@solongate/proxy 0.81.60 → 0.81.61

package/hooks/.solongate/.eval-ring.jsonl

@@ -15,3 +15,15 @@
 {"ms":2,"ts":1784326365762,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":3,"ts":1784326398280,"tool":"Edit","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":1,"ts":1784326403539,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784359530309,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784359565744,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359892056,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784359899408,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359942766,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359948446,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784360088630,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784360093227,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784360125661,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784360134508,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784360234461,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784360256656,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-deny

@@ -1 +1 @@
-{"tool":"Bash","ts":1784138162061}
+{"tool":"Bash","ts":1784360236505}

package/hooks/.solongate/.last-eval

@@ -1 +1 @@
-{"ms":1,"ts":1784326403539,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784360256656,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-tool-call

@@ -1 +1 @@
-1784326398329
+1784360236504

package/hooks/guard.bundled.mjs

@@ -6536,10 +6536,26 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 34;
+var HOOK_VERSION = 35;
 function localLogsOnly(security) {
-  const l = security && security.localLogs;
-  return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+  if (security && typeof security === "object") {
+    const l = security.localLogs;
+    return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+  }
+  try {
+    const m = JSON.parse(readFileSync(join(resolve(homedir(), ".solongate"), ".local-logs-mode.json"), "utf-8"));
+    return !!(m && m.localOnly);
+  } catch {
+    return false;
+  }
+}
+function writeLocalMarker(security) {
+  try {
+    const l = security && security.localLogs;
+    const localOnly = !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+    writeFileSync(join(resolve(homedir(), ".solongate"), ".local-logs-mode.json"), JSON.stringify({ localOnly, ts: Date.now() }));
+  } catch {
+  }
 }
 function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
@@ -6753,6 +6769,7 @@ async function refreshPolicyCache() {
       writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions }));
     } catch {
     }
+    writeLocalMarker(security);
   } catch {
   }
 }
@@ -7751,8 +7768,10 @@ if (!REFRESH_MODE) {
                 dashboardPolicy = cached.policy;
               if (typeof cached.selfProtect === "boolean")
                 selfProtectEnabled = cached.selfProtect;
-              if (cached.security !== void 0)
+              if (cached.security !== void 0) {
                 securityCfg = cached.security;
+                writeLocalMarker(securityCfg);
+              }
               if (cached.hookVersions)
                 CLOUD_HOOK_VERSIONS = cached.hookVersions;
             }

package/hooks/guard.mjs

@@ -32,13 +32,36 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 34;
+const HOOK_VERSION = 35;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
 function localLogsOnly(security) {
-  const l = security && security.localLogs;
-  return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+  if (security && typeof security === 'object') {
+    const l = security.localLogs;
+    return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+  }
+  // security UNKNOWN (cold start / policy-cache miss / mid-toggle): consult the
+  // persisted local-mode marker so a DENY is NEVER leaked to the cloud when this
+  // device is in local-only mode. Without this fallback the first call(s) before
+  // the policy cache warms POST the denial to the cloud and fire webhooks/alerts
+  // even though the user chose local-only.
+  try {
+    const m = JSON.parse(readFileSync(join(resolve(homedir(), '.solongate'), '.local-logs-mode.json'), 'utf-8'));
+    return !!(m && m.localOnly);
+  } catch { return false; }
+}
+
+// Persist whether this device is in local-only mode, INDEPENDENT of the policy
+// cache, so localLogsOnly() answers correctly even on a cache-miss call. Written
+// on every policy refresh; switching back to cloud sets localOnly:false so cloud
+// POSTs resume.
+function writeLocalMarker(security) {
+  try {
+    const l = security && security.localLogs;
+    const localOnly = !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+    writeFileSync(join(resolve(homedir(), '.solongate'), '.local-logs-mode.json'), JSON.stringify({ localOnly, ts: Date.now() }));
+  } catch {}
 }
 
 // Resolve the FOLDER local logs may be written into. It MUST be absolute on
@@ -279,6 +302,7 @@ async function refreshPolicyCache() {
     } catch {}
     // Always advance _ts (success or failure) so the hot path backs off between refreshes.
     try { writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions })); } catch {}
+    writeLocalMarker(security);
   } catch {}
 }
 if (REFRESH_MODE) { try { setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 8000).unref(); } catch {} refreshPolicyCache().finally(() => { process.exitCode = 0; }); }
@@ -1553,7 +1577,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
             refreshDue = false;
             if (cached.policy) dashboardPolicy = cached.policy;
             if (typeof cached.selfProtect === 'boolean') selfProtectEnabled = cached.selfProtect;
-            if (cached.security !== undefined) securityCfg = cached.security;
+            if (cached.security !== undefined) { securityCfg = cached.security; writeLocalMarker(securityCfg); }
             if (cached.hookVersions) CLOUD_HOOK_VERSIONS = cached.hookVersions;
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.60",
+  "version": "0.81.61",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {