@solongate/proxy 0.81.85 → 0.81.87

package/dist/index.js

@@ -6663,17 +6663,15 @@ async function tuiUpdateFlow(onStatus) {
     const state = readState();
     if (latest) writeState({ ...state, lastCheckAt: Date.now(), latestSeen: latest });
     if (!latest || !newerThan(latest, current)) return;
-    const attempts = readState().attempts ?? {};
-    const canRetry = Date.now() - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS;
-    if (canRetry) {
-      writeState({ ...readState(), attempts: { [latest]: Date.now() } });
-      onStatus({ kind: "updating", version: latest });
-      if (await runGlobalInstall(latest)) {
-        onStatus({ kind: "updated", version: latest });
-        return;
-      }
+    if (readState().installed === latest) {
+      onStatus({ kind: "updated", version: latest });
+      return;
+    }
+    onStatus({ kind: "updating", version: latest });
+    if (await runGlobalInstall(latest)) {
+      writeState({ ...readState(), installed: latest });
+      onStatus({ kind: "updated", version: latest });
     }
-    onStatus({ kind: "manual", version: latest });
   } catch {
   }
 }
@@ -6695,12 +6693,8 @@ function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
         writeState({ ...readState(), attempts: { [latest]: now } });
         if (spawnGlobalInstall(latest)) {
           notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
-          return;
         }
-      } else {
-        return;
       }
-      notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 update: ${c.reset}${c.cyan}npm i -g ${PKG}@latest${c.reset}`);
     } catch {
     }
   })();
@@ -11072,7 +11066,7 @@ function App() {
         /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "account: " }),
         /* @__PURE__ */ jsx8(Text8, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
         locked ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : update2.kind === "manual" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 v${update2.version} available \u2014 npm i -g @solongate/proxy@latest` }) : null
+        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : null
       ] }),
       /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexGrow: 1, children: [
         /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", flexShrink: 0, width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {

package/dist/self-update.d.ts

@@ -8,9 +8,6 @@ export type UpdateStatus = {
 } | {
     kind: 'updated';
     version: string;
-} | {
-    kind: 'manual';
-    version: string;
 };
 /**
  * The dataroom's updater (Claude Code-style): check the registry EVERY time the

package/dist/tui/index.js

@@ -4138,17 +4138,15 @@ async function tuiUpdateFlow(onStatus) {
     const state = readState2();
     if (latest) writeState2({ ...state, lastCheckAt: Date.now(), latestSeen: latest });
     if (!latest || !newerThan(latest, current)) return;
-    const attempts = readState2().attempts ?? {};
-    const canRetry = Date.now() - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS;
-    if (canRetry) {
-      writeState2({ ...readState2(), attempts: { [latest]: Date.now() } });
-      onStatus({ kind: "updating", version: latest });
-      if (await runGlobalInstall(latest)) {
-        onStatus({ kind: "updated", version: latest });
-        return;
-      }
+    if (readState2().installed === latest) {
+      onStatus({ kind: "updated", version: latest });
+      return;
+    }
+    onStatus({ kind: "updating", version: latest });
+    if (await runGlobalInstall(latest)) {
+      writeState2({ ...readState2(), installed: latest });
+      onStatus({ kind: "updated", version: latest });
     }
-    onStatus({ kind: "manual", version: latest });
   } catch {
   }
 }
@@ -4292,7 +4290,7 @@ function App() {
         /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "account: " }),
         /* @__PURE__ */ jsx8(Text8, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
         locked ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : update2.kind === "manual" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 v${update2.version} available \u2014 npm i -g @solongate/proxy@latest` }) : null
+        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : null
       ] }),
       /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexGrow: 1, children: [
         /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", flexShrink: 0, width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 42;
+var HOOK_VERSION = 43;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -7180,6 +7180,29 @@ function dlpGlobToRe(glob) {
   }
   return new RegExp(re, "i");
 }
+function dlpViews(text) {
+  const views = [text];
+  try {
+    const dequoted = text.replace(/[`'"\\]/g, "");
+    if (dequoted !== text)
+      views.push(dequoted);
+    const src = dequoted !== text ? text + "\n" + dequoted : text;
+    const toks = src.match(/[A-Za-z0-9+/]{16,}={0,2}/g) || [];
+    let decoded = "";
+    for (const t of toks.slice(0, 60)) {
+      try {
+        const d = Buffer.from(t, "base64").toString("latin1");
+        if (/[ -~]{8,}/.test(d))
+          decoded += d + "\n";
+      } catch {
+      }
+    }
+    if (decoded)
+      views.push(decoded);
+  } catch {
+  }
+  return views;
+}
 function dlpScan(args, cfg) {
   if (!cfg)
     return null;
@@ -7189,14 +7212,16 @@ function dlpScan(args, cfg) {
   } catch {
     return null;
   }
+  const views = dlpViews(text);
   const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
   for (const p of DLP_PATTERNS) {
-    if (allow.has(p.name) && p.re.test(text))
+    if (allow.has(p.name) && views.some((v) => p.re.test(v)))
       return p.name;
   }
   for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
     try {
-      if (dlpGlobToRe(c.re).test(text))
+      const re = dlpGlobToRe(c.re);
+      if (views.some((v) => re.test(v)))
         return c.name || "custom pattern";
     } catch {
     }

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 42;
+const HOOK_VERSION = 43;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -900,18 +900,45 @@ function dlpGlobToRe(glob) {
   }
   return new RegExp(re, 'i');
 }
+// De-obfuscated VIEWS of the scanned text, so an agent can't smuggle a secret
+// past the literal patterns by SPLITTING it (printf "AKIA""3XZ9…") or ENCODING it
+// (echo <base64> | base64 -d). We scan every view. Not exhaustive — pattern DLP
+// can never be — but it closes the two obvious bypasses.
+function dlpViews(text) {
+  const views = [text];
+  try {
+    // 1) Drop shell quotes + backslashes so a split secret collapses back to a
+    //    contiguous run: "AKIA""3XZ9…" / 'AKIA'\''…' / AKIA\3XZ9 → AKIA3XZ9…
+    const dequoted = text.replace(/[`'"\\]/g, '');
+    if (dequoted !== text) views.push(dequoted);
+    // 2) Decode base64-looking tokens (from both the raw and the dequoted view —
+    //    the payload itself may be split too) and scan the decoded bytes.
+    const src = dequoted !== text ? text + '\n' + dequoted : text;
+    const toks = src.match(/[A-Za-z0-9+/]{16,}={0,2}/g) || [];
+    let decoded = '';
+    for (const t of toks.slice(0, 60)) {
+      try {
+        const d = Buffer.from(t, 'base64').toString('latin1');
+        if (/[ -~]{8,}/.test(d)) decoded += d + '\n'; // keep printable decodes only
+      } catch { /* not base64 */ }
+    }
+    if (decoded) views.push(decoded);
+  } catch { /* fall back to the raw view */ }
+  return views;
+}
 // Scan args against the enabled built-in patterns + any user custom patterns.
 // `cfg` = { patterns: string[], custom: {name,re}[] }.
 function dlpScan(args, cfg) {
   if (!cfg) return null;
   let text = '';
   try { text = JSON.stringify(args || {}); } catch { return null; }
+  const views = dlpViews(text);
   const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
   for (const p of DLP_PATTERNS) {
-    if (allow.has(p.name) && p.re.test(text)) return p.name;
+    if (allow.has(p.name) && views.some((v) => p.re.test(v))) return p.name;
   }
   for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
-    try { if (dlpGlobToRe(c.re).test(text)) return c.name || 'custom pattern'; } catch { /* skip invalid */ }
+    try { const re = dlpGlobToRe(c.re); if (views.some((v) => re.test(v))) return c.name || 'custom pattern'; } catch { /* skip invalid */ }
   }
   return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.85",
+  "version": "0.81.87",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {