@solongate/proxy 0.82.45 → 0.82.47

package/dist/global-install.d.ts

@@ -24,6 +24,13 @@ export declare function runGlobalRestore(): void;
  * The auto-shield shell shim is left to `solongate` login (it can print), so this
  * touches only the guard/audit/stop hooks — the primary protection.
  */
+/**
+ * `solongate repair` — restore the guard after tampering/deletion. Reports what
+ * was missing, then rewrites every protection file (guard/audit/stop/shield hooks
+ * + cloud config) and re-registers the hooks in Claude Code and Antigravity, then
+ * re-locks. Reuses the logged-in account, so no re-login. Human-only (gated).
+ */
+export declare function runRepair(): Promise<number>;
 export declare function installGlobalQuiet(): {
     ok: boolean;
     message: string;

package/dist/global-install.js

@@ -1,5 +1,5 @@
 // src/global-install.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync, chmodSync } from "fs";
 import { resolve, join, dirname } from "path";
 import { homedir } from "os";
 import { fileURLToPath } from "url";
@@ -12,7 +12,11 @@ function lockFile(file) {
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE,WDAC,WO)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("icacls", [file, "/grant", "*S-1-3-4:(RX)"], { stdio: "ignore" });
       } catch {
       }
       try {
@@ -29,6 +33,10 @@ function lockFile(file) {
         execFileSync("chattr", ["+i", file], { stdio: "ignore" });
       } catch {
       }
+      try {
+        chmodSync(file, 292);
+      } catch {
+      }
     }
   } catch {
   }
@@ -37,6 +45,10 @@ function unlockFile(file) {
   if (!existsSync(file)) return;
   try {
     if (process.platform === "win32") {
+      try {
+        execFileSync("icacls", [file, "/remove:g", "*S-1-3-4"], { stdio: "ignore" });
+      } catch {
+      }
       try {
         execFileSync("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
       } catch {
@@ -59,6 +71,10 @@ function unlockFile(file) {
         execFileSync("chattr", ["-i", file], { stdio: "ignore" });
       } catch {
       }
+      try {
+        chmodSync(file, 420);
+      } catch {
+      }
     }
   } catch {
   }
@@ -193,6 +209,34 @@ function runGlobalRestore() {
   }
   console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
 }
+async function runRepair() {
+  const p = globalPaths();
+  const out = (s) => void process.stderr.write(s + "\n");
+  const has = (f) => existsSync(f);
+  const guardFile = join(p.hooksDir, "guard.mjs");
+  out("");
+  out("  SolonGate repair");
+  out("");
+  out("  before:");
+  out(`    guard hook file      ${has(guardFile) ? "present" : "MISSING"}`);
+  out(`    cloud credential     ${has(p.configPath) ? "present" : "MISSING"}`);
+  out(`    Claude Code settings ${isGuardInstalled() ? "guard registered" : "guard NOT registered"}`);
+  out(`    Antigravity hooks    ${has(p.antigravityHooksPath) ? "present" : "MISSING"}`);
+  out("");
+  const r = installGlobalQuiet();
+  if (!r.ok) {
+    out(`  \u2717 ${r.message}`);
+    return 1;
+  }
+  out("  restored:");
+  out(`    guard hook file      present (v${installedGuardVersion() ?? "?"})`);
+  out(`    Claude Code settings ${isGuardInstalled() ? "guard registered" : "NOT registered"}`);
+  out(`    Antigravity hooks    ${has(p.antigravityHooksPath) ? "present" : "MISSING"}`);
+  out("");
+  out("  \u2713 guard repaired. Open a new AI session for it to take effect.");
+  out("");
+  return 0;
+}
 function installGlobalQuiet() {
   try {
     const p = globalPaths();
@@ -246,7 +290,7 @@ function installGlobalQuiet() {
       installAntigravityGuard(p, join(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
     } catch {
     }
-    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") lockProtected();
     return { ok: true, message: "guard installed (open a new session)" };
   } catch (e) {
     return { ok: false, message: e instanceof Error ? e.message : String(e) };
@@ -436,7 +480,7 @@ async function runGlobalInstall(opts = {}) {
     console.log(`  Registered Antigravity CLI guard \u2192 ${p.antigravityHooksPath}`);
   } catch {
   }
-  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
+  if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") {
     lockProtected();
     console.log("  Locked protection files (OS-level read-only/immutable).");
   }
@@ -457,6 +501,7 @@ export {
   removeClaudeShim,
   runGlobalInstall,
   runGlobalRestore,
+  runRepair,
   uninstallGlobalQuiet,
   unlockProtected
 };

package/dist/index.js

@@ -6202,10 +6202,11 @@ __export(global_install_exports, {
   removeClaudeShim: () => removeClaudeShim,
   runGlobalInstall: () => runGlobalInstall,
   runGlobalRestore: () => runGlobalRestore,
+  runRepair: () => runRepair,
   uninstallGlobalQuiet: () => uninstallGlobalQuiet,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync2 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync2, chmodSync } from "fs";
 import { resolve as resolve3, join as join4, dirname } from "path";
 import { homedir as homedir2 } from "os";
 import { fileURLToPath } from "url";
@@ -6216,7 +6217,11 @@ function lockFile(file) {
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE,WDAC,WO)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("icacls", [file, "/grant", "*S-1-3-4:(RX)"], { stdio: "ignore" });
       } catch {
       }
       try {
@@ -6233,6 +6238,10 @@ function lockFile(file) {
         execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
       } catch {
       }
+      try {
+        chmodSync(file, 292);
+      } catch {
+      }
     }
   } catch {
   }
@@ -6241,6 +6250,10 @@ function unlockFile(file) {
   if (!existsSync3(file)) return;
   try {
     if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/remove:g", "*S-1-3-4"], { stdio: "ignore" });
+      } catch {
+      }
       try {
         execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
       } catch {
@@ -6263,6 +6276,10 @@ function unlockFile(file) {
         execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
       } catch {
       }
+      try {
+        chmodSync(file, 420);
+      } catch {
+      }
     }
   } catch {
   }
@@ -6396,6 +6413,34 @@ function runGlobalRestore() {
   }
   console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
 }
+async function runRepair() {
+  const p = globalPaths();
+  const out2 = (s) => void process.stderr.write(s + "\n");
+  const has = (f) => existsSync3(f);
+  const guardFile = join4(p.hooksDir, "guard.mjs");
+  out2("");
+  out2("  SolonGate repair");
+  out2("");
+  out2("  before:");
+  out2(`    guard hook file      ${has(guardFile) ? "present" : "MISSING"}`);
+  out2(`    cloud credential     ${has(p.configPath) ? "present" : "MISSING"}`);
+  out2(`    Claude Code settings ${isGuardInstalled() ? "guard registered" : "guard NOT registered"}`);
+  out2(`    Antigravity hooks    ${has(p.antigravityHooksPath) ? "present" : "MISSING"}`);
+  out2("");
+  const r = installGlobalQuiet();
+  if (!r.ok) {
+    out2(`  \u2717 ${r.message}`);
+    return 1;
+  }
+  out2("  restored:");
+  out2(`    guard hook file      present (v${installedGuardVersion() ?? "?"})`);
+  out2(`    Claude Code settings ${isGuardInstalled() ? "guard registered" : "NOT registered"}`);
+  out2(`    Antigravity hooks    ${has(p.antigravityHooksPath) ? "present" : "MISSING"}`);
+  out2("");
+  out2("  \u2713 guard repaired. Open a new AI session for it to take effect.");
+  out2("");
+  return 0;
+}
 function installGlobalQuiet() {
   try {
     const p = globalPaths();
@@ -6449,7 +6494,7 @@ function installGlobalQuiet() {
       installAntigravityGuard(p, join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
     } catch {
     }
-    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") lockProtected();
     return { ok: true, message: "guard installed (open a new session)" };
   } catch (e) {
     return { ok: false, message: e instanceof Error ? e.message : String(e) };
@@ -6637,7 +6682,7 @@ async function runGlobalInstall(opts = {}) {
     console.log(`  Registered Antigravity CLI guard \u2192 ${p.antigravityHooksPath}`);
   } catch {
   }
-  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
+  if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") {
     lockProtected();
     console.log("  Locked protection files (OS-level read-only/immutable).");
   }
@@ -16058,7 +16103,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["update", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["update", "repair", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
 var CLI_INFO_ARGS = /* @__PURE__ */ new Set(["login", "help", "--help", "-h", "--version", "-v", "version"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "") || CLI_INFO_ARGS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
@@ -16120,6 +16165,7 @@ function printHelp() {
   head("Setup & status");
   cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
   cmd("update", "update SolonGate to the newest version and refresh the guard");
+  cmd("repair", "restore the guard + hook + settings files if they were deleted or disarmed");
   cmd("doctor", "health check: login, policy, guard, local logs");
   cmd("doctor --json", "the same health check as machine-readable JSON");
   cmd("logs-server start", "start the local audit-log service for the dashboard (background)");
@@ -16262,6 +16308,10 @@ async function main() {
     const { runUpdateCommand: runUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
     process.exit(await runUpdateCommand2());
   }
+  if (subcommand === "repair") {
+    const { runRepair: runRepair2 } = await Promise.resolve().then(() => (init_global_install(), global_install_exports));
+    process.exit(await runRepair2());
+  }
   if (subcommand === "logs-server" || subcommand === "local-logs") {
     const { runLogsServer: runLogsServer2 } = await Promise.resolve().then(() => (init_logs_server(), logs_server_exports));
     await runLogsServer2();

package/dist/tui/index.js

@@ -9,7 +9,7 @@ var __export = (target, all) => {
 };
 
 // src/global-install.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync2, mkdirSync as mkdirSync4, rmSync } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync2, mkdirSync as mkdirSync4, rmSync, chmodSync } from "fs";
 import { resolve as resolve2, join as join6, dirname } from "path";
 import { homedir as homedir6 } from "os";
 import { fileURLToPath } from "url";
@@ -20,7 +20,11 @@ function lockFile(file) {
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE,WDAC,WO)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("icacls", [file, "/grant", "*S-1-3-4:(RX)"], { stdio: "ignore" });
       } catch {
       }
       try {
@@ -37,6 +41,10 @@ function lockFile(file) {
         execFileSync("chattr", ["+i", file], { stdio: "ignore" });
       } catch {
       }
+      try {
+        chmodSync(file, 292);
+      } catch {
+      }
     }
   } catch {
   }
@@ -45,6 +53,10 @@ function unlockFile(file) {
   if (!existsSync2(file)) return;
   try {
     if (process.platform === "win32") {
+      try {
+        execFileSync("icacls", [file, "/remove:g", "*S-1-3-4"], { stdio: "ignore" });
+      } catch {
+      }
       try {
         execFileSync("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
       } catch {
@@ -67,6 +79,10 @@ function unlockFile(file) {
         execFileSync("chattr", ["-i", file], { stdio: "ignore" });
       } catch {
       }
+      try {
+        chmodSync(file, 420);
+      } catch {
+      }
     }
   } catch {
   }
@@ -217,7 +233,7 @@ function installGlobalQuiet() {
       installAntigravityGuard(p, join6(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
     } catch {
     }
-    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") lockProtected();
     return { ok: true, message: "guard installed (open a new session)" };
   } catch (e) {
     return { ok: false, message: e instanceof Error ? e.message : String(e) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.45",
+  "version": "0.82.47",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {