@solongate/proxy 0.81.63 → 0.81.65

package/hooks/.solongate/.eval-ring.jsonl

@@ -58,3 +58,5 @@
 {"ms":4,"ts":1784374792946,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":4,"ts":1784374838495,"tool":"Write","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
 {"ms":3,"ts":1784374848281,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":4,"ts":1784375224287,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784375813890,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-eval

@@ -1 +1 @@
-{"ms":3,"ts":1784374848281,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}
+{"ms":5,"ts":1784375813890,"tool":"Bash","session":"f5933c65-c315-4440-9afb-7136fce6b695"}

package/hooks/.solongate/.last-tool-call

@@ -1 +1 @@
-1784374838541
+1784375802574

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 37;
+var HOOK_VERSION = 39;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -6557,35 +6557,16 @@ function writeLocalMarker(security) {
   } catch {
   }
 }
-var _invalidPathNoted = false;
-function resolveLocalLogDir(rawPath) {
-  const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
-  if (!dir)
-    return null;
-  if (isAbsolute(dir))
-    return dir;
-  const fallback = resolve(homedir(), ".solongate", "local-logs");
-  if (!_invalidPathNoted) {
-    _invalidPathNoted = true;
-    try {
-      mkdirSync(resolve(homedir(), ".solongate"), { recursive: true });
-      writeFileSync(
-        resolve(homedir(), ".solongate", ".local-logs-invalid-path"),
-        JSON.stringify({ configured: dir, fallback, ts: Date.now() })
-      );
-    } catch {
-    }
-  }
-  return fallback;
-}
 function writeLocalLog(security, entry) {
   try {
     const l = security && security.localLogs;
     if (!l || !l.enabled || typeof l.path !== "string" || !l.path.trim())
       return;
-    const dir = resolveLocalLogDir(l.path);
+    let dir = String(l.path).trim().replace(/[\\/]+$/, "");
     if (!dir)
       return;
+    if (!isAbsolute(dir))
+      dir = resolve(homedir(), ".solongate", "local-logs");
     const line = JSON.stringify(entry) + "\n";
     const payload = Buffer.from(JSON.stringify({ dir, line }), "utf-8").toString("base64");
     spawn(process.execPath, [process.argv[1], "--sg-log-write", payload], { detached: true, stdio: "ignore" }).unref();

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 37;
+const HOOK_VERSION = 39;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -100,13 +100,17 @@ function writeLocalLog(security, entry) {
   try {
     const l = security && security.localLogs;
     if (!l || !l.enabled || typeof l.path !== 'string' || !l.path.trim()) return;
-    const dir = resolveLocalLogDir(l.path);
+    // Resolve the dir with ZERO filesystem work (no mkdir, no marker write) so the
+    // detached spawn below is the FIRST syscall. Traced root cause: the earliest
+    // guard processes in a burst do extra startup work (policy refresh + WASM),
+    // exceed Claude Code's hook timeout, and get SIGKILLed partway THROUGH
+    // writeLocalLog — before any append. So we hand the write to a DETACHED child
+    // (own process group, survives the kill) IMMEDIATELY, as the very first action,
+    // and do it EVERY time (no inline append → no partial-write / duplicate risk).
+    let dir = String(l.path).trim().replace(/[\\/]+$/, '');
     if (!dir) return;
+    if (!isAbsolute(dir)) dir = resolve(homedir(), '.solongate', 'local-logs');
     const line = JSON.stringify(entry) + '\n';
-    // GUARANTEED write: hand the append to a DETACHED child in its own process
-    // group. Even if Claude Code kills this hook mid-write during a concurrent
-    // denial burst, the child survives and completes the append — no denial is
-    // ever lost from the local log. (Inline appends dropped under burst.)
     const payload = Buffer.from(JSON.stringify({ dir, line }), 'utf-8').toString('base64');
     spawn(process.execPath, [process.argv[1], '--sg-log-write', payload], { detached: true, stdio: 'ignore' }).unref();
   } catch { /* best-effort */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.63",
+  "version": "0.81.65",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {