@solongate/proxy 0.82.87 → 0.82.89

package/dist/api-client/client.d.ts

@@ -18,6 +18,16 @@ export declare function saveAccount(acc: SavedAccount): void;
 /** Remove a saved account from this device (does NOT revoke the cloud key). */
 export declare function removeAccount(apiKey: string): void;
 export declare function setViewCredentials(creds: Credentials | null): void;
+/** The unroutable address a guest ("Skip for now") account is stored under. */
+export declare const GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
+/**
+ * True when the account this device is enforcing with is a guest one.
+ *
+ * A guest has no dashboard rights beyond reading, and the CLI is the same
+ * account reached a different way, so the management commands answer the same
+ * way the dashboard does rather than half-working here.
+ */
+export declare function isGuestAccount(): boolean;
 /** True when the given key is the ACTIVE one the guard hooks use. */
 export declare function isActiveAccount(apiKey: string): boolean;
 /**
@@ -44,6 +54,10 @@ export declare class ApiError extends Error {
     readonly code: string;
     constructor(status: number, code: string, message: string);
 }
+/** Raised when a guest account tries to change something. */
+export declare class GuestReadOnlyError extends Error {
+    constructor();
+}
 /** Raised when no API key can be found — tells the user to run `solongate` and pair. */
 export declare class NotAuthenticatedError extends Error {
     constructor();

package/dist/commands/index.js

@@ -125,7 +125,31 @@ function codexHooksStatus() {
 
 // src/api-client/client.ts
 var DEFAULT_API_URL = "https://api.solongate.com";
+var accountsFile = () => join2(homedir2(), ".solongate", "accounts.json");
+function listAccounts() {
+  let list5 = [];
+  try {
+    const raw = JSON.parse(readFileSync2(accountsFile(), "utf-8"));
+    if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
+  } catch {
+  }
+  const active2 = loginCredentialFile();
+  if (active2.apiKey && !list5.some((a) => a.apiKey === active2.apiKey)) {
+    list5.unshift({ apiKey: active2.apiKey, apiUrl: active2.apiUrl || DEFAULT_API_URL });
+  }
+  return list5;
+}
 var viewOverride = null;
+var GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
+function isGuestAccount() {
+  try {
+    const active2 = loginCredentialFile().apiKey;
+    if (!active2) return false;
+    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
+  } catch {
+    return false;
+  }
+}
 var ApiError = class extends Error {
   status;
   code;
@@ -136,6 +160,12 @@ var ApiError = class extends Error {
     this.code = code;
   }
 };
+var GuestReadOnlyError = class extends Error {
+  constructor() {
+    super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
+    this.name = "GuestReadOnlyError";
+  }
+};
 var NotAuthenticatedError = class extends Error {
   constructor() {
     super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -200,6 +230,9 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
+  if (method !== "GET" && isGuestAccount()) {
+    throw new GuestReadOnlyError();
+  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {

package/dist/index.js

@@ -7518,6 +7518,25 @@ var init_local_log = __esm({
 });
 
 // src/api-client/client.ts
+var client_exports = {};
+__export(client_exports, {
+  ApiError: () => ApiError,
+  DEFAULT_API_URL: () => DEFAULT_API_URL2,
+  GUEST_EMAIL_SUFFIX: () => GUEST_EMAIL_SUFFIX,
+  GuestReadOnlyError: () => GuestReadOnlyError,
+  NotAuthenticatedError: () => NotAuthenticatedError,
+  clearActiveCredential: () => clearActiveCredential,
+  isActiveAccount: () => isActiveAccount,
+  isAuthenticated: () => isAuthenticated,
+  isGuestAccount: () => isGuestAccount,
+  listAccounts: () => listAccounts,
+  removeAccount: () => removeAccount,
+  request: () => request,
+  resolveCredentials: () => resolveCredentials,
+  saveAccount: () => saveAccount,
+  setActiveAccount: () => setActiveAccount,
+  setViewCredentials: () => setViewCredentials
+});
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync5 } from "fs";
 import { resolve as resolve4, join as join9 } from "path";
 import { homedir as homedir7 } from "os";
@@ -7569,6 +7588,15 @@ function setViewCredentials(creds) {
   viewOverride = creds;
   cached2 = null;
 }
+function isGuestAccount() {
+  try {
+    const active2 = loginCredentialFile().apiKey;
+    if (!active2) return false;
+    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
+  } catch {
+    return false;
+  }
+}
 function isActiveAccount(apiKey) {
   return loginCredentialFile().apiKey === apiKey;
 }
@@ -7668,6 +7696,9 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
+  if (method !== "GET" && isGuestAccount()) {
+    throw new GuestReadOnlyError();
+  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {
@@ -7723,7 +7754,7 @@ async function request(method, path, opts = {}) {
   }
   return json;
 }
-var DEFAULT_API_URL2, accountsFile, viewOverride, ApiError, NotAuthenticatedError, cached2;
+var DEFAULT_API_URL2, accountsFile, viewOverride, GUEST_EMAIL_SUFFIX, ApiError, GuestReadOnlyError, NotAuthenticatedError, cached2;
 var init_client = __esm({
   "src/api-client/client.ts"() {
     "use strict";
@@ -7731,6 +7762,7 @@ var init_client = __esm({
     DEFAULT_API_URL2 = "https://api.solongate.com";
     accountsFile = () => join9(homedir7(), ".solongate", "accounts.json");
     viewOverride = null;
+    GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
     ApiError = class extends Error {
       status;
       code;
@@ -7741,6 +7773,12 @@ var init_client = __esm({
         this.code = code;
       }
     };
+    GuestReadOnlyError = class extends Error {
+      constructor() {
+        super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
+        this.name = "GuestReadOnlyError";
+      }
+    };
     NotAuthenticatedError = class extends Error {
       constructor() {
         super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -11713,6 +11751,7 @@ function SettingsPanel({
       else if (inp === "m") {
         if (cur.kind === "acct") {
           const ok = setActiveAccount({ apiKey: cur.acc.apiKey, apiUrl: cur.acc.apiUrl });
+          if (ok) clearLocalLog();
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
         } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
@@ -11732,6 +11771,7 @@ function SettingsPanel({
         }
         setConfirmDel(null);
         removeAccount(target.apiKey);
+        clearLocalLog();
         let extra = " from this device";
         if (wasActive) {
           if (others.length) {
@@ -12079,6 +12119,7 @@ var init_Settings = __esm({
     init_components();
     init_hooks();
     init_theme();
+    init_local_log();
     EVENTS = ["denials", "allowed", "all"];
     SPIN2 = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     SIGNALS2 = ["any", "deny", "dlp", "ratelimit"];
@@ -12161,9 +12202,8 @@ function App() {
   const acctIdx = Math.max(0, accounts.findIndex((a) => a.apiKey === viewKey));
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
-  const isGuestAccount = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const hasKey = isAuthenticated();
-  const acctLabel2 = !cur ? "not logged in" : !hasKey ? "signed out" : isGuestAccount ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
+  const isGuestAccount2 = rawEmail.endsWith("@anonymous.solongate.invalid");
+  const acctLabel2 = !cur ? "not logged in" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -12198,7 +12238,7 @@ function App() {
     setViewKey(next?.apiKey);
     setViewNonce((n) => n + 1);
   };
-  const locked = accounts.length === 0 || !hasKey;
+  const locked = accounts.length === 0;
   const effectiveSection = locked ? SETTINGS_SECTION : section;
   useInput8((input, key) => {
     if (help) {
@@ -17003,6 +17043,13 @@ async function main() {
   }
   const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
+    const { isGuestAccount: isGuestAccount2 } = await Promise.resolve().then(() => (init_client(), client_exports));
+    if (subcommand !== "doctor" && isGuestAccount2()) {
+      process.stderr.write(
+        "\n  This is a guest account, which can look but not change.\n  Create an account to use the management commands:\n    https://auth.solongate.com\n\n  Your project, its policy and everything already recorded carry over,\n  and this device keeps working without being paired again.\n\n"
+      );
+      process.exit(1);
+    }
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));
     process.exit(code);

package/dist/tui/index.js

@@ -904,6 +904,16 @@ function setViewCredentials(creds) {
   viewOverride = creds;
   cached2 = null;
 }
+var GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
+function isGuestAccount() {
+  try {
+    const active2 = loginCredentialFile().apiKey;
+    if (!active2) return false;
+    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
+  } catch {
+    return false;
+  }
+}
 function isActiveAccount(apiKey) {
   return loginCredentialFile().apiKey === apiKey;
 }
@@ -956,6 +966,12 @@ var ApiError = class extends Error {
     this.code = code;
   }
 };
+var GuestReadOnlyError = class extends Error {
+  constructor() {
+    super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
+    this.name = "GuestReadOnlyError";
+  }
+};
 var NotAuthenticatedError = class extends Error {
   constructor() {
     super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -1020,6 +1036,9 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
+  if (method !== "GET" && isGuestAccount()) {
+    throw new GuestReadOnlyError();
+  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {
@@ -4929,6 +4948,7 @@ function SettingsPanel({
       else if (inp === "m") {
         if (cur.kind === "acct") {
           const ok = setActiveAccount({ apiKey: cur.acc.apiKey, apiUrl: cur.acc.apiUrl });
+          if (ok) clearLocalLog();
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
         } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
@@ -4948,6 +4968,7 @@ function SettingsPanel({
         }
         setConfirmDel(null);
         removeAccount(target.apiKey);
+        clearLocalLog();
         let extra = " from this device";
         if (wasActive) {
           if (others.length) {
@@ -5354,9 +5375,8 @@ function App() {
   const acctIdx = Math.max(0, accounts.findIndex((a) => a.apiKey === viewKey));
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
-  const isGuestAccount = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const hasKey = isAuthenticated();
-  const acctLabel2 = !cur ? "not logged in" : !hasKey ? "signed out" : isGuestAccount ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
+  const isGuestAccount2 = rawEmail.endsWith("@anonymous.solongate.invalid");
+  const acctLabel2 = !cur ? "not logged in" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -5391,7 +5411,7 @@ function App() {
     setViewKey(next?.apiKey);
     setViewNonce((n) => n + 1);
   };
-  const locked = accounts.length === 0 || !hasKey;
+  const locked = accounts.length === 0;
   const effectiveSection = locked ? SETTINGS_SECTION : section;
   useInput8((input, key) => {
     if (help) {

package/dist/tui/local-log.d.ts

@@ -44,7 +44,13 @@ export interface LocalLogLine {
 }
 /** Delete ONE matching line (ts + tool [+ session]) from the local log file. */
 export declare function deleteLocalEntry(at: number, tool: string, session?: string | null): number;
-/** Empty the local log file. Returns how many lines were removed. */
+/**
+ * Empty the local log file. Returns how many lines were removed.
+ *
+ * The file is one per machine, not one per account, and nothing in an entry
+ * says which account produced it — so when the account changes, the honest move
+ * is to start it over rather than keep showing another account's calls in Live.
+ */
 export declare function clearLocalLog(): number;
 /** DLP pattern name + rate-limit-burst flag derived from a decision's reason. */
 export declare function reasonSignals(reason: string | null | undefined): {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.87",
+  "version": "0.82.89",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {