@solongate/proxy 0.82.95 → 0.82.97

package/dist/index.js

@@ -11407,7 +11407,26 @@ var init_doctor = __esm({
 import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
 import TextInput6 from "ink-text-input";
 import { useEffect as useEffect7, useRef as useRef3, useState as useState8 } from "react";
+import { readFileSync as readFileSync11, readdirSync as readdirSync2 } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join13 } from "path";
 import { Fragment as Fragment5, jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+function guestAllowance() {
+  try {
+    const dir = join13(homedir11(), ".solongate");
+    for (const f of readdirSync2(dir)) {
+      if (!f.startsWith(".policy-cache-") || !f.endsWith(".json")) continue;
+      try {
+        const c2 = JSON.parse(readFileSync11(join13(dir, f), "utf-8"));
+        const q = c2?.security?.guestQuota;
+        if (q && typeof q.limit === "number") return { used: q.used ?? 0, limit: q.limit };
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 function SettingsPanel({
   active: active2,
   focused,
@@ -11443,6 +11462,7 @@ function SettingsPanel({
     const step = setInterval(() => setDiagStep((s) => Math.min(s + 1, total - 1)), 220);
     return () => clearInterval(step);
   }, [diagBusy]);
+  const allowance = guestAllowance();
   const ver = currentVersion();
   useEffect7(() => {
     let live2 = true;
@@ -11514,6 +11534,7 @@ function SettingsPanel({
   const rowsAll = [
     ...accounts.map((acc) => ({ kind: "acct", acc })),
     { kind: "acct-add" },
+    ...allowance ? [{ kind: "allowance", used: allowance.used, limit: allowance.limit }] : [],
     ...locked ? [] : [
       { kind: "guard" },
       { kind: "self" },
@@ -11965,6 +11986,15 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add account (enter \u2014 device login in the browser)" })
         ] });
+      case "allowance": {
+        const left = Math.max(0, r.limit - r.used);
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "allowance".padEnd(11) }),
+          /* @__PURE__ */ jsx8(Text8, { color: left === 0 ? theme.bad : left <= 20 ? theme.warn : theme.ok, bold: true, children: `${r.used}/${r.limit} tool calls` }),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: left === 0 ? "   used up \u2014 every call is denied \xB7 create an account to carry on" : `   ${left} left on this guest account \xB7 create an account for no limit` })
+        ] });
+      }
       case "guard":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -12051,7 +12081,7 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
@@ -12409,8 +12439,8 @@ __export(tui_exports, {
   launchTui: () => launchTui
 });
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
+import { homedir as homedir12 } from "os";
+import { join as join14 } from "path";
 import { render } from "ink";
 import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
@@ -12421,11 +12451,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join13(homedir11(), ".solongate", "dataroom-debug.log");
+  const debugLog = join14(homedir12(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync9(join13(homedir11(), ".solongate"), { recursive: true });
+      mkdirSync9(join14(homedir12(), ".solongate"), { recursive: true });
       appendFileSync2(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {
@@ -12452,7 +12482,7 @@ var init_tui = __esm({
 });
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 async function run2(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0];
@@ -12609,7 +12639,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync11(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -13323,10 +13353,10 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer } from "http";
-import { readFileSync as readFileSync12, statSync as statSync4 } from "fs";
-import { resolve as resolve5, join as join14, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir12 } from "os";
-import { readdirSync as readdirSync2 } from "fs";
+import { readFileSync as readFileSync13, statSync as statSync4 } from "fs";
+import { resolve as resolve5, join as join15, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir13 } from "os";
+import { readdirSync as readdirSync3 } from "fs";
 function allowedOrigins() {
   const base = [
     "https://dashboard.solongate.com",
@@ -13342,15 +13372,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute2(dir)) return dir;
-  return resolve5(homedir12(), ".solongate", "local-logs");
+  return resolve5(homedir13(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve5(homedir12(), ".solongate");
+  const base = resolve5(homedir13(), ".solongate");
   try {
-    const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
+    const files = readdirSync3(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync12(join14(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync13(join15(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -13359,7 +13389,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync12(join14(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync13(join15(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -13388,7 +13418,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join14(dir, LOG_FILENAME);
+  const file = join15(dir, LOG_FILENAME);
   try {
     const st = statSync4(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -13471,7 +13501,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync12(info.file, "utf-8");
+        const text = readFileSync13(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -13524,9 +13554,9 @@ var init_logs_server = __esm({
 });
 
 // src/index.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname4, join as join16 } from "path";
 
 // src/config.ts
 import { readFileSync, existsSync } from "fs";
@@ -16921,8 +16951,8 @@ if (!IS_HUMAN_CLI) {
 }
 var PKG_VERSION = (() => {
   try {
-    const p = join15(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync13(p, "utf-8")).version || "unknown";
+    const p = join16(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync14(p, "utf-8")).version || "unknown";
   } catch {
     return "unknown";
   }

package/dist/tui/index.js

@@ -530,8 +530,8 @@ var init_global_install = __esm({
 
 // src/tui/index.tsx
 import { appendFileSync, mkdirSync as mkdirSync7 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
+import { homedir as homedir11 } from "os";
+import { join as join11 } from "path";
 import { render } from "ink";
 
 // src/tui/App.tsx
@@ -4587,7 +4587,26 @@ async function tuiUpdateFlow(onStatus) {
 }
 
 // src/tui/panels/Settings.tsx
+import { readFileSync as readFileSync8, readdirSync as readdirSync2 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join10 } from "path";
 import { Fragment as Fragment5, jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+function guestAllowance() {
+  try {
+    const dir = join10(homedir10(), ".solongate");
+    for (const f of readdirSync2(dir)) {
+      if (!f.startsWith(".policy-cache-") || !f.endsWith(".json")) continue;
+      try {
+        const c2 = JSON.parse(readFileSync8(join10(dir, f), "utf-8"));
+        const q = c2?.security?.guestQuota;
+        if (q && typeof q.limit === "number") return { used: q.used ?? 0, limit: q.limit };
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 var EVENTS = ["denials", "allowed", "all"];
 var SPIN2 = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var SIGNALS2 = ["any", "deny", "dlp", "ratelimit"];
@@ -4639,6 +4658,7 @@ function SettingsPanel({
     const step = setInterval(() => setDiagStep((s) => Math.min(s + 1, total - 1)), 220);
     return () => clearInterval(step);
   }, [diagBusy]);
+  const allowance = guestAllowance();
   const ver = currentVersion();
   useEffect7(() => {
     let live2 = true;
@@ -4710,6 +4730,7 @@ function SettingsPanel({
   const rowsAll = [
     ...accounts.map((acc) => ({ kind: "acct", acc })),
     { kind: "acct-add" },
+    ...allowance ? [{ kind: "allowance", used: allowance.used, limit: allowance.limit }] : [],
     ...locked ? [] : [
       { kind: "guard" },
       { kind: "self" },
@@ -5161,6 +5182,15 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add account (enter \u2014 device login in the browser)" })
         ] });
+      case "allowance": {
+        const left = Math.max(0, r.limit - r.used);
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "allowance".padEnd(11) }),
+          /* @__PURE__ */ jsx8(Text8, { color: left === 0 ? theme.bad : left <= 20 ? theme.warn : theme.ok, bold: true, children: `${r.used}/${r.limit} tool calls` }),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: left === 0 ? "   used up \u2014 every call is denied \xB7 create an account to carry on" : `   ${left} left on this guest account \xB7 create an account for no limit` })
+        ] });
+      }
       case "guard":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -5247,7 +5277,7 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
@@ -5552,11 +5582,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join10(homedir10(), ".solongate", "dataroom-debug.log");
+  const debugLog = join11(homedir11(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync7(join10(homedir10(), ".solongate"), { recursive: true });
+      mkdirSync7(join11(homedir11(), ".solongate"), { recursive: true });
       appendFileSync(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 67;
+var HOOK_VERSION = 68;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -7955,6 +7955,10 @@ function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg)
     return null;
   try {
+    const q = cfg.guestQuota;
+    if (q && q.exhausted) {
+      return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on \u2014 your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate \u2192 Settings \u2192 guard \u2192 d.`;
+    }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);
       if (hit)

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 67;
+const HOOK_VERSION = 68;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -1765,6 +1765,15 @@ function rateLimitCheck(agentKey, limits) {
 function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg) return null;
   try {
+    // Guest allowance. A guest account is a trial, so past its allowance every
+    // call is denied without exception rather than quietly running unguarded:
+    // an agent that believes it is protected and is not is worse off than one
+    // that is stopped and told why. Checked first, so no other layer can let a
+    // call through after the allowance is gone.
+    const q = cfg.guestQuota;
+    if (q && q.exhausted) {
+      return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on — your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate → Settings → guard → d.`;
+    }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);
       if (hit) return 'Security layer (DLP): blocked - arguments contain a ' + hit +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.95",
+  "version": "0.82.97",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {