@solongate/proxy 0.83.13 → 0.83.14

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 76;
+var HOOK_VERSION = 77;
 function localLogsOnly(security) {
   if (security !== void 0) {
     const l = security && security.localLogs;
@@ -6714,6 +6714,30 @@ function installedHookVersion(fileName) {
     return 0;
   }
 }
+function registeredClients() {
+  const home = resolve(homedir());
+  const has = (p, needle) => {
+    try {
+      const s = safeReadFileSync(p);
+      if (!s)
+        return false;
+      return needle ? s.includes(needle) : true;
+    } catch {
+      return false;
+    }
+  };
+  const out = [];
+  if (has(join(home, ".claude", "settings.json"), ".solongate"))
+    out.push("claude-code");
+  if (has(join(home, ".gemini", "config", "hooks.json"), ".solongate"))
+    out.push("antigravity");
+  if (has(join(process.env.CODEX_HOME ? resolve(process.env.CODEX_HOME) : join(home, ".codex"), "hooks.json"), ".solongate"))
+    out.push("codex");
+  const xdg = process.env.XDG_CONFIG_HOME ? resolve(process.env.XDG_CONFIG_HOME) : join(home, ".config");
+  if (has(join(xdg, "opencode", "plugins", "solongate.js"), "tool.execute.before"))
+    out.push("opencode");
+  return out;
+}
 var CLOUD_HOOK_VERSIONS = null;
 function hooksBehindCloud() {
   const v = CLOUD_HOOK_VERSIONS;
@@ -6808,7 +6832,10 @@ async function refreshPolicyCache() {
     } catch {
     }
     try {
-      const res = await fetch(API_URL + "/api/v1/policies/active?agent_id=" + encodeURIComponent(AGENT_ID || "") + "&hv=" + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8e3) });
+      const res = await fetch(
+        API_URL + "/api/v1/policies/active?agent_id=" + encodeURIComponent(AGENT_ID || "") + "&hv=" + HOOK_VERSION + "&clients=" + encodeURIComponent(registeredClients().join(",")),
+        { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8e3) }
+      );
       if (res.ok) {
         const body = await res.json();
         if (typeof body?.self_protection_enabled === "boolean")

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 76;
+const HOOK_VERSION = 77;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log — local and cloud are one or the
@@ -313,6 +313,36 @@ function installedHookVersion(fileName) {
   } catch { return 0; }
 }
 
+/**
+ * Which clients the guard is REGISTERED for on this machine.
+ *
+ * The dashboard used to infer this from "whose guard has called in", which
+ * answers a different question than `repair` and `doctor` do — a client that is
+ * installed but has not been opened in days reads as unguarded, and the three
+ * surfaces contradicted each other while using identical wording. The machine
+ * is the only thing that can see its own files, so it reports them.
+ *
+ * Cheap on purpose: four existence/substring checks against files this hook
+ * already treats as tamper targets, run on a poll that is throttled to 10s.
+ */
+function registeredClients() {
+  const home = resolve(homedir());
+  const has = (p, needle) => {
+    try {
+      const s = safeReadFileSync(p);
+      if (!s) return false;
+      return needle ? s.includes(needle) : true;
+    } catch { return false; }
+  };
+  const out = [];
+  if (has(join(home, '.claude', 'settings.json'), '.solongate')) out.push('claude-code');
+  if (has(join(home, '.gemini', 'config', 'hooks.json'), '.solongate')) out.push('antigravity');
+  if (has(join(process.env.CODEX_HOME ? resolve(process.env.CODEX_HOME) : join(home, '.codex'), 'hooks.json'), '.solongate')) out.push('codex');
+  const xdg = process.env.XDG_CONFIG_HOME ? resolve(process.env.XDG_CONFIG_HOME) : join(home, '.config');
+  if (has(join(xdg, 'opencode', 'plugins', 'solongate.js'), 'tool.execute.before')) out.push('opencode');
+  return out;
+}
+
 // Latest hook versions the cloud reports on /policies/active (hook_versions).
 // Captured during the policy fetch of THIS run (or its short-lived cache); lets
 // maybeSelfUpdate() know it is behind and bypass the 6h stamp entirely.
@@ -425,7 +455,12 @@ async function refreshPolicyCache() {
       }
     } catch {}
     try {
-      const res = await fetch(API_URL + '/api/v1/policies/active?agent_id=' + encodeURIComponent(AGENT_ID || '') + '&hv=' + HOOK_VERSION, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) });
+      const res = await fetch(
+        API_URL + '/api/v1/policies/active?agent_id=' + encodeURIComponent(AGENT_ID || '')
+          + '&hv=' + HOOK_VERSION
+          + '&clients=' + encodeURIComponent(registeredClients().join(',')),
+        { headers: AUTH_HEADERS, signal: AbortSignal.timeout(8000) },
+      );
       if (res.ok) {
         const body = await res.json();
         if (typeof body?.self_protection_enabled === 'boolean') selfProtect = body.self_protection_enabled;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.13",
+  "version": "0.83.14",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {