@solongate/proxy 0.83.17 → 0.83.19

package/dist/index.js

@@ -8726,6 +8726,7 @@ function LivePanel({ active: active2 }) {
     const setting = localLogsSetting();
     setLocalOn(setting.enabled);
     setLocalPath(setting);
+    if (!setting.enabled) return;
     const lines = tailLines(setting.file);
     if (!lines.length) return;
     const fresh = [];
@@ -8988,9 +8989,7 @@ function LivePanel({ active: active2 }) {
     }))
   ];
   sessRef.current = combinedSess;
-  const localSessIds = new Set(localSess.keys());
-  if (ring?.session) localSessIds.add(ring.session);
-  const isLoc = (e) => e.source === "local" || !!e.session && localSessIds.has(e.session);
+  const isLoc = (e) => e.source === "local";
   const q = search.trim().toLowerCase();
   const matches = (e) => !q || `${e.tool} ${e.agent ?? ""} ${e.decision} ${e.permission} ${e.rule ?? ""} ${e.detail}`.toLowerCase().includes(q);
   const signalOk = (e) => signal === "none" ? true : signal === "deny" ? e.decision !== "ALLOW" : signal === "dlp" ? e.dlp : e.burst;
@@ -9557,14 +9556,14 @@ function LivePanel({ active: active2 }) {
         filter === "all" ? /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
           spin,
           " awaiting traffic\u2026"
-        ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${spin} no ${filter === "local" ? "LOC (this machine)" : "CLD (other devices)"} calls in the buffer \xB7 f switches origin` })
+        ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${spin} no ${filter === "local" ? "LOC (local log)" : "CLD (cloud)"} calls in the buffer \xB7 f switches source` })
       ) : null,
       windowed.map((e, i) => /* @__PURE__ */ jsx2(StreamLine, { e, loc: isLoc(e), selected: clampedScroll + i === selClamped }, e.id))
     ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "white", bold: true, children: " LIVE " }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "white", children: ` local-log ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld \xB7 origin ${filter === "all" ? "all" : filter === "local" ? "LOC only" : "CLD only"} \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "white", children: ` \u2191\u2193 select \xB7 enter full entry \xB7 f origin \xB7 / search \xB7 space copy \xB7 ? all keys \xB7 esc menu \xB7 q quit ` })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "white", children: ` local-log ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld \xB7 source ${filter === "all" ? "all" : filter === "local" ? "LOC only" : "CLD only"} \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "white", children: ` \u2191\u2193 select \xB7 enter full entry \xB7 f source \xB7 / search \xB7 space copy \xB7 ? all keys \xB7 esc menu \xB7 q quit ` })
     ] })
   ] });
 }
@@ -9613,7 +9612,7 @@ var init_Live = __esm({
           ["w", "whitelist the selected DENY (adds ALLOW rule)"],
           ["b", "block the selected ALLOW (adds DENY rule)"],
           ["d / x / r", "filter: denies / dlp hits / rate-limit bursts"],
-          ["f", "origin: all \u2192 LOC (this machine) \u2192 CLD (other devices)"],
+          ["f", "source: all \u2192 LOC (this machine's local log) \u2192 CLD (cloud)"],
           ["/", "live search (tool, agent, command\u2026) \xB7 enter done"],
           ["s", "session picker"],
           ["l", "layers detail (rate limit \xB7 dlp \xB7 ghost \xB7 guard)"],

package/dist/tui/components.d.ts

@@ -11,11 +11,10 @@ export declare function PaneTitle({ label, extra, width }: {
 }): JSX.Element;
 /**
  * One tool-stream row, shared verbatim by Live (rolling buffer) and Audit (full
- * history). `loc` tags where the call HAPPENED: LOC (this machine) vs CLD
- * (another paired device). Note this is ORIGIN, not storage — a call made here
- * reads LOC even when local logging is off and the record went to the cloud.
- * The storage setting is spelled `local-log` in the footer so the two are not
- * the same word. `selected` highlights + shows the ▸ cursor.
+ * history). `loc` tags where the record IS: LOC (a line in this machine's
+ * local log) vs CLD (the cloud audit log). With local storage off nothing is
+ * LOC, which is the whole point of the setting. `selected` highlights + shows
+ * the ▸ cursor.
  * Columns are fixed-width and NEVER conditional so scrolling can't reshuffle the
  * line and glitch the frame.
  */

package/dist/tui/index.js

@@ -1746,7 +1746,7 @@ var LIVE_HELP = [
       ["w", "whitelist the selected DENY (adds ALLOW rule)"],
       ["b", "block the selected ALLOW (adds DENY rule)"],
       ["d / x / r", "filter: denies / dlp hits / rate-limit bursts"],
-      ["f", "origin: all \u2192 LOC (this machine) \u2192 CLD (other devices)"],
+      ["f", "source: all \u2192 LOC (this machine's local log) \u2192 CLD (cloud)"],
       ["/", "live search (tool, agent, command\u2026) \xB7 enter done"],
       ["s", "session picker"],
       ["l", "layers detail (rate limit \xB7 dlp \xB7 ghost \xB7 guard)"],
@@ -1841,6 +1841,7 @@ function LivePanel({ active: active2 }) {
     const setting = localLogsSetting();
     setLocalOn(setting.enabled);
     setLocalPath(setting);
+    if (!setting.enabled) return;
     const lines = tailLines(setting.file);
     if (!lines.length) return;
     const fresh = [];
@@ -2103,9 +2104,7 @@ function LivePanel({ active: active2 }) {
     }))
   ];
   sessRef.current = combinedSess;
-  const localSessIds = new Set(localSess.keys());
-  if (ring?.session) localSessIds.add(ring.session);
-  const isLoc = (e) => e.source === "local" || !!e.session && localSessIds.has(e.session);
+  const isLoc = (e) => e.source === "local";
   const q = search.trim().toLowerCase();
   const matches = (e) => !q || `${e.tool} ${e.agent ?? ""} ${e.decision} ${e.permission} ${e.rule ?? ""} ${e.detail}`.toLowerCase().includes(q);
   const signalOk = (e) => signal === "none" ? true : signal === "deny" ? e.decision !== "ALLOW" : signal === "dlp" ? e.dlp : e.burst;
@@ -2672,14 +2671,14 @@ function LivePanel({ active: active2 }) {
         filter === "all" ? /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
           spin,
           " awaiting traffic\u2026"
-        ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${spin} no ${filter === "local" ? "LOC (this machine)" : "CLD (other devices)"} calls in the buffer \xB7 f switches origin` })
+        ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${spin} no ${filter === "local" ? "LOC (local log)" : "CLD (cloud)"} calls in the buffer \xB7 f switches source` })
       ) : null,
       windowed.map((e, i) => /* @__PURE__ */ jsx2(StreamLine, { e, loc: isLoc(e), selected: clampedScroll + i === selClamped }, e.id))
     ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "white", bold: true, children: " LIVE " }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "white", children: ` local-log ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld \xB7 origin ${filter === "all" ? "all" : filter === "local" ? "LOC only" : "CLD only"} \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "white", children: ` \u2191\u2193 select \xB7 enter full entry \xB7 f origin \xB7 / search \xB7 space copy \xB7 ? all keys \xB7 esc menu \xB7 q quit ` })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "white", children: ` local-log ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld \xB7 source ${filter === "all" ? "all" : filter === "local" ? "LOC only" : "CLD only"} \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "white", children: ` \u2191\u2193 select \xB7 enter full entry \xB7 f source \xB7 / search \xB7 space copy \xB7 ? all keys \xB7 esc menu \xB7 q quit ` })
     ] })
   ] });
 }

package/hooks/audit.mjs

@@ -40,7 +40,7 @@ function projectFlagDir() {
 // Bump on every audit hook change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 27;
+const HOOK_VERSION = 28;
 
 function loadEnvKey(dir) {
   try {
@@ -724,13 +724,6 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
         : v;
     }
 
-    // Write flag so stop.mjs knows tool calls happened (skip text-only ALLOW)
-    try {
-      const flagDir = projectFlagDir();
-      mkdirSync(flagDir, { recursive: true });
-      writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
-    } catch {}
-
     // Codex CANNOT rewrite tool output from PostToolUse: its output struct is
     // deny_unknown_fields and the only rewrite field it defines
     // (updatedMCPToolOutput) is explicitly rejected as unsupported — so emitting

package/hooks/guard.bundled.mjs

@@ -6578,7 +6578,7 @@ function sweepLegacyFlagDir() {
   } catch {
   }
 }
-var HOOK_VERSION = 78;
+var HOOK_VERSION = 79;
 function localLogsOnly(security) {
   if (security !== void 0) {
     const l = security && security.localLogs;
@@ -7096,7 +7096,6 @@ function writeDenyFlag(toolName) {
   try {
     const flagDir = projectFlagDir();
     mkdirSync(flagDir, { recursive: true });
-    writeFileSync(join(flagDir, ".last-tool-call"), Date.now().toString());
     writeFileSync(join(flagDir, ".last-deny"), JSON.stringify({
       tool: toolName,
       ts: Date.now(),

package/hooks/guard.mjs

@@ -81,7 +81,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 78;
+const HOOK_VERSION = 79;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log — local and cloud are one or the
@@ -826,12 +826,12 @@ function callFingerprint(s) {
   return h.toString(16);
 }
 
-// Write flag file so stop.mjs knows a tool call (DENY) happened and doesn't log extra ALLOW
+// Records WHICH call was denied, so the PostToolUse audit hook does not log a
+// second, ALLOW-looking entry for a call the guard already blocked.
 function writeDenyFlag(toolName) {
   try {
     const flagDir = projectFlagDir();
     mkdirSync(flagDir, { recursive: true });
-    writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
     // Deny-specific flag: audit.mjs (PostToolUse) reads it to avoid logging a
     // second, ALLOW-looking entry for a call the guard already denied.
     //

package/hooks/stop.mjs

@@ -1,91 +1,22 @@
 #!/usr/bin/env node
 /**
- * SolonGate Stop Hook (Stop event)
- * Logs a single ALLOW when Claude responds WITHOUT any tool calls.
- * If tool calls were made, audit.mjs already logged them — this hook skips.
- * Auto-installed by: npx @solongate/proxy login
+ * SolonGate Stop Hook (Stop event) — intentionally does nothing.
+ *
+ * It used to POST one synthetic audit row named `_response` whenever a turn
+ * ended with no tool calls, to record "the agent replied with text only". That
+ * was wrong twice over:
+ *
+ *   - `_response` is not a tool, and it sat in the TOOL CALL log. It showed up
+ *     as a row in the live stream and as an entry in the dashboard's top-tools
+ *     list, and it inflated the call count with something no policy can act on.
+ *   - it decided whether to write by looking for a flag file left by the audit
+ *     hook, so any drift in where that flag lived turned "text-only turn" into
+ *     "every turn" — which is exactly what happened when the per-call scratch
+ *     moved out of the working directory.
+ *
+ * The registration is kept (it costs one process exit per turn and removing it
+ * would need every client's hook config rewritten), but nothing is logged. If a
+ * text-only turn is ever worth recording, it belongs in its own place, not in
+ * the record of what the agent was allowed to run.
  */
-import { readFileSync, existsSync, unlinkSync, writeFileSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { homedir } from 'node:os';
-
-function loadEnvKey(dir) {
-  try {
-    const envPath = resolve(dir, '.env');
-    if (!existsSync(envPath)) return {};
-    const lines = readFileSync(envPath, 'utf-8').split('\n');
-    const env = {};
-    for (const line of lines) {
-      const m = line.match(/^([A-Z_]+)=(.*)$/);
-      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
-    }
-    return env;
-  } catch { return {}; }
-}
-
-// Global cloud config written at login (~/.solongate/cloud-guard.json). This hook
-// used to read ONLY the environment and a project env file, so on a normally
-// paired device it silently logged nothing — and where an env file did exist, a
-// stale key in it shadowed the login. Same order as the other hooks now:
-// process env -> login -> project env file.
-function loadGlobalCloudConfig() {
-  try {
-    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
-    if (!existsSync(p)) return {};
-    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
-    return (cfg && typeof cfg === 'object') ? cfg : {};
-  } catch { return {}; }
-}
-
-const dotenv = loadEnvKey(process.cwd());
-const globalCfg = loadGlobalCloudConfig();
-const API_KEY = process.env.SOLONGATE_API_KEY || globalCfg.apiKey || dotenv.SOLONGATE_API_KEY || '';
-const API_URL = process.env.SOLONGATE_API_URL || globalCfg.apiUrl || dotenv.SOLONGATE_API_URL || 'https://api.solongate.com';
-
-// Agent identity from CLI args: node stop.mjs <agent_id> <agent_name>
-const AGENT_ID = process.argv[2] || 'claude-code';
-const AGENT_NAME = process.argv[3] || 'Claude Code';
-
-if (!API_KEY || !API_KEY.startsWith('sg_live_')) process.exit(0);
-
-// Flag file: audit.mjs writes this when a tool call was logged in this turn.
-// If the flag exists, tool calls were made → skip (already logged).
-// If the flag doesn't exist, no tool calls → log 1 ALLOW for the text response.
-const flagDir = resolve('.solongate');
-const flagFile = join(flagDir, '.last-tool-call');
-
-let input = '';
-process.stdin.on('data', c => input += c);
-process.stdin.on('end', async () => {
-  try {
-    // Check if tool calls were made in this turn
-    if (existsSync(flagFile)) {
-      // Tool calls happened → audit.mjs already logged them. Clean up flag.
-      try { unlinkSync(flagFile); } catch {}
-      process.exit(0);
-    }
-
-    // No tool calls → log 1 ALLOW for the text-only response (fire-and-forget)
-    fetch(`${API_URL}/api/v1/audit-logs`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${API_KEY}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        tool: '_response',
-        arguments: {},
-        decision: 'ALLOW',
-        reason: 'text response (no tool calls)',
-        source: `${AGENT_ID}-hook`,
-        evaluationTimeMs: 0,
-        agent_id: AGENT_ID,
-        agent_name: AGENT_NAME,
-      }),
-      signal: AbortSignal.timeout(5000),
-    }).catch(() => {}).finally(() => process.exit(0));
-    setTimeout(() => process.exit(0), 3000);
-  } catch {
-    process.exit(0);
-  }
-});
+process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.17",
+  "version": "0.83.19",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {