@solongate/proxy 0.82.94 → 0.82.96

package/dist/commands/index.js

@@ -1239,7 +1239,9 @@ async function collectChecks() {
       checks.push(
         rlBlock ? { name: "rate limit", ok: true, detail: `block \xB7 ${rlWindows(rlBlock)}` } : rlObserve ? { name: "rate limit", ok: true, detail: `detect \xB7 ${rlWindows(rlObserve)} \xB7 flags bursts, never blocks` } : { name: "rate limit", ok: "warn", detail: "off" }
       );
-      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push(
+        sec?.dlpBlock ? { name: "dlp", ok: true, detail: `block \xB7 ${sec.dlpBlock.patterns.length} patterns` } : sec?.dlpRedact ? { name: "dlp", ok: true, detail: `detect \xB7 ${sec.dlpRedact.patterns.length} patterns \xB7 masks secrets, never blocks` } : { name: "dlp", ok: "warn", detail: "off" }
+      );
       checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
     } catch (e) {
       checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });

package/dist/index.js

@@ -11326,7 +11326,9 @@ async function collectChecks() {
       checks.push(
         rlBlock ? { name: "rate limit", ok: true, detail: `block \xB7 ${rlWindows(rlBlock)}` } : rlObserve ? { name: "rate limit", ok: true, detail: `detect \xB7 ${rlWindows(rlObserve)} \xB7 flags bursts, never blocks` } : { name: "rate limit", ok: "warn", detail: "off" }
       );
-      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push(
+        sec?.dlpBlock ? { name: "dlp", ok: true, detail: `block \xB7 ${sec.dlpBlock.patterns.length} patterns` } : sec?.dlpRedact ? { name: "dlp", ok: true, detail: `detect \xB7 ${sec.dlpRedact.patterns.length} patterns \xB7 masks secrets, never blocks` } : { name: "dlp", ok: "warn", detail: "off" }
+      );
       checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
     } catch (e) {
       checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });

package/dist/tui/index.js

@@ -4355,7 +4355,9 @@ async function collectChecks() {
       checks.push(
         rlBlock ? { name: "rate limit", ok: true, detail: `block \xB7 ${rlWindows(rlBlock)}` } : rlObserve ? { name: "rate limit", ok: true, detail: `detect \xB7 ${rlWindows(rlObserve)} \xB7 flags bursts, never blocks` } : { name: "rate limit", ok: "warn", detail: "off" }
       );
-      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push(
+        sec?.dlpBlock ? { name: "dlp", ok: true, detail: `block \xB7 ${sec.dlpBlock.patterns.length} patterns` } : sec?.dlpRedact ? { name: "dlp", ok: true, detail: `detect \xB7 ${sec.dlpRedact.patterns.length} patterns \xB7 masks secrets, never blocks` } : { name: "dlp", ok: "warn", detail: "off" }
+      );
       checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
     } catch (e) {
       checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 67;
+var HOOK_VERSION = 68;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -7955,6 +7955,10 @@ function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg)
     return null;
   try {
+    const q = cfg.guestQuota;
+    if (q && q.exhausted) {
+      return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on \u2014 your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate \u2192 Settings \u2192 guard \u2192 d.`;
+    }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);
       if (hit)

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 67;
+const HOOK_VERSION = 68;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -1765,6 +1765,15 @@ function rateLimitCheck(agentKey, limits) {
 function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg) return null;
   try {
+    // Guest allowance. A guest account is a trial, so past its allowance every
+    // call is denied without exception rather than quietly running unguarded:
+    // an agent that believes it is protected and is not is worse off than one
+    // that is stopped and told why. Checked first, so no other layer can let a
+    // call through after the allowance is gone.
+    const q = cfg.guestQuota;
+    if (q && q.exhausted) {
+      return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on — your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate → Settings → guard → d.`;
+    }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);
       if (hit) return 'Security layer (DLP): blocked - arguments contain a ' + hit +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.94",
+  "version": "0.82.96",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {