@solongate/proxy 0.82.88 → 0.82.90

package/dist/api-client/client.d.ts

@@ -28,6 +28,8 @@ export declare const GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
  * way the dashboard does rather than half-working here.
  */
 export declare function isGuestAccount(): boolean;
+/** The key this device enforces with, or null when it is not paired. */
+export declare function enforcingKey(): string | null;
 /** True when the given key is the ACTIVE one the guard hooks use. */
 export declare function isActiveAccount(apiKey: string): boolean;
 /**
@@ -54,6 +56,10 @@ export declare class ApiError extends Error {
     readonly code: string;
     constructor(status: number, code: string, message: string);
 }
+/** Raised when a guest account tries to change something. */
+export declare class GuestReadOnlyError extends Error {
+    constructor();
+}
 /** Raised when no API key can be found — tells the user to run `solongate` and pair. */
 export declare class NotAuthenticatedError extends Error {
     constructor();

package/dist/commands/index.js

@@ -125,7 +125,31 @@ function codexHooksStatus() {
 
 // src/api-client/client.ts
 var DEFAULT_API_URL = "https://api.solongate.com";
+var accountsFile = () => join2(homedir2(), ".solongate", "accounts.json");
+function listAccounts() {
+  let list5 = [];
+  try {
+    const raw = JSON.parse(readFileSync2(accountsFile(), "utf-8"));
+    if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
+  } catch {
+  }
+  const active2 = loginCredentialFile();
+  if (active2.apiKey && !list5.some((a) => a.apiKey === active2.apiKey)) {
+    list5.unshift({ apiKey: active2.apiKey, apiUrl: active2.apiUrl || DEFAULT_API_URL });
+  }
+  return list5;
+}
 var viewOverride = null;
+var GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
+function isGuestAccount() {
+  try {
+    const active2 = loginCredentialFile().apiKey;
+    if (!active2) return false;
+    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
+  } catch {
+    return false;
+  }
+}
 var ApiError = class extends Error {
   status;
   code;
@@ -136,6 +160,12 @@ var ApiError = class extends Error {
     this.code = code;
   }
 };
+var GuestReadOnlyError = class extends Error {
+  constructor() {
+    super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
+    this.name = "GuestReadOnlyError";
+  }
+};
 var NotAuthenticatedError = class extends Error {
   constructor() {
     super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -200,6 +230,9 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
+  if (method !== "GET" && isGuestAccount()) {
+    throw new GuestReadOnlyError();
+  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {
@@ -1149,6 +1182,7 @@ import { join as join4 } from "path";
 // src/tui/local-log.ts
 import { closeSync, existsSync as existsSync3, openSync, readdirSync, readFileSync as readFileSync4, readSync, statSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
+import { createHash } from "crypto";
 import { isAbsolute, join as join3 } from "path";
 var DEFAULT_LOCAL_LOG = join3(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
 function localLogFile() {

package/dist/index.js

@@ -7404,6 +7404,7 @@ var init_components = __esm({
 // src/tui/local-log.ts
 import { closeSync, existsSync as existsSync4, openSync as openSync3, readdirSync, readFileSync as readFileSync8, readSync, statSync, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir6 } from "os";
+import { createHash as createHash2 } from "crypto";
 import { isAbsolute, join as join8 } from "path";
 function localLogFile() {
   try {
@@ -7435,6 +7436,30 @@ function localLogFile() {
   }
   return DEFAULT_LOCAL_LOG;
 }
+function ensureLocalLogOwner(activeApiKey) {
+  try {
+    const marker = join8(homedir6(), ".solongate", "local-logs", ".owner");
+    const want = activeApiKey ? createHash2("sha256").update(activeApiKey).digest("hex").slice(0, 16) : "";
+    let have = "";
+    try {
+      have = readFileSync8(marker, "utf-8").trim();
+    } catch {
+    }
+    if (have === want) return false;
+    const cleared = have !== "" && localLogExists();
+    if (cleared) clearLocalLog();
+    try {
+      writeFileSync6(marker, want);
+    } catch {
+    }
+    return cleared;
+  } catch {
+    return false;
+  }
+}
+function localLogExists() {
+  return existsSync4(localLogFile());
+}
 function tailLines(file, maxBytes = 131072) {
   try {
     const size = statSync(file).size;
@@ -7523,8 +7548,10 @@ __export(client_exports, {
   ApiError: () => ApiError,
   DEFAULT_API_URL: () => DEFAULT_API_URL2,
   GUEST_EMAIL_SUFFIX: () => GUEST_EMAIL_SUFFIX,
+  GuestReadOnlyError: () => GuestReadOnlyError,
   NotAuthenticatedError: () => NotAuthenticatedError,
   clearActiveCredential: () => clearActiveCredential,
+  enforcingKey: () => enforcingKey,
   isActiveAccount: () => isActiveAccount,
   isAuthenticated: () => isAuthenticated,
   isGuestAccount: () => isGuestAccount,
@@ -7596,6 +7623,9 @@ function isGuestAccount() {
     return false;
   }
 }
+function enforcingKey() {
+  return loginCredentialFile().apiKey ?? null;
+}
 function isActiveAccount(apiKey) {
   return loginCredentialFile().apiKey === apiKey;
 }
@@ -7695,6 +7725,9 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
+  if (method !== "GET" && isGuestAccount()) {
+    throw new GuestReadOnlyError();
+  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {
@@ -7750,7 +7783,7 @@ async function request(method, path, opts = {}) {
   }
   return json;
 }
-var DEFAULT_API_URL2, accountsFile, viewOverride, GUEST_EMAIL_SUFFIX, ApiError, NotAuthenticatedError, cached2;
+var DEFAULT_API_URL2, accountsFile, viewOverride, GUEST_EMAIL_SUFFIX, ApiError, GuestReadOnlyError, NotAuthenticatedError, cached2;
 var init_client = __esm({
   "src/api-client/client.ts"() {
     "use strict";
@@ -7769,6 +7802,12 @@ var init_client = __esm({
         this.code = code;
       }
     };
+    GuestReadOnlyError = class extends Error {
+      constructor() {
+        super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
+        this.name = "GuestReadOnlyError";
+      }
+    };
     NotAuthenticatedError = class extends Error {
       constructor() {
         super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -11741,6 +11780,7 @@ function SettingsPanel({
       else if (inp === "m") {
         if (cur.kind === "acct") {
           const ok = setActiveAccount({ apiKey: cur.acc.apiKey, apiUrl: cur.acc.apiUrl });
+          if (ok) clearLocalLog();
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
         } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
@@ -11760,6 +11800,7 @@ function SettingsPanel({
         }
         setConfirmDel(null);
         removeAccount(target.apiKey);
+        clearLocalLog();
         let extra = " from this device";
         if (wasActive) {
           if (others.length) {
@@ -12107,6 +12148,7 @@ var init_Settings = __esm({
     init_components();
     init_hooks();
     init_theme();
+    init_local_log();
     EVENTS = ["denials", "allowed", "all"];
     SPIN2 = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     SIGNALS2 = ["any", "deny", "dlp", "ratelimit"];
@@ -12190,8 +12232,7 @@ function App() {
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
   const isGuestAccount2 = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const hasKey = isAuthenticated();
-  const acctLabel2 = !cur ? "not logged in" : !hasKey ? "signed out" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
+  const acctLabel2 = !cur ? "not logged in" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -12226,7 +12267,13 @@ function App() {
     setViewKey(next?.apiKey);
     setViewNonce((n) => n + 1);
   };
-  const locked = accounts.length === 0 || !hasKey;
+  useEffect8(() => {
+    try {
+      ensureLocalLogOwner(enforcingKey());
+    } catch {
+    }
+  }, [accounts.length]);
+  const locked = accounts.length === 0;
   const effectiveSection = locked ? SETTINGS_SECTION : section;
   useInput8((input, key) => {
     if (help) {
@@ -12317,6 +12364,7 @@ var init_App = __esm({
     init_nav();
     init_client();
     init_api_client();
+    init_local_log();
     init_self_update();
     SECTIONS = [
       { label: "Live", Panel: LiveHint },

package/dist/tui/index.js

@@ -738,6 +738,7 @@ import { join as join5 } from "path";
 // src/tui/local-log.ts
 import { closeSync, existsSync, openSync, readdirSync, readFileSync as readFileSync2, readSync, statSync, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
+import { createHash } from "crypto";
 import { isAbsolute, join as join2 } from "path";
 var DEFAULT_LOCAL_LOG = join2(homedir2(), ".solongate", "local-logs", "solongate-audit.jsonl");
 function localLogFile() {
@@ -771,6 +772,30 @@ function localLogFile() {
   return DEFAULT_LOCAL_LOG;
 }
 var LOCAL_LOG = localLogFile();
+function ensureLocalLogOwner(activeApiKey) {
+  try {
+    const marker = join2(homedir2(), ".solongate", "local-logs", ".owner");
+    const want = activeApiKey ? createHash("sha256").update(activeApiKey).digest("hex").slice(0, 16) : "";
+    let have = "";
+    try {
+      have = readFileSync2(marker, "utf-8").trim();
+    } catch {
+    }
+    if (have === want) return false;
+    const cleared = have !== "" && localLogExists();
+    if (cleared) clearLocalLog();
+    try {
+      writeFileSync(marker, want);
+    } catch {
+    }
+    return cleared;
+  } catch {
+    return false;
+  }
+}
+function localLogExists() {
+  return existsSync(localLogFile());
+}
 function tailLines(file, maxBytes = 131072) {
   try {
     const size = statSync(file).size;
@@ -904,6 +929,19 @@ function setViewCredentials(creds) {
   viewOverride = creds;
   cached2 = null;
 }
+var GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
+function isGuestAccount() {
+  try {
+    const active2 = loginCredentialFile().apiKey;
+    if (!active2) return false;
+    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
+  } catch {
+    return false;
+  }
+}
+function enforcingKey() {
+  return loginCredentialFile().apiKey ?? null;
+}
 function isActiveAccount(apiKey) {
   return loginCredentialFile().apiKey === apiKey;
 }
@@ -956,6 +994,12 @@ var ApiError = class extends Error {
     this.code = code;
   }
 };
+var GuestReadOnlyError = class extends Error {
+  constructor() {
+    super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
+    this.name = "GuestReadOnlyError";
+  }
+};
 var NotAuthenticatedError = class extends Error {
   constructor() {
     super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -1020,6 +1064,9 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
+  if (method !== "GET" && isGuestAccount()) {
+    throw new GuestReadOnlyError();
+  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {
@@ -4929,6 +4976,7 @@ function SettingsPanel({
       else if (inp === "m") {
         if (cur.kind === "acct") {
           const ok = setActiveAccount({ apiKey: cur.acc.apiKey, apiUrl: cur.acc.apiUrl });
+          if (ok) clearLocalLog();
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
         } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
@@ -4948,6 +4996,7 @@ function SettingsPanel({
         }
         setConfirmDel(null);
         removeAccount(target.apiKey);
+        clearLocalLog();
         let extra = " from this device";
         if (wasActive) {
           if (others.length) {
@@ -5354,9 +5403,8 @@ function App() {
   const acctIdx = Math.max(0, accounts.findIndex((a) => a.apiKey === viewKey));
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
-  const isGuestAccount = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const hasKey = isAuthenticated();
-  const acctLabel2 = !cur ? "not logged in" : !hasKey ? "signed out" : isGuestAccount ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
+  const isGuestAccount2 = rawEmail.endsWith("@anonymous.solongate.invalid");
+  const acctLabel2 = !cur ? "not logged in" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -5391,7 +5439,13 @@ function App() {
     setViewKey(next?.apiKey);
     setViewNonce((n) => n + 1);
   };
-  const locked = accounts.length === 0 || !hasKey;
+  useEffect8(() => {
+    try {
+      ensureLocalLogOwner(enforcingKey());
+    } catch {
+    }
+  }, [accounts.length]);
+  const locked = accounts.length === 0;
   const effectiveSection = locked ? SETTINGS_SECTION : section;
   useInput8((input, key) => {
     if (help) {

package/dist/tui/local-log.d.ts

@@ -23,6 +23,18 @@ export declare function localLogFile(): string;
 export declare const LOCAL_LOG: string;
 /** True when the resolved file exists — viewers use it to say "no entries yet"
  *  instead of pointing at a path that was never written. */
+/**
+ * Make sure the local log belongs to the account now in use.
+ *
+ * The file is one per machine and no entry records which account produced it,
+ * so after pairing a different account the previous one's calls were still
+ * sitting in Live. Clearing on an in-app account switch was not enough: the
+ * account can change by pairing a new device, by signing out, or from the
+ * dashboard. A marker beside the log records whose it is (a hash, never the
+ * key itself); when that stops matching, the file is not ours and is started
+ * over. Returns true when it cleared.
+ */
+export declare function ensureLocalLogOwner(activeApiKey: string | null | undefined): boolean;
 export declare function localLogExists(): boolean;
 /** Read the last `maxBytes` of a file as complete lines (first partial dropped). */
 export declare function tailLines(file: string, maxBytes?: number): string[];
@@ -44,7 +56,13 @@ export interface LocalLogLine {
 }
 /** Delete ONE matching line (ts + tool [+ session]) from the local log file. */
 export declare function deleteLocalEntry(at: number, tool: string, session?: string | null): number;
-/** Empty the local log file. Returns how many lines were removed. */
+/**
+ * Empty the local log file. Returns how many lines were removed.
+ *
+ * The file is one per machine, not one per account, and nothing in an entry
+ * says which account produced it — so when the account changes, the honest move
+ * is to start it over rather than keep showing another account's calls in Live.
+ */
 export declare function clearLocalLog(): number;
 /** DLP pattern name + rate-limit-burst flag derived from a decision's reason. */
 export declare function reasonSignals(reason: string | null | undefined): {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.88",
+  "version": "0.82.90",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {