378,8 +10359,6 @@ function SettingsPanel({
         run12("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
           if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx)");
         }), whQ.reload);
-      } else if (inp === "t" && cur.kind === "alert") {
-        testAlert(cur.rule);
       } else if (inp === "e" && cur.kind === "ll-path") activate(cur);
       else if (inp === "e" && cur.kind === "wh") {
         const next = EVENTS[(EVENTS.indexOf(cur.wh.events) + 1) % EVENTS.length];
@@ -10447,11 +10426,7 @@ function SettingsPanel({
         editor.channel,
         " alert"
       ] }),
-      /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-        "\u2191\u2193 field \xB7 \u2190\u2192 change \xB7 e edit target \xB7 enter save",
-        editor.id ? " \xB7 t test" : "",
-        " \xB7 esc cancel"
-      ] }),
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2191\u2193 field \xB7 \u2190\u2192 change \xB7 e edit target \xB7 enter save \xB7 esc cancel" }),
       editing === "alert-target" ? /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, children: [
         /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: editor.channel === "email" ? "e-mail address: " : "telegram chat id (from @userinfobot): " }),
         /* @__PURE__ */ jsx7(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
@@ -10573,7 +10548,7 @@ function SettingsPanel({
     PROTECTION: "guard hook version + self-protection toggle",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
-    ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 t tests`
+    ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits`
   };
   const lineEls = [];
   const lineKey = [];
@@ -10595,7 +10570,7 @@ function SettingsPanel({
       lineKey.push("");
       if ((sec === "WEBHOOKS" || sec === "ALERTS") && local?.enabled) {
         lineEls.push(
-          /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: theme.warn, children: `  \u26A0 local logs on \u2014 real denials stay on this machine, so ${sec.toLowerCase()} do NOT fire (t test still works)` }, "warn:" + sec)
+          /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: theme.warn, children: `  \u26A0 local logs on \u2014 real denials stay on this machine, so ${sec.toLowerCase()} do NOT fire${sec === "WEBHOOKS" ? " (t test still works)" : ""}` }, "warn:" + sec)
         );
         lineKey.push("");
       }

package/dist/tui/index.js

@@ -564,7 +564,6 @@ __export(settings_exports, {
   getSecurityLayers: () => getSecurityLayers,
   getSelfProtection: () => getSelfProtection,
   getWebhooks: () => getWebhooks,
-  sendTestAlert: () => sendTestAlert,
   sendTestWebhook: () => sendTestWebhook,
   setAlertEnabled: () => setAlertEnabled,
   setLocalLogs: () => setLocalLogs,
@@ -615,9 +614,6 @@ function setAlertEnabled(id, enabled) {
 function updateAlert(id, patch) {
   return request("PATCH", "/settings/denial-alerts", { query: { id }, body: patch });
 }
-function sendTestAlert(id) {
-  return request("POST", "/settings/denial-alerts/send-test", { body: { id } });
-}
 function getWebhooks() {
   return request("GET", "/settings/denial-webhook");
 }
@@ -3366,16 +3362,6 @@ function SettingsPanel({
     if (id) run("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
     else run(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "dataroom alert", ...body }), alertQ.reload);
   };
-  const testAlert = (rule) => {
-    run(
-      "alert test sent \u2014 check your " + (alertChannel(rule) ?? "channel"),
-      () => api.settings.sendTestAlert(rule.id).then((r) => {
-        if (!r.delivered.telegram && !r.delivered.email) throw new Error("no channel on this rule");
-      }),
-      () => {
-      }
-    );
-  };
   const activate = (r) => {
     if (r.kind === "acct") {
       setViewCredentials({ apiKey: r.acc.apiKey, apiUrl: r.acc.apiUrl });
@@ -3454,11 +3440,6 @@ function SettingsPanel({
           setEditing("alert-target");
           return;
         }
-        if (inp === "t" && editor.id) {
-          const rule = alerts.find((a) => a.id === editor.id);
-          if (rule) testAlert(rule);
-          return;
-        }
         if (key.return) {
           saveEditor();
           return;
@@ -3505,8 +3486,6 @@ function SettingsPanel({
         run("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
           if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx)");
         }), whQ.reload);
-      } else if (inp === "t" && cur.kind === "alert") {
-        testAlert(cur.rule);
       } else if (inp === "e" && cur.kind === "ll-path") activate(cur);
       else if (inp === "e" && cur.kind === "wh") {
         const next = EVENTS[(EVENTS.indexOf(cur.wh.events) + 1) % EVENTS.length];
@@ -3574,11 +3553,7 @@ function SettingsPanel({
         editor.channel,
         " alert"
       ] }),
-      /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-        "\u2191\u2193 field \xB7 \u2190\u2192 change \xB7 e edit target \xB7 enter save",
-        editor.id ? " \xB7 t test" : "",
-        " \xB7 esc cancel"
-      ] }),
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2191\u2193 field \xB7 \u2190\u2192 change \xB7 e edit target \xB7 enter save \xB7 esc cancel" }),
       editing === "alert-target" ? /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, children: [
         /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: editor.channel === "email" ? "e-mail address: " : "telegram chat id (from @userinfobot): " }),
         /* @__PURE__ */ jsx7(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
@@ -3700,7 +3675,7 @@ function SettingsPanel({
     PROTECTION: "guard hook version + self-protection toggle",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
-    ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 t tests`
+    ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits`
   };
   const lineEls = [];
   const lineKey = [];
@@ -3722,7 +3697,7 @@ function SettingsPanel({
       lineKey.push("");
       if ((sec === "WEBHOOKS" || sec === "ALERTS") && local?.enabled) {
         lineEls.push(
-          /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: theme.warn, children: `  \u26A0 local logs on \u2014 real denials stay on this machine, so ${sec.toLowerCase()} do NOT fire (t test still works)` }, "warn:" + sec)
+          /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: theme.warn, children: `  \u26A0 local logs on \u2014 real denials stay on this machine, so ${sec.toLowerCase()} do NOT fire${sec === "WEBHOOKS" ? " (t test still works)" : ""}` }, "warn:" + sec)
         );
         lineKey.push("");
       }

package/hooks/.solongate/.eval-ring.jsonl

@@ -15,3 +15,15 @@
 {"ms":2,"ts":1784326365762,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":3,"ts":1784326398280,"tool":"Edit","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":1,"ts":1784326403539,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784359530309,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784359565744,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359892056,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784359899408,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359942766,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359948446,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784360088630,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784360093227,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784360125661,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784360134508,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784360234461,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784360256656,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-deny

@@ -1 +1 @@
-{"tool":"Bash","ts":1784138162061}
+{"tool":"Bash","ts":1784360236505}

package/hooks/.solongate/.last-eval

@@ -1 +1 @@
-{"ms":1,"ts":1784326403539,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784360256656,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-tool-call

@@ -1 +1 @@
-1784326398329
+1784360236504

package/hooks/guard.bundled.mjs

@@ -6536,10 +6536,26 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 34;
+var HOOK_VERSION = 35;
 function localLogsOnly(security) {
-  const l = security && security.localLogs;
-  return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+  if (security && typeof security === "object") {
+    const l = security.localLogs;
+    return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+  }
+  try {
+    const m = JSON.parse(readFileSync(join(resolve(homedir(), ".solongate"), ".local-logs-mode.json"), "utf-8"));
+    return !!(m && m.localOnly);
+  } catch {
+    return false;
+  }
+}
+function writeLocalMarker(security) {
+  try {
+    const l = security && security.localLogs;
+    const localOnly = !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+    writeFileSync(join(resolve(homedir(), ".solongate"), ".local-logs-mode.json"), JSON.stringify({ localOnly, ts: Date.now() }));
+  } catch {
+  }
 }
 function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
@@ -6753,6 +6769,7 @@ async function refreshPolicyCache() {
       writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions }));
     } catch {
     }
+    writeLocalMarker(security);
   } catch {
   }
 }
@@ -7751,8 +7768,10 @@ if (!REFRESH_MODE) {
                 dashboardPolicy = cached.policy;
               if (typeof cached.selfProtect === "boolean")
                 selfProtectEnabled = cached.selfProtect;
-              if (cached.security !== void 0)
+              if (cached.security !== void 0) {
                 securityCfg = cached.security;
+                writeLocalMarker(securityCfg);
+              }
               if (cached.hookVersions)
                 CLOUD_HOOK_VERSIONS = cached.hookVersions;
             }

package/hooks/guard.mjs

@@ -32,13 +32,36 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 34;
+const HOOK_VERSION = 35;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
 function localLogsOnly(security) {
-  const l = security && security.localLogs;
-  return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+  if (security && typeof security === 'object') {
+    const l = security.localLogs;
+    return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+  }
+  // security UNKNOWN (cold start / policy-cache miss / mid-toggle): consult the
+  // persisted local-mode marker so a DENY is NEVER leaked to the cloud when this
+  // device is in local-only mode. Without this fallback the first call(s) before
+  // the policy cache warms POST the denial to the cloud and fire webhooks/alerts
+  // even though the user chose local-only.
+  try {
+    const m = JSON.parse(readFileSync(join(resolve(homedir(), '.solongate'), '.local-logs-mode.json'), 'utf-8'));
+    return !!(m && m.localOnly);
+  } catch { return false; }
+}
+
+// Persist whether this device is in local-only mode, INDEPENDENT of the policy
+// cache, so localLogsOnly() answers correctly even on a cache-miss call. Written
+// on every policy refresh; switching back to cloud sets localOnly:false so cloud
+// POSTs resume.
+function writeLocalMarker(security) {
+  try {
+    const l = security && security.localLogs;
+    const localOnly = !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+    writeFileSync(join(resolve(homedir(), '.solongate'), '.local-logs-mode.json'), JSON.stringify({ localOnly, ts: Date.now() }));
+  } catch {}
 }
 
 // Resolve the FOLDER local logs may be written into. It MUST be absolute on
@@ -279,6 +302,7 @@ async function refreshPolicyCache() {
     } catch {}
     // Always advance _ts (success or failure) so the hot path backs off between refreshes.
     try { writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions })); } catch {}
+    writeLocalMarker(security);
   } catch {}
 }
 if (REFRESH_MODE) { try { setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 8000).unref(); } catch {} refreshPolicyCache().finally(() => { process.exitCode = 0; }); }
@@ -1553,7 +1577,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
             refreshDue = false;
             if (cached.policy) dashboardPolicy = cached.policy;
             if (typeof cached.selfProtect === 'boolean') selfProtectEnabled = cached.selfProtect;
-            if (cached.security !== undefined) securityCfg = cached.security;
+            if (cached.security !== undefined) { securityCfg = cached.security; writeLocalMarker(securityCfg); }
             if (cached.hookVersions) CLOUD_HOOK_VERSIONS = cached.hookVersions;
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.59",
+  "version": "0.81.61",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {