@solongate/proxy 0.83.31 → 0.83.33

package/dist/commands/index.js

@@ -692,7 +692,7 @@ var USAGE = usage("solongate policy", "manage cloud policies", [
   ["policy deny  <id> [--command|--path|--url <val>]", "append a DENY rule"],
   ["policy revoke <id> <ruleId>", "remove a rule"],
   ["policy active", "show the resolved active policy"],
-  ["policy activate <id> | --clear", "pin / unpin the active policy"],
+  ["policy activate <id> | --off", "pin the active policy, or enforce nothing"],
   ["policy dry-run <id|file.json> [--limit N] [--mode denylist|whitelist]", "replay recent traffic against rules"]
 ], "Add --json to any read command for machine-readable output.");
 async function run(argv) {
@@ -798,13 +798,15 @@ async function run(argv) {
       return 0;
     }
     case "activate": {
-      if (flagBool(flags, "clear")) {
+      if (flagBool(flags, "off") || flagBool(flags, "clear")) {
         const res2 = await api.policies.setActive(null);
         if (json) return printJson(res2), 0;
-        return err(green("  \u2713 Cleared active-policy pin.")), 0;
+        err(green("  \u2713 Deactivated - this project now enforces no policy."));
+        err(dim("    Pin one again with: solongate policy activate <id>"));
+        return 0;
       }
       const id = positionals[1];
-      if (!id) return err("  Usage: policy activate <id>  |  policy activate --clear"), 1;
+      if (!id) return err("  Usage: policy activate <id>  |  policy activate --off"), 1;
       const res = await api.policies.setActive(id);
       if (json) return printJson(res), 0;
       err(green(`  \u2713 Pinned active policy \u2192 ${res.active}`));

package/dist/index.js

@@ -7125,6 +7125,30 @@ import { access, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync
 import { homedir as homedir3 } from "os";
 import { dirname as dirname2, join as join5, sep } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
+function lockHeldAt() {
+  try {
+    const ts = Number(readFileSync5(LOCK_FILE, "utf-8").trim().split(/\s+/)[1] ?? 0);
+    if (!Number.isFinite(ts) || Date.now() - ts >= LOCK_STALE_MS) return null;
+    return ts;
+  } catch {
+    return null;
+  }
+}
+function takeInstallLock() {
+  try {
+    mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+    writeFileSync4(LOCK_FILE, `${process.pid} ${Date.now()}
+`);
+  } catch {
+  }
+}
+function releaseInstallLock() {
+  try {
+    writeFileSync4(LOCK_FILE, `${process.pid} 0
+`);
+  } catch {
+  }
+}
 function readState() {
   try {
     const s = JSON.parse(readFileSync5(STATE_FILE, "utf-8"));
@@ -7191,8 +7215,10 @@ async function fetchLatest() {
   }
 }
 function spawnGlobalInstall(version) {
+  if (lockHeldAt() !== null) return false;
   try {
     mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+    takeInstallLock();
     const log3 = openSync(LOG_FILE, "a");
     const p = spawn2("npm", ["install", "-g", `${PKG}@${version}`], {
       stdio: ["ignore", log3, log3],
@@ -7242,7 +7268,7 @@ async function runUpdateCommand() {
       return 1;
     }
     out2(`  updating ${cur} -> ${latest} ...`);
-    const r = await runGlobalInstall2(latest);
+    const r = await installGlobally(latest, out2);
     if (!r.ok) {
       if (r.needsAdmin) {
         writeState({ ...readState(), needsAdmin: latest });
@@ -7250,7 +7276,8 @@ async function runUpdateCommand() {
         out2("  Run these two:");
         for (const s of adminUpdateSteps()) out2("  " + s);
       } else {
-        out2("  update failed. Try: npm i -g @solongate/proxy@latest");
+        out2("  update failed \u2014 the CLI may not be installed right now. Run:");
+        out2(`    npm i -g ${PKG}@${latest}`);
       }
       return 1;
     }
@@ -7300,6 +7327,26 @@ ${output}
     }
   });
 }
+async function installGlobally(version, out2) {
+  const heldSince = lockHeldAt();
+  if (heldSince !== null) {
+    out2("  another install is already running \u2014 waiting for it to finish ...");
+    const until = Date.now() + LOCK_WAIT_MS;
+    while (Date.now() < until && lockHeldAt() !== null) await sleep(1e3);
+  }
+  takeInstallLock();
+  try {
+    let r = await runGlobalInstall2(version);
+    if (!r.ok && !r.needsAdmin) {
+      await sleep(2e3);
+      out2("  install did not take \u2014 retrying once ...");
+      r = await runGlobalInstall2(version);
+    }
+    return r;
+  } finally {
+    releaseInstallLock();
+  }
+}
 function adminInstallCommand() {
   return process.platform === "win32" ? `npm i -g ${PKG}@latest  (in an Administrator terminal)` : `sudo npm i -g ${PKG}@latest`;
 }
@@ -7443,7 +7490,7 @@ function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
     }
   })();
 }
-var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE, NEEDS_ADMIN_RE, prefixCheck;
+var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE, LOCK_FILE, LOCK_STALE_MS, LOCK_WAIT_MS, sleep, NEEDS_ADMIN_RE, prefixCheck;
 var init_self_update = __esm({
   "src/self-update.ts"() {
     "use strict";
@@ -7453,6 +7500,10 @@ var init_self_update = __esm({
     ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
     STATE_FILE = join5(homedir3(), ".solongate", ".self-update.json");
     LOG_FILE = join5(homedir3(), ".solongate", "self-update.log");
+    LOCK_FILE = join5(homedir3(), ".solongate", ".update-install.lock");
+    LOCK_STALE_MS = 3 * 6e4;
+    LOCK_WAIT_MS = 9e4;
+    sleep = (ms) => new Promise((r) => setTimeout(r, ms));
     NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
     prefixCheck = null;
   }
@@ -13041,13 +13092,15 @@ async function run2(argv) {
       return 0;
     }
     case "activate": {
-      if (flagBool(flags, "clear")) {
+      if (flagBool(flags, "off") || flagBool(flags, "clear")) {
         const res2 = await api.policies.setActive(null);
         if (json) return printJson(res2), 0;
-        return err(green("  \u2713 Cleared active-policy pin.")), 0;
+        err(green("  \u2713 Deactivated - this project now enforces no policy."));
+        err(dim("    Pin one again with: solongate policy activate <id>"));
+        return 0;
       }
       const id = positionals[1];
-      if (!id) return err("  Usage: policy activate <id>  |  policy activate --clear"), 1;
+      if (!id) return err("  Usage: policy activate <id>  |  policy activate --off"), 1;
       const res = await api.policies.setActive(id);
       if (json) return printJson(res), 0;
       err(green(`  \u2713 Pinned active policy \u2192 ${res.active}`));
@@ -13116,7 +13169,7 @@ var init_policy = __esm({
       ["policy deny  <id> [--command|--path|--url <val>]", "append a DENY rule"],
       ["policy revoke <id> <ruleId>", "remove a rule"],
       ["policy active", "show the resolved active policy"],
-      ["policy activate <id> | --clear", "pin / unpin the active policy"],
+      ["policy activate <id> | --off", "pin the active policy, or enforce nothing"],
       ["policy dry-run <id|file.json> [--limit N] [--mode denylist|whitelist]", "replay recent traffic against rules"]
     ], "Add --json to any read command for machine-readable output.");
   }
@@ -17464,7 +17517,7 @@ function printHelp() {
   cmd("policy allow <id> [--command|--path|--url <val>]", "add an ALLOW rule");
   cmd("policy deny <id> [--command|--path|--url <val>]", "add a DENY rule");
   cmd("policy revoke <id> <ruleId>", "remove a rule");
-  cmd("policy activate <id> | --clear", "pin / unpin the active policy");
+  cmd("policy activate <id> | --off", "pin the active policy, or enforce nothing");
   cmd("policy active", "show the resolved active policy");
   cmd("policy dry-run <id|file.json> [--mode denylist|whitelist]", "replay recent traffic against rules");
   head("Rate limits");
@@ -17553,7 +17606,7 @@ async function main() {
   }
   if (IS_HUMAN_CLI) {
     const tuiBound = subcommand === "dataroom" || process.argv.length <= 2 && process.stdout.isTTY && process.stdin.isTTY;
-    if (!tuiBound) {
+    if (!tuiBound && subcommand !== "update") {
       const { maybeSelfUpdate: maybeSelfUpdate2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
       maybeSelfUpdate2();
     }

package/dist/tui/index.js

@@ -4720,6 +4720,8 @@ var CHECK_EVERY_MS = 30 * 60 * 1e3;
 var ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
 var STATE_FILE2 = join9(homedir9(), ".solongate", ".self-update.json");
 var LOG_FILE2 = join9(homedir9(), ".solongate", "self-update.log");
+var LOCK_FILE = join9(homedir9(), ".solongate", ".update-install.lock");
+var LOCK_STALE_MS = 3 * 6e4;
 var NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
 function readState2() {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.31",
+  "version": "0.83.33",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {
@@ -61,12 +61,12 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@solongate/guard-linux-x64": "0.83.31",
-    "@solongate/guard-linux-arm64": "0.83.31",
-    "@solongate/guard-darwin-x64": "0.83.31",
-    "@solongate/guard-darwin-arm64": "0.83.31",
-    "@solongate/guard-win32-x64": "0.83.31",
-    "@solongate/guard-win32-arm64": "0.83.31"
+    "@solongate/guard-linux-x64": "0.83.33",
+    "@solongate/guard-linux-arm64": "0.83.33",
+    "@solongate/guard-darwin-x64": "0.83.33",
+    "@solongate/guard-darwin-arm64": "0.83.33",
+    "@solongate/guard-win32-x64": "0.83.33",
+    "@solongate/guard-win32-arm64": "0.83.33"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",