@solongate/proxy 0.83.3 → 0.83.4

package/dist/global-install.js

@@ -405,6 +405,16 @@ function repairQuiet() {
 }
 async function runRepair() {
   const out = (s) => void process.stderr.write(s + "\n");
+  if (process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0 && process.env["SOLONGATE_INTERNAL"] !== "1") {
+    out("");
+    out("  Do not run `solongate repair` with sudo.");
+    out("  It installs the guard into your home directory, and as root it would");
+    out(`  arm root\u2019s home instead${process.env["SUDO_USER"] ? ` of ${process.env["SUDO_USER"]}\u2019s` : ""} \u2014 reporting success while nothing changed for you.`);
+    out("");
+    out("  Run it as yourself:  solongate repair");
+    out("");
+    return 1;
+  }
   const rep = repairQuiet();
   out("");
   out("  SolonGate repair");

package/dist/index.js

@@ -465,13 +465,13 @@ ${offset}${err2}${errEnd}`;
         return next >= src.length || src[next] === "\n" ? str + "\n" : str;
       }
       // ^(---|...)
-      static atDocumentBoundary(src, offset, sep) {
+      static atDocumentBoundary(src, offset, sep2) {
         const ch0 = src[offset];
         if (!ch0) return true;
         const prev = src[offset - 1];
         if (prev && prev !== "\n") return false;
-        if (sep) {
-          if (ch0 !== sep) return false;
+        if (sep2) {
+          if (ch0 !== sep2) return false;
         } else {
           if (ch0 !== Char.DIRECTIVES_END && ch0 !== Char.DOCUMENT_END) return false;
         }
@@ -1647,7 +1647,7 @@ var require_parse_cst = __commonJS({
         const folded = this.type === PlainValue.Type.BLOCK_FOLDED;
         let atStart = true;
         let str = "";
-        let sep = "";
+        let sep2 = "";
         let prevMoreIndented = false;
         for (let i = start; i < end; ++i) {
           for (let j = 0; j < bi; ++j) {
@@ -1656,21 +1656,21 @@ var require_parse_cst = __commonJS({
           }
           const ch2 = src[i];
           if (ch2 === "\n") {
-            if (sep === "\n") str += "\n";
-            else sep = "\n";
+            if (sep2 === "\n") str += "\n";
+            else sep2 = "\n";
           } else {
             const lineEnd = PlainValue.Node.endOfLine(src, i);
             const line = src.slice(i, lineEnd);
             i = lineEnd;
             if (folded && (ch2 === " " || ch2 === "	") && i < keepStart) {
-              if (sep === " ") sep = "\n";
-              else if (!prevMoreIndented && !atStart && sep === "\n") sep = "\n\n";
-              str += sep + line;
-              sep = lineEnd < end && src[lineEnd] || "";
+              if (sep2 === " ") sep2 = "\n";
+              else if (!prevMoreIndented && !atStart && sep2 === "\n") sep2 = "\n\n";
+              str += sep2 + line;
+              sep2 = lineEnd < end && src[lineEnd] || "";
               prevMoreIndented = true;
             } else {
-              str += sep + line;
-              sep = folded && i < keepStart ? " " : "\n";
+              str += sep2 + line;
+              sep2 = folded && i < keepStart ? " " : "\n";
               prevMoreIndented = false;
             }
             if (atStart && line !== "") atStart = false;
@@ -6612,6 +6612,16 @@ function repairQuiet() {
 }
 async function runRepair() {
   const out2 = (s) => void process.stderr.write(s + "\n");
+  if (process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0 && process.env["SOLONGATE_INTERNAL"] !== "1") {
+    out2("");
+    out2("  Do not run `solongate repair` with sudo.");
+    out2("  It installs the guard into your home directory, and as root it would");
+    out2(`  arm root\u2019s home instead${process.env["SUDO_USER"] ? ` of ${process.env["SUDO_USER"]}\u2019s` : ""} \u2014 reporting success while nothing changed for you.`);
+    out2("");
+    out2("  Run it as yourself:  solongate repair");
+    out2("");
+    return 1;
+  }
   const rep = repairQuiet();
   out2("");
   out2("  SolonGate repair");
@@ -6924,22 +6934,25 @@ var init_global_install = __esm({
 var self_update_exports = {};
 __export(self_update_exports, {
   adminInstallCommand: () => adminInstallCommand,
+  adminUpdateSteps: () => adminUpdateSteps,
   autoUpdateEnabled: () => autoUpdateEnabled,
   autoUpdateForcedByEnv: () => autoUpdateForcedByEnv,
   currentVersion: () => currentVersion,
+  globalInstallCheck: () => globalInstallCheck,
   latestVersion: () => latestVersion,
   maybeSelfUpdate: () => maybeSelfUpdate,
   newerThan: () => newerThan,
   runAutoUpdateCommand: () => runAutoUpdateCommand,
   runUpdateCommand: () => runUpdateCommand,
+  runningAsRoot: () => runningAsRoot,
   setAutoUpdate: () => setAutoUpdate,
   tuiUpdateFlow: () => tuiUpdateFlow,
   updateNow: () => updateNow
 });
 import { execFile, execFileSync as execFileSync3, spawn } from "child_process";
-import { mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { access, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4, constants as FS } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join5, sep } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function readState() {
   try {
@@ -7026,6 +7039,17 @@ function spawnGlobalInstall(version) {
 }
 async function runUpdateCommand() {
   const out2 = (s) => void process.stderr.write(s + "\n");
+  if (runningAsRoot()) {
+    out2("");
+    out2("  Do not run `solongate update` with sudo.");
+    out2("  npm would install fine, but the guard hooks would be written into root\u2019s");
+    out2("  home instead of yours, and your agents would stop being guarded.");
+    out2("");
+    out2("  Run these two instead:");
+    for (const s of adminUpdateSteps()) out2("  " + s);
+    out2("");
+    return 1;
+  }
   const cur = currentVersion();
   out2(`  current  ${cur}`);
   const latest = await latestVersion();
@@ -7034,13 +7058,26 @@ async function runUpdateCommand() {
     return 1;
   }
   if (newerThan(latest, cur)) {
+    const pre = await globalInstallCheck();
+    if (pre.writable === false) {
+      writeState({ ...readState(), needsAdmin: latest });
+      out2(`  v${latest} is out, but npm\u2019s global folder needs admin rights on this machine:`);
+      out2(`    ${pre.dir}`);
+      out2("  That is the normal macOS setup \u2014 SolonGate cannot install there on its own.");
+      out2("");
+      out2("  Run these two:");
+      for (const s of adminUpdateSteps()) out2("  " + s);
+      out2("");
+      return 1;
+    }
     out2(`  updating ${cur} -> ${latest} ...`);
     const r = await runGlobalInstall2(latest);
     if (!r.ok) {
       if (r.needsAdmin) {
         writeState({ ...readState(), needsAdmin: latest });
-        out2(`  npm could not write to the global folder (it needs admin rights).`);
-        out2(`  Run:  ${adminInstallCommand()}`);
+        out2("  npm could not write to the global folder (it needs admin rights).");
+        out2("  Run these two:");
+        for (const s of adminUpdateSteps()) out2("  " + s);
       } else {
         out2("  update failed. Try: npm i -g @solongate/proxy@latest");
       }
@@ -7095,11 +7132,43 @@ ${output}
 function adminInstallCommand() {
   return process.platform === "win32" ? `npm i -g ${PKG}@latest  (in an Administrator terminal)` : `sudo npm i -g ${PKG}@latest`;
 }
+function runningAsRoot() {
+  return process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0;
+}
+function ownNodeModules() {
+  let dir = dirname2(fileURLToPath2(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    if (dir.endsWith(`${sep}node_modules`)) return dir;
+    dir = parent;
+  }
+  return null;
+}
+function globalInstallCheck() {
+  prefixCheck ??= new Promise((resolve6) => {
+    try {
+      const dir = ownNodeModules();
+      if (!dir) return resolve6({ writable: null, dir: null });
+      access(dir, FS.W_OK, (e) => resolve6({ writable: !e, dir }));
+    } catch {
+      resolve6({ writable: null, dir: null });
+    }
+  });
+  return prefixCheck;
+}
+function adminUpdateSteps() {
+  return [`  ${adminInstallCommand()}`, `  solongate repair${process.platform === "win32" ? "" : "   (this one WITHOUT sudo)"}`];
+}
 async function updateNow() {
   const cur = currentVersion();
   const latest = await fetchLatest();
   if (!latest) return { status: "unreachable", version: cur };
   if (!newerThan(latest, cur)) return { status: "current", version: cur };
+  if ((await globalInstallCheck()).writable === false) {
+    writeState({ ...readState(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
   const r = await runGlobalInstall2(latest);
   if (r.ok) {
     writeState({ ...readState(), installed: latest, needsAdmin: void 0 });
@@ -7111,7 +7180,7 @@ async function updateNow() {
   }
   return { status: "failed", version: latest };
 }
-function runAutoUpdateCommand(arg) {
+async function runAutoUpdateCommand(arg) {
   const out2 = (s) => void process.stderr.write(s + "\n");
   const envForced = autoUpdateForcedByEnv();
   if (arg === void 0) {
@@ -7128,6 +7197,13 @@ function runAutoUpdateCommand(arg) {
   }
   setAutoUpdate(on);
   out2(on ? "  \u2713 auto-update on \u2014 new versions install in the background" : "  \u2713 auto-update off \u2014 update with: solongate update");
+  if (on && (await globalInstallCheck()).writable === false) {
+    out2("");
+    out2("  Heads up: npm\u2019s global folder needs admin rights on this machine, so a");
+    out2("  background install cannot succeed here. Updates will still be announced,");
+    out2("  and installing them takes:");
+    for (const s of adminUpdateSteps()) out2("  " + s);
+  }
   if (envForced) out2(`  note: SOLONGATE_AUTO_UPDATE is set and overrides this while it stays set`);
   return 0;
 }
@@ -7178,18 +7254,25 @@ function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
       const attempts = readState().attempts ?? {};
       if (now - (attempts[latest] ?? 0) < ATTEMPT_EVERY_MS) return;
       writeState({ ...readState(), attempts: { [latest]: now } });
+      const needsAdmin = (await globalInstallCheck()).writable === false;
+      const head = `${c.dim}\u2191 solongate v${latest} available (running v${current})`;
+      if (needsAdmin) {
+        notify(`${head} \u2014 needs admin rights on this machine:${c.reset}`);
+        for (const s of adminUpdateSteps()) notify(`${c.cyan}  ${s.trim()}${c.reset}`);
+        return;
+      }
       if (!autoUpdateEnabled()) {
-        notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 run ${c.reset}${c.cyan}solongate update${c.reset}`);
+        notify(`${head} \u2014 run ${c.reset}${c.cyan}solongate update${c.reset}`);
         return;
       }
       if (spawnGlobalInstall(latest)) {
-        notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
+        notify(`${head} \u2014 updating in the background, next run uses it${c.reset}`);
       }
     } catch {
     }
   })();
 }
-var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE, NEEDS_ADMIN_RE;
+var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE, NEEDS_ADMIN_RE, prefixCheck;
 var init_self_update = __esm({
   "src/self-update.ts"() {
     "use strict";
@@ -7200,6 +7283,7 @@ var init_self_update = __esm({
     STATE_FILE = join5(homedir3(), ".solongate", ".self-update.json");
     LOG_FILE = join5(homedir3(), ".solongate", "self-update.log");
     NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
+    prefixCheck = null;
   }
 });
 
@@ -11543,6 +11627,17 @@ function SettingsPanel({
   const [diagBusy, setDiagBusy] = useState8(null);
   const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
   const [updBusy, setUpdBusy] = useState8(false);
+  const [canInstall, setCanInstall] = useState8(null);
+  useEffect7(() => {
+    let live2 = true;
+    globalInstallCheck().then((r) => {
+      if (live2) setCanInstall(r.writable);
+    }).catch(() => {
+    });
+    return () => {
+      live2 = false;
+    };
+  }, []);
   const [diag, setDiag] = useState8(null);
   const [diagStep, setDiagStep] = useState8(0);
   const DIAG_STEPS = {
@@ -11822,15 +11917,27 @@ function SettingsPanel({
       if (updBusy) return;
       setUpdBusy(true);
       setMsg({ text: "updating\u2026", level: "ok" });
+      setDiag(null);
       void (async () => {
         try {
           const res = await updateNow();
           if (res.status === "updated") setMsg({ text: `\u2713 v${res.version} installed \xB7 restart (q, then solongate) to apply`, level: "ok" });
           else if (res.status === "current") setMsg({ text: `\u2713 already on the latest version (v${res.version})`, level: "ok" });
-          else if (res.status === "needs-admin") setMsg({ text: `\u2717 npm needs admin rights here \u2014 run: ${adminInstallCommand()}`, level: "bad" });
-          else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
+          else if (res.status === "needs-admin") {
+            setMsg({ text: `\u2717 v${res.version} needs admin rights \u2014 run the two commands below`, level: "bad" });
+            setDiag({
+              of: "cli-update",
+              lines: [
+                { text: "npm\u2019s global folder belongs to root on this machine (the usual macOS", level: "warn" },
+                { text: "setup), so SolonGate cannot install there by itself. In a terminal:", level: "warn" },
+                ...adminUpdateSteps().map((s) => ({ text: s.trim(), level: "ok" })),
+                { text: "run repair WITHOUT sudo, or the guard hooks land in root\u2019s home", level: "dim" }
+              ]
+            });
+          } else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
           else setMsg({ text: `\u2717 update to v${res.version} failed \u2014 see ~/.solongate/self-update.log`, level: "bad" });
           setLatest(await latestVersion());
+          setCanInstall((await globalInstallCheck()).writable);
         } finally {
           setUpdBusy(false);
         }
@@ -11844,7 +11951,7 @@ function SettingsPanel({
       setAutoUpdate(next);
       setAutoUp(next);
       setMsg(
-        next ? { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
+        next ? canInstall === false ? { text: "\u2713 auto-update on \u2014 but npm needs sudo here, so it still cannot install on its own", level: "bad" } : { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
       );
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
@@ -12162,7 +12269,10 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "version".padEnd(11) }),
           /* @__PURE__ */ jsx8(Text8, { color: behind ? theme.warn : theme.ok, children: `v${ver}` }),
-          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
+          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind && canInstall === false ? (
+            // Said before they press enter, not after a minute of npm noise.
+            /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `   v${latest} on npm \xB7 needs sudo here \xB7 enter shows how` })
+          ) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
         ] });
       }
       case "auto-update":
@@ -12170,7 +12280,7 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "auto".padEnd(11) }),
           onOff(autoUp),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : canInstall === false ? "   cannot work here: npm needs sudo, so updates stay manual \xB7 enter toggles" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
         ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
@@ -12269,7 +12379,7 @@ function SettingsPanel({
         lineKey.push("");
       });
     }
-    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair")) {
+    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair" || r.kind === "cli-update" && diag.of === "cli-update")) {
       diag.lines.forEach((l, i) => {
         lineEls.push(
           /* @__PURE__ */ jsx8(
@@ -17157,7 +17267,7 @@ function printHelp() {
   console.log(`  ${c.dim}Usage:${c.reset} ${c.cyan}solongate${c.reset} ${c.dim}[command]${c.reset}   ${c.dim}(no command opens the dataroom: all of this in a terminal UI)${c.reset}`);
   head("Setup & status");
   cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
-  cmd("update", "update SolonGate to the newest version and refresh the guard");
+  cmd("update", "update SolonGate and refresh the guard (tells you if it needs sudo)");
   cmd("update auto on|off", "background auto-update (default off \u2014 on macOS npm -g often needs sudo)");
   cmd("repair", "restore the guard + hook + settings files if they were deleted or disarmed");
   cmd("doctor", "health check: login, policy, guard, local logs");
@@ -17308,7 +17418,7 @@ async function main() {
   if (subcommand === "update") {
     if (process.argv[3] === "auto") {
       const { runAutoUpdateCommand: runAutoUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
-      process.exit(runAutoUpdateCommand2(process.argv[4]));
+      process.exit(await runAutoUpdateCommand2(process.argv[4]));
     }
     const { runUpdateCommand: runUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
     process.exit(await runUpdateCommand2());

package/dist/self-update.d.ts

@@ -23,6 +23,19 @@ export declare function latestVersion(): Promise<string | null>;
 export declare function runUpdateCommand(): Promise<number>;
 /** The exact command that fixes a root-owned global prefix. */
 export declare function adminInstallCommand(): string;
+/** Are we root — i.e. did someone run this under sudo? */
+export declare function runningAsRoot(): boolean;
+export declare function globalInstallCheck(): Promise<{
+    writable: boolean | null;
+    dir: string | null;
+}>;
+/**
+ * The two commands that update SolonGate on a machine whose global npm folder
+ * belongs to root. `repair` is deliberately NOT under sudo: it writes the guard
+ * hooks into the invoking user's home, so as root it would arm root's home and
+ * leave the actual user unguarded.
+ */
+export declare function adminUpdateSteps(): string[];
 /**
  * Install the newest version NOW, whatever the auto-update setting says — the
  * dataroom's UPDATES row and `solongate update` both run through here.
@@ -36,7 +49,7 @@ export declare function updateNow(): Promise<{
  * Kept separate from `runUpdateCommand` so `solongate update` stays "update me
  * now" and never changes a setting as a side effect.
  */
-export declare function runAutoUpdateCommand(arg?: string): number;
+export declare function runAutoUpdateCommand(arg?: string): Promise<number>;
 /** What the dataroom shows about the updater. */
 export type UpdateStatus = {
     kind: 'idle';

package/dist/tui/index.js

@@ -4495,9 +4495,9 @@ function stopLogsServerDaemon() {
 
 // src/self-update.ts
 import { execFile, execFileSync as execFileSync2, spawn as spawn4 } from "child_process";
-import { mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { access, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync7, constants as FS } from "fs";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname3, join as join9 } from "path";
+import { dirname as dirname3, join as join9, sep } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var PKG = "@solongate/proxy";
 var CHECK_EVERY_MS = 30 * 60 * 1e3;
@@ -4598,11 +4598,41 @@ ${output}
 function adminInstallCommand() {
   return process.platform === "win32" ? `npm i -g ${PKG}@latest  (in an Administrator terminal)` : `sudo npm i -g ${PKG}@latest`;
 }
+function ownNodeModules() {
+  let dir = dirname3(fileURLToPath3(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    const parent = dirname3(dir);
+    if (parent === dir) break;
+    if (dir.endsWith(`${sep}node_modules`)) return dir;
+    dir = parent;
+  }
+  return null;
+}
+var prefixCheck = null;
+function globalInstallCheck() {
+  prefixCheck ??= new Promise((resolve3) => {
+    try {
+      const dir = ownNodeModules();
+      if (!dir) return resolve3({ writable: null, dir: null });
+      access(dir, FS.W_OK, (e) => resolve3({ writable: !e, dir }));
+    } catch {
+      resolve3({ writable: null, dir: null });
+    }
+  });
+  return prefixCheck;
+}
+function adminUpdateSteps() {
+  return [`  ${adminInstallCommand()}`, `  solongate repair${process.platform === "win32" ? "" : "   (this one WITHOUT sudo)"}`];
+}
 async function updateNow() {
   const cur = currentVersion();
   const latest = await fetchLatest();
   if (!latest) return { status: "unreachable", version: cur };
   if (!newerThan(latest, cur)) return { status: "current", version: cur };
+  if ((await globalInstallCheck()).writable === false) {
+    writeState2({ ...readState2(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
   const r = await runGlobalInstall(latest);
   if (r.ok) {
     writeState2({ ...readState2(), installed: latest, needsAdmin: void 0 });
@@ -4703,6 +4733,17 @@ function SettingsPanel({
   const [diagBusy, setDiagBusy] = useState8(null);
   const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
   const [updBusy, setUpdBusy] = useState8(false);
+  const [canInstall, setCanInstall] = useState8(null);
+  useEffect7(() => {
+    let live2 = true;
+    globalInstallCheck().then((r) => {
+      if (live2) setCanInstall(r.writable);
+    }).catch(() => {
+    });
+    return () => {
+      live2 = false;
+    };
+  }, []);
   const [diag, setDiag] = useState8(null);
   const [diagStep, setDiagStep] = useState8(0);
   const DIAG_STEPS = {
@@ -4982,15 +5023,27 @@ function SettingsPanel({
       if (updBusy) return;
       setUpdBusy(true);
       setMsg({ text: "updating\u2026", level: "ok" });
+      setDiag(null);
       void (async () => {
         try {
           const res = await updateNow();
           if (res.status === "updated") setMsg({ text: `\u2713 v${res.version} installed \xB7 restart (q, then solongate) to apply`, level: "ok" });
           else if (res.status === "current") setMsg({ text: `\u2713 already on the latest version (v${res.version})`, level: "ok" });
-          else if (res.status === "needs-admin") setMsg({ text: `\u2717 npm needs admin rights here \u2014 run: ${adminInstallCommand()}`, level: "bad" });
-          else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
+          else if (res.status === "needs-admin") {
+            setMsg({ text: `\u2717 v${res.version} needs admin rights \u2014 run the two commands below`, level: "bad" });
+            setDiag({
+              of: "cli-update",
+              lines: [
+                { text: "npm\u2019s global folder belongs to root on this machine (the usual macOS", level: "warn" },
+                { text: "setup), so SolonGate cannot install there by itself. In a terminal:", level: "warn" },
+                ...adminUpdateSteps().map((s) => ({ text: s.trim(), level: "ok" })),
+                { text: "run repair WITHOUT sudo, or the guard hooks land in root\u2019s home", level: "dim" }
+              ]
+            });
+          } else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
           else setMsg({ text: `\u2717 update to v${res.version} failed \u2014 see ~/.solongate/self-update.log`, level: "bad" });
           setLatest(await latestVersion());
+          setCanInstall((await globalInstallCheck()).writable);
         } finally {
           setUpdBusy(false);
         }
@@ -5004,7 +5057,7 @@ function SettingsPanel({
       setAutoUpdate(next);
       setAutoUp(next);
       setMsg(
-        next ? { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
+        next ? canInstall === false ? { text: "\u2713 auto-update on \u2014 but npm needs sudo here, so it still cannot install on its own", level: "bad" } : { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
       );
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
@@ -5322,7 +5375,10 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "version".padEnd(11) }),
           /* @__PURE__ */ jsx8(Text8, { color: behind ? theme.warn : theme.ok, children: `v${ver}` }),
-          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
+          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind && canInstall === false ? (
+            // Said before they press enter, not after a minute of npm noise.
+            /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `   v${latest} on npm \xB7 needs sudo here \xB7 enter shows how` })
+          ) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
         ] });
       }
       case "auto-update":
@@ -5330,7 +5386,7 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "auto".padEnd(11) }),
           onOff(autoUp),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : canInstall === false ? "   cannot work here: npm needs sudo, so updates stay manual \xB7 enter toggles" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
         ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
@@ -5429,7 +5485,7 @@ function SettingsPanel({
         lineKey.push("");
       });
     }
-    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair")) {
+    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair" || r.kind === "cli-update" && diag.of === "cli-update")) {
       diag.lines.forEach((l, i) => {
         lineEls.push(
           /* @__PURE__ */ jsx8(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.3",
+  "version": "0.83.4",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {