@solongate/proxy 0.81.62 → 0.81.64

package/hooks/.solongate/.eval-ring.jsonl

@@ -53,3 +53,9 @@
 {"ms":2,"ts":1784367428790,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":3,"ts":1784369708978,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":4,"ts":1784369720104,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784374757475,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":2,"ts":1784374762962,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784374792946,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784374838495,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":3,"ts":1784374848281,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784375224287,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-eval

@@ -1 +1 @@
-{"ms":4,"ts":1784369720104,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784375224287,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-tool-call

@@ -1 +1 @@
-1784369709035
+1784375211122

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 36;
+var HOOK_VERSION = 38;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -6590,7 +6590,23 @@ function writeLocalLog(security, entry) {
       mkdirSync(dir, { recursive: true });
     } catch {
     }
-    appendFileSync(join(dir, "solongate-audit.jsonl"), JSON.stringify(entry) + "\n");
+    const file = join(dir, "solongate-audit.jsonl");
+    const line = JSON.stringify(entry) + "\n";
+    for (let attempt = 0; attempt < 12; attempt++) {
+      try {
+        appendFileSync(file, line);
+        return;
+      } catch {
+        const _end = Date.now() + 2;
+        while (Date.now() < _end) {
+        }
+      }
+    }
+    try {
+      const payload = Buffer.from(JSON.stringify({ dir, line }), "utf-8").toString("base64");
+      spawn(process.execPath, [process.argv[1], "--sg-log-write", payload], { detached: true, stdio: "ignore" }).unref();
+    } catch {
+    }
   } catch {
   }
 }
@@ -6734,6 +6750,23 @@ var AGENT_TYPE = process.argv[2] || "claude-code";
 var POLICY_SELECTOR = process.env.SOLONGATE_AGENT_ID || "";
 var AGENT_ID = POLICY_SELECTOR || AGENT_TYPE;
 var AGENT_NAME = process.env.SOLONGATE_AGENT_NAME || process.argv[3] || AGENT_TYPE;
+{
+  const _wi = process.argv.indexOf("--sg-log-write");
+  if (_wi !== -1) {
+    try {
+      const _pl = JSON.parse(Buffer.from(process.argv[_wi + 1] || "", "base64").toString("utf-8"));
+      if (_pl && _pl.dir && _pl.line) {
+        try {
+          mkdirSync(_pl.dir, { recursive: true });
+        } catch {
+        }
+        appendFileSync(join(_pl.dir, "solongate-audit.jsonl"), _pl.line);
+      }
+    } catch {
+    }
+    process.exit(0);
+  }
+}
 var REFRESH_MODE = process.argv.includes("--sg-refresh-policy");
 async function refreshPolicyCache() {
   try {

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 36;
+const HOOK_VERSION = 38;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -102,8 +102,23 @@ function writeLocalLog(security, entry) {
     if (!l || !l.enabled || typeof l.path !== 'string' || !l.path.trim()) return;
     const dir = resolveLocalLogDir(l.path);
     if (!dir) return;
-    try { mkdirSync(dir, { recursive: true }); } catch { /* ignore */ }
-    appendFileSync(join(dir, 'solongate-audit.jsonl'), JSON.stringify(entry) + '\n');
+    try { mkdirSync(dir, { recursive: true }); } catch {}
+    const file = join(dir, 'solongate-audit.jsonl');
+    const line = JSON.stringify(entry) + '\n';
+    // GUARANTEED write. Under a concurrent denial burst the append can transiently
+    // throw (contention on the shared file while the dashboard reads it); this
+    // hook process stays alive (it reaches blockTool), so retry the append a few
+    // times with a short spin-backoff until it lands.
+    for (let attempt = 0; attempt < 12; attempt++) {
+      try { appendFileSync(file, line); return; }
+      catch { const _end = Date.now() + 2; while (Date.now() < _end) { /* spin ~2ms */ } }
+    }
+    // Every inline attempt threw: hand off to a DETACHED child (own process group,
+    // survives this process's death) as the final guarantee the entry is written.
+    try {
+      const payload = Buffer.from(JSON.stringify({ dir, line }), 'utf-8').toString('base64');
+      spawn(process.execPath, [process.argv[1], '--sg-log-write', payload], { detached: true, stdio: 'ignore' }).unref();
+    } catch {}
   } catch { /* best-effort */ }
 }
 
@@ -285,6 +300,24 @@ const AGENT_NAME = process.env.SOLONGATE_AGENT_NAME || process.argv[3] || AGENT_
 // serves the cached (or local) policy INSTANTLY and spawns this detached mode to
 // fetch a fresh policy and rewrite the cache for the NEXT call. Result: fast tool
 // calls AND ~one-call propagation of policy changes — no long-TTL tradeoff.
+// Survivable local-log writer. A denial's audit line is written by a DETACHED
+// child (this same file, invoked with --sg-log-write <base64>) so the entry
+// lands even if Claude Code kills the parent hook mid-write during a concurrent
+// denial burst. Handled FIRST and exits immediately — the child never loads the
+// heavy guard logic below.
+{
+  const _wi = process.argv.indexOf('--sg-log-write');
+  if (_wi !== -1) {
+    try {
+      const _pl = JSON.parse(Buffer.from(process.argv[_wi + 1] || '', 'base64').toString('utf-8'));
+      if (_pl && _pl.dir && _pl.line) {
+        try { mkdirSync(_pl.dir, { recursive: true }); } catch {}
+        appendFileSync(join(_pl.dir, 'solongate-audit.jsonl'), _pl.line);
+      }
+    } catch {}
+    process.exit(0);
+  }
+}
 const REFRESH_MODE = process.argv.includes('--sg-refresh-policy');
 async function refreshPolicyCache() {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.62",
+  "version": "0.81.64",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {