@solongate/proxy 0.82.15 → 0.82.17

package/dist/global-install.js

@@ -114,6 +114,17 @@ function clearGuardUpdateCheck() {
 function readHook(filename) {
   return readFileSync(join(HOOKS_DIR, filename), "utf-8");
 }
+function firstAccountCredential() {
+  try {
+    const raw = JSON.parse(readFileSync(join(homedir(), ".solongate", "accounts.json"), "utf-8"));
+    if (Array.isArray(raw)) {
+      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
+      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
+    }
+  } catch {
+  }
+  return {};
+}
 function readGuard() {
   const bundled = join(HOOKS_DIR, "guard.bundled.mjs");
   return existsSync(bundled) ? readFileSync(bundled, "utf-8") : readHook("guard.mjs");
@@ -193,6 +204,13 @@ function installGlobalQuiet() {
       if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
     } catch {
     }
+    if (!apiKey) {
+      const acc = firstAccountCredential();
+      if (acc.apiKey) {
+        apiKey = acc.apiKey;
+        if (acc.apiUrl) apiUrl = acc.apiUrl;
+      }
+    }
     if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
     mkdirSync(p.hooksDir, { recursive: true });
     mkdirSync(p.claudeDir, { recursive: true });
@@ -361,6 +379,10 @@ async function runGlobalInstall(opts = {}) {
     } catch {
     }
   }
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    const acc = firstAccountCredential();
+    if (acc.apiKey) apiKey = acc.apiKey;
+  }
   if (!apiKey || apiKey === "sg_live_your_key_here") {
     apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
   }

package/dist/index.js

@@ -10245,6 +10245,17 @@ function globalPaths() {
 function readHook(filename) {
   return readFileSync9(join11(HOOKS_DIR, filename), "utf-8");
 }
+function firstAccountCredential() {
+  try {
+    const raw = JSON.parse(readFileSync9(join11(homedir9(), ".solongate", "accounts.json"), "utf-8"));
+    if (Array.isArray(raw)) {
+      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
+      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
+    }
+  } catch {
+  }
+  return {};
+}
 function readGuard() {
   const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
   return existsSync4(bundled) ? readFileSync9(bundled, "utf-8") : readHook("guard.mjs");
@@ -10295,6 +10306,13 @@ function installGlobalQuiet() {
       if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
     } catch {
     }
+    if (!apiKey) {
+      const acc = firstAccountCredential();
+      if (acc.apiKey) {
+        apiKey = acc.apiKey;
+        if (acc.apiUrl) apiUrl = acc.apiUrl;
+      }
+    }
     if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
     mkdirSync8(p.hooksDir, { recursive: true });
     mkdirSync8(p.claudeDir, { recursive: true });

package/dist/tui/index.js

@@ -3303,6 +3303,17 @@ function globalPaths() {
 function readHook(filename) {
   return readFileSync4(join6(HOOKS_DIR, filename), "utf-8");
 }
+function firstAccountCredential() {
+  try {
+    const raw = JSON.parse(readFileSync4(join6(homedir6(), ".solongate", "accounts.json"), "utf-8"));
+    if (Array.isArray(raw)) {
+      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
+      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
+    }
+  } catch {
+  }
+  return {};
+}
 function readGuard() {
   const bundled = join6(HOOKS_DIR, "guard.bundled.mjs");
   return existsSync2(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
@@ -3354,6 +3365,13 @@ function installGlobalQuiet() {
       if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
     } catch {
     }
+    if (!apiKey) {
+      const acc = firstAccountCredential();
+      if (acc.apiKey) {
+        apiKey = acc.apiKey;
+        if (acc.apiUrl) apiUrl = acc.apiUrl;
+      }
+    }
     if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
     mkdirSync4(p.hooksDir, { recursive: true });
     mkdirSync4(p.claudeDir, { recursive: true });

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 44;
+var HOOK_VERSION = 45;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -6799,8 +6799,8 @@ function sgFinish(code) {
 function blockTool(reason) {
   if (AGENT_TYPE === "antigravity") {
     process.stdout.write(JSON.stringify({
-      decision: "deny",
-      reason: `[SolonGate] ${reason}`
+      allow_tool: false,
+      deny_reason: `[SolonGate] ${reason}`
     }));
     sgFinish(0);
   } else {
@@ -6818,7 +6818,7 @@ function blockTool(reason) {
 }
 function allowTool() {
   if (AGENT_TYPE === "antigravity") {
-    process.stdout.write(JSON.stringify({ decision: "allow" }));
+    process.stdout.write(JSON.stringify({ allow_tool: true }));
   }
   sgFinish(0);
 }
@@ -7966,7 +7966,7 @@ if (!REFRESH_MODE) {
           }
           await maybeSelfUpdate();
           if (AGENT_TYPE === "antigravity") {
-            process.stdout.write(JSON.stringify({ decision: "deny", reason: ghostHit }));
+            process.stdout.write(JSON.stringify({ allow_tool: false, deny_reason: ghostHit }));
             sgFinish(0);
           }
           process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: ghostHit } }));

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 44;
+const HOOK_VERSION = 45;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -345,7 +345,12 @@ if (REFRESH_MODE) { try { setTimeout(() => { try { process.exit(process.exitCode
 // ── Per-tool block/allow output ──
 // Response format depends on the agent:
 // Claude Code:      exit 2 + stderr = BLOCK, exit 0 = ALLOW
-// Antigravity CLI:  {"decision": "deny/allow", "reason": "..."} on stdout (exit 0)
+// Antigravity CLI:  its PreToolUse hook result is a protobuf message decoded from
+//   stdout JSON — BLOCK = {"allow_tool": false, "deny_reason": "..."}, ALLOW =
+//   {"allow_tool": true} (exit 0). NOTE: {"decision":"deny"} is Antigravity's
+//   *Stop* hook schema, NOT the tool gate — agy silently runs the tool if we
+//   send that, so the field names here are load-bearing (verified in the agy
+//   1.1.5 binary: AllowTool bool / DenyReason string).
 
 // Terminate the hook WITHOUT forcing process.exit(). On Windows + Node 24, calling
 // process.exit() right after a fetch() (the cloud audit-log POST) aborts with
@@ -380,8 +385,8 @@ function sgFinish(code) {
 function blockTool(reason) {
   if (AGENT_TYPE === 'antigravity') {
     process.stdout.write(JSON.stringify({
-      decision: 'deny',
-      reason: `[SolonGate] ${reason}`,
+      allow_tool: false,
+      deny_reason: `[SolonGate] ${reason}`,
     }));
     sgFinish(0);
   } else {
@@ -409,7 +414,7 @@ function blockTool(reason) {
 
 function allowTool() {
   if (AGENT_TYPE === 'antigravity') {
-    process.stdout.write(JSON.stringify({ decision: 'allow' }));
+    process.stdout.write(JSON.stringify({ allow_tool: true }));
   }
   sgFinish(0);
 }
@@ -1816,7 +1821,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
           });
         } catch {}
         await maybeSelfUpdate();
-        if (AGENT_TYPE === 'antigravity') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); sgFinish(0); }
+        if (AGENT_TYPE === 'antigravity') { process.stdout.write(JSON.stringify({ allow_tool: false, deny_reason: ghostHit })); sgFinish(0); }
         // Claude Code: JSON deny on stdout + exit 2 (reason on stderr). Exit 2 is
         // the only block enforced in auto-accept mode (see blockTool); the JSON is
         // the Windows fallback. ghostHit is a bare "No such file or directory", so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.15",
+  "version": "0.82.17",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {