@solongate/proxy 0.82.16 → 0.82.17

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 44;
+var HOOK_VERSION = 45;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -6799,8 +6799,8 @@ function sgFinish(code) {
 function blockTool(reason) {
   if (AGENT_TYPE === "antigravity") {
     process.stdout.write(JSON.stringify({
-      decision: "deny",
-      reason: `[SolonGate] ${reason}`
+      allow_tool: false,
+      deny_reason: `[SolonGate] ${reason}`
     }));
     sgFinish(0);
   } else {
@@ -6818,7 +6818,7 @@ function blockTool(reason) {
 }
 function allowTool() {
   if (AGENT_TYPE === "antigravity") {
-    process.stdout.write(JSON.stringify({ decision: "allow" }));
+    process.stdout.write(JSON.stringify({ allow_tool: true }));
   }
   sgFinish(0);
 }
@@ -7966,7 +7966,7 @@ if (!REFRESH_MODE) {
           }
           await maybeSelfUpdate();
           if (AGENT_TYPE === "antigravity") {
-            process.stdout.write(JSON.stringify({ decision: "deny", reason: ghostHit }));
+            process.stdout.write(JSON.stringify({ allow_tool: false, deny_reason: ghostHit }));
             sgFinish(0);
           }
           process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: ghostHit } }));

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 44;
+const HOOK_VERSION = 45;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -345,7 +345,12 @@ if (REFRESH_MODE) { try { setTimeout(() => { try { process.exit(process.exitCode
 // ── Per-tool block/allow output ──
 // Response format depends on the agent:
 // Claude Code:      exit 2 + stderr = BLOCK, exit 0 = ALLOW
-// Antigravity CLI:  {"decision": "deny/allow", "reason": "..."} on stdout (exit 0)
+// Antigravity CLI:  its PreToolUse hook result is a protobuf message decoded from
+//   stdout JSON — BLOCK = {"allow_tool": false, "deny_reason": "..."}, ALLOW =
+//   {"allow_tool": true} (exit 0). NOTE: {"decision":"deny"} is Antigravity's
+//   *Stop* hook schema, NOT the tool gate — agy silently runs the tool if we
+//   send that, so the field names here are load-bearing (verified in the agy
+//   1.1.5 binary: AllowTool bool / DenyReason string).
 
 // Terminate the hook WITHOUT forcing process.exit(). On Windows + Node 24, calling
 // process.exit() right after a fetch() (the cloud audit-log POST) aborts with
@@ -380,8 +385,8 @@ function sgFinish(code) {
 function blockTool(reason) {
   if (AGENT_TYPE === 'antigravity') {
     process.stdout.write(JSON.stringify({
-      decision: 'deny',
-      reason: `[SolonGate] ${reason}`,
+      allow_tool: false,
+      deny_reason: `[SolonGate] ${reason}`,
     }));
     sgFinish(0);
   } else {
@@ -409,7 +414,7 @@ function blockTool(reason) {
 
 function allowTool() {
   if (AGENT_TYPE === 'antigravity') {
-    process.stdout.write(JSON.stringify({ decision: 'allow' }));
+    process.stdout.write(JSON.stringify({ allow_tool: true }));
   }
   sgFinish(0);
 }
@@ -1816,7 +1821,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
           });
         } catch {}
         await maybeSelfUpdate();
-        if (AGENT_TYPE === 'antigravity') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); sgFinish(0); }
+        if (AGENT_TYPE === 'antigravity') { process.stdout.write(JSON.stringify({ allow_tool: false, deny_reason: ghostHit })); sgFinish(0); }
         // Claude Code: JSON deny on stdout + exit 2 (reason on stderr). Exit 2 is
         // the only block enforced in auto-accept mode (see blockTool); the JSON is
         // the Windows fallback. ghostHit is a bare "No such file or directory", so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.16",
+  "version": "0.82.17",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {