@solongate/proxy 0.83.18 → 0.83.19

package/hooks/audit.mjs

@@ -40,7 +40,7 @@ function projectFlagDir() {
 // Bump on every audit hook change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 27;
+const HOOK_VERSION = 28;
 
 function loadEnvKey(dir) {
   try {
@@ -724,13 +724,6 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
         : v;
     }
 
-    // Write flag so stop.mjs knows tool calls happened (skip text-only ALLOW)
-    try {
-      const flagDir = projectFlagDir();
-      mkdirSync(flagDir, { recursive: true });
-      writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
-    } catch {}
-
     // Codex CANNOT rewrite tool output from PostToolUse: its output struct is
     // deny_unknown_fields and the only rewrite field it defines
     // (updatedMCPToolOutput) is explicitly rejected as unsupported — so emitting

package/hooks/guard.bundled.mjs

@@ -6578,7 +6578,7 @@ function sweepLegacyFlagDir() {
   } catch {
   }
 }
-var HOOK_VERSION = 78;
+var HOOK_VERSION = 79;
 function localLogsOnly(security) {
   if (security !== void 0) {
     const l = security && security.localLogs;
@@ -7096,7 +7096,6 @@ function writeDenyFlag(toolName) {
   try {
     const flagDir = projectFlagDir();
     mkdirSync(flagDir, { recursive: true });
-    writeFileSync(join(flagDir, ".last-tool-call"), Date.now().toString());
     writeFileSync(join(flagDir, ".last-deny"), JSON.stringify({
       tool: toolName,
       ts: Date.now(),

package/hooks/guard.mjs

@@ -81,7 +81,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 78;
+const HOOK_VERSION = 79;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log — local and cloud are one or the
@@ -826,12 +826,12 @@ function callFingerprint(s) {
   return h.toString(16);
 }
 
-// Write flag file so stop.mjs knows a tool call (DENY) happened and doesn't log extra ALLOW
+// Records WHICH call was denied, so the PostToolUse audit hook does not log a
+// second, ALLOW-looking entry for a call the guard already blocked.
 function writeDenyFlag(toolName) {
   try {
     const flagDir = projectFlagDir();
     mkdirSync(flagDir, { recursive: true });
-    writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
     // Deny-specific flag: audit.mjs (PostToolUse) reads it to avoid logging a
     // second, ALLOW-looking entry for a call the guard already denied.
     //

package/hooks/stop.mjs

@@ -1,91 +1,22 @@
 #!/usr/bin/env node
 /**
- * SolonGate Stop Hook (Stop event)
- * Logs a single ALLOW when Claude responds WITHOUT any tool calls.
- * If tool calls were made, audit.mjs already logged them — this hook skips.
- * Auto-installed by: npx @solongate/proxy login
+ * SolonGate Stop Hook (Stop event) — intentionally does nothing.
+ *
+ * It used to POST one synthetic audit row named `_response` whenever a turn
+ * ended with no tool calls, to record "the agent replied with text only". That
+ * was wrong twice over:
+ *
+ *   - `_response` is not a tool, and it sat in the TOOL CALL log. It showed up
+ *     as a row in the live stream and as an entry in the dashboard's top-tools
+ *     list, and it inflated the call count with something no policy can act on.
+ *   - it decided whether to write by looking for a flag file left by the audit
+ *     hook, so any drift in where that flag lived turned "text-only turn" into
+ *     "every turn" — which is exactly what happened when the per-call scratch
+ *     moved out of the working directory.
+ *
+ * The registration is kept (it costs one process exit per turn and removing it
+ * would need every client's hook config rewritten), but nothing is logged. If a
+ * text-only turn is ever worth recording, it belongs in its own place, not in
+ * the record of what the agent was allowed to run.
  */
-import { readFileSync, existsSync, unlinkSync, writeFileSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { homedir } from 'node:os';
-
-function loadEnvKey(dir) {
-  try {
-    const envPath = resolve(dir, '.env');
-    if (!existsSync(envPath)) return {};
-    const lines = readFileSync(envPath, 'utf-8').split('\n');
-    const env = {};
-    for (const line of lines) {
-      const m = line.match(/^([A-Z_]+)=(.*)$/);
-      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
-    }
-    return env;
-  } catch { return {}; }
-}
-
-// Global cloud config written at login (~/.solongate/cloud-guard.json). This hook
-// used to read ONLY the environment and a project env file, so on a normally
-// paired device it silently logged nothing — and where an env file did exist, a
-// stale key in it shadowed the login. Same order as the other hooks now:
-// process env -> login -> project env file.
-function loadGlobalCloudConfig() {
-  try {
-    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
-    if (!existsSync(p)) return {};
-    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
-    return (cfg && typeof cfg === 'object') ? cfg : {};
-  } catch { return {}; }
-}
-
-const dotenv = loadEnvKey(process.cwd());
-const globalCfg = loadGlobalCloudConfig();
-const API_KEY = process.env.SOLONGATE_API_KEY || globalCfg.apiKey || dotenv.SOLONGATE_API_KEY || '';
-const API_URL = process.env.SOLONGATE_API_URL || globalCfg.apiUrl || dotenv.SOLONGATE_API_URL || 'https://api.solongate.com';
-
-// Agent identity from CLI args: node stop.mjs <agent_id> <agent_name>
-const AGENT_ID = process.argv[2] || 'claude-code';
-const AGENT_NAME = process.argv[3] || 'Claude Code';
-
-if (!API_KEY || !API_KEY.startsWith('sg_live_')) process.exit(0);
-
-// Flag file: audit.mjs writes this when a tool call was logged in this turn.
-// If the flag exists, tool calls were made → skip (already logged).
-// If the flag doesn't exist, no tool calls → log 1 ALLOW for the text response.
-const flagDir = resolve('.solongate');
-const flagFile = join(flagDir, '.last-tool-call');
-
-let input = '';
-process.stdin.on('data', c => input += c);
-process.stdin.on('end', async () => {
-  try {
-    // Check if tool calls were made in this turn
-    if (existsSync(flagFile)) {
-      // Tool calls happened → audit.mjs already logged them. Clean up flag.
-      try { unlinkSync(flagFile); } catch {}
-      process.exit(0);
-    }
-
-    // No tool calls → log 1 ALLOW for the text-only response (fire-and-forget)
-    fetch(`${API_URL}/api/v1/audit-logs`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${API_KEY}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        tool: '_response',
-        arguments: {},
-        decision: 'ALLOW',
-        reason: 'text response (no tool calls)',
-        source: `${AGENT_ID}-hook`,
-        evaluationTimeMs: 0,
-        agent_id: AGENT_ID,
-        agent_name: AGENT_NAME,
-      }),
-      signal: AbortSignal.timeout(5000),
-    }).catch(() => {}).finally(() => process.exit(0));
-    setTimeout(() => process.exit(0), 3000);
-  } catch {
-    process.exit(0);
-  }
-});
+process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.18",
+  "version": "0.83.19",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {