@solongate/proxy 0.83.10 → 0.83.11

package/dist/commands/index.js

@@ -15,7 +15,7 @@ import { resolve, join, dirname } from "path";
 import { homedir } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
-import { execFileSync } from "child_process";
+import { execFileSync, spawn } from "child_process";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var HOOKS_DIR = resolve(__dirname, "..", "hooks");
 function globalPaths() {
@@ -25,6 +25,7 @@ function globalPaths() {
   const claudeDir = join(home, ".claude");
   const antigravityDir = join(home, ".gemini", "config");
   const codexDir = process.env["CODEX_HOME"] ? resolve(process.env["CODEX_HOME"]) : join(home, ".codex");
+  const opencodeDir = join(process.env["XDG_CONFIG_HOME"] ? resolve(process.env["XDG_CONFIG_HOME"]) : join(home, ".config"), "opencode");
   return {
     home,
     sgDir,
@@ -32,6 +33,7 @@ function globalPaths() {
     claudeDir,
     antigravityDir,
     codexDir,
+    opencodeDir,
     settingsPath: join(claudeDir, "settings.json"),
     backupPath: join(claudeDir, "settings.solongate.bak"),
     configPath: join(sgDir, "cloud-guard.json"),
@@ -45,7 +47,14 @@ function globalPaths() {
     // the user's TOML, which also holds the hook TRUST state Codex manages).
     codexHooksPath: join(codexDir, "hooks.json"),
     codexBackupPath: join(codexDir, "hooks.solongate.bak"),
-    codexConfigPath: join(codexDir, "config.toml")
+    codexConfigPath: join(codexDir, "config.toml"),
+    // OpenCode scans its plugin folder at startup and loads every module in it.
+    // Measured on 1.18.10: BOTH `plugin/` and `plugins/` are scanned, so the
+    // docs and the field reports are each half right. We write the documented
+    // one. There is nothing to register anywhere — dropping the file IS the
+    // installation, which also means deleting the file IS the uninstall.
+    opencodePluginDir: join(opencodeDir, "plugins"),
+    opencodePluginPath: join(opencodeDir, "plugins", "solongate.js")
   };
 }
 function isOurCodexGroup(group) {
@@ -267,7 +276,7 @@ async function request(method, path, opts = {}) {
 }
 
 // src/api-client/device-login.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // src/api-client/auth.ts
 var auth_exports = {};

package/dist/global-install.d.ts

@@ -22,6 +22,7 @@ export declare function globalPaths(): {
     claudeDir: string;
     antigravityDir: string;
     codexDir: string;
+    opencodeDir: string;
     settingsPath: string;
     backupPath: string;
     configPath: string;
@@ -30,6 +31,8 @@ export declare function globalPaths(): {
     codexHooksPath: string;
     codexBackupPath: string;
     codexConfigPath: string;
+    opencodePluginDir: string;
+    opencodePluginPath: string;
 };
 export declare function clearGuardUpdateCheck(): boolean;
 /** Is our guard currently registered in Codex's hooks.json on THIS device? */
@@ -48,6 +51,10 @@ export declare function codexHooksStatus(): {
     trusted: boolean;
     disabled: boolean;
 };
+export declare function isOpencodeGuardInstalled(): boolean;
+/** True when OpenCode looks present on this device, so callers can decide
+ *  whether the OpenCode line is worth showing at all. */
+export declare function opencodeDetected(): boolean;
 export declare function runGlobalRestore(): void;
 /**
  * TUI-safe (re)install — the dataroom's one-key "install / update guard" action.

package/dist/global-install.js

@@ -4,7 +4,7 @@ import { resolve, join, dirname } from "path";
 import { homedir } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
-import { execFileSync } from "child_process";
+import { execFileSync, spawn } from "child_process";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var HOOKS_DIR = resolve(__dirname, "..", "hooks");
 function lockFile(file) {
@@ -89,7 +89,11 @@ function protectedTargets() {
     p.configPath,
     p.settingsPath,
     p.antigravityHooksPath,
-    p.codexHooksPath
+    p.codexHooksPath,
+    // The OpenCode plugin IS the registration — delete it and the guard is gone
+    // from that client with nothing left to notice the absence, so it belongs
+    // under the same OS lock as every other protection file.
+    p.opencodePluginPath
   ];
 }
 function lockProtected() {
@@ -121,6 +125,7 @@ function globalPaths() {
   const claudeDir = join(home, ".claude");
   const antigravityDir = join(home, ".gemini", "config");
   const codexDir = process.env["CODEX_HOME"] ? resolve(process.env["CODEX_HOME"]) : join(home, ".codex");
+  const opencodeDir = join(process.env["XDG_CONFIG_HOME"] ? resolve(process.env["XDG_CONFIG_HOME"]) : join(home, ".config"), "opencode");
   return {
     home,
     sgDir,
@@ -128,6 +133,7 @@ function globalPaths() {
     claudeDir,
     antigravityDir,
     codexDir,
+    opencodeDir,
     settingsPath: join(claudeDir, "settings.json"),
     backupPath: join(claudeDir, "settings.solongate.bak"),
     configPath: join(sgDir, "cloud-guard.json"),
@@ -141,7 +147,14 @@ function globalPaths() {
     // the user's TOML, which also holds the hook TRUST state Codex manages).
     codexHooksPath: join(codexDir, "hooks.json"),
     codexBackupPath: join(codexDir, "hooks.solongate.bak"),
-    codexConfigPath: join(codexDir, "config.toml")
+    codexConfigPath: join(codexDir, "config.toml"),
+    // OpenCode scans its plugin folder at startup and loads every module in it.
+    // Measured on 1.18.10: BOTH `plugin/` and `plugins/` are scanned, so the
+    // docs and the field reports are each half right. We write the documented
+    // one. There is nothing to register anywhere — dropping the file IS the
+    // installation, which also means deleting the file IS the uninstall.
+    opencodePluginDir: join(opencodeDir, "plugins"),
+    opencodePluginPath: join(opencodeDir, "plugins", "solongate.js")
   };
 }
 function clearGuardUpdateCheck() {
@@ -341,6 +354,47 @@ function codexHooksStatus() {
   }
   return { registered, trusted, disabled };
 }
+function installOpencodeGuard(p) {
+  mkdirSync(p.opencodePluginDir, { recursive: true });
+  const src = readHook("opencode-plugin.mjs").replace("__SOLONGATE_NODE__", process.execPath.replace(/\\/g, "\\\\"));
+  writeProtectedFile(p.opencodePluginPath, src);
+}
+function removeOpencodeGuard(p) {
+  try {
+    unlockFile(p.opencodePluginPath);
+    rmSync(p.opencodePluginPath, { force: true });
+  } catch {
+  }
+}
+function warmPolicyCache(hooksDir, agents) {
+  for (const agent of agents) {
+    try {
+      const child = spawn(process.execPath, [join(hooksDir, "guard.mjs"), agent, "--sg-refresh-policy"], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
+    }
+  }
+}
+function isOpencodeGuardInstalled() {
+  try {
+    return readFileSync(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
+  } catch {
+    return false;
+  }
+}
+function opencodeDetected() {
+  try {
+    return existsSync(globalPaths().opencodeDir);
+  } catch {
+    return false;
+  }
+}
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   return new Promise((res) => rl.question(question, (a) => {
@@ -357,6 +411,10 @@ function runGlobalRestore() {
     removeCodexGuard(p);
   } catch {
   }
+  try {
+    removeOpencodeGuard(p);
+  } catch {
+  }
   if (existsSync(p.backupPath)) {
     writeFileSync(p.settingsPath, readFileSync(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
@@ -383,7 +441,8 @@ function repairQuiet() {
     line("cloud credential", has(p.configPath), "present", "MISSING"),
     line("Claude Code settings", isGuardInstalled(), "guard registered", "guard NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
-    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered")
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered"),
+    line("OpenCode plugin", isOpencodeGuardInstalled(), "installed", "MISSING")
   ];
   const r = installGlobalQuiet();
   if (!r.ok) return { ok: false, message: r.message, before, after: [], notes: [] };
@@ -391,7 +450,8 @@ function repairQuiet() {
     { label: "guard hook file", ok: true, detail: `present (v${installedGuardVersion() ?? "?"})` },
     line("Claude Code settings", isGuardInstalled(), "guard registered", "NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
-    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered")
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered"),
+    line("OpenCode plugin", isOpencodeGuardInstalled(), "installed", "MISSING")
   ];
   const notes = [];
   const cx = codexHooksStatus();
@@ -494,6 +554,11 @@ function installGlobalQuiet() {
       installCodexGuard(p, p.hooksDir);
     } catch {
     }
+    try {
+      installOpencodeGuard(p);
+    } catch {
+    }
+    warmPolicyCache(p.hooksDir, ["claude-code", "codex", "antigravity", "opencode"]);
     if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") lockProtected();
     return { ok: true, message: "guard installed (open a new session)" };
   } catch (e) {
@@ -541,6 +606,10 @@ function uninstallGlobalQuiet() {
       removeCodexGuard(p);
     } catch {
     }
+    try {
+      removeOpencodeGuard(p);
+    } catch {
+    }
     if (!existsSync(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
     const s = JSON.parse(readFileSync(p.settingsPath, "utf-8"));
     delete s.hooks;
@@ -703,6 +772,13 @@ async function runGlobalInstall(opts = {}) {
     }
   } catch {
   }
+  try {
+    installOpencodeGuard(p);
+    console.log(`  Installed OpenCode plugin \u2192 ${p.opencodePluginPath}`);
+    console.log("  OpenCode: `opencode --pure` runs without external plugins and");
+    console.log("            therefore without the guard. That is its own escape hatch.");
+  } catch {
+  }
   if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") {
     lockProtected();
     console.log("  Locked protection files (OS-level read-only/immutable).");
@@ -723,7 +799,9 @@ export {
   installedGuardVersion,
   isCodexGuardInstalled,
   isGuardInstalled,
+  isOpencodeGuardInstalled,
   lockProtected,
+  opencodeDetected,
   removeClaudeShim,
   repairQuiet,
   runGlobalInstall,

package/dist/index.js

@@ -6201,7 +6201,9 @@ __export(global_install_exports, {
   installedGuardVersion: () => installedGuardVersion,
   isCodexGuardInstalled: () => isCodexGuardInstalled,
   isGuardInstalled: () => isGuardInstalled,
+  isOpencodeGuardInstalled: () => isOpencodeGuardInstalled,
   lockProtected: () => lockProtected,
+  opencodeDetected: () => opencodeDetected,
   removeClaudeShim: () => removeClaudeShim,
   repairQuiet: () => repairQuiet,
   runGlobalInstall: () => runGlobalInstall,
@@ -6216,7 +6218,7 @@ import { resolve as resolve3, join as join4, dirname } from "path";
 import { homedir as homedir2 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync2, spawn } from "child_process";
 function lockFile(file) {
   if (!existsSync3(file)) return;
   try {
@@ -6299,7 +6301,11 @@ function protectedTargets() {
     p.configPath,
     p.settingsPath,
     p.antigravityHooksPath,
-    p.codexHooksPath
+    p.codexHooksPath,
+    // The OpenCode plugin IS the registration — delete it and the guard is gone
+    // from that client with nothing left to notice the absence, so it belongs
+    // under the same OS lock as every other protection file.
+    p.opencodePluginPath
   ];
 }
 function lockProtected() {
@@ -6331,6 +6337,7 @@ function globalPaths() {
   const claudeDir = join4(home, ".claude");
   const antigravityDir = join4(home, ".gemini", "config");
   const codexDir = process.env["CODEX_HOME"] ? resolve3(process.env["CODEX_HOME"]) : join4(home, ".codex");
+  const opencodeDir = join4(process.env["XDG_CONFIG_HOME"] ? resolve3(process.env["XDG_CONFIG_HOME"]) : join4(home, ".config"), "opencode");
   return {
     home,
     sgDir,
@@ -6338,6 +6345,7 @@ function globalPaths() {
     claudeDir,
     antigravityDir,
     codexDir,
+    opencodeDir,
     settingsPath: join4(claudeDir, "settings.json"),
     backupPath: join4(claudeDir, "settings.solongate.bak"),
     configPath: join4(sgDir, "cloud-guard.json"),
@@ -6351,7 +6359,14 @@ function globalPaths() {
     // the user's TOML, which also holds the hook TRUST state Codex manages).
     codexHooksPath: join4(codexDir, "hooks.json"),
     codexBackupPath: join4(codexDir, "hooks.solongate.bak"),
-    codexConfigPath: join4(codexDir, "config.toml")
+    codexConfigPath: join4(codexDir, "config.toml"),
+    // OpenCode scans its plugin folder at startup and loads every module in it.
+    // Measured on 1.18.10: BOTH `plugin/` and `plugins/` are scanned, so the
+    // docs and the field reports are each half right. We write the documented
+    // one. There is nothing to register anywhere — dropping the file IS the
+    // installation, which also means deleting the file IS the uninstall.
+    opencodePluginDir: join4(opencodeDir, "plugins"),
+    opencodePluginPath: join4(opencodeDir, "plugins", "solongate.js")
   };
 }
 function clearGuardUpdateCheck() {
@@ -6548,6 +6563,47 @@ function codexHooksStatus() {
   }
   return { registered, trusted, disabled };
 }
+function installOpencodeGuard(p) {
+  mkdirSync3(p.opencodePluginDir, { recursive: true });
+  const src = readHook("opencode-plugin.mjs").replace("__SOLONGATE_NODE__", process.execPath.replace(/\\/g, "\\\\"));
+  writeProtectedFile(p.opencodePluginPath, src);
+}
+function removeOpencodeGuard(p) {
+  try {
+    unlockFile(p.opencodePluginPath);
+    rmSync2(p.opencodePluginPath, { force: true });
+  } catch {
+  }
+}
+function warmPolicyCache(hooksDir, agents) {
+  for (const agent of agents) {
+    try {
+      const child = spawn(process.execPath, [join4(hooksDir, "guard.mjs"), agent, "--sg-refresh-policy"], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
+    }
+  }
+}
+function isOpencodeGuardInstalled() {
+  try {
+    return readFileSync4(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
+  } catch {
+    return false;
+  }
+}
+function opencodeDetected() {
+  try {
+    return existsSync3(globalPaths().opencodeDir);
+  } catch {
+    return false;
+  }
+}
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   return new Promise((res) => rl.question(question, (a) => {
@@ -6564,6 +6620,10 @@ function runGlobalRestore() {
     removeCodexGuard(p);
   } catch {
   }
+  try {
+    removeOpencodeGuard(p);
+  } catch {
+  }
   if (existsSync3(p.backupPath)) {
     writeFileSync3(p.settingsPath, readFileSync4(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
@@ -6590,7 +6650,8 @@ function repairQuiet() {
     line("cloud credential", has(p.configPath), "present", "MISSING"),
     line("Claude Code settings", isGuardInstalled(), "guard registered", "guard NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
-    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered")
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered"),
+    line("OpenCode plugin", isOpencodeGuardInstalled(), "installed", "MISSING")
   ];
   const r = installGlobalQuiet();
   if (!r.ok) return { ok: false, message: r.message, before, after: [], notes: [] };
@@ -6598,7 +6659,8 @@ function repairQuiet() {
     { label: "guard hook file", ok: true, detail: `present (v${installedGuardVersion() ?? "?"})` },
     line("Claude Code settings", isGuardInstalled(), "guard registered", "NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
-    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered")
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered"),
+    line("OpenCode plugin", isOpencodeGuardInstalled(), "installed", "MISSING")
   ];
   const notes = [];
   const cx = codexHooksStatus();
@@ -6701,6 +6763,11 @@ function installGlobalQuiet() {
       installCodexGuard(p, p.hooksDir);
     } catch {
     }
+    try {
+      installOpencodeGuard(p);
+    } catch {
+    }
+    warmPolicyCache(p.hooksDir, ["claude-code", "codex", "antigravity", "opencode"]);
     if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") lockProtected();
     return { ok: true, message: "guard installed (open a new session)" };
   } catch (e) {
@@ -6748,6 +6815,10 @@ function uninstallGlobalQuiet() {
       removeCodexGuard(p);
     } catch {
     }
+    try {
+      removeOpencodeGuard(p);
+    } catch {
+    }
     if (!existsSync3(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
     const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
     delete s.hooks;
@@ -6908,6 +6979,13 @@ async function runGlobalInstall(opts = {}) {
     }
   } catch {
   }
+  try {
+    installOpencodeGuard(p);
+    console.log(`  Installed OpenCode plugin \u2192 ${p.opencodePluginPath}`);
+    console.log("  OpenCode: `opencode --pure` runs without external plugins and");
+    console.log("            therefore without the guard. That is its own escape hatch.");
+  } catch {
+  }
   if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") {
     lockProtected();
     console.log("  Locked protection files (OS-level read-only/immutable).");
@@ -6949,7 +7027,7 @@ __export(self_update_exports, {
   tuiUpdateFlow: () => tuiUpdateFlow,
   updateNow: () => updateNow
 });
-import { execFile, execFileSync as execFileSync3, spawn } from "child_process";
+import { execFile, execFileSync as execFileSync3, spawn as spawn2 } from "child_process";
 import { access, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4, constants as FS } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname2, join as join5, sep } from "path";
@@ -7023,7 +7101,7 @@ function spawnGlobalInstall(version) {
   try {
     mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
     const log3 = openSync(LOG_FILE, "a");
-    const p = spawn("npm", ["install", "-g", `${PKG}@${version}`], {
+    const p = spawn2("npm", ["install", "-g", `${PKG}@${version}`], {
       stdio: ["ignore", log3, log3],
       detached: true,
       windowsHide: true,
@@ -7297,7 +7375,7 @@ __export(logs_server_daemon_exports, {
   startLogsServerDaemon: () => startLogsServerDaemon,
   stopLogsServerDaemon: () => stopLogsServerDaemon
 });
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir4 } from "os";
 import { dirname as dirname3, join as join6 } from "path";
@@ -7344,7 +7422,7 @@ function startLogsServerDaemon() {
     mkdirSync5(DIR, { recursive: true });
     const log3 = openSync2(LOG_FILE2, "a");
     const cli = join6(dirname3(fileURLToPath3(import.meta.url)), "index.js");
-    const p = spawn2(process.execPath, [cli, "logs-server"], {
+    const p = spawn3(process.execPath, [cli, "logs-server"], {
       detached: true,
       stdio: ["ignore", log3, log3],
       windowsHide: true,
@@ -7995,12 +8073,12 @@ var init_types = __esm({
 });
 
 // src/api-client/device-login.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 function openBrowser(url) {
   try {
     const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
     const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
-    const child = spawn3(cmd, args, { stdio: "ignore", detached: true });
+    const child = spawn4(cmd, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -8353,24 +8431,24 @@ var init_api_client = __esm({
 });
 
 // src/tui/notify.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 function desktopNotify(title, msg) {
   try {
     if (process.platform === "linux") {
-      const p = spawn4("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
+      const p = spawn5("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
       p.on("error", () => {
       });
       p.unref();
     } else if (process.platform === "win32") {
       const q = (s) => s.replace(/'/g, "''");
       const ps = `Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;$n.ShowBalloonTip(6000,'${q(title)}','${q(msg)}',[System.Windows.Forms.ToolTipIcon]::Warning);Start-Sleep -Milliseconds 6500;$n.Dispose()`;
-      const p = spawn4("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true });
+      const p = spawn5("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true });
       p.on("error", () => {
       });
       p.unref();
     } else if (process.platform === "darwin") {
       const esc = (s) => s.replace(/"/g, '\\"');
-      const p = spawn4("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });
+      const p = spawn5("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });
       p.on("error", () => {
       });
       p.unref();

package/dist/tui/index.js

@@ -14,7 +14,7 @@ import { resolve, join as join3, dirname } from "path";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
-import { execFileSync } from "child_process";
+import { execFileSync, spawn } from "child_process";
 function lockFile(file) {
   if (!existsSync2(file)) return;
   try {
@@ -97,7 +97,11 @@ function protectedTargets() {
     p.configPath,
     p.settingsPath,
     p.antigravityHooksPath,
-    p.codexHooksPath
+    p.codexHooksPath,
+    // The OpenCode plugin IS the registration — delete it and the guard is gone
+    // from that client with nothing left to notice the absence, so it belongs
+    // under the same OS lock as every other protection file.
+    p.opencodePluginPath
   ];
 }
 function lockProtected() {
@@ -129,6 +133,7 @@ function globalPaths() {
   const claudeDir = join3(home, ".claude");
   const antigravityDir = join3(home, ".gemini", "config");
   const codexDir = process.env["CODEX_HOME"] ? resolve(process.env["CODEX_HOME"]) : join3(home, ".codex");
+  const opencodeDir = join3(process.env["XDG_CONFIG_HOME"] ? resolve(process.env["XDG_CONFIG_HOME"]) : join3(home, ".config"), "opencode");
   return {
     home,
     sgDir,
@@ -136,6 +141,7 @@ function globalPaths() {
     claudeDir,
     antigravityDir,
     codexDir,
+    opencodeDir,
     settingsPath: join3(claudeDir, "settings.json"),
     backupPath: join3(claudeDir, "settings.solongate.bak"),
     configPath: join3(sgDir, "cloud-guard.json"),
@@ -149,7 +155,14 @@ function globalPaths() {
     // the user's TOML, which also holds the hook TRUST state Codex manages).
     codexHooksPath: join3(codexDir, "hooks.json"),
     codexBackupPath: join3(codexDir, "hooks.solongate.bak"),
-    codexConfigPath: join3(codexDir, "config.toml")
+    codexConfigPath: join3(codexDir, "config.toml"),
+    // OpenCode scans its plugin folder at startup and loads every module in it.
+    // Measured on 1.18.10: BOTH `plugin/` and `plugins/` are scanned, so the
+    // docs and the field reports are each half right. We write the documented
+    // one. There is nothing to register anywhere — dropping the file IS the
+    // installation, which also means deleting the file IS the uninstall.
+    opencodePluginDir: join3(opencodeDir, "plugins"),
+    opencodePluginPath: join3(opencodeDir, "plugins", "solongate.js")
   };
 }
 function readHook(filename) {
@@ -338,6 +351,40 @@ function codexHooksStatus() {
   }
   return { registered, trusted, disabled };
 }
+function installOpencodeGuard(p) {
+  mkdirSync(p.opencodePluginDir, { recursive: true });
+  const src = readHook("opencode-plugin.mjs").replace("__SOLONGATE_NODE__", process.execPath.replace(/\\/g, "\\\\"));
+  writeProtectedFile(p.opencodePluginPath, src);
+}
+function removeOpencodeGuard(p) {
+  try {
+    unlockFile(p.opencodePluginPath);
+    rmSync(p.opencodePluginPath, { force: true });
+  } catch {
+  }
+}
+function warmPolicyCache(hooksDir, agents) {
+  for (const agent of agents) {
+    try {
+      const child = spawn(process.execPath, [join3(hooksDir, "guard.mjs"), agent, "--sg-refresh-policy"], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
+    }
+  }
+}
+function isOpencodeGuardInstalled() {
+  try {
+    return readFileSync3(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
+  } catch {
+    return false;
+  }
+}
 function repairQuiet() {
   const p = globalPaths();
   const has = (f) => existsSync2(f);
@@ -348,7 +395,8 @@ function repairQuiet() {
     line("cloud credential", has(p.configPath), "present", "MISSING"),
     line("Claude Code settings", isGuardInstalled(), "guard registered", "guard NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
-    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered")
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered"),
+    line("OpenCode plugin", isOpencodeGuardInstalled(), "installed", "MISSING")
   ];
   const r = installGlobalQuiet();
   if (!r.ok) return { ok: false, message: r.message, before, after: [], notes: [] };
@@ -356,7 +404,8 @@ function repairQuiet() {
     { label: "guard hook file", ok: true, detail: `present (v${installedGuardVersion() ?? "?"})` },
     line("Claude Code settings", isGuardInstalled(), "guard registered", "NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
-    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered")
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered"),
+    line("OpenCode plugin", isOpencodeGuardInstalled(), "installed", "MISSING")
   ];
   const notes = [];
   const cx = codexHooksStatus();
@@ -425,6 +474,11 @@ function installGlobalQuiet() {
       installCodexGuard(p, p.hooksDir);
     } catch {
     }
+    try {
+      installOpencodeGuard(p);
+    } catch {
+    }
+    warmPolicyCache(p.hooksDir, ["claude-code", "codex", "antigravity", "opencode"]);
     if (process.env["SOLONGATE_NO_OS_LOCK"] !== "1") lockProtected();
     return { ok: true, message: "guard installed (open a new session)" };
   } catch (e) {
@@ -472,6 +526,10 @@ function uninstallGlobalQuiet() {
       removeCodexGuard(p);
     } catch {
     }
+    try {
+      removeOpencodeGuard(p);
+    } catch {
+    }
     if (!existsSync2(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
     const s = JSON.parse(readFileSync3(p.settingsPath, "utf-8"));
     delete s.hooks;
@@ -1146,12 +1204,12 @@ async function request(method, path, opts = {}) {
 }
 
 // src/api-client/device-login.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 function openBrowser(url) {
   try {
     const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
     const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    const child = spawn2(cmd, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -1433,24 +1491,24 @@ function list4() {
 var api = { auth: auth_exports, policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports, keys: keys_exports, mcp: mcp_exports };
 
 // src/tui/notify.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 function desktopNotify(title, msg) {
   try {
     if (process.platform === "linux") {
-      const p = spawn2("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
+      const p = spawn3("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
       p.on("error", () => {
       });
       p.unref();
     } else if (process.platform === "win32") {
       const q = (s) => s.replace(/'/g, "''");
       const ps = `Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;$n.ShowBalloonTip(6000,'${q(title)}','${q(msg)}',[System.Windows.Forms.ToolTipIcon]::Warning);Start-Sleep -Milliseconds 6500;$n.Dispose()`;
-      const p = spawn2("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true });
+      const p = spawn3("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true });
       p.on("error", () => {
       });
       p.unref();
     } else if (process.platform === "darwin") {
       const esc = (s) => s.replace(/"/g, '\\"');
-      const p = spawn2("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });
+      const p = spawn3("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });
       p.on("error", () => {
       });
       p.unref();
@@ -4446,7 +4504,7 @@ async function collectChecks() {
 }
 
 // src/logs-server-daemon.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir8 } from "os";
 import { dirname as dirname2, join as join8 } from "path";
@@ -4494,7 +4552,7 @@ function startLogsServerDaemon() {
     mkdirSync5(DIR, { recursive: true });
     const log = openSync2(LOG_FILE, "a");
     const cli = join8(dirname2(fileURLToPath2(import.meta.url)), "index.js");
-    const p = spawn3(process.execPath, [cli, "logs-server"], {
+    const p = spawn4(process.execPath, [cli, "logs-server"], {
       detached: true,
       stdio: ["ignore", log, log],
       windowsHide: true,
@@ -4524,7 +4582,7 @@ function stopLogsServerDaemon() {
 }
 
 // src/self-update.ts
-import { execFile, execFileSync as execFileSync2, spawn as spawn4 } from "child_process";
+import { execFile, execFileSync as execFileSync2, spawn as spawn5 } from "child_process";
 import { access, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync7, constants as FS } from "fs";
 import { homedir as homedir9 } from "os";
 import { dirname as dirname3, join as join9, sep } from "path";

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 75;
+var HOOK_VERSION = 76;
 function localLogsOnly(security) {
   if (security !== void 0) {
     const l = security && security.localLogs;
@@ -6925,6 +6925,20 @@ var CLIENTS = {
     redactsOutput: false
     // has a post-tool stage, but it rejects output rewrites
   },
+  // OpenCode: no subprocess hook contract at all — a plugin runs in-process and
+  // refuses a call by throwing. The shim that does the throwing (see
+  // hooks/opencode-plugin.mjs) spawns this guard with a flat Claude-shaped
+  // payload and reads the Claude dialect back, so both halves are reused as-is
+  // and only the identity differs.
+  opencode: {
+    parse: parseFlatPayload,
+    emit: emitHookSpecific,
+    // tool.execute.after does hand the plugin the tool's result, but whether
+    // writing to it changes what the model sees is untested. Claiming the
+    // capability we have not proven would let a secret through masked-in-name-
+    // only; false makes any masking we cannot apply a block instead.
+    redactsOutput: false
+  },
   // Antigravity CLI: nested payload, and a decision dialect of its own.
   antigravity: {
     redactsOutput: false,

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 75;
+const HOOK_VERSION = 76;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log — local and cloud are one or the
@@ -617,6 +617,21 @@ const CLIENTS = {
     redactsOutput: false, // has a post-tool stage, but it rejects output rewrites
   },
 
+  // OpenCode: no subprocess hook contract at all — a plugin runs in-process and
+  // refuses a call by throwing. The shim that does the throwing (see
+  // hooks/opencode-plugin.mjs) spawns this guard with a flat Claude-shaped
+  // payload and reads the Claude dialect back, so both halves are reused as-is
+  // and only the identity differs.
+  opencode: {
+    parse: parseFlatPayload,
+    emit: emitHookSpecific,
+    // tool.execute.after does hand the plugin the tool's result, but whether
+    // writing to it changes what the model sees is untested. Claiming the
+    // capability we have not proven would let a secret through masked-in-name-
+    // only; false makes any masking we cannot apply a block instead.
+    redactsOutput: false,
+  },
+
   // Antigravity CLI: nested payload, and a decision dialect of its own.
   antigravity: {
     redactsOutput: false, // no post-tool stage at all (its output is ignored)

package/hooks/opencode-plugin.mjs

@@ -0,0 +1,151 @@
+/**
+ * SolonGate plugin for OpenCode.
+ *
+ * OpenCode is the odd one out among the guarded clients: it has no subprocess
+ * hook contract. Plugins are JavaScript modules Bun loads INTO the running
+ * process, and a tool call is refused by throwing from `tool.execute.before`.
+ *
+ * So this file is a shim, not an engine. It spawns the same guard every other
+ * client runs and turns its answer into the shape OpenCode wants — which keeps
+ * one implementation of policy, DLP, rate limiting, ghost paths and auditing
+ * instead of a second one that drifts.
+ *
+ * Measured against opencode 1.18.10, because none of this is documented:
+ *   tool.execute.before(input, output)
+ *     input  = { tool, sessionID, callID }
+ *     output = { args }                      ← mutable, so a rewrite lands here
+ *     throwing blocks the call, and the Error message is handed to the model as
+ *     the tool result (it reads it and reports it, so the reason is visible)
+ *   tool.execute.after(input, output)
+ *     input  = { tool, sessionID, callID, args }
+ *     output = { title, metadata, output, attachments }
+ *
+ * Verified on the same version: subagent calls spawned through the `task` tool
+ * DO reach this hook (in their own sessionID), and so do MCP tool calls (named
+ * `<server>_<tool>`). Both were once bypasses; both are closed.
+ *
+ * Not covered, and it cannot be: `opencode --pure` runs with external plugins
+ * disabled, which switches the guard off. That is the client's design and there
+ * is no hook that survives it.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOOKS_DIR = join(homedir(), '.solongate', 'hooks');
+const GUARD = join(HOOKS_DIR, 'guard.mjs');
+const AUDIT = join(HOOKS_DIR, 'audit.mjs');
+
+// The node binary, written in by the installer.
+//
+// NOT process.execPath: OpenCode runs plugins inside its own Bun-based binary,
+// so in here process.execPath is `.../opencode-ai/bin/opencode.exe`. Spawning
+// THAT with the guard as an argument does not run the guard — it re-runs
+// opencode with nonsense arguments, which exits non-2, which this shim reads as
+// "allowed". The result was a guard that never guarded and never said so.
+// Measured: execPath=/…/opencode-ai/bin/opencode.exe, versions.bun=1.3.14.
+const NODE_BAKED = '__SOLONGATE_NODE__';
+const NODE = NODE_BAKED.startsWith('__SOLONGATE') || !existsSync(NODE_BAKED) ? 'node' : NODE_BAKED;
+
+// The guard carries its own 8s backstop; this is the outer bound for the whole
+// round trip so a wedged process can never hang the editor.
+const GUARD_TIMEOUT_MS = 15000;
+
+/**
+ * Run a hook with a JSON payload on stdin. Resolves to {code, stdout, stderr},
+ * or null when the hook could not be run at all.
+ */
+function runHook(script, payload, timeoutMs) {
+  return new Promise((resolve) => {
+    if (!existsSync(script)) return resolve(null);
+    let done = false;
+    const finish = (v) => { if (!done) { done = true; resolve(v); } };
+    let child;
+    try {
+      child = spawn(NODE, [script, 'opencode', 'OpenCode'], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        windowsHide: true,
+      });
+    } catch {
+      return finish(null);
+    }
+    let stdout = '', stderr = '';
+    child.stdout.on('data', (d) => { stdout += d; });
+    child.stderr.on('data', (d) => { stderr += d; });
+    child.on('error', () => finish(null));
+    child.on('close', (code) => finish({ code, stdout, stderr }));
+    const timer = setTimeout(() => { try { child.kill('SIGKILL'); } catch {} finish(null); }, timeoutMs);
+    if (typeof timer.unref === 'function') timer.unref();
+    try { child.stdin.end(JSON.stringify(payload)); } catch { finish(null); }
+  });
+}
+
+/** The deny reason, preferring the structured field over the stderr line. */
+function denyReason(res) {
+  try {
+    const j = JSON.parse(res.stdout);
+    const r = j?.hookSpecificOutput?.permissionDecisionReason;
+    if (typeof r === 'string' && r.trim()) return r.trim();
+  } catch { /* not JSON — fall back to stderr */ }
+  const line = String(res.stderr || '').split('\n').map((s) => s.trim()).filter(Boolean).pop();
+  return line || 'Blocked by SolonGate.';
+}
+
+/** A rewrite instruction, when the guard asked for one (ghost-path listings). */
+function rewritePatch(res) {
+  try {
+    const j = JSON.parse(res.stdout);
+    const h = j?.hookSpecificOutput;
+    if (h?.permissionDecision === 'allow' && h.updatedInput && typeof h.updatedInput === 'object') {
+      return h.updatedInput;
+    }
+  } catch { /* no patch */ }
+  return null;
+}
+
+export const SolonGate = async ({ directory, worktree } = {}) => {
+  const cwd = directory || worktree || process.cwd();
+
+  return {
+    'tool.execute.before': async (input, output) => {
+      const res = await runHook(GUARD, {
+        tool_name: input?.tool ?? '',
+        tool_input: output?.args ?? {},
+        session_id: input?.sessionID ?? '',
+        tool_use_id: input?.callID ?? '',
+        cwd,
+      }, GUARD_TIMEOUT_MS);
+
+      // The guard could not run (not installed, spawn refused, wedged). Fail
+      // OPEN, the same way every enforcement layer inside it does: a guard that
+      // cannot answer must not become an editor that cannot work.
+      if (!res) return;
+
+      if (res.code === 2) {
+        throw new Error(denyReason(res));
+      }
+
+      // Allow-with-rewrite: `output.args` is what actually runs, so replacing it
+      // here is how a hidden path gets filtered out of a listing before the
+      // model ever sees the result.
+      const patch = rewritePatch(res);
+      if (patch && output && typeof output === 'object') {
+        try { Object.assign(output.args, patch); } catch { /* leave the call as it was */ }
+      }
+    },
+
+    'tool.execute.after': async (input, output) => {
+      // The ALLOW-path audit record. Fire and forget: it must never delay the
+      // editor, and losing one line is better than a stalled tool.
+      void runHook(AUDIT, {
+        tool_name: input?.tool ?? '',
+        tool_input: input?.args ?? {},
+        tool_response: output?.output ?? output?.metadata ?? {},
+        session_id: input?.sessionID ?? '',
+        tool_use_id: input?.callID ?? '',
+        cwd,
+      }, GUARD_TIMEOUT_MS);
+    },
+  };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.10",
+  "version": "0.83.11",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {