@solongate/proxy 0.82.91 → 0.82.92

package/dist/index.js

@@ -7446,20 +7446,15 @@ function ensureLocalLogOwner(activeApiKey) {
     } catch {
     }
     if (have === want) return false;
-    const cleared = localLogExists();
-    if (cleared) clearLocalLog();
     try {
       writeFileSync6(marker, want);
     } catch {
     }
-    return cleared;
+    return false;
   } catch {
     return false;
   }
 }
-function localLogExists() {
-  return existsSync4(localLogFile());
-}
 function tailLines(file, maxBytes = 131072) {
   try {
     const size = statSync(file).size;
@@ -7519,11 +7514,22 @@ function reasonSignals(reason) {
   }
   return { dlp, burst: RL_REASON.test(r) };
 }
+function ownMark() {
+  try {
+    const p = join8(homedir6(), ".solongate", "cloud-guard.json");
+    const c2 = JSON.parse(readFileSync8(p, "utf-8"));
+    return c2?.apiKey ? createHash2("sha256").update(c2.apiKey).digest("hex").slice(0, 16) : "";
+  } catch {
+    return "";
+  }
+}
 function parseLocalLines(lines) {
   const out2 = [];
+  const mine = ownMark();
   for (const line of lines) {
     try {
       const j = JSON.parse(line);
+      if (mine && j.acct !== mine) continue;
       const at = Date.parse(j.ts ?? "");
       if (Number.isFinite(at)) out2.push({ ...j, at });
     } catch {

package/dist/tui/index.js

@@ -782,20 +782,15 @@ function ensureLocalLogOwner(activeApiKey) {
     } catch {
     }
     if (have === want) return false;
-    const cleared = localLogExists();
-    if (cleared) clearLocalLog();
     try {
       writeFileSync(marker, want);
     } catch {
     }
-    return cleared;
+    return false;
   } catch {
     return false;
   }
 }
-function localLogExists() {
-  return existsSync(localLogFile());
-}
 function tailLines(file, maxBytes = 131072) {
   try {
     const size = statSync(file).size;
@@ -857,11 +852,22 @@ function reasonSignals(reason) {
   }
   return { dlp, burst: RL_REASON.test(r) };
 }
+function ownMark() {
+  try {
+    const p = join2(homedir2(), ".solongate", "cloud-guard.json");
+    const c2 = JSON.parse(readFileSync2(p, "utf-8"));
+    return c2?.apiKey ? createHash("sha256").update(c2.apiKey).digest("hex").slice(0, 16) : "";
+  } catch {
+    return "";
+  }
+}
 function parseLocalLines(lines) {
   const out = [];
+  const mine = ownMark();
   for (const line of lines) {
     try {
       const j = JSON.parse(line);
+      if (mine && j.acct !== mine) continue;
       const at = Date.parse(j.ts ?? "");
       if (Number.isFinite(at)) out.push({ ...j, at });
     } catch {

package/dist/tui/local-log.d.ts

@@ -49,6 +49,8 @@ export interface LocalLogLine {
     permission?: string;
     trust_level?: string;
     session_id?: string;
+    /** Hash prefix of the account that wrote this line. */
+    acct?: string;
     agent_name?: string;
     evaluation_time_ms?: number;
     matched_rule_id?: string;

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 66;
+var HOOK_VERSION = 67;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -6557,8 +6557,18 @@ function writeLocalMarker(security) {
   } catch {
   }
 }
+function accountMark() {
+  try {
+    return API_KEY ? createHash("sha256").update(API_KEY).digest("hex").slice(0, 16) : "";
+  } catch {
+    return "";
+  }
+}
 function writeLocalLog(security, entry) {
   try {
+    const mark = accountMark();
+    if (mark)
+      entry = { ...entry, acct: mark };
     const l = security && security.localLogs;
     if (!l || !l.enabled || typeof l.path !== "string" || !l.path.trim()) {
       if (!localLogsOnly(security))

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 66;
+const HOOK_VERSION = 67;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -96,8 +96,26 @@ function resolveLocalLogDir(rawPath) {
 // Local log storage (opt-in): write solongate-audit.jsonl inside the user's
 // chosen FOLDER. The audit hook does the ALLOW path; the guard does DENY (a
 // blocked call never reaches PostToolUse). `security` is the resolved config.
+/**
+ * Short, non-reversible mark of the account an entry belongs to.
+ *
+ * The machine-local log is one file, and nothing in a line said which account
+ * produced it, so after pairing a different account the viewers presented the
+ * previous one's calls as yours. Stamping each line lets a reader keep only its
+ * own without deleting anybody's history. It is a hash prefix, never the key.
+ */
+function accountMark() {
+  try {
+    return API_KEY ? createHash('sha256').update(API_KEY).digest('hex').slice(0, 16) : '';
+  } catch {
+    return '';
+  }
+}
+
 function writeLocalLog(security, entry) {
   try {
+    const mark = accountMark();
+    if (mark) entry = { ...entry, acct: mark };
     const l = security && security.localLogs;
     // The cloud POST is skipped whenever localLogsOnly() says this device is in
     // local-only mode — and that answer can come from the persisted marker alone,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.91",
+  "version": "0.82.92",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {