@solongate/proxy 0.81.60 → 0.81.62

package/hooks/.solongate/.eval-ring.jsonl

@@ -15,3 +15,41 @@
 {"ms":2,"ts":1784326365762,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":3,"ts":1784326398280,"tool":"Edit","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":1,"ts":1784326403539,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784359530309,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784359565744,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359892056,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784359899408,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359942766,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784359948446,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784360088630,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784360093227,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784360125661,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784360134508,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784360234461,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784360256656,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784365255204,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784365279092,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784365328385,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784365360712,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784365375478,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784365383985,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":9,"ts":1784365415903,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784365422626,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784365497358,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784365509533,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784365523577,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":1,"ts":1784365524083,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784365525077,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784365525605,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784365526627,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784365527031,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784366243066,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784366250503,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784366281171,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784366288049,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784367337998,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784367345104,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784367420866,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784367428790,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784369708978,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784369720104,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-deny

@@ -1 +1 @@
-{"tool":"Bash","ts":1784138162061}
+{"tool":"Bash","ts":1784365527031}

package/hooks/.solongate/.last-eval

@@ -1 +1 @@
-{"ms":1,"ts":1784326403539,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784369720104,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-tool-call

@@ -1 +1 @@
-1784326398329
+1784369709035

package/hooks/guard.bundled.mjs

@@ -6536,11 +6536,28 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 34;
+var HOOK_VERSION = 36;
 function localLogsOnly(security) {
-  const l = security && security.localLogs;
-  return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+  if (security && typeof security === "object") {
+    const l = security.localLogs;
+    return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+  }
+  try {
+    const m = JSON.parse(readFileSync(join(resolve(homedir(), ".solongate"), ".local-logs-mode.json"), "utf-8"));
+    return !!(m && m.localOnly);
+  } catch {
+    return false;
+  }
+}
+function writeLocalMarker(security) {
+  try {
+    const l = security && security.localLogs;
+    const localOnly = !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+    writeFileSync(join(resolve(homedir(), ".solongate"), ".local-logs-mode.json"), JSON.stringify({ localOnly, ts: Date.now() }));
+  } catch {
+  }
 }
+var _invalidPathNoted = false;
 function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir)
@@ -6548,13 +6565,16 @@ function resolveLocalLogDir(rawPath) {
   if (isAbsolute(dir))
     return dir;
   const fallback = resolve(homedir(), ".solongate", "local-logs");
-  try {
-    mkdirSync(resolve(homedir(), ".solongate"), { recursive: true });
-    writeFileSync(
-      resolve(homedir(), ".solongate", ".local-logs-invalid-path"),
-      JSON.stringify({ configured: dir, fallback, ts: Date.now() })
-    );
-  } catch {
+  if (!_invalidPathNoted) {
+    _invalidPathNoted = true;
+    try {
+      mkdirSync(resolve(homedir(), ".solongate"), { recursive: true });
+      writeFileSync(
+        resolve(homedir(), ".solongate", ".local-logs-invalid-path"),
+        JSON.stringify({ configured: dir, fallback, ts: Date.now() })
+      );
+    } catch {
+    }
   }
   return fallback;
 }
@@ -6753,6 +6773,7 @@ async function refreshPolicyCache() {
       writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions }));
     } catch {
     }
+    writeLocalMarker(security);
   } catch {
   }
 }
@@ -7751,8 +7772,10 @@ if (!REFRESH_MODE) {
                 dashboardPolicy = cached.policy;
               if (typeof cached.selfProtect === "boolean")
                 selfProtectEnabled = cached.selfProtect;
-              if (cached.security !== void 0)
+              if (cached.security !== void 0) {
                 securityCfg = cached.security;
+                writeLocalMarker(securityCfg);
+              }
               if (cached.hookVersions)
                 CLOUD_HOOK_VERSIONS = cached.hookVersions;
             }

package/hooks/guard.mjs

@@ -32,13 +32,36 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 34;
+const HOOK_VERSION = 36;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
 function localLogsOnly(security) {
-  const l = security && security.localLogs;
-  return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+  if (security && typeof security === 'object') {
+    const l = security.localLogs;
+    return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+  }
+  // security UNKNOWN (cold start / policy-cache miss / mid-toggle): consult the
+  // persisted local-mode marker so a DENY is NEVER leaked to the cloud when this
+  // device is in local-only mode. Without this fallback the first call(s) before
+  // the policy cache warms POST the denial to the cloud and fire webhooks/alerts
+  // even though the user chose local-only.
+  try {
+    const m = JSON.parse(readFileSync(join(resolve(homedir(), '.solongate'), '.local-logs-mode.json'), 'utf-8'));
+    return !!(m && m.localOnly);
+  } catch { return false; }
+}
+
+// Persist whether this device is in local-only mode, INDEPENDENT of the policy
+// cache, so localLogsOnly() answers correctly even on a cache-miss call. Written
+// on every policy refresh; switching back to cloud sets localOnly:false so cloud
+// POSTs resume.
+function writeLocalMarker(security) {
+  try {
+    const l = security && security.localLogs;
+    const localOnly = !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+    writeFileSync(join(resolve(homedir(), '.solongate'), '.local-logs-mode.json'), JSON.stringify({ localOnly, ts: Date.now() }));
+  } catch {}
 }
 
 // Resolve the FOLDER local logs may be written into. It MUST be absolute on
@@ -49,16 +72,24 @@ function localLogsOnly(security) {
 // When the configured path isn't absolute here, fall back to a fixed home folder
 // so entries are never lost and never leak into a project, and record the bad
 // path so the dashboard/user can be told their path isn't valid on this device.
+let _invalidPathNoted = false;
 function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || '').trim().replace(/[\\/]+$/, '');
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
   const fallback = resolve(homedir(), '.solongate', 'local-logs');
-  try {
-    mkdirSync(resolve(homedir(), '.solongate'), { recursive: true });
-    writeFileSync(resolve(homedir(), '.solongate', '.local-logs-invalid-path'),
-      JSON.stringify({ configured: dir, fallback, ts: Date.now() }));
-  } catch { /* ignore */ }
+  // Non-absolute path (e.g. a Windows path on Linux): fall back. The diagnostic
+  // marker is written at most ONCE per process, NOT on every denial — a per-call
+  // writeFileSync here widened the window where a concurrent guard process dies
+  // before its audit append lands (dropped denials under a simultaneous burst).
+  if (!_invalidPathNoted) {
+    _invalidPathNoted = true;
+    try {
+      mkdirSync(resolve(homedir(), '.solongate'), { recursive: true });
+      writeFileSync(resolve(homedir(), '.solongate', '.local-logs-invalid-path'),
+        JSON.stringify({ configured: dir, fallback, ts: Date.now() }));
+    } catch { /* ignore */ }
+  }
   return fallback;
 }
 
@@ -279,6 +310,7 @@ async function refreshPolicyCache() {
     } catch {}
     // Always advance _ts (success or failure) so the hot path backs off between refreshes.
     try { writeFileSync(cacheFile, JSON.stringify({ _ts: Date.now(), policy, selfProtect, security, hookVersions })); } catch {}
+    writeLocalMarker(security);
   } catch {}
 }
 if (REFRESH_MODE) { try { setTimeout(() => { try { process.exit(process.exitCode || 0); } catch {} }, 8000).unref(); } catch {} refreshPolicyCache().finally(() => { process.exitCode = 0; }); }
@@ -1553,7 +1585,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
             refreshDue = false;
             if (cached.policy) dashboardPolicy = cached.policy;
             if (typeof cached.selfProtect === 'boolean') selfProtectEnabled = cached.selfProtect;
-            if (cached.security !== undefined) securityCfg = cached.security;
+            if (cached.security !== undefined) { securityCfg = cached.security; writeLocalMarker(securityCfg); }
             if (cached.hookVersions) CLOUD_HOOK_VERSIONS = cached.hookVersions;
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.60",
+  "version": "0.81.62",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {