@solongate/proxy 0.81.84 → 0.81.86

package/dist/index.js

@@ -6663,17 +6663,15 @@ async function tuiUpdateFlow(onStatus) {
     const state = readState();
     if (latest) writeState({ ...state, lastCheckAt: Date.now(), latestSeen: latest });
     if (!latest || !newerThan(latest, current)) return;
-    const attempts = readState().attempts ?? {};
-    const canRetry = Date.now() - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS;
-    if (canRetry) {
-      writeState({ ...readState(), attempts: { [latest]: Date.now() } });
-      onStatus({ kind: "updating", version: latest });
-      if (await runGlobalInstall(latest)) {
-        onStatus({ kind: "updated", version: latest });
-        return;
-      }
+    if (readState().installed === latest) {
+      onStatus({ kind: "updated", version: latest });
+      return;
+    }
+    onStatus({ kind: "updating", version: latest });
+    if (await runGlobalInstall(latest)) {
+      writeState({ ...readState(), installed: latest });
+      onStatus({ kind: "updated", version: latest });
     }
-    onStatus({ kind: "manual", version: latest });
   } catch {
   }
 }
@@ -6695,12 +6693,8 @@ function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
         writeState({ ...readState(), attempts: { [latest]: now } });
         if (spawnGlobalInstall(latest)) {
           notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
-          return;
         }
-      } else {
-        return;
       }
-      notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 update: ${c.reset}${c.cyan}npm i -g ${PKG}@latest${c.reset}`);
     } catch {
     }
   })();
@@ -11072,7 +11066,7 @@ function App() {
         /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "account: " }),
         /* @__PURE__ */ jsx8(Text8, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
         locked ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : update2.kind === "manual" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 v${update2.version} available \u2014 npm i -g @solongate/proxy@latest` }) : null
+        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : null
       ] }),
       /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexGrow: 1, children: [
         /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", flexShrink: 0, width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {

package/dist/self-update.d.ts

@@ -8,9 +8,6 @@ export type UpdateStatus = {
 } | {
     kind: 'updated';
     version: string;
-} | {
-    kind: 'manual';
-    version: string;
 };
 /**
  * The dataroom's updater (Claude Code-style): check the registry EVERY time the

package/dist/tui/index.js

@@ -4138,17 +4138,15 @@ async function tuiUpdateFlow(onStatus) {
     const state = readState2();
     if (latest) writeState2({ ...state, lastCheckAt: Date.now(), latestSeen: latest });
     if (!latest || !newerThan(latest, current)) return;
-    const attempts = readState2().attempts ?? {};
-    const canRetry = Date.now() - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS;
-    if (canRetry) {
-      writeState2({ ...readState2(), attempts: { [latest]: Date.now() } });
-      onStatus({ kind: "updating", version: latest });
-      if (await runGlobalInstall(latest)) {
-        onStatus({ kind: "updated", version: latest });
-        return;
-      }
+    if (readState2().installed === latest) {
+      onStatus({ kind: "updated", version: latest });
+      return;
+    }
+    onStatus({ kind: "updating", version: latest });
+    if (await runGlobalInstall(latest)) {
+      writeState2({ ...readState2(), installed: latest });
+      onStatus({ kind: "updated", version: latest });
     }
-    onStatus({ kind: "manual", version: latest });
   } catch {
   }
 }
@@ -4292,7 +4290,7 @@ function App() {
         /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "account: " }),
         /* @__PURE__ */ jsx8(Text8, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
         locked ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : update2.kind === "manual" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 v${update2.version} available \u2014 npm i -g @solongate/proxy@latest` }) : null
+        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : null
       ] }),
       /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexGrow: 1, children: [
         /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", flexShrink: 0, width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 41;
+var HOOK_VERSION = 42;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -6804,17 +6804,16 @@ function blockTool(reason) {
     }));
     sgFinish(0);
   } else {
+    const msg = reason || "[SolonGate] Blocked by policy";
     process.stdout.write(JSON.stringify({
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
         permissionDecision: "deny",
-        // Never empty: a deny with an empty reason becomes an is_error tool_result
-        // with empty content, which the API rejects and crashes the agent. Always
-        // carry a SolonGate-worded reason so the block says WHAT stopped it.
-        permissionDecisionReason: reason || "[SolonGate] Blocked by policy"
+        permissionDecisionReason: msg
       }
     }));
-    sgFinish(0);
+    process.stderr.write(msg + "\n");
+    sgFinish(2);
   }
 }
 function allowTool() {
@@ -7924,7 +7923,8 @@ if (!REFRESH_MODE) {
             sgFinish(0);
           }
           process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: ghostHit } }));
-          sgFinish(0);
+          process.stderr.write(ghostHit + "\n");
+          sgFinish(2);
         }
         if (AGENT_TYPE !== "gemini-cli" && toolName === "Bash") {
           const rw = ghostListingRewrite(args, securityCfg.ghost);

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 41;
+const HOOK_VERSION = 42;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -385,23 +385,25 @@ function blockTool(reason) {
     }));
     sgFinish(0);
   } else {
-    // Claude Code — signal the block via the JSON PreToolUse protocol on stdout,
-    // NOT exit code 2. On Windows the hook runs through PowerShell, which does not
-    // reliably propagate a native process's exit code back to Claude Code, so an
-    // `exit 2` block was being seen as a "non-blocking status code" and the tool ran
-    // anyway. Claude only processes this JSON on exit 0 (JSON is ignored if you exit
-    // 2), so we MUST exit 0 here. This is shell-independent and works everywhere.
+    // Claude Code — emit the JSON PreToolUse deny on stdout AND exit 2 (reason on
+    // stderr). Exit 2 is the ONLY block Claude Code enforces in EVERY permission
+    // mode: JSON + exit 0 goes through the NORMAL permission flow, which
+    // AUTO-ACCEPT ("auto mode") OVERRIDES — the tool then runs despite the deny
+    // (observed: a DLP-blocked Write still landed on disk in auto mode). Exit 2
+    // hard-blocks BEFORE the permission system, in every mode. The JSON on stdout
+    // stays as the Windows/PowerShell fallback (there a native exit code may not
+    // propagate reliably; Claude Code parses the JSON instead). Reason is never
+    // empty — an empty deny becomes an is_error tool_result the API rejects.
+    const msg = reason || '[SolonGate] Blocked by policy';
     process.stdout.write(JSON.stringify({
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
         permissionDecision: 'deny',
-        // Never empty: a deny with an empty reason becomes an is_error tool_result
-        // with empty content, which the API rejects and crashes the agent. Always
-        // carry a SolonGate-worded reason so the block says WHAT stopped it.
-        permissionDecisionReason: reason || '[SolonGate] Blocked by policy',
+        permissionDecisionReason: msg,
       },
     }));
-    sgFinish(0);
+    process.stderr.write(msg + '\n');
+    sgFinish(2);
   }
 }
 
@@ -1761,10 +1763,13 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         } catch {}
         await maybeSelfUpdate();
         if (AGENT_TYPE === 'gemini-cli') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); sgFinish(0); }
-        // Claude Code: JSON deny on stdout + exit 0 (see blockTool — exit codes are
-        // not reliable through PowerShell on Windows; JSON is ignored on exit 2).
+        // Claude Code: JSON deny on stdout + exit 2 (reason on stderr). Exit 2 is
+        // the only block enforced in auto-accept mode (see blockTool); the JSON is
+        // the Windows fallback. ghostHit is a bare "No such file or directory", so
+        // the stderr text keeps the stealth (looks like the path simply isn't there).
         process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: ghostHit } }));
-        sgFinish(0);
+        process.stderr.write(ghostHit + '\n');
+        sgFinish(2);
       }
       // No direct hit: if this is a listing command, rewrite it so hidden
       // entries are filtered out of its output (Claude Code only).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.84",
+  "version": "0.81.86",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {