@solongate/proxy 0.83.1 → 0.83.3

package/dist/index.js

@@ -6923,12 +6923,18 @@ var init_global_install = __esm({
 // src/self-update.ts
 var self_update_exports = {};
 __export(self_update_exports, {
+  adminInstallCommand: () => adminInstallCommand,
+  autoUpdateEnabled: () => autoUpdateEnabled,
+  autoUpdateForcedByEnv: () => autoUpdateForcedByEnv,
   currentVersion: () => currentVersion,
   latestVersion: () => latestVersion,
   maybeSelfUpdate: () => maybeSelfUpdate,
   newerThan: () => newerThan,
+  runAutoUpdateCommand: () => runAutoUpdateCommand,
   runUpdateCommand: () => runUpdateCommand,
-  tuiUpdateFlow: () => tuiUpdateFlow
+  setAutoUpdate: () => setAutoUpdate,
+  tuiUpdateFlow: () => tuiUpdateFlow,
+  updateNow: () => updateNow
 });
 import { execFile, execFileSync as execFileSync3, spawn } from "child_process";
 import { mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
@@ -6950,6 +6956,20 @@ function writeState(s) {
   } catch {
   }
 }
+function autoUpdateEnabled() {
+  const env = (process.env.SOLONGATE_AUTO_UPDATE ?? "").trim().toLowerCase();
+  if (env === "1" || env === "true" || env === "on" || env === "yes") return true;
+  if (env === "0" || env === "false" || env === "off" || env === "no") return false;
+  return readState().auto === true;
+}
+function autoUpdateForcedByEnv() {
+  const env = (process.env.SOLONGATE_AUTO_UPDATE ?? "").trim().toLowerCase();
+  return ["1", "true", "on", "yes", "0", "false", "off", "no"].includes(env);
+}
+function setAutoUpdate(on) {
+  const s = readState();
+  writeState(on ? { ...s, auto: true, needsAdmin: void 0 } : { ...s, auto: false });
+}
 function currentVersion() {
   try {
     const pkg = JSON.parse(readFileSync5(join5(dirname2(fileURLToPath2(import.meta.url)), "..", "package.json"), "utf-8"));
@@ -7015,11 +7035,18 @@ async function runUpdateCommand() {
   }
   if (newerThan(latest, cur)) {
     out2(`  updating ${cur} -> ${latest} ...`);
-    const ok = await runGlobalInstall2(latest);
-    if (!ok) {
-      out2("  update failed. Try: npm i -g @solongate/proxy@latest");
+    const r = await runGlobalInstall2(latest);
+    if (!r.ok) {
+      if (r.needsAdmin) {
+        writeState({ ...readState(), needsAdmin: latest });
+        out2(`  npm could not write to the global folder (it needs admin rights).`);
+        out2(`  Run:  ${adminInstallCommand()}`);
+      } else {
+        out2("  update failed. Try: npm i -g @solongate/proxy@latest");
+      }
       return 1;
     }
+    writeState({ ...readState(), needsAdmin: void 0 });
     out2(`  \u2713 updated to ${latest}  (open a new session to use it)`);
   } else {
     out2(`  \u2713 already up to date`);
@@ -7049,21 +7076,61 @@ function runGlobalInstall2(version) {
         ["install", "-g", `${PKG}@${version}`],
         { timeout: 3e5, windowsHide: true, shell: process.platform === "win32" },
         (err2, stdout, stderr) => {
+          const output = `${stdout}
+${stderr}`;
           try {
             writeFileSync4(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
-${stdout}
-${stderr}
+${output}
 `, { flag: "a" });
           } catch {
           }
-          resolve6(!err2);
+          resolve6({ ok: !err2, needsAdmin: !!err2 && NEEDS_ADMIN_RE.test(output) });
         }
       );
     } catch {
-      resolve6(false);
+      resolve6({ ok: false, needsAdmin: false });
     }
   });
 }
+function adminInstallCommand() {
+  return process.platform === "win32" ? `npm i -g ${PKG}@latest  (in an Administrator terminal)` : `sudo npm i -g ${PKG}@latest`;
+}
+async function updateNow() {
+  const cur = currentVersion();
+  const latest = await fetchLatest();
+  if (!latest) return { status: "unreachable", version: cur };
+  if (!newerThan(latest, cur)) return { status: "current", version: cur };
+  const r = await runGlobalInstall2(latest);
+  if (r.ok) {
+    writeState({ ...readState(), installed: latest, needsAdmin: void 0 });
+    return { status: "updated", version: latest };
+  }
+  if (r.needsAdmin) {
+    writeState({ ...readState(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
+  return { status: "failed", version: latest };
+}
+function runAutoUpdateCommand(arg) {
+  const out2 = (s) => void process.stderr.write(s + "\n");
+  const envForced = autoUpdateForcedByEnv();
+  if (arg === void 0) {
+    out2(`  auto-update is ${autoUpdateEnabled() ? "on" : "off"}${envForced ? "  (forced by SOLONGATE_AUTO_UPDATE)" : ""}`);
+    out2("  change it with: solongate update auto on|off");
+    return 0;
+  }
+  const v = arg.trim().toLowerCase();
+  const on = ["on", "1", "true", "yes", "enable", "enabled"].includes(v);
+  const off = ["off", "0", "false", "no", "disable", "disabled"].includes(v);
+  if (!on && !off) {
+    out2(`  unknown value "${arg}" \u2014 use: solongate update auto on|off`);
+    return 1;
+  }
+  setAutoUpdate(on);
+  out2(on ? "  \u2713 auto-update on \u2014 new versions install in the background" : "  \u2713 auto-update off \u2014 update with: solongate update");
+  if (envForced) out2(`  note: SOLONGATE_AUTO_UPDATE is set and overrides this while it stays set`);
+  return 0;
+}
 async function tuiUpdateFlow(onStatus) {
   try {
     const current = currentVersion();
@@ -7075,10 +7142,22 @@ async function tuiUpdateFlow(onStatus) {
       onStatus({ kind: "updated", version: latest });
       return;
     }
+    if (!autoUpdateEnabled()) {
+      onStatus({ kind: "available", version: latest });
+      return;
+    }
+    if (readState().needsAdmin === latest) {
+      onStatus({ kind: "needs-admin", version: latest });
+      return;
+    }
     onStatus({ kind: "updating", version: latest });
-    if (await runGlobalInstall2(latest)) {
-      writeState({ ...readState(), installed: latest });
+    const r = await runGlobalInstall2(latest);
+    if (r.ok) {
+      writeState({ ...readState(), installed: latest, needsAdmin: void 0 });
       onStatus({ kind: "updated", version: latest });
+    } else if (r.needsAdmin) {
+      writeState({ ...readState(), needsAdmin: latest });
+      onStatus({ kind: "needs-admin", version: latest });
     }
   } catch {
   }
@@ -7097,17 +7176,20 @@ function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
       }
       if (!latest || !newerThan(latest, current)) return;
       const attempts = readState().attempts ?? {};
-      if (now - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS) {
-        writeState({ ...readState(), attempts: { [latest]: now } });
-        if (spawnGlobalInstall(latest)) {
-          notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
-        }
+      if (now - (attempts[latest] ?? 0) < ATTEMPT_EVERY_MS) return;
+      writeState({ ...readState(), attempts: { [latest]: now } });
+      if (!autoUpdateEnabled()) {
+        notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 run ${c.reset}${c.cyan}solongate update${c.reset}`);
+        return;
+      }
+      if (spawnGlobalInstall(latest)) {
+        notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
       }
     } catch {
     }
   })();
 }
-var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE;
+var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE, NEEDS_ADMIN_RE;
 var init_self_update = __esm({
   "src/self-update.ts"() {
     "use strict";
@@ -7117,6 +7199,7 @@ var init_self_update = __esm({
     ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
     STATE_FILE = join5(homedir3(), ".solongate", ".self-update.json");
     LOG_FILE = join5(homedir3(), ".solongate", "self-update.log");
+    NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
   }
 });
 
@@ -11458,6 +11541,8 @@ function SettingsPanel({
   const [editor, setEditor] = useState8(null);
   const [latest, setLatest] = useState8(null);
   const [diagBusy, setDiagBusy] = useState8(null);
+  const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
+  const [updBusy, setUpdBusy] = useState8(false);
   const [diag, setDiag] = useState8(null);
   const [diagStep, setDiagStep] = useState8(0);
   const DIAG_STEPS = {
@@ -11515,10 +11600,10 @@ function SettingsPanel({
   }, []);
   useEffect7(() => {
     const loggingIn = login && login.phase !== "done" && login.phase !== "error";
-    if (!loggingIn && !diagBusy) return;
+    if (!loggingIn && !diagBusy && !updBusy) return;
     const t = setInterval(() => setTick((n) => n + 1), 120);
     return () => clearInterval(t);
-  }, [login, diagBusy]);
+  }, [login, diagBusy, updBusy]);
   const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
   const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
   const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
@@ -11552,6 +11637,8 @@ function SettingsPanel({
       { kind: "self" },
       { kind: "doctor" },
       { kind: "repair" },
+      { kind: "cli-update" },
+      { kind: "auto-update" },
       { kind: "ll-enabled" },
       { kind: "ll-path" },
       { kind: "ll-server" },
@@ -11731,6 +11818,34 @@ function SettingsPanel({
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run10(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
+    } else if (r.kind === "cli-update") {
+      if (updBusy) return;
+      setUpdBusy(true);
+      setMsg({ text: "updating\u2026", level: "ok" });
+      void (async () => {
+        try {
+          const res = await updateNow();
+          if (res.status === "updated") setMsg({ text: `\u2713 v${res.version} installed \xB7 restart (q, then solongate) to apply`, level: "ok" });
+          else if (res.status === "current") setMsg({ text: `\u2713 already on the latest version (v${res.version})`, level: "ok" });
+          else if (res.status === "needs-admin") setMsg({ text: `\u2717 npm needs admin rights here \u2014 run: ${adminInstallCommand()}`, level: "bad" });
+          else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
+          else setMsg({ text: `\u2717 update to v${res.version} failed \u2014 see ~/.solongate/self-update.log`, level: "bad" });
+          setLatest(await latestVersion());
+        } finally {
+          setUpdBusy(false);
+        }
+      })();
+    } else if (r.kind === "auto-update") {
+      if (autoUpdateForcedByEnv()) {
+        setMsg({ text: "SOLONGATE_AUTO_UPDATE is set \u2014 unset it to change this here", level: "bad" });
+        return;
+      }
+      const next = !autoUp;
+      setAutoUpdate(next);
+      setAutoUp(next);
+      setMsg(
+        next ? { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
+      );
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
       if (!local.enabled && !local.path.trim()) {
@@ -11829,7 +11944,7 @@ function SettingsPanel({
           if (ok) clearLocalLog();
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
-        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
+        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "auto-update" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
           if (cur.kind === "alert") run10(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
           else activate(cur);
         }
@@ -12041,6 +12156,22 @@ function SettingsPanel({
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "repair".padEnd(11) }),
           diagBusy === "repair" ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `${spin} restoring protection\u2026` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "restore every protection file after tampering or deletion \xB7 enter runs it" })
         ] });
+      case "cli-update": {
+        const behind = latest ? newerThan(latest, ver) : false;
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "version".padEnd(11) }),
+          /* @__PURE__ */ jsx8(Text8, { color: behind ? theme.warn : theme.ok, children: `v${ver}` }),
+          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
+        ] });
+      }
+      case "auto-update":
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "auto".padEnd(11) }),
+          onOff(autoUp),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
+        ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -12093,10 +12224,11 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
+    UPDATES: "the solongate CLI itself \xB7 background auto-update is off unless you turn it on",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -12165,7 +12297,7 @@ function SettingsPanel({
   lineEls.push(
     /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", color: theme.dim, children: [
       `solongate v${ver}`,
-      latest ? newerThan(latest, ver) ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \xB7 v${latest} on npm \u2014 auto-updating` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "  \xB7 latest" }) : null
+      latest ? newerThan(latest, ver) ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \xB7 v${latest} on npm \u2014 ${autoUp ? "auto-updating" : "UPDATES above"}` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "  \xB7 latest" }) : null
     ] }, "ver")
   );
   lineKey.push("");
@@ -12394,7 +12526,7 @@ function App() {
           // a row off whichever panel is open.
           /* @__PURE__ */ jsx9(Text9, { color: theme.bad, bold: true, children: "  \xB7 allowance used up \xB7 every call denied \xB7 create an account to carry on" })
         ) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-        update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : null
+        update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : update2.kind === "available" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} out \xB7 Settings \u2192 UPDATES` }) : update2.kind === "needs-admin" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} needs admin rights \xB7 Settings \u2192 UPDATES` }) : null
       ] }),
       /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
         /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", flexShrink: 0, width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {
@@ -17026,6 +17158,7 @@ function printHelp() {
   head("Setup & status");
   cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
   cmd("update", "update SolonGate to the newest version and refresh the guard");
+  cmd("update auto on|off", "background auto-update (default off \u2014 on macOS npm -g often needs sudo)");
   cmd("repair", "restore the guard + hook + settings files if they were deleted or disarmed");
   cmd("doctor", "health check: login, policy, guard, local logs");
   cmd("doctor --json", "the same health check as machine-readable JSON");
@@ -17173,6 +17306,10 @@ async function main() {
     return;
   }
   if (subcommand === "update") {
+    if (process.argv[3] === "auto") {
+      const { runAutoUpdateCommand: runAutoUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
+      process.exit(runAutoUpdateCommand2(process.argv[4]));
+    }
     const { runUpdateCommand: runUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
     process.exit(await runUpdateCommand2());
   }

package/dist/self-update.d.ts

@@ -1,30 +1,64 @@
+/**
+ * Is the background updater turned on? Default: NO — see the file header.
+ * SOLONGATE_AUTO_UPDATE=on|off (1/0, true/false) overrides the stored setting
+ * for one run, so a CI image or a managed fleet can force either way without
+ * writing to the user's home directory.
+ */
+export declare function autoUpdateEnabled(): boolean;
+/** True when the env var is deciding, so the UI can say the row is overridden. */
+export declare function autoUpdateForcedByEnv(): boolean;
+/** Turn the background updater on/off. Clears the "npm refused" memo on enable. */
+export declare function setAutoUpdate(on: boolean): void;
 export declare function currentVersion(): string;
 /** true when `b` is a strictly newer semver than `a` (numeric triples only). */
 export declare function newerThan(b: string, a: string): boolean;
 /** The latest version published to npm, or null if it can't be reached. */
 export declare function latestVersion(): Promise<string | null>;
-/** Foreground global install — resolves true on success, output → update log. */
 /**
- * `solongate update` — explicit, visible update instead of waiting for the
- * background auto-update: installs the newest CLI globally, then refreshes the
- * installed guard hooks. Returns a process exit code.
+ * `solongate update` — the normal way to update, and the ONLY way when the
+ * background updater is off (which is the default): installs the newest CLI
+ * globally, then refreshes the installed guard hooks. Returns a process exit
+ * code.
  */
 export declare function runUpdateCommand(): Promise<number>;
+/** The exact command that fixes a root-owned global prefix. */
+export declare function adminInstallCommand(): string;
+/**
+ * Install the newest version NOW, whatever the auto-update setting says — the
+ * dataroom's UPDATES row and `solongate update` both run through here.
+ */
+export declare function updateNow(): Promise<{
+    status: 'updated' | 'current' | 'needs-admin' | 'unreachable' | 'failed';
+    version: string;
+}>;
+/**
+ * `solongate update auto [on|off]` — show or change the background updater.
+ * Kept separate from `runUpdateCommand` so `solongate update` stays "update me
+ * now" and never changes a setting as a side effect.
+ */
+export declare function runAutoUpdateCommand(arg?: string): number;
 /** What the dataroom shows about the updater. */
 export type UpdateStatus = {
     kind: 'idle';
+} | {
+    kind: 'available';
+    version: string;
 } | {
     kind: 'updating';
     version: string;
 } | {
     kind: 'updated';
     version: string;
+} | {
+    kind: 'needs-admin';
+    version: string;
 };
 /**
- * The dataroom's updater (Claude Code-style): check the registry EVERY time the
- * TUI opens (and periodically while it stays open), install the new version in
- * the background, then tell the user to restart. `onStatus` drives the in-app
- * status line; nothing is ever written to the terminal directly.
+ * The dataroom's updater: check the registry EVERY time the TUI opens (and
+ * periodically while it stays open). With auto-update ON, install in the
+ * background and ask for a restart; with it OFF (the default), only report that
+ * a version is available. `onStatus` drives the in-app status line; nothing is
+ * ever written to the terminal directly.
  */
 export declare function tuiUpdateFlow(onStatus: (s: UpdateStatus) => void): Promise<void>;
 /**

package/dist/tui/index.js

@@ -4504,6 +4504,7 @@ var CHECK_EVERY_MS = 30 * 60 * 1e3;
 var ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
 var STATE_FILE2 = join9(homedir9(), ".solongate", ".self-update.json");
 var LOG_FILE2 = join9(homedir9(), ".solongate", "self-update.log");
+var NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
 function readState2() {
   try {
     const s = JSON.parse(readFileSync7(STATE_FILE2, "utf-8"));
@@ -4519,6 +4520,20 @@ function writeState2(s) {
   } catch {
   }
 }
+function autoUpdateEnabled() {
+  const env = (process.env.SOLONGATE_AUTO_UPDATE ?? "").trim().toLowerCase();
+  if (env === "1" || env === "true" || env === "on" || env === "yes") return true;
+  if (env === "0" || env === "false" || env === "off" || env === "no") return false;
+  return readState2().auto === true;
+}
+function autoUpdateForcedByEnv() {
+  const env = (process.env.SOLONGATE_AUTO_UPDATE ?? "").trim().toLowerCase();
+  return ["1", "true", "on", "yes", "0", "false", "off", "no"].includes(env);
+}
+function setAutoUpdate(on) {
+  const s = readState2();
+  writeState2(on ? { ...s, auto: true, needsAdmin: void 0 } : { ...s, auto: false });
+}
 function currentVersion() {
   try {
     const pkg = JSON.parse(readFileSync7(join9(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json"), "utf-8"));
@@ -4564,21 +4579,41 @@ function runGlobalInstall(version) {
         ["install", "-g", `${PKG}@${version}`],
         { timeout: 3e5, windowsHide: true, shell: process.platform === "win32" },
         (err2, stdout, stderr) => {
+          const output = `${stdout}
+${stderr}`;
           try {
             writeFileSync7(LOG_FILE2, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
-${stdout}
-${stderr}
+${output}
 `, { flag: "a" });
           } catch {
           }
-          resolve3(!err2);
+          resolve3({ ok: !err2, needsAdmin: !!err2 && NEEDS_ADMIN_RE.test(output) });
         }
       );
     } catch {
-      resolve3(false);
+      resolve3({ ok: false, needsAdmin: false });
     }
   });
 }
+function adminInstallCommand() {
+  return process.platform === "win32" ? `npm i -g ${PKG}@latest  (in an Administrator terminal)` : `sudo npm i -g ${PKG}@latest`;
+}
+async function updateNow() {
+  const cur = currentVersion();
+  const latest = await fetchLatest();
+  if (!latest) return { status: "unreachable", version: cur };
+  if (!newerThan(latest, cur)) return { status: "current", version: cur };
+  const r = await runGlobalInstall(latest);
+  if (r.ok) {
+    writeState2({ ...readState2(), installed: latest, needsAdmin: void 0 });
+    return { status: "updated", version: latest };
+  }
+  if (r.needsAdmin) {
+    writeState2({ ...readState2(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
+  return { status: "failed", version: latest };
+}
 async function tuiUpdateFlow(onStatus) {
   try {
     const current = currentVersion();
@@ -4590,10 +4625,22 @@ async function tuiUpdateFlow(onStatus) {
       onStatus({ kind: "updated", version: latest });
       return;
     }
+    if (!autoUpdateEnabled()) {
+      onStatus({ kind: "available", version: latest });
+      return;
+    }
+    if (readState2().needsAdmin === latest) {
+      onStatus({ kind: "needs-admin", version: latest });
+      return;
+    }
     onStatus({ kind: "updating", version: latest });
-    if (await runGlobalInstall(latest)) {
-      writeState2({ ...readState2(), installed: latest });
+    const r = await runGlobalInstall(latest);
+    if (r.ok) {
+      writeState2({ ...readState2(), installed: latest, needsAdmin: void 0 });
       onStatus({ kind: "updated", version: latest });
+    } else if (r.needsAdmin) {
+      writeState2({ ...readState2(), needsAdmin: latest });
+      onStatus({ kind: "needs-admin", version: latest });
     }
   } catch {
   }
@@ -4654,6 +4701,8 @@ function SettingsPanel({
   const [editor, setEditor] = useState8(null);
   const [latest, setLatest] = useState8(null);
   const [diagBusy, setDiagBusy] = useState8(null);
+  const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
+  const [updBusy, setUpdBusy] = useState8(false);
   const [diag, setDiag] = useState8(null);
   const [diagStep, setDiagStep] = useState8(0);
   const DIAG_STEPS = {
@@ -4711,10 +4760,10 @@ function SettingsPanel({
   }, []);
   useEffect7(() => {
     const loggingIn = login && login.phase !== "done" && login.phase !== "error";
-    if (!loggingIn && !diagBusy) return;
+    if (!loggingIn && !diagBusy && !updBusy) return;
     const t = setInterval(() => setTick((n) => n + 1), 120);
     return () => clearInterval(t);
-  }, [login, diagBusy]);
+  }, [login, diagBusy, updBusy]);
   const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
   const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
   const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
@@ -4748,6 +4797,8 @@ function SettingsPanel({
       { kind: "self" },
       { kind: "doctor" },
       { kind: "repair" },
+      { kind: "cli-update" },
+      { kind: "auto-update" },
       { kind: "ll-enabled" },
       { kind: "ll-path" },
       { kind: "ll-server" },
@@ -4927,6 +4978,34 @@ function SettingsPanel({
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
+    } else if (r.kind === "cli-update") {
+      if (updBusy) return;
+      setUpdBusy(true);
+      setMsg({ text: "updating\u2026", level: "ok" });
+      void (async () => {
+        try {
+          const res = await updateNow();
+          if (res.status === "updated") setMsg({ text: `\u2713 v${res.version} installed \xB7 restart (q, then solongate) to apply`, level: "ok" });
+          else if (res.status === "current") setMsg({ text: `\u2713 already on the latest version (v${res.version})`, level: "ok" });
+          else if (res.status === "needs-admin") setMsg({ text: `\u2717 npm needs admin rights here \u2014 run: ${adminInstallCommand()}`, level: "bad" });
+          else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
+          else setMsg({ text: `\u2717 update to v${res.version} failed \u2014 see ~/.solongate/self-update.log`, level: "bad" });
+          setLatest(await latestVersion());
+        } finally {
+          setUpdBusy(false);
+        }
+      })();
+    } else if (r.kind === "auto-update") {
+      if (autoUpdateForcedByEnv()) {
+        setMsg({ text: "SOLONGATE_AUTO_UPDATE is set \u2014 unset it to change this here", level: "bad" });
+        return;
+      }
+      const next = !autoUp;
+      setAutoUpdate(next);
+      setAutoUp(next);
+      setMsg(
+        next ? { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
+      );
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
       if (!local.enabled && !local.path.trim()) {
@@ -5025,7 +5104,7 @@ function SettingsPanel({
           if (ok) clearLocalLog();
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
-        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
+        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "auto-update" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
           if (cur.kind === "alert") run(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
           else activate(cur);
         }
@@ -5237,6 +5316,22 @@ function SettingsPanel({
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "repair".padEnd(11) }),
           diagBusy === "repair" ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `${spin} restoring protection\u2026` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "restore every protection file after tampering or deletion \xB7 enter runs it" })
         ] });
+      case "cli-update": {
+        const behind = latest ? newerThan(latest, ver) : false;
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "version".padEnd(11) }),
+          /* @__PURE__ */ jsx8(Text8, { color: behind ? theme.warn : theme.ok, children: `v${ver}` }),
+          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
+        ] });
+      }
+      case "auto-update":
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "auto".padEnd(11) }),
+          onOff(autoUp),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
+        ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -5289,10 +5384,11 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
+    UPDATES: "the solongate CLI itself \xB7 background auto-update is off unless you turn it on",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -5361,7 +5457,7 @@ function SettingsPanel({
   lineEls.push(
     /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", color: theme.dim, children: [
       `solongate v${ver}`,
-      latest ? newerThan(latest, ver) ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \xB7 v${latest} on npm \u2014 auto-updating` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "  \xB7 latest" }) : null
+      latest ? newerThan(latest, ver) ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \xB7 v${latest} on npm \u2014 ${autoUp ? "auto-updating" : "UPDATES above"}` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "  \xB7 latest" }) : null
     ] }, "ver")
   );
   lineKey.push("");
@@ -5566,7 +5662,7 @@ function App() {
           // a row off whichever panel is open.
           /* @__PURE__ */ jsx9(Text9, { color: theme.bad, bold: true, children: "  \xB7 allowance used up \xB7 every call denied \xB7 create an account to carry on" })
         ) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-        update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : null
+        update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : update2.kind === "available" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} out \xB7 Settings \u2192 UPDATES` }) : update2.kind === "needs-admin" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} needs admin rights \xB7 Settings \u2192 UPDATES` }) : null
       ] }),
       /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
         /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", flexShrink: 0, width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 69;
+var HOOK_VERSION = 70;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -7951,13 +7951,52 @@ function rateLimitCheck(agentKey, limits) {
     return null;
   }
 }
+function quotaTally(used) {
+  const dir = resolve(homedir(), ".solongate");
+  const markFile = join(dir, ".quota-mark");
+  const tallyFile = join(dir, ".quota-tally");
+  let n = 0;
+  try {
+    let mark = null;
+    if (existsSync(markFile)) {
+      try {
+        mark = readFileSync(markFile, "utf-8").trim();
+      } catch {
+      }
+    }
+    if (mark !== String(used)) {
+      writeFileSync(markFile, String(used));
+      writeFileSync(tallyFile, "");
+    } else if (existsSync(tallyFile)) {
+      try {
+        n = statSync(tallyFile).size;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return {
+    n,
+    add() {
+      try {
+        appendFileSync(tallyFile, ".");
+      } catch {
+      }
+    }
+  };
+}
 function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg)
     return null;
   try {
     const q = cfg.guestQuota;
-    if (q && q.exhausted) {
-      return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on. Your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate, Settings, guard, then press d.`;
+    if (q) {
+      const tally = quotaTally(q.used ?? 0);
+      const spent = (q.used ?? 0) + tally.n;
+      if (q.exhausted || spent >= q.limit) {
+        return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on. Your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate, Settings, guard, then press d.`;
+      }
+      tally.add();
     }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 69;
+const HOOK_VERSION = 70;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -1761,6 +1761,40 @@ function rateLimitCheck(agentKey, limits) {
   }
 }
 
+// The allowance figure the API sends is built from audit rows, and those are
+// written AFTER a call runs. Under a burst of parallel tool calls every hook
+// therefore reads the same pre-burst figure, and the allowance overshoots by
+// roughly a batch before the count catches up.
+//
+// The guard is the thing making the calls, so it can close that gap without
+// another round trip: it tallies what it has already let through since the
+// server's figure last moved, and adds it in. One byte is appended per call and
+// the file's LENGTH is the count, because many hooks run at once and a
+// read-modify-write would lose increments; an O_APPEND write of a single byte
+// does not interleave.
+function quotaTally(used) {
+  const dir = resolve(homedir(), '.solongate');
+  const markFile = join(dir, '.quota-mark');
+  const tallyFile = join(dir, '.quota-tally');
+  let n = 0;
+  try {
+    let mark = null;
+    if (existsSync(markFile)) { try { mark = readFileSync(markFile, 'utf-8').trim(); } catch {} }
+    // A figure that has moved means the audit rows caught up and absorbed the
+    // local tally, so it starts again from there.
+    if (mark !== String(used)) {
+      writeFileSync(markFile, String(used));
+      writeFileSync(tallyFile, '');
+    } else if (existsSync(tallyFile)) {
+      try { n = statSync(tallyFile).size; } catch {}
+    }
+  } catch { /* a missing tally only costs accuracy near the edge, never the gate */ }
+  return {
+    n,
+    add() { try { appendFileSync(tallyFile, '.'); } catch {} },
+  };
+}
+
 // Runs all enabled enforcement layers; returns a deny reason or null (allow).
 function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg) return null;
@@ -1771,8 +1805,17 @@ function securityLayerCheck(toolName, args, cfg, agentKey) {
     // that is stopped and told why. Checked first, so no other layer can let a
     // call through after the allowance is gone.
     const q = cfg.guestQuota;
-    if (q && q.exhausted) {
-      return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on. Your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate, Settings, guard, then press d.`;
+    if (q) {
+      // The server's figure plus what this device has run since, so a burst
+      // cannot spend past the allowance while the audit rows are still in flight.
+      const tally = quotaTally(q.used ?? 0);
+      const spent = (q.used ?? 0) + tally.n;
+      if (q.exhausted || spent >= q.limit) {
+        return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on. Your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate, Settings, guard, then press d.`;
+      }
+      // Counted here rather than after the verdict, because a call the policy
+      // goes on to deny is still recorded and still spends the allowance.
+      tally.add();
     }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.1",
+  "version": "0.83.3",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {