@solongate/proxy 0.82.86 → 0.82.88

package/dist/api-client/client.d.ts

@@ -18,6 +18,16 @@ export declare function saveAccount(acc: SavedAccount): void;
 /** Remove a saved account from this device (does NOT revoke the cloud key). */
 export declare function removeAccount(apiKey: string): void;
 export declare function setViewCredentials(creds: Credentials | null): void;
+/** The unroutable address a guest ("Skip for now") account is stored under. */
+export declare const GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
+/**
+ * True when the account this device is enforcing with is a guest one.
+ *
+ * A guest has no dashboard rights beyond reading, and the CLI is the same
+ * account reached a different way, so the management commands answer the same
+ * way the dashboard does rather than half-working here.
+ */
+export declare function isGuestAccount(): boolean;
 /** True when the given key is the ACTIVE one the guard hooks use. */
 export declare function isActiveAccount(apiKey: string): boolean;
 /**

package/dist/index.js

@@ -7518,6 +7518,24 @@ var init_local_log = __esm({
 });
 
 // src/api-client/client.ts
+var client_exports = {};
+__export(client_exports, {
+  ApiError: () => ApiError,
+  DEFAULT_API_URL: () => DEFAULT_API_URL2,
+  GUEST_EMAIL_SUFFIX: () => GUEST_EMAIL_SUFFIX,
+  NotAuthenticatedError: () => NotAuthenticatedError,
+  clearActiveCredential: () => clearActiveCredential,
+  isActiveAccount: () => isActiveAccount,
+  isAuthenticated: () => isAuthenticated,
+  isGuestAccount: () => isGuestAccount,
+  listAccounts: () => listAccounts,
+  removeAccount: () => removeAccount,
+  request: () => request,
+  resolveCredentials: () => resolveCredentials,
+  saveAccount: () => saveAccount,
+  setActiveAccount: () => setActiveAccount,
+  setViewCredentials: () => setViewCredentials
+});
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync5 } from "fs";
 import { resolve as resolve4, join as join9 } from "path";
 import { homedir as homedir7 } from "os";
@@ -7569,6 +7587,15 @@ function setViewCredentials(creds) {
   viewOverride = creds;
   cached2 = null;
 }
+function isGuestAccount() {
+  try {
+    const active2 = loginCredentialFile().apiKey;
+    if (!active2) return false;
+    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
+  } catch {
+    return false;
+  }
+}
 function isActiveAccount(apiKey) {
   return loginCredentialFile().apiKey === apiKey;
 }
@@ -7723,7 +7750,7 @@ async function request(method, path, opts = {}) {
   }
   return json;
 }
-var DEFAULT_API_URL2, accountsFile, viewOverride, ApiError, NotAuthenticatedError, cached2;
+var DEFAULT_API_URL2, accountsFile, viewOverride, GUEST_EMAIL_SUFFIX, ApiError, NotAuthenticatedError, cached2;
 var init_client = __esm({
   "src/api-client/client.ts"() {
     "use strict";
@@ -7731,6 +7758,7 @@ var init_client = __esm({
     DEFAULT_API_URL2 = "https://api.solongate.com";
     accountsFile = () => join9(homedir7(), ".solongate", "accounts.json");
     viewOverride = null;
+    GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
     ApiError = class extends Error {
       status;
       code;
@@ -11857,7 +11885,8 @@ function SettingsPanel({
   }
   const loading = !locked && (localQ.loading && !localQ.data || whQ.loading && !whQ.data || alertQ.loading && !alertQ.data || guardQ.loading && !guardQ.data || selfQ.loading && !selfQ.data);
   const rawError = locked ? null : localQ.error ?? whQ.error ?? alertQ.error ?? guardQ.error ?? selfQ.error;
-  const authError = rawError && /invalid api key|authentication|401|unauthor/i.test(rawError) ? rawError : null;
+  const authError = rawError && /invalid api key|authentication|401|unauthor|not logged in/i.test(rawError) ? rawError : null;
+  const noKey = !!authError && /not logged in/i.test(authError);
   const error = authError ? null : rawError;
   const onOff = (on) => on ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "on " }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "off" });
   const chanOf = (rule) => [...rule.emails ?? [], ...(rule.telegram ?? []).map((t) => "tg " + t)].join(", ") || "\u2014";
@@ -12053,7 +12082,10 @@ function SettingsPanel({
   const moreBelow = Math.max(0, lineEls.length - (startL + budget));
   return /* @__PURE__ */ jsx8(DataView, { loading, error, children: /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
     /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: theme.dim, children: focused ? `\u2191\u2193 move \xB7 enter act \xB7 m toggle \xB7 t test \xB7 e edit \xB7 x remove \xB7 d delete \xB7 n add${moreAbove ? ` \xB7 \u25B2${moreAbove}` : ""}${moreBelow ? ` \xB7 \u25BC${moreBelow}` : ""}` : "press \u2192 to configure" }),
-    authError ? /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: theme.bad, children: truncate2("\u2717 this device's key is invalid or was revoked \u2014 press x on the account below to remove it, then + add account to pair again", cols) }) : null,
+    authError ? /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: theme.bad, children: truncate2(
+      noKey ? "\u2717 this device is not paired yet \u2014 press + add account below to sign in and pair it" : "\u2717 this device's key is invalid or was revoked \u2014 press x on the account below to remove it, then + add account to pair again",
+      cols
+    ) }) : null,
     editing ? /* @__PURE__ */ jsxs8(Box8, { children: [
       /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: editing === "path" ? "local log path: " : "webhook url: " }),
       /* @__PURE__ */ jsx8(TextInput6, { value: input, onChange: setInput, onSubmit: submitInput })
@@ -12157,8 +12189,9 @@ function App() {
   const acctIdx = Math.max(0, accounts.findIndex((a) => a.apiKey === viewKey));
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
-  const isGuestAccount = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const acctLabel2 = cur ? isGuestAccount ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}` : "not logged in";
+  const isGuestAccount2 = rawEmail.endsWith("@anonymous.solongate.invalid");
+  const hasKey = isAuthenticated();
+  const acctLabel2 = !cur ? "not logged in" : !hasKey ? "signed out" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -12193,7 +12226,7 @@ function App() {
     setViewKey(next?.apiKey);
     setViewNonce((n) => n + 1);
   };
-  const locked = accounts.length === 0 || !isAuthenticated();
+  const locked = accounts.length === 0 || !hasKey;
   const effectiveSection = locked ? SETTINGS_SECTION : section;
   useInput8((input, key) => {
     if (help) {
@@ -16998,6 +17031,13 @@ async function main() {
   }
   const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
+    const { isGuestAccount: isGuestAccount2 } = await Promise.resolve().then(() => (init_client(), client_exports));
+    if (subcommand !== "doctor" && isGuestAccount2()) {
+      process.stderr.write(
+        "\n  This is a guest account, which can look but not change.\n  Create an account to use the management commands:\n    https://auth.solongate.com\n\n  Your project, its policy and everything already recorded carry over,\n  and this device keeps working without being paired again.\n\n"
+      );
+      process.exit(1);
+    }
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));
     process.exit(code);

package/dist/tui/index.js

@@ -5073,7 +5073,8 @@ function SettingsPanel({
   }
   const loading = !locked && (localQ.loading && !localQ.data || whQ.loading && !whQ.data || alertQ.loading && !alertQ.data || guardQ.loading && !guardQ.data || selfQ.loading && !selfQ.data);
   const rawError = locked ? null : localQ.error ?? whQ.error ?? alertQ.error ?? guardQ.error ?? selfQ.error;
-  const authError = rawError && /invalid api key|authentication|401|unauthor/i.test(rawError) ? rawError : null;
+  const authError = rawError && /invalid api key|authentication|401|unauthor|not logged in/i.test(rawError) ? rawError : null;
+  const noKey = !!authError && /not logged in/i.test(authError);
   const error = authError ? null : rawError;
   const onOff = (on) => on ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "on " }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "off" });
   const chanOf = (rule) => [...rule.emails ?? [], ...(rule.telegram ?? []).map((t) => "tg " + t)].join(", ") || "\u2014";
@@ -5269,7 +5270,10 @@ function SettingsPanel({
   const moreBelow = Math.max(0, lineEls.length - (startL + budget));
   return /* @__PURE__ */ jsx8(DataView, { loading, error, children: /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
     /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: theme.dim, children: focused ? `\u2191\u2193 move \xB7 enter act \xB7 m toggle \xB7 t test \xB7 e edit \xB7 x remove \xB7 d delete \xB7 n add${moreAbove ? ` \xB7 \u25B2${moreAbove}` : ""}${moreBelow ? ` \xB7 \u25BC${moreBelow}` : ""}` : "press \u2192 to configure" }),
-    authError ? /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: theme.bad, children: truncate("\u2717 this device's key is invalid or was revoked \u2014 press x on the account below to remove it, then + add account to pair again", cols) }) : null,
+    authError ? /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: theme.bad, children: truncate(
+      noKey ? "\u2717 this device is not paired yet \u2014 press + add account below to sign in and pair it" : "\u2717 this device's key is invalid or was revoked \u2014 press x on the account below to remove it, then + add account to pair again",
+      cols
+    ) }) : null,
     editing ? /* @__PURE__ */ jsxs8(Box8, { children: [
       /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: editing === "path" ? "local log path: " : "webhook url: " }),
       /* @__PURE__ */ jsx8(TextInput6, { value: input, onChange: setInput, onSubmit: submitInput })
@@ -5351,7 +5355,8 @@ function App() {
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
   const isGuestAccount = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const acctLabel2 = cur ? isGuestAccount ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}` : "not logged in";
+  const hasKey = isAuthenticated();
+  const acctLabel2 = !cur ? "not logged in" : !hasKey ? "signed out" : isGuestAccount ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -5386,7 +5391,7 @@ function App() {
     setViewKey(next?.apiKey);
     setViewNonce((n) => n + 1);
   };
-  const locked = accounts.length === 0 || !isAuthenticated();
+  const locked = accounts.length === 0 || !hasKey;
   const effectiveSection = locked ? SETTINGS_SECTION : section;
   useInput8((input, key) => {
     if (help) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.86",
+  "version": "0.82.88",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {