@solongate/proxy 0.81.80 → 0.81.82

package/dist/global-install.d.ts

@@ -11,6 +11,28 @@ export declare function globalPaths(): {
 };
 export declare function clearGuardUpdateCheck(): boolean;
 export declare function runGlobalRestore(): void;
+/**
+ * TUI-safe (re)install — the dataroom's one-key "install / update guard" action.
+ * Writes the hook files THIS CLI ships (readGuard = the current package's bundle,
+ * so a self-updated dataroom installs the newest hooks DIRECTLY — no waiting for a
+ * tool call) and registers them in the global Claude settings, reusing the key
+ * already stored in cloud-guard.json. No prompt, no stdout, no process.exit — safe
+ * to call from Ink. Returns a status; asks the user to log in when no key exists.
+ * The auto-shield shell shim is left to `solongate` login (it can print), so this
+ * touches only the guard/audit/stop hooks — the primary protection.
+ */
+export declare function installGlobalQuiet(): {
+    ok: boolean;
+    message: string;
+};
+/** HOOK_VERSION of the guard hook currently installed on THIS device (read from
+ *  the file), or null when not installed. The LOCAL truth — independent of the
+ *  cloud guard-status (which only knows what the device last REPORTED). */
+export declare function installedGuardVersion(): number | null;
+/** True when the installed guard hook DIFFERS from the one this CLI ships — i.e.
+ *  a newer hook is available locally (the CLI self-updated). Cloud-independent,
+ *  so the dataroom can offer/apply an update even when the API is behind. */
+export declare function guardHookOutdated(): boolean;
 /**
  * Are the SolonGate guard hooks currently installed in the global Claude settings
  * on THIS device? Reflects a local install/remove IMMEDIATELY — unlike the cloud

package/dist/global-install.js

@@ -137,6 +137,72 @@ function runGlobalRestore() {
   }
   console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
 }
+function installGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync(p.hooksDir, { recursive: true });
+    mkdirSync(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync(join(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync(join(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync(join(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync(join(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync(p.settingsPath)) {
+      const raw = readFileSync(p.settingsPath, "utf-8");
+      if (!existsSync(p.backupPath)) writeFileSync(p.backupPath, raw);
+      try {
+        existing = JSON.parse(raw);
+      } catch {
+        existing = {};
+      }
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
+}
+function installedGuardVersion() {
+  try {
+    const p = globalPaths();
+    const s = readFileSync(join(p.hooksDir, "guard.mjs"), "utf-8");
+    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : null;
+  } catch {
+    return null;
+  }
+}
+function guardHookOutdated() {
+  try {
+    const p = globalPaths();
+    return readFileSync(join(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
+  } catch {
+    return false;
+  }
+}
 function isGuardInstalled() {
   try {
     const p = globalPaths();
@@ -152,18 +218,11 @@ function uninstallGlobalQuiet() {
     const p = globalPaths();
     unlockProtected();
     removeClaudeShim();
-    const applies = "applies to NEW Claude Code sessions \u2014 a session already running keeps its loaded hooks until it ends";
-    if (existsSync(p.backupPath)) {
-      writeFileSync(p.settingsPath, readFileSync(p.backupPath, "utf-8"));
-      return { ok: true, message: `guard removed \u2014 restored the pre-install settings \xB7 ${applies}` };
-    }
-    if (existsSync(p.settingsPath)) {
-      const s = JSON.parse(readFileSync(p.settingsPath, "utf-8"));
-      delete s.hooks;
-      writeFileSync(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
-      return { ok: true, message: `guard removed \u2014 hooks cleared \xB7 ${applies}` };
-    }
-    return { ok: true, message: "nothing to remove \u2014 no global Claude Code settings found" };
+    if (!existsSync(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
+    const s = JSON.parse(readFileSync(p.settingsPath, "utf-8"));
+    delete s.hooks;
+    writeFileSync(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+    return { ok: true, message: "guard removed (open a new session)" };
   } catch (e) {
     return { ok: false, message: e instanceof Error ? e.message : String(e) };
   }
@@ -308,8 +367,11 @@ async function installGlobalWithKey(apiKey, apiUrl) {
 export {
   clearGuardUpdateCheck,
   globalPaths,
+  guardHookOutdated,
   installClaudeShim,
+  installGlobalQuiet,
   installGlobalWithKey,
+  installedGuardVersion,
   isGuardInstalled,
   lockProtected,
   removeClaudeShim,

package/dist/index.js

@@ -10091,6 +10091,32 @@ import { homedir as homedir9 } from "os";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
+function lockFile(file) {
+  if (!existsSync4(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
 function unlockFile(file) {
   if (!existsSync4(file)) return;
   try {
@@ -10132,6 +10158,9 @@ function protectedTargets() {
     p.settingsPath
   ];
 }
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
+}
 function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
@@ -10150,10 +10179,75 @@ function globalPaths() {
     configPath: join11(sgDir, "cloud-guard.json")
   };
 }
-function clearGuardUpdateCheck() {
+function readHook(filename) {
+  return readFileSync9(join11(HOOKS_DIR, filename), "utf-8");
+}
+function readGuard() {
+  const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync4(bundled) ? readFileSync9(bundled, "utf-8") : readHook("guard.mjs");
+}
+function installGlobalQuiet() {
   try {
-    rmSync2(join11(globalPaths().sgDir, ".hook-update-check"), { force: true });
-    return true;
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync9(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync8(p.hooksDir, { recursive: true });
+    mkdirSync8(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync9(join11(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync9(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync9(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync9(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync4(p.settingsPath)) {
+      const raw = readFileSync9(p.settingsPath, "utf-8");
+      if (!existsSync4(p.backupPath)) writeFileSync9(p.backupPath, raw);
+      try {
+        existing = JSON.parse(raw);
+      } catch {
+        existing = {};
+      }
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join11(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
+}
+function installedGuardVersion() {
+  try {
+    const p = globalPaths();
+    const s = readFileSync9(join11(p.hooksDir, "guard.mjs"), "utf-8");
+    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : null;
+  } catch {
+    return null;
+  }
+}
+function guardHookOutdated() {
+  try {
+    const p = globalPaths();
+    return readFileSync9(join11(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
   } catch {
     return false;
   }
@@ -10173,18 +10267,11 @@ function uninstallGlobalQuiet() {
     const p = globalPaths();
     unlockProtected();
     removeClaudeShim();
-    const applies = "applies to NEW Claude Code sessions \u2014 a session already running keeps its loaded hooks until it ends";
-    if (existsSync4(p.backupPath)) {
-      writeFileSync9(p.settingsPath, readFileSync9(p.backupPath, "utf-8"));
-      return { ok: true, message: `guard removed \u2014 restored the pre-install settings \xB7 ${applies}` };
-    }
-    if (existsSync4(p.settingsPath)) {
-      const s = JSON.parse(readFileSync9(p.settingsPath, "utf-8"));
-      delete s.hooks;
-      writeFileSync9(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
-      return { ok: true, message: `guard removed \u2014 hooks cleared \xB7 ${applies}` };
-    }
-    return { ok: true, message: "nothing to remove \u2014 no global Claude Code settings found" };
+    if (!existsSync4(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
+    const s = JSON.parse(readFileSync9(p.settingsPath, "utf-8"));
+    delete s.hooks;
+    writeFileSync9(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+    return { ok: true, message: "guard removed (open a new session)" };
   } catch (e) {
     return { ok: false, message: e instanceof Error ? e.message : String(e) };
   }
@@ -10260,6 +10347,13 @@ function SettingsPanel({
   const abort = useRef3(false);
   const refreshAccounts = () => setAccounts(listAccounts());
   const [guardHere, setGuardHere] = useState7(() => isGuardInstalled());
+  const [guardVer, setGuardVer] = useState7(() => installedGuardVersion());
+  const [guardOld, setGuardOld] = useState7(() => guardHookOutdated());
+  const refreshGuard = () => {
+    setGuardHere(isGuardInstalled());
+    setGuardVer(installedGuardVersion());
+    setGuardOld(guardHookOutdated());
+  };
   const locked = accounts.length === 0;
   const [srv, setSrv] = useState7(() => logsServerStatus());
   useEffect6(() => {
@@ -10277,8 +10371,20 @@ function SettingsPanel({
   const guardQ = useLoader(() => listAccounts().length ? api.settings.getGuardStatus() : Promise.resolve(null));
   const selfQ = useLoader(() => listAccounts().length ? api.settings.getSelfProtection() : Promise.resolve(null));
   const local = localQ.data;
-  const guard = guardQ.data;
   const selfProt = selfQ.data;
+  const autoInstalledRef = useRef3(false);
+  useEffect6(() => {
+    if (autoInstalledRef.current) return;
+    if (guardHere && guardOld) {
+      autoInstalledRef.current = true;
+      const res = installGlobalQuiet();
+      if (res.ok) {
+        refreshGuard();
+        setMsg({ text: `\u2713 guard updated \u2192 v${installedGuardVersion() ?? "?"} (open a new session)`, level: "ok" });
+        guardQ.reload();
+      }
+    }
+  }, [guardHere, guardOld]);
   const [hidden, setHidden] = useState7(/* @__PURE__ */ new Set());
   const webhooks = (whQ.data?.webhooks ?? []).filter((w) => !hidden.has("wh:" + w.id));
   const alerts = (alertQ.data?.rules ?? []).filter((r) => !hidden.has("alert:" + r.id));
@@ -10404,19 +10510,10 @@ function SettingsPanel({
     } else if (r.kind === "acct-add") {
       beginLogin();
     } else if (r.kind === "guard") {
-      if (!guardHere) {
-        setMsg({ text: "guard is removed on this device \u2014 log in again (Accounts \u2192 + add) to reinstall it", level: "bad" });
-        return;
-      }
-      if (!guard) return;
-      if (guard.up_to_date) {
-        setMsg({ text: `guard already on the latest hook (v${guard.latest})`, level: "ok" });
-        return;
-      }
-      const armed = clearGuardUpdateCheck();
-      setMsg(
-        armed ? { text: `\u2713 update armed. now make your agent RUN any command (e.g. "echo ok"), not just chat; the guard installs v${guard.latest} on the next executed command`, level: "ok" } : { text: "\u2717 could not arm the update (check ~/.solongate permissions)", level: "bad" }
-      );
+      const res = installGlobalQuiet();
+      setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
+      refreshGuard();
+      guardQ.reload();
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run12(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
@@ -10579,7 +10676,7 @@ function SettingsPanel({
         setConfirmDel(null);
         const res = uninstallGlobalQuiet();
         setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
-        setGuardHere(isGuardInstalled());
+        refreshGuard();
         guardQ.reload();
       } else if (inp === "d" && (cur.kind === "wh" || cur.kind === "alert")) {
         const k = keyOf(cur);
@@ -10688,12 +10785,13 @@ function SettingsPanel({
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
           !guardHere ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: theme.bad, bold: true, children: "removed" }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2014 not installed on this device \xB7 new Claude Code sessions are unguarded" })
-          ] }) : guard ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
-            /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter update` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""} \xB7 d remove` })
-          ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \xB7 " }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.accentBright, children: "enter to install" })
+          ] }) : /* @__PURE__ */ jsxs7(Fragment4, { children: [
+            /* @__PURE__ */ jsx7(Text7, { color: guardOld ? theme.warn : theme.ok, children: `v${guardVer ?? "?"}` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guardOld ? " \xB7 update available \xB7 enter update" : " (latest) \xB7 enter reinstall" }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \xB7 d remove" })
+          ] })
         ] });
       case "self":
         return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
@@ -10757,7 +10855,7 @@ function SettingsPanel({
   const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook: enter update \xB7 d remove \xB7 + self-protection toggle",
+    PROTECTION: "guard hook: enter install/update (writes the files) \xB7 d remove \xB7 + self-protection",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`

package/dist/tui/index.js

@@ -3148,6 +3148,32 @@ import { createInterface } from "readline";
 import { execFileSync } from "child_process";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var HOOKS_DIR = resolve2(__dirname, "..", "hooks");
+function lockFile(file) {
+  if (!existsSync2(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
 function unlockFile(file) {
   if (!existsSync2(file)) return;
   try {
@@ -3189,6 +3215,9 @@ function protectedTargets() {
     p.settingsPath
   ];
 }
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
+}
 function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
@@ -3207,10 +3236,75 @@ function globalPaths() {
     configPath: join6(sgDir, "cloud-guard.json")
   };
 }
-function clearGuardUpdateCheck() {
+function readHook(filename) {
+  return readFileSync4(join6(HOOKS_DIR, filename), "utf-8");
+}
+function readGuard() {
+  const bundled = join6(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync2(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
+}
+function installGlobalQuiet() {
   try {
-    rmSync(join6(globalPaths().sgDir, ".hook-update-check"), { force: true });
-    return true;
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync4(p.hooksDir, { recursive: true });
+    mkdirSync4(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync5(join6(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync5(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync5(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync5(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync5(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync2(p.settingsPath)) {
+      const raw = readFileSync4(p.settingsPath, "utf-8");
+      if (!existsSync2(p.backupPath)) writeFileSync5(p.backupPath, raw);
+      try {
+        existing = JSON.parse(raw);
+      } catch {
+        existing = {};
+      }
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join6(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync5(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
+}
+function installedGuardVersion() {
+  try {
+    const p = globalPaths();
+    const s = readFileSync4(join6(p.hooksDir, "guard.mjs"), "utf-8");
+    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : null;
+  } catch {
+    return null;
+  }
+}
+function guardHookOutdated() {
+  try {
+    const p = globalPaths();
+    return readFileSync4(join6(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
   } catch {
     return false;
   }
@@ -3230,18 +3324,11 @@ function uninstallGlobalQuiet() {
     const p = globalPaths();
     unlockProtected();
     removeClaudeShim();
-    const applies = "applies to NEW Claude Code sessions \u2014 a session already running keeps its loaded hooks until it ends";
-    if (existsSync2(p.backupPath)) {
-      writeFileSync5(p.settingsPath, readFileSync4(p.backupPath, "utf-8"));
-      return { ok: true, message: `guard removed \u2014 restored the pre-install settings \xB7 ${applies}` };
-    }
-    if (existsSync2(p.settingsPath)) {
-      const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
-      delete s.hooks;
-      writeFileSync5(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
-      return { ok: true, message: `guard removed \u2014 hooks cleared \xB7 ${applies}` };
-    }
-    return { ok: true, message: "nothing to remove \u2014 no global Claude Code settings found" };
+    if (!existsSync2(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    delete s.hooks;
+    writeFileSync5(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+    return { ok: true, message: "guard removed (open a new session)" };
   } catch (e) {
     return { ok: false, message: e instanceof Error ? e.message : String(e) };
   }
@@ -3397,6 +3484,13 @@ function SettingsPanel({
   const abort = useRef3(false);
   const refreshAccounts = () => setAccounts(listAccounts());
   const [guardHere, setGuardHere] = useState7(() => isGuardInstalled());
+  const [guardVer, setGuardVer] = useState7(() => installedGuardVersion());
+  const [guardOld, setGuardOld] = useState7(() => guardHookOutdated());
+  const refreshGuard = () => {
+    setGuardHere(isGuardInstalled());
+    setGuardVer(installedGuardVersion());
+    setGuardOld(guardHookOutdated());
+  };
   const locked = accounts.length === 0;
   const [srv, setSrv] = useState7(() => logsServerStatus());
   useEffect6(() => {
@@ -3414,8 +3508,20 @@ function SettingsPanel({
   const guardQ = useLoader(() => listAccounts().length ? api.settings.getGuardStatus() : Promise.resolve(null));
   const selfQ = useLoader(() => listAccounts().length ? api.settings.getSelfProtection() : Promise.resolve(null));
   const local = localQ.data;
-  const guard = guardQ.data;
   const selfProt = selfQ.data;
+  const autoInstalledRef = useRef3(false);
+  useEffect6(() => {
+    if (autoInstalledRef.current) return;
+    if (guardHere && guardOld) {
+      autoInstalledRef.current = true;
+      const res = installGlobalQuiet();
+      if (res.ok) {
+        refreshGuard();
+        setMsg({ text: `\u2713 guard updated \u2192 v${installedGuardVersion() ?? "?"} (open a new session)`, level: "ok" });
+        guardQ.reload();
+      }
+    }
+  }, [guardHere, guardOld]);
   const [hidden, setHidden] = useState7(/* @__PURE__ */ new Set());
   const webhooks = (whQ.data?.webhooks ?? []).filter((w) => !hidden.has("wh:" + w.id));
   const alerts = (alertQ.data?.rules ?? []).filter((r) => !hidden.has("alert:" + r.id));
@@ -3541,19 +3647,10 @@ function SettingsPanel({
     } else if (r.kind === "acct-add") {
       beginLogin();
     } else if (r.kind === "guard") {
-      if (!guardHere) {
-        setMsg({ text: "guard is removed on this device \u2014 log in again (Accounts \u2192 + add) to reinstall it", level: "bad" });
-        return;
-      }
-      if (!guard) return;
-      if (guard.up_to_date) {
-        setMsg({ text: `guard already on the latest hook (v${guard.latest})`, level: "ok" });
-        return;
-      }
-      const armed = clearGuardUpdateCheck();
-      setMsg(
-        armed ? { text: `\u2713 update armed. now make your agent RUN any command (e.g. "echo ok"), not just chat; the guard installs v${guard.latest} on the next executed command`, level: "ok" } : { text: "\u2717 could not arm the update (check ~/.solongate permissions)", level: "bad" }
-      );
+      const res = installGlobalQuiet();
+      setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
+      refreshGuard();
+      guardQ.reload();
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
@@ -3716,7 +3813,7 @@ function SettingsPanel({
         setConfirmDel(null);
         const res = uninstallGlobalQuiet();
         setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
-        setGuardHere(isGuardInstalled());
+        refreshGuard();
         guardQ.reload();
       } else if (inp === "d" && (cur.kind === "wh" || cur.kind === "alert")) {
         const k = keyOf(cur);
@@ -3825,12 +3922,13 @@ function SettingsPanel({
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
           !guardHere ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: theme.bad, bold: true, children: "removed" }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2014 not installed on this device \xB7 new Claude Code sessions are unguarded" })
-          ] }) : guard ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
-            /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter update` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""} \xB7 d remove` })
-          ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \xB7 " }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.accentBright, children: "enter to install" })
+          ] }) : /* @__PURE__ */ jsxs7(Fragment4, { children: [
+            /* @__PURE__ */ jsx7(Text7, { color: guardOld ? theme.warn : theme.ok, children: `v${guardVer ?? "?"}` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guardOld ? " \xB7 update available \xB7 enter update" : " (latest) \xB7 enter reinstall" }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \xB7 d remove" })
+          ] })
         ] });
       case "self":
         return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
@@ -3894,7 +3992,7 @@ function SettingsPanel({
   const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook: enter update \xB7 d remove \xB7 + self-protection toggle",
+    PROTECTION: "guard hook: enter install/update (writes the files) \xB7 d remove \xB7 + self-protection",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.80",
+  "version": "0.81.82",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {