@solongate/proxy 0.83.18 → 0.83.20

package/hooks/audit.mjs

@@ -40,7 +40,7 @@ function projectFlagDir() {
 // Bump on every audit hook change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 27;
+const HOOK_VERSION = 28;
 
 function loadEnvKey(dir) {
   try {
@@ -724,13 +724,6 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
         : v;
     }
 
-    // Write flag so stop.mjs knows tool calls happened (skip text-only ALLOW)
-    try {
-      const flagDir = projectFlagDir();
-      mkdirSync(flagDir, { recursive: true });
-      writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
-    } catch {}
-
     // Codex CANNOT rewrite tool output from PostToolUse: its output struct is
     // deny_unknown_fields and the only rewrite field it defines
     // (updatedMCPToolOutput) is explicitly rejected as unsupported — so emitting

package/hooks/guard.bundled.mjs

@@ -6578,7 +6578,7 @@ function sweepLegacyFlagDir() {
   } catch {
   }
 }
-var HOOK_VERSION = 78;
+var HOOK_VERSION = 80;
 function localLogsOnly(security) {
   if (security !== void 0) {
     const l = security && security.localLogs;
@@ -6606,6 +6606,17 @@ function accountMark() {
     return "";
   }
 }
+function postAuditDetached(entry) {
+  try {
+    const payload = Buffer.from(JSON.stringify({
+      url: API_URL + "/api/v1/audit-logs",
+      headers: AUTH_HEADERS,
+      body: entry
+    }), "utf-8").toString("base64");
+    spawn(process.execPath, [process.argv[1], "--sg-audit-post", payload], { detached: true, stdio: "ignore" }).unref();
+  } catch {
+  }
+}
 function writeLocalLog(security, entry) {
   try {
     const mark = accountMark();
@@ -6818,6 +6829,28 @@ var AGENT_TYPE = process.argv[2] || "claude-code";
 var POLICY_SELECTOR = process.env.SOLONGATE_AGENT_ID || "";
 var AGENT_ID = POLICY_SELECTOR || AGENT_TYPE;
 var AGENT_NAME = process.env.SOLONGATE_AGENT_NAME || process.argv[3] || AGENT_TYPE;
+{
+  const _ai = process.argv.indexOf("--sg-audit-post");
+  if (_ai !== -1) {
+    try {
+      const _raw = Buffer.from(process.argv[_ai + 1] || "", "base64").toString("utf-8");
+      const _p = JSON.parse(_raw);
+      if (_p && _p.url && _p.body) {
+        fetch(_p.url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", ..._p.headers || {} },
+          body: JSON.stringify(_p.body),
+          signal: AbortSignal.timeout(1e4)
+        }).catch(() => {
+        }).finally(() => process.exit(0));
+        setTimeout(() => process.exit(0), 11e3).unref();
+      } else
+        process.exit(0);
+    } catch {
+      process.exit(0);
+    }
+  }
+}
 {
   const _wi = process.argv.indexOf("--sg-log-write");
   if (_wi !== -1) {
@@ -7096,7 +7129,6 @@ function writeDenyFlag(toolName) {
   try {
     const flagDir = projectFlagDir();
     mkdirSync(flagDir, { recursive: true });
-    writeFileSync(join(flagDir, ".last-tool-call"), Date.now().toString());
     writeFileSync(join(flagDir, ".last-deny"), JSON.stringify({
       tool: toolName,
       ts: Date.now(),
@@ -8512,12 +8544,7 @@ if (!REFRESH_MODE) {
           }
           try {
             if (!localLogsOnly(_sec))
-              await fetch(API_URL + "/api/v1/audit-logs", {
-                method: "POST",
-                headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-                body: JSON.stringify(_logEntry),
-                signal: AbortSignal.timeout(3e3)
-              });
+              postAuditDetached(_logEntry);
           } catch {
           }
           if (AGENT_TYPE !== "codex")
@@ -8630,22 +8657,17 @@ if (!REFRESH_MODE) {
           writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), tool: toolName, arguments: args, decision: "DENY", reason: "ghost path (hidden from agent)", permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: call.sessionId, evaluation_time_ms: Date.now() - _evalStart });
           try {
             if (!localLogsOnly(securityCfg))
-              await fetch(API_URL + "/api/v1/audit-logs", {
-                method: "POST",
-                headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-                body: JSON.stringify({
-                  tool: toolName,
-                  arguments: args,
-                  decision: "DENY",
-                  reason: "ghost path (hidden from agent)",
-                  permission: guessPermission(toolName),
-                  source: `${AGENT_TYPE}-guard`,
-                  agent_id: AGENT_TYPE,
-                  agent_name: AGENT_NAME,
-                  session_id: call.sessionId,
-                  evaluation_time_ms: Date.now() - _evalStart
-                }),
-                signal: AbortSignal.timeout(3e3)
+              postAuditDetached({
+                tool: toolName,
+                arguments: args,
+                decision: "DENY",
+                reason: "ghost path (hidden from agent)",
+                permission: guessPermission(toolName),
+                source: `${AGENT_TYPE}-guard`,
+                agent_id: AGENT_TYPE,
+                agent_name: AGENT_NAME,
+                session_id: call.sessionId,
+                evaluation_time_ms: Date.now() - _evalStart
               });
           } catch {
           }
@@ -8729,12 +8751,7 @@ if (!REFRESH_MODE) {
             };
             writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), ...logEntry });
             if (!localLogsOnly(securityCfg))
-              await fetch(API_URL + "/api/v1/audit-logs", {
-                method: "POST",
-                headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-                body: JSON.stringify(logEntry),
-                signal: AbortSignal.timeout(3e3)
-              });
+              postAuditDetached(logEntry);
           } catch {
           }
         }

package/hooks/guard.mjs

@@ -81,7 +81,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 78;
+const HOOK_VERSION = 80;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log — local and cloud are one or the
@@ -170,6 +170,25 @@ function accountMark() {
   }
 }
 
+/**
+ * Record a denial in the cloud WITHOUT making the agent wait for it.
+ *
+ * The verdict is the product; the audit line is bookkeeping. Awaiting the POST
+ * put a full network round trip between "blocked" and the agent hearing it —
+ * measured at 1643ms per denial, against 78ms with the API unreachable. Handing
+ * it to a detached child keeps the record and gives the time back.
+ */
+function postAuditDetached(entry) {
+  try {
+    const payload = Buffer.from(JSON.stringify({
+      url: API_URL + '/api/v1/audit-logs',
+      headers: AUTH_HEADERS,
+      body: entry,
+    }), 'utf-8').toString('base64');
+    spawn(process.execPath, [process.argv[1], '--sg-audit-post', payload], { detached: true, stdio: 'ignore' }).unref();
+  } catch { /* the denial still stands; only the record is at risk */ }
+}
+
 function writeLocalLog(security, entry) {
   try {
     const mark = accountMark();
@@ -460,6 +479,31 @@ const AGENT_NAME = process.env.SOLONGATE_AGENT_NAME || process.argv[3] || AGENT_
 // lands even if Claude Code kills the parent hook mid-write during a concurrent
 // denial burst. Handled FIRST and exits immediately — the child never loads the
 // heavy guard logic below.
+// Survivable CLOUD writer, same idea. A denial used to `await` its audit POST
+// before telling the agent it was blocked, so the agent sat waiting on a network
+// round trip to be told "no": measured at 1643ms per denial against 78ms with
+// the API unreachable. The record still has to land, so it is handed to a
+// detached child rather than dropped — the verdict goes out at once and the POST
+// finishes on its own.
+{
+  const _ai = process.argv.indexOf('--sg-audit-post');
+  if (_ai !== -1) {
+    try {
+      const _raw = Buffer.from(process.argv[_ai + 1] || '', 'base64').toString('utf-8');
+      const _p = JSON.parse(_raw);
+      if (_p && _p.url && _p.body) {
+        fetch(_p.url, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', ...(_p.headers || {}) },
+          body: JSON.stringify(_p.body),
+          signal: AbortSignal.timeout(10000),
+        }).catch(() => {}).finally(() => process.exit(0));
+        setTimeout(() => process.exit(0), 11000).unref();
+      } else process.exit(0);
+    } catch { process.exit(0); }
+  }
+}
+
 {
   const _wi = process.argv.indexOf('--sg-log-write');
   if (_wi !== -1) {
@@ -826,12 +870,12 @@ function callFingerprint(s) {
   return h.toString(16);
 }
 
-// Write flag file so stop.mjs knows a tool call (DENY) happened and doesn't log extra ALLOW
+// Records WHICH call was denied, so the PostToolUse audit hook does not log a
+// second, ALLOW-looking entry for a call the guard already blocked.
 function writeDenyFlag(toolName) {
   try {
     const flagDir = projectFlagDir();
     mkdirSync(flagDir, { recursive: true });
-    writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
     // Deny-specific flag: audit.mjs (PostToolUse) reads it to avoid logging a
     // second, ALLOW-looking entry for a call the guard already denied.
     //
@@ -2523,12 +2567,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         };
         try { writeLocalLog(_sec, { ts: new Date().toISOString(), ..._logEntry }); } catch {}
         try {
-          if (!localLogsOnly(_sec)) await fetch(API_URL + '/api/v1/audit-logs', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
-            body: JSON.stringify(_logEntry),
-            signal: AbortSignal.timeout(3000),
-          });
+          if (!localLogsOnly(_sec)) postAuditDetached(_logEntry);
         } catch {}
         // Not on Codex: its block reason IS the hook's stderr (see the ROUTE
         // write at the end of the slow path for the full rationale).
@@ -2676,18 +2715,13 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         try { writeDenyFlag(toolName); } catch {}
         writeLocalLog(securityCfg, { ts: new Date().toISOString(), tool: toolName, arguments: args, decision: 'DENY', reason: 'ghost path (hidden from agent)', permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: call.sessionId, evaluation_time_ms: Date.now() - _evalStart });
         try {
-          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
-            body: JSON.stringify({
-              tool: toolName, arguments: args, decision: 'DENY',
-              reason: 'ghost path (hidden from agent)',
-              permission: guessPermission(toolName),
-              source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME,
-              session_id: call.sessionId,
-              evaluation_time_ms: Date.now() - _evalStart,
-            }),
-            signal: AbortSignal.timeout(3000),
+          if (!localLogsOnly(securityCfg)) postAuditDetached({
+            tool: toolName, arguments: args, decision: 'DENY',
+            reason: 'ghost path (hidden from agent)',
+            permission: guessPermission(toolName),
+            source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME,
+            session_id: call.sessionId,
+            evaluation_time_ms: Date.now() - _evalStart,
           });
         } catch {}
         // NOT maybeSelfUpdate() first: see the deny at the end of this flow.
@@ -2819,12 +2853,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
           writeLocalLog(securityCfg, { ts: new Date().toISOString(), ...logEntry });
           // PI hook layer removed — piResult fields no longer attached.
           // Local-only mode: keep the log on the user's machine, skip the cloud.
-          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
-            body: JSON.stringify(logEntry),
-            signal: AbortSignal.timeout(3000),
-          });
+          if (!localLogsOnly(securityCfg)) postAuditDetached(logEntry);
         } catch {}
       }
       writeDenyFlag(toolName);

package/hooks/stop.mjs

@@ -1,91 +1,22 @@
 #!/usr/bin/env node
 /**
- * SolonGate Stop Hook (Stop event)
- * Logs a single ALLOW when Claude responds WITHOUT any tool calls.
- * If tool calls were made, audit.mjs already logged them — this hook skips.
- * Auto-installed by: npx @solongate/proxy login
+ * SolonGate Stop Hook (Stop event) — intentionally does nothing.
+ *
+ * It used to POST one synthetic audit row named `_response` whenever a turn
+ * ended with no tool calls, to record "the agent replied with text only". That
+ * was wrong twice over:
+ *
+ *   - `_response` is not a tool, and it sat in the TOOL CALL log. It showed up
+ *     as a row in the live stream and as an entry in the dashboard's top-tools
+ *     list, and it inflated the call count with something no policy can act on.
+ *   - it decided whether to write by looking for a flag file left by the audit
+ *     hook, so any drift in where that flag lived turned "text-only turn" into
+ *     "every turn" — which is exactly what happened when the per-call scratch
+ *     moved out of the working directory.
+ *
+ * The registration is kept (it costs one process exit per turn and removing it
+ * would need every client's hook config rewritten), but nothing is logged. If a
+ * text-only turn is ever worth recording, it belongs in its own place, not in
+ * the record of what the agent was allowed to run.
  */
-import { readFileSync, existsSync, unlinkSync, writeFileSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { homedir } from 'node:os';
-
-function loadEnvKey(dir) {
-  try {
-    const envPath = resolve(dir, '.env');
-    if (!existsSync(envPath)) return {};
-    const lines = readFileSync(envPath, 'utf-8').split('\n');
-    const env = {};
-    for (const line of lines) {
-      const m = line.match(/^([A-Z_]+)=(.*)$/);
-      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
-    }
-    return env;
-  } catch { return {}; }
-}
-
-// Global cloud config written at login (~/.solongate/cloud-guard.json). This hook
-// used to read ONLY the environment and a project env file, so on a normally
-// paired device it silently logged nothing — and where an env file did exist, a
-// stale key in it shadowed the login. Same order as the other hooks now:
-// process env -> login -> project env file.
-function loadGlobalCloudConfig() {
-  try {
-    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
-    if (!existsSync(p)) return {};
-    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
-    return (cfg && typeof cfg === 'object') ? cfg : {};
-  } catch { return {}; }
-}
-
-const dotenv = loadEnvKey(process.cwd());
-const globalCfg = loadGlobalCloudConfig();
-const API_KEY = process.env.SOLONGATE_API_KEY || globalCfg.apiKey || dotenv.SOLONGATE_API_KEY || '';
-const API_URL = process.env.SOLONGATE_API_URL || globalCfg.apiUrl || dotenv.SOLONGATE_API_URL || 'https://api.solongate.com';
-
-// Agent identity from CLI args: node stop.mjs <agent_id> <agent_name>
-const AGENT_ID = process.argv[2] || 'claude-code';
-const AGENT_NAME = process.argv[3] || 'Claude Code';
-
-if (!API_KEY || !API_KEY.startsWith('sg_live_')) process.exit(0);
-
-// Flag file: audit.mjs writes this when a tool call was logged in this turn.
-// If the flag exists, tool calls were made → skip (already logged).
-// If the flag doesn't exist, no tool calls → log 1 ALLOW for the text response.
-const flagDir = resolve('.solongate');
-const flagFile = join(flagDir, '.last-tool-call');
-
-let input = '';
-process.stdin.on('data', c => input += c);
-process.stdin.on('end', async () => {
-  try {
-    // Check if tool calls were made in this turn
-    if (existsSync(flagFile)) {
-      // Tool calls happened → audit.mjs already logged them. Clean up flag.
-      try { unlinkSync(flagFile); } catch {}
-      process.exit(0);
-    }
-
-    // No tool calls → log 1 ALLOW for the text-only response (fire-and-forget)
-    fetch(`${API_URL}/api/v1/audit-logs`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${API_KEY}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        tool: '_response',
-        arguments: {},
-        decision: 'ALLOW',
-        reason: 'text response (no tool calls)',
-        source: `${AGENT_ID}-hook`,
-        evaluationTimeMs: 0,
-        agent_id: AGENT_ID,
-        agent_name: AGENT_NAME,
-      }),
-      signal: AbortSignal.timeout(5000),
-    }).catch(() => {}).finally(() => process.exit(0));
-    setTimeout(() => process.exit(0), 3000);
-  } catch {
-    process.exit(0);
-  }
-});
+process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.18",
+  "version": "0.83.20",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {