@solongate/proxy 0.82.95 → 0.82.96

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 67;
+var HOOK_VERSION = 68;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -7955,6 +7955,10 @@ function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg)
     return null;
   try {
+    const q = cfg.guestQuota;
+    if (q && q.exhausted) {
+      return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on \u2014 your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate \u2192 Settings \u2192 guard \u2192 d.`;
+    }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);
       if (hit)

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 67;
+const HOOK_VERSION = 68;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -1765,6 +1765,15 @@ function rateLimitCheck(agentKey, limits) {
 function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg) return null;
   try {
+    // Guest allowance. A guest account is a trial, so past its allowance every
+    // call is denied without exception rather than quietly running unguarded:
+    // an agent that believes it is protected and is not is worse off than one
+    // that is stopped and told why. Checked first, so no other layer can let a
+    // call through after the allowance is gone.
+    const q = cfg.guestQuota;
+    if (q && q.exhausted) {
+      return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on — your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate → Settings → guard → d.`;
+    }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);
       if (hit) return 'Security layer (DLP): blocked - arguments contain a ' + hit +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.95",
+  "version": "0.82.96",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {