@solongate/proxy 0.81.79 → 0.81.81

package/dist/global-install.d.ts

@@ -11,6 +11,20 @@ export declare function globalPaths(): {
 };
 export declare function clearGuardUpdateCheck(): boolean;
 export declare function runGlobalRestore(): void;
+/**
+ * TUI-safe (re)install — the dataroom's one-key "install / update guard" action.
+ * Writes the hook files THIS CLI ships (readGuard = the current package's bundle,
+ * so a self-updated dataroom installs the newest hooks DIRECTLY — no waiting for a
+ * tool call) and registers them in the global Claude settings, reusing the key
+ * already stored in cloud-guard.json. No prompt, no stdout, no process.exit — safe
+ * to call from Ink. Returns a status; asks the user to log in when no key exists.
+ * The auto-shield shell shim is left to `solongate` login (it can print), so this
+ * touches only the guard/audit/stop hooks — the primary protection.
+ */
+export declare function installGlobalQuiet(): {
+    ok: boolean;
+    message: string;
+};
 /**
  * Are the SolonGate guard hooks currently installed in the global Claude settings
  * on THIS device? Reflects a local install/remove IMMEDIATELY — unlike the cloud

package/dist/global-install.js

@@ -137,6 +137,54 @@ function runGlobalRestore() {
   }
   console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
 }
+function installGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync(p.hooksDir, { recursive: true });
+    mkdirSync(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync(join(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync(join(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync(join(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync(join(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync(p.settingsPath)) {
+      const raw = readFileSync(p.settingsPath, "utf-8");
+      if (!existsSync(p.backupPath)) writeFileSync(p.backupPath, raw);
+      try {
+        existing = JSON.parse(raw);
+      } catch {
+        existing = {};
+      }
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed \u2014 active in NEW Claude Code sessions (open a new one)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
+}
 function isGuardInstalled() {
   try {
     const p = globalPaths();
@@ -309,6 +357,7 @@ export {
   clearGuardUpdateCheck,
   globalPaths,
   installClaudeShim,
+  installGlobalQuiet,
   installGlobalWithKey,
   isGuardInstalled,
   lockProtected,

package/dist/index.js

@@ -6562,7 +6562,7 @@ __export(self_update_exports, {
   tuiUpdateFlow: () => tuiUpdateFlow
 });
 import { execFile, spawn } from "child_process";
-import { mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync4, realpathSync, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname, join as join4 } from "path";
 import { fileURLToPath } from "url";
@@ -6614,28 +6614,6 @@ async function fetchLatest() {
     return null;
   }
 }
-function npmGlobalRoot() {
-  return new Promise((resolve10) => {
-    try {
-      execFile("npm", ["root", "-g"], { timeout: 5e3, windowsHide: true, shell: process.platform === "win32" }, (err2, stdout) => {
-        resolve10(err2 ? null : stdout.trim() || null);
-      });
-    } catch {
-      resolve10(null);
-    }
-  });
-}
-async function isGlobalInstall() {
-  try {
-    const script = realpathSync(process.argv[1] ?? "");
-    if (!script) return false;
-    const root = await npmGlobalRoot();
-    if (!root) return false;
-    return script.startsWith(realpathSync(root));
-  } catch {
-    return false;
-  }
-}
 function spawnGlobalInstall(version) {
   try {
     mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
@@ -6687,7 +6665,7 @@ async function tuiUpdateFlow(onStatus) {
     if (!latest || !newerThan(latest, current)) return;
     const attempts = readState().attempts ?? {};
     const canRetry = Date.now() - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS;
-    if (await isGlobalInstall() && canRetry) {
+    if (canRetry) {
       writeState({ ...readState(), attempts: { [latest]: Date.now() } });
       onStatus({ kind: "updating", version: latest });
       if (await runGlobalInstall(latest)) {
@@ -6713,16 +6691,14 @@ function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
       }
       if (!latest || !newerThan(latest, current)) return;
       const attempts = readState().attempts ?? {};
-      if (await isGlobalInstall()) {
-        if (now - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS) {
-          writeState({ ...readState(), attempts: { [latest]: now } });
-          if (spawnGlobalInstall(latest)) {
-            notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
-            return;
-          }
-        } else {
+      if (now - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS) {
+        writeState({ ...readState(), attempts: { [latest]: now } });
+        if (spawnGlobalInstall(latest)) {
+          notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
           return;
         }
+      } else {
+        return;
       }
       notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 update: ${c.reset}${c.cyan}npm i -g ${PKG}@latest${c.reset}`);
     } catch {
@@ -10115,6 +10091,32 @@ import { homedir as homedir9 } from "os";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
+function lockFile(file) {
+  if (!existsSync4(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
 function unlockFile(file) {
   if (!existsSync4(file)) return;
   try {
@@ -10156,6 +10158,9 @@ function protectedTargets() {
     p.settingsPath
   ];
 }
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
+}
 function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
@@ -10174,12 +10179,59 @@ function globalPaths() {
     configPath: join11(sgDir, "cloud-guard.json")
   };
 }
-function clearGuardUpdateCheck() {
+function readHook(filename) {
+  return readFileSync9(join11(HOOKS_DIR, filename), "utf-8");
+}
+function readGuard() {
+  const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync4(bundled) ? readFileSync9(bundled, "utf-8") : readHook("guard.mjs");
+}
+function installGlobalQuiet() {
   try {
-    rmSync2(join11(globalPaths().sgDir, ".hook-update-check"), { force: true });
-    return true;
-  } catch {
-    return false;
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync9(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync8(p.hooksDir, { recursive: true });
+    mkdirSync8(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync9(join11(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync9(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync9(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync9(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync4(p.settingsPath)) {
+      const raw = readFileSync9(p.settingsPath, "utf-8");
+      if (!existsSync4(p.backupPath)) writeFileSync9(p.backupPath, raw);
+      try {
+        existing = JSON.parse(raw);
+      } catch {
+        existing = {};
+      }
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join11(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed \u2014 active in NEW Claude Code sessions (open a new one)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
   }
 }
 function isGuardInstalled() {
@@ -10303,6 +10355,19 @@ function SettingsPanel({
   const local = localQ.data;
   const guard = guardQ.data;
   const selfProt = selfQ.data;
+  const autoInstalledRef = useRef3(false);
+  useEffect6(() => {
+    if (autoInstalledRef.current) return;
+    if (guardHere && guard && guard.installed != null && !guard.up_to_date) {
+      autoInstalledRef.current = true;
+      const res = installGlobalQuiet();
+      if (res.ok) {
+        setGuardHere(isGuardInstalled());
+        setMsg({ text: `\u2713 guard auto-updated \u2192 v${guard.latest} hooks written \xB7 open a new Claude Code session to apply`, level: "ok" });
+        guardQ.reload();
+      }
+    }
+  }, [guardHere, guard]);
   const [hidden, setHidden] = useState7(/* @__PURE__ */ new Set());
   const webhooks = (whQ.data?.webhooks ?? []).filter((w) => !hidden.has("wh:" + w.id));
   const alerts = (alertQ.data?.rules ?? []).filter((r) => !hidden.has("alert:" + r.id));
@@ -10428,19 +10493,10 @@ function SettingsPanel({
     } else if (r.kind === "acct-add") {
       beginLogin();
     } else if (r.kind === "guard") {
-      if (!guardHere) {
-        setMsg({ text: "guard is removed on this device \u2014 log in again (Accounts \u2192 + add) to reinstall it", level: "bad" });
-        return;
-      }
-      if (!guard) return;
-      if (guard.up_to_date) {
-        setMsg({ text: `guard already on the latest hook (v${guard.latest})`, level: "ok" });
-        return;
-      }
-      const armed = clearGuardUpdateCheck();
-      setMsg(
-        armed ? { text: `\u2713 update armed. now make your agent RUN any command (e.g. "echo ok"), not just chat; the guard installs v${guard.latest} on the next executed command`, level: "ok" } : { text: "\u2717 could not arm the update (check ~/.solongate permissions)", level: "bad" }
-      );
+      const res = installGlobalQuiet();
+      setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
+      setGuardHere(isGuardInstalled());
+      guardQ.reload();
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run12(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
@@ -10712,12 +10768,13 @@ function SettingsPanel({
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
           !guardHere ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: theme.bad, bold: true, children: "removed" }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2014 not installed on this device \xB7 new Claude Code sessions are unguarded" })
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2014 new Claude Code sessions are unguarded \xB7 " }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.accentBright, children: "enter to install" })
           ] }) : guard ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter update` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest) \xB7 enter reinstall" : ` \u2192 v${guard.latest} available \xB7 enter update` }),
             /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""} \xB7 d remove` })
-          ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
+          ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "installed \xB7 enter reinstall/update \xB7 d remove" })
         ] });
       case "self":
         return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
@@ -10781,7 +10838,7 @@ function SettingsPanel({
   const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook: enter update \xB7 d remove \xB7 + self-protection toggle",
+    PROTECTION: "guard hook: enter install/update (writes the files) \xB7 d remove \xB7 + self-protection",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`

package/dist/tui/index.js

@@ -3148,6 +3148,32 @@ import { createInterface } from "readline";
 import { execFileSync } from "child_process";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var HOOKS_DIR = resolve2(__dirname, "..", "hooks");
+function lockFile(file) {
+  if (!existsSync2(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
 function unlockFile(file) {
   if (!existsSync2(file)) return;
   try {
@@ -3189,6 +3215,9 @@ function protectedTargets() {
     p.settingsPath
   ];
 }
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
+}
 function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
@@ -3207,12 +3236,59 @@ function globalPaths() {
     configPath: join6(sgDir, "cloud-guard.json")
   };
 }
-function clearGuardUpdateCheck() {
+function readHook(filename) {
+  return readFileSync4(join6(HOOKS_DIR, filename), "utf-8");
+}
+function readGuard() {
+  const bundled = join6(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync2(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
+}
+function installGlobalQuiet() {
   try {
-    rmSync(join6(globalPaths().sgDir, ".hook-update-check"), { force: true });
-    return true;
-  } catch {
-    return false;
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync4(p.hooksDir, { recursive: true });
+    mkdirSync4(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync5(join6(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync5(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync5(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync5(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync5(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync2(p.settingsPath)) {
+      const raw = readFileSync4(p.settingsPath, "utf-8");
+      if (!existsSync2(p.backupPath)) writeFileSync5(p.backupPath, raw);
+      try {
+        existing = JSON.parse(raw);
+      } catch {
+        existing = {};
+      }
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join6(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync5(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed \u2014 active in NEW Claude Code sessions (open a new one)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
   }
 }
 function isGuardInstalled() {
@@ -3416,6 +3492,19 @@ function SettingsPanel({
   const local = localQ.data;
   const guard = guardQ.data;
   const selfProt = selfQ.data;
+  const autoInstalledRef = useRef3(false);
+  useEffect6(() => {
+    if (autoInstalledRef.current) return;
+    if (guardHere && guard && guard.installed != null && !guard.up_to_date) {
+      autoInstalledRef.current = true;
+      const res = installGlobalQuiet();
+      if (res.ok) {
+        setGuardHere(isGuardInstalled());
+        setMsg({ text: `\u2713 guard auto-updated \u2192 v${guard.latest} hooks written \xB7 open a new Claude Code session to apply`, level: "ok" });
+        guardQ.reload();
+      }
+    }
+  }, [guardHere, guard]);
   const [hidden, setHidden] = useState7(/* @__PURE__ */ new Set());
   const webhooks = (whQ.data?.webhooks ?? []).filter((w) => !hidden.has("wh:" + w.id));
   const alerts = (alertQ.data?.rules ?? []).filter((r) => !hidden.has("alert:" + r.id));
@@ -3541,19 +3630,10 @@ function SettingsPanel({
     } else if (r.kind === "acct-add") {
       beginLogin();
     } else if (r.kind === "guard") {
-      if (!guardHere) {
-        setMsg({ text: "guard is removed on this device \u2014 log in again (Accounts \u2192 + add) to reinstall it", level: "bad" });
-        return;
-      }
-      if (!guard) return;
-      if (guard.up_to_date) {
-        setMsg({ text: `guard already on the latest hook (v${guard.latest})`, level: "ok" });
-        return;
-      }
-      const armed = clearGuardUpdateCheck();
-      setMsg(
-        armed ? { text: `\u2713 update armed. now make your agent RUN any command (e.g. "echo ok"), not just chat; the guard installs v${guard.latest} on the next executed command`, level: "ok" } : { text: "\u2717 could not arm the update (check ~/.solongate permissions)", level: "bad" }
-      );
+      const res = installGlobalQuiet();
+      setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
+      setGuardHere(isGuardInstalled());
+      guardQ.reload();
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
@@ -3825,12 +3905,13 @@ function SettingsPanel({
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
           !guardHere ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: theme.bad, bold: true, children: "removed" }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2014 not installed on this device \xB7 new Claude Code sessions are unguarded" })
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2014 new Claude Code sessions are unguarded \xB7 " }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.accentBright, children: "enter to install" })
           ] }) : guard ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter update` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest) \xB7 enter reinstall" : ` \u2192 v${guard.latest} available \xB7 enter update` }),
             /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""} \xB7 d remove` })
-          ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
+          ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "installed \xB7 enter reinstall/update \xB7 d remove" })
         ] });
       case "self":
         return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
@@ -3894,7 +3975,7 @@ function SettingsPanel({
   const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook: enter update \xB7 d remove \xB7 + self-protection toggle",
+    PROTECTION: "guard hook: enter install/update (writes the files) \xB7 d remove \xB7 + self-protection",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -3952,7 +4033,7 @@ function SettingsPanel({
 
 // src/self-update.ts
 import { execFile, spawn as spawn4 } from "child_process";
-import { mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync6, realpathSync, writeFileSync as writeFileSync7 } from "fs";
+import { mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir8 } from "os";
 import { dirname as dirname3, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -4009,28 +4090,6 @@ async function fetchLatest() {
     return null;
   }
 }
-function npmGlobalRoot() {
-  return new Promise((resolve3) => {
-    try {
-      execFile("npm", ["root", "-g"], { timeout: 5e3, windowsHide: true, shell: process.platform === "win32" }, (err, stdout) => {
-        resolve3(err ? null : stdout.trim() || null);
-      });
-    } catch {
-      resolve3(null);
-    }
-  });
-}
-async function isGlobalInstall() {
-  try {
-    const script = realpathSync(process.argv[1] ?? "");
-    if (!script) return false;
-    const root = await npmGlobalRoot();
-    if (!root) return false;
-    return script.startsWith(realpathSync(root));
-  } catch {
-    return false;
-  }
-}
 function runGlobalInstall(version) {
   return new Promise((resolve3) => {
     try {
@@ -4064,7 +4123,7 @@ async function tuiUpdateFlow(onStatus) {
     if (!latest || !newerThan(latest, current)) return;
     const attempts = readState2().attempts ?? {};
     const canRetry = Date.now() - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS;
-    if (await isGlobalInstall() && canRetry) {
+    if (canRetry) {
       writeState2({ ...readState2(), attempts: { [latest]: Date.now() } });
       onStatus({ kind: "updating", version: latest });
       if (await runGlobalInstall(latest)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.79",
+  "version": "0.81.81",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {