@solongate/proxy 0.83.4 → 0.83.5

package/dist/api-client/auth.d.ts

@@ -8,13 +8,5 @@ export interface Me {
         name?: string;
         slug?: string;
     } | null;
-    /**
-     * Present only for a guest account, and carrying only whether the allowance is
-     * spent. The size of it and how much is left are the operator's numbers and
-     * are not sent here.
-     */
-    guest?: {
-        exhausted?: boolean;
-    } | null;
 }
 export declare function me(): Promise<Me>;

package/dist/api-client/client.d.ts

@@ -18,16 +18,6 @@ export declare function saveAccount(acc: SavedAccount): void;
 /** Remove a saved account from this device (does NOT revoke the cloud key). */
 export declare function removeAccount(apiKey: string): void;
 export declare function setViewCredentials(creds: Credentials | null): void;
-/** The unroutable address a guest ("Skip for now") account is stored under. */
-export declare const GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
-/**
- * True when the account this device is enforcing with is a guest one.
- *
- * A guest has no dashboard rights beyond reading, and the CLI is the same
- * account reached a different way, so the management commands answer the same
- * way the dashboard does rather than half-working here.
- */
-export declare function isGuestAccount(): boolean;
 /** The key this device enforces with, or null when it is not paired. */
 export declare function enforcingKey(): string | null;
 /** True when the given key is the ACTIVE one the guard hooks use. */
@@ -56,10 +46,6 @@ export declare class ApiError extends Error {
     readonly code: string;
     constructor(status: number, code: string, message: string);
 }
-/** Raised when a guest account tries to change something. */
-export declare class GuestReadOnlyError extends Error {
-    constructor();
-}
 /** Raised when no API key can be found — tells the user to run `solongate` and pair. */
 export declare class NotAuthenticatedError extends Error {
     constructor();

package/dist/commands/index.js

@@ -135,31 +135,7 @@ function installedGuardVersion() {
 
 // src/api-client/client.ts
 var DEFAULT_API_URL = "https://api.solongate.com";
-var accountsFile = () => join2(homedir2(), ".solongate", "accounts.json");
-function listAccounts() {
-  let list5 = [];
-  try {
-    const raw = JSON.parse(readFileSync2(accountsFile(), "utf-8"));
-    if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
-  } catch {
-  }
-  const active2 = loginCredentialFile();
-  if (active2.apiKey && !list5.some((a) => a.apiKey === active2.apiKey)) {
-    list5.unshift({ apiKey: active2.apiKey, apiUrl: active2.apiUrl || DEFAULT_API_URL });
-  }
-  return list5;
-}
 var viewOverride = null;
-var GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
-function isGuestAccount() {
-  try {
-    const active2 = loginCredentialFile().apiKey;
-    if (!active2) return false;
-    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
-  } catch {
-    return false;
-  }
-}
 var ApiError = class extends Error {
   status;
   code;
@@ -170,12 +146,6 @@ var ApiError = class extends Error {
     this.code = code;
   }
 };
-var GuestReadOnlyError = class extends Error {
-  constructor() {
-    super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
-    this.name = "GuestReadOnlyError";
-  }
-};
 var NotAuthenticatedError = class extends Error {
   constructor() {
     super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -240,9 +210,6 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
-  if (method !== "GET" && isGuestAccount()) {
-    throw new GuestReadOnlyError();
-  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {

package/dist/index.js

@@ -7716,26 +7716,6 @@ var init_local_log = __esm({
 });
 
 // src/api-client/client.ts
-var client_exports = {};
-__export(client_exports, {
-  ApiError: () => ApiError,
-  DEFAULT_API_URL: () => DEFAULT_API_URL2,
-  GUEST_EMAIL_SUFFIX: () => GUEST_EMAIL_SUFFIX,
-  GuestReadOnlyError: () => GuestReadOnlyError,
-  NotAuthenticatedError: () => NotAuthenticatedError,
-  clearActiveCredential: () => clearActiveCredential,
-  enforcingKey: () => enforcingKey,
-  isActiveAccount: () => isActiveAccount,
-  isAuthenticated: () => isAuthenticated,
-  isGuestAccount: () => isGuestAccount,
-  listAccounts: () => listAccounts,
-  removeAccount: () => removeAccount,
-  request: () => request,
-  resolveCredentials: () => resolveCredentials,
-  saveAccount: () => saveAccount,
-  setActiveAccount: () => setActiveAccount,
-  setViewCredentials: () => setViewCredentials
-});
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync5 } from "fs";
 import { resolve as resolve4, join as join9 } from "path";
 import { homedir as homedir7 } from "os";
@@ -7787,15 +7767,6 @@ function setViewCredentials(creds) {
   viewOverride = creds;
   cached2 = null;
 }
-function isGuestAccount() {
-  try {
-    const active2 = loginCredentialFile().apiKey;
-    if (!active2) return false;
-    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
-  } catch {
-    return false;
-  }
-}
 function enforcingKey() {
   return loginCredentialFile().apiKey ?? null;
 }
@@ -7898,9 +7869,6 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
-  if (method !== "GET" && isGuestAccount()) {
-    throw new GuestReadOnlyError();
-  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {
@@ -7956,7 +7924,7 @@ async function request(method, path, opts = {}) {
   }
   return json;
 }
-var DEFAULT_API_URL2, accountsFile, viewOverride, GUEST_EMAIL_SUFFIX, ApiError, GuestReadOnlyError, NotAuthenticatedError, cached2;
+var DEFAULT_API_URL2, accountsFile, viewOverride, ApiError, NotAuthenticatedError, cached2;
 var init_client = __esm({
   "src/api-client/client.ts"() {
     "use strict";
@@ -7964,7 +7932,6 @@ var init_client = __esm({
     DEFAULT_API_URL2 = "https://api.solongate.com";
     accountsFile = () => join9(homedir7(), ".solongate", "accounts.json");
     viewOverride = null;
-    GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
     ApiError = class extends Error {
       status;
       code;
@@ -7975,12 +7942,6 @@ var init_client = __esm({
         this.code = code;
       }
     };
-    GuestReadOnlyError = class extends Error {
-      constructor() {
-        super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
-        this.name = "GuestReadOnlyError";
-      }
-    };
     NotAuthenticatedError = class extends Error {
       constructor() {
         super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -9321,18 +9282,18 @@ function LivePanel({ active: active2 }) {
       }
     ) : null,
     activeAction ? /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: activeAction.level === "bad" ? "#3d1220" : "#123d1f", color: activeAction.level === "bad" ? "#ff6b6b" : "#7bd88f", bold: true, children: ` ${truncate2(activeAction.text, innerW - 4)} ` }) : null,
-    /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, children: [
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, marginRight: 2, children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, height: 1 + chartH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "TRAFFIC", extra: `${trafficLabel} \xB7 peak ${Math.max(0, ...traffic)} \xB7 red = denials`, width: leftW }),
         /* @__PURE__ */ jsx2(ColumnChart, { series: traffic, hot: trafficHot, height: chartH, width: leftW, color: theme.accent })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: rightW, children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: rightW, height: 1 + chartH, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "API LATENCY", extra: `now ${latNow}ms \xB7 med ${latMed}ms \xB7 amber >${Math.round(latHotAt)}ms`, width: rightW }),
         /* @__PURE__ */ jsx2(ColumnChart, { series: lat, hot: lat.map((v) => v > latHotAt), height: chartH, width: rightW, color: "white", hotColor: "#ffb454" })
       ] })
     ] }),
-    /* @__PURE__ */ jsxs2(Box2, { height: colH, children: [
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: colH, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "LAYERS", extra: "l = inspect", width: colW }),
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "RATELIMIT ".padEnd(10) }),
@@ -9345,7 +9306,11 @@ function LivePanel({ active: active2 }) {
           /* @__PURE__ */ jsx2(Text2, { color: dl?.mode === "block" ? theme.ok : dl?.mode === "detect" ? theme.warn : theme.dim, children: (dl?.mode ?? "?").padEnd(7) }),
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${(dl?.patterns ?? []).length} builtin \xB7 ${(dl?.custom ?? []).length} custom` })
         ] }),
-        dlpBars.length ? dlpBars.map((d2) => /* @__PURE__ */ jsx2(HBar, { label: truncate2(d2.pattern, 10), value: d2.count, max: maxDlpBar, width: Math.max(6, colW - 16), color: theme.bad }, d2.pattern)) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "          no dlp hits in last 7 days" }),
+        dlpBars.length ? dlpBars.map((d2) => /* @__PURE__ */ jsx2(HBar, { label: truncate2(d2.pattern, 10), value: d2.count, max: maxDlpBar, width: Math.max(6, colW - 16), color: theme.bad }, d2.pattern)) : (
+          // 36 chars against a colW that is ~31 at cols=100: without truncate
+          // this wrapped onto a second line and pushed the column over colH.
+          /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", color: theme.dim, children: "          no dlp hits in last 7 days" })
+        ),
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "GUARD".padEnd(10) }),
           ring ? /* @__PURE__ */ jsxs2(Text2, { color: theme.ok, children: [
@@ -9354,7 +9319,7 @@ function LivePanel({ active: active2 }) {
           ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "no local ring in cwd" })
         ] })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: mode === "pick" ? "\u2191\u2193 pick \xB7 enter open" : `${combinedSess.length} \xB7 s = inspect`, width: colW }),
         pickable.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "scanning\u2026" }) : null,
         pickable.map((r, i) => {
@@ -9380,7 +9345,7 @@ function LivePanel({ active: active2 }) {
           ] }, r.id);
         })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "system heartbeat", width: colW }),
         log3.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
@@ -11587,26 +11552,7 @@ var init_doctor = __esm({
 import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
 import TextInput6 from "ink-text-input";
 import { useEffect as useEffect7, useRef as useRef3, useState as useState8 } from "react";
-import { readFileSync as readFileSync11, readdirSync as readdirSync2 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
 import { Fragment as Fragment5, jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
-function guestAllowance() {
-  try {
-    const dir = join13(homedir11(), ".solongate");
-    for (const f of readdirSync2(dir)) {
-      if (!f.startsWith(".policy-cache-") || !f.endsWith(".json")) continue;
-      try {
-        const c2 = JSON.parse(readFileSync11(join13(dir, f), "utf-8"));
-        const q = c2?.security?.guestQuota;
-        if (q && typeof q.limit === "number") return { used: q.used ?? 0, limit: q.limit };
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return null;
-}
 function SettingsPanel({
   active: active2,
   focused,
@@ -11655,7 +11601,6 @@ function SettingsPanel({
     const step = setInterval(() => setDiagStep((s) => Math.min(s + 1, total - 1)), 220);
     return () => clearInterval(step);
   }, [diagBusy]);
-  void guestAllowance;
   const ver = currentVersion();
   useEffect7(() => {
     let live2 = true;
@@ -12220,15 +12165,6 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add account (enter \u2014 device login in the browser)" })
         ] });
-      case "allowance": {
-        const left = Math.max(0, r.limit - r.used);
-        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-          cursor(r),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "allowance".padEnd(11) }),
-          /* @__PURE__ */ jsx8(Text8, { color: left === 0 ? theme.bad : left <= 20 ? theme.warn : theme.ok, bold: true, children: `${r.used}/${r.limit} tool calls` }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: left === 0 ? "   used up \u2014 every call is denied \xB7 create an account to carry on" : `   ${left} left on this guest account \xB7 create an account for no limit` })
-        ] });
-      }
       case "guard":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -12334,7 +12270,7 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
@@ -12528,23 +12464,7 @@ function App() {
   const acctIdx = Math.max(0, accounts.findIndex((a) => a.apiKey === viewKey));
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
-  const isGuestAccount2 = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const acctLabel2 = !cur ? "not logged in" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
-  const [guestSpent, setGuestSpent] = useState9(false);
-  useEffect8(() => {
-    if (!isGuestAccount2) {
-      setGuestSpent(false);
-      return;
-    }
-    let alive = true;
-    api.auth.me().then((r) => {
-      if (alive) setGuestSpent(r.guest?.exhausted === true);
-    }).catch(() => {
-    });
-    return () => {
-      alive = false;
-    };
-  }, [isGuestAccount2, cur?.apiKey]);
+  const acctLabel2 = !cur ? "not logged in" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -12630,12 +12550,7 @@ function App() {
       /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
         /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "account: " }),
         /* @__PURE__ */ jsx9(Text9, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
-        locked ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : guestSpent ? (
-          // Said on this line rather than on a new one: every panel budgets its
-          // height against a fixed shell, so one more line up here silently clips
-          // a row off whichever panel is open.
-          /* @__PURE__ */ jsx9(Text9, { color: theme.bad, bold: true, children: "  \xB7 allowance used up \xB7 every call denied \xB7 create an account to carry on" })
-        ) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
+        locked ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
         update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : update2.kind === "available" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} out \xB7 Settings \u2192 UPDATES` }) : update2.kind === "needs-admin" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} needs admin rights \xB7 Settings \u2192 UPDATES` }) : null
       ] }),
       /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
@@ -12713,8 +12628,8 @@ __export(tui_exports, {
   launchTui: () => launchTui
 });
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join14 } from "path";
+import { homedir as homedir11 } from "os";
+import { join as join13 } from "path";
 import { render } from "ink";
 import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
@@ -12725,11 +12640,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join14(homedir12(), ".solongate", "dataroom-debug.log");
+  const debugLog = join13(homedir11(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync9(join14(homedir12(), ".solongate"), { recursive: true });
+      mkdirSync9(join13(homedir11(), ".solongate"), { recursive: true });
       appendFileSync2(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {
@@ -12756,7 +12671,7 @@ var init_tui = __esm({
 });
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 async function run2(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0];
@@ -12913,7 +12828,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync12(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync11(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -13627,10 +13542,10 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer } from "http";
-import { readFileSync as readFileSync13, statSync as statSync4 } from "fs";
-import { resolve as resolve5, join as join15, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir13 } from "os";
-import { readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync12, statSync as statSync4 } from "fs";
+import { resolve as resolve5, join as join14, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir12 } from "os";
+import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
     "https://dashboard.solongate.com",
@@ -13646,15 +13561,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute2(dir)) return dir;
-  return resolve5(homedir13(), ".solongate", "local-logs");
+  return resolve5(homedir12(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve5(homedir13(), ".solongate");
+  const base = resolve5(homedir12(), ".solongate");
   try {
-    const files = readdirSync3(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
+    const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync13(join15(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync12(join14(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -13663,7 +13578,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync13(join15(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync12(join14(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -13692,7 +13607,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join15(dir, LOG_FILENAME);
+  const file = join14(dir, LOG_FILENAME);
   try {
     const st = statSync4(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -13775,7 +13690,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync13(info.file, "utf-8");
+        const text = readFileSync12(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -13828,9 +13743,9 @@ var init_logs_server = __esm({
 });
 
 // src/index.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname4, join as join16 } from "path";
+import { dirname as dirname4, join as join15 } from "path";
 
 // src/config.ts
 import { readFileSync, existsSync } from "fs";
@@ -17225,8 +17140,8 @@ if (!IS_HUMAN_CLI) {
 }
 var PKG_VERSION = (() => {
   try {
-    const p = join16(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync14(p, "utf-8")).version || "unknown";
+    const p = join15(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync13(p, "utf-8")).version || "unknown";
   } catch {
     return "unknown";
   }
@@ -17397,13 +17312,6 @@ async function main() {
   }
   const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
-    const { isGuestAccount: isGuestAccount2 } = await Promise.resolve().then(() => (init_client(), client_exports));
-    if (subcommand !== "doctor" && isGuestAccount2()) {
-      process.stderr.write(
-        "\n  This is a guest account, which can look but not change.\n  Create an account to use the management commands:\n    https://auth.solongate.com\n\n  Your project, its policy and everything already recorded carry over,\n  and this device keeps working without being paired again.\n\n"
-      );
-      process.exit(1);
-    }
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));
     process.exit(code);

package/dist/tui/index.js

@@ -530,8 +530,8 @@ var init_global_install = __esm({
 
 // src/tui/index.tsx
 import { appendFileSync, mkdirSync as mkdirSync7 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join11 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join10 } from "path";
 import { render } from "ink";
 
 // src/tui/App.tsx
@@ -935,16 +935,6 @@ function setViewCredentials(creds) {
   viewOverride = creds;
   cached2 = null;
 }
-var GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
-function isGuestAccount() {
-  try {
-    const active2 = loginCredentialFile().apiKey;
-    if (!active2) return false;
-    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
-  } catch {
-    return false;
-  }
-}
 function enforcingKey() {
   return loginCredentialFile().apiKey ?? null;
 }
@@ -1000,12 +990,6 @@ var ApiError = class extends Error {
     this.code = code;
   }
 };
-var GuestReadOnlyError = class extends Error {
-  constructor() {
-    super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
-    this.name = "GuestReadOnlyError";
-  }
-};
 var NotAuthenticatedError = class extends Error {
   constructor() {
     super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -1070,9 +1054,6 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
-  if (method !== "GET" && isGuestAccount()) {
-    throw new GuestReadOnlyError();
-  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {
@@ -2422,18 +2403,18 @@ function LivePanel({ active: active2 }) {
       }
     ) : null,
     activeAction ? /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: activeAction.level === "bad" ? "#3d1220" : "#123d1f", color: activeAction.level === "bad" ? "#ff6b6b" : "#7bd88f", bold: true, children: ` ${truncate(activeAction.text, innerW - 4)} ` }) : null,
-    /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, children: [
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, marginRight: 2, children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, height: 1 + chartH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "TRAFFIC", extra: `${trafficLabel} \xB7 peak ${Math.max(0, ...traffic)} \xB7 red = denials`, width: leftW }),
         /* @__PURE__ */ jsx2(ColumnChart, { series: traffic, hot: trafficHot, height: chartH, width: leftW, color: theme.accent })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: rightW, children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: rightW, height: 1 + chartH, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "API LATENCY", extra: `now ${latNow}ms \xB7 med ${latMed}ms \xB7 amber >${Math.round(latHotAt)}ms`, width: rightW }),
         /* @__PURE__ */ jsx2(ColumnChart, { series: lat, hot: lat.map((v) => v > latHotAt), height: chartH, width: rightW, color: "white", hotColor: "#ffb454" })
       ] })
     ] }),
-    /* @__PURE__ */ jsxs2(Box2, { height: colH, children: [
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: colH, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "LAYERS", extra: "l = inspect", width: colW }),
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "RATELIMIT ".padEnd(10) }),
@@ -2446,7 +2427,11 @@ function LivePanel({ active: active2 }) {
           /* @__PURE__ */ jsx2(Text2, { color: dl?.mode === "block" ? theme.ok : dl?.mode === "detect" ? theme.warn : theme.dim, children: (dl?.mode ?? "?").padEnd(7) }),
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${(dl?.patterns ?? []).length} builtin \xB7 ${(dl?.custom ?? []).length} custom` })
         ] }),
-        dlpBars.length ? dlpBars.map((d2) => /* @__PURE__ */ jsx2(HBar, { label: truncate(d2.pattern, 10), value: d2.count, max: maxDlpBar, width: Math.max(6, colW - 16), color: theme.bad }, d2.pattern)) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "          no dlp hits in last 7 days" }),
+        dlpBars.length ? dlpBars.map((d2) => /* @__PURE__ */ jsx2(HBar, { label: truncate(d2.pattern, 10), value: d2.count, max: maxDlpBar, width: Math.max(6, colW - 16), color: theme.bad }, d2.pattern)) : (
+          // 36 chars against a colW that is ~31 at cols=100: without truncate
+          // this wrapped onto a second line and pushed the column over colH.
+          /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", color: theme.dim, children: "          no dlp hits in last 7 days" })
+        ),
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "GUARD".padEnd(10) }),
           ring ? /* @__PURE__ */ jsxs2(Text2, { color: theme.ok, children: [
@@ -2455,7 +2440,7 @@ function LivePanel({ active: active2 }) {
           ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "no local ring in cwd" })
         ] })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: mode === "pick" ? "\u2191\u2193 pick \xB7 enter open" : `${combinedSess.length} \xB7 s = inspect`, width: colW }),
         pickable.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "scanning\u2026" }) : null,
         pickable.map((r, i) => {
@@ -2481,7 +2466,7 @@ function LivePanel({ active: active2 }) {
           ] }, r.id);
         })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "system heartbeat", width: colW }),
         log.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
@@ -4677,26 +4662,7 @@ async function tuiUpdateFlow(onStatus) {
 }
 
 // src/tui/panels/Settings.tsx
-import { readFileSync as readFileSync8, readdirSync as readdirSync2 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
 import { Fragment as Fragment5, jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
-function guestAllowance() {
-  try {
-    const dir = join10(homedir10(), ".solongate");
-    for (const f of readdirSync2(dir)) {
-      if (!f.startsWith(".policy-cache-") || !f.endsWith(".json")) continue;
-      try {
-        const c2 = JSON.parse(readFileSync8(join10(dir, f), "utf-8"));
-        const q = c2?.security?.guestQuota;
-        if (q && typeof q.limit === "number") return { used: q.used ?? 0, limit: q.limit };
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return null;
-}
 var EVENTS = ["denials", "allowed", "all"];
 var SPIN2 = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var SIGNALS2 = ["any", "deny", "dlp", "ratelimit"];
@@ -4761,7 +4727,6 @@ function SettingsPanel({
     const step = setInterval(() => setDiagStep((s) => Math.min(s + 1, total - 1)), 220);
     return () => clearInterval(step);
   }, [diagBusy]);
-  void guestAllowance;
   const ver = currentVersion();
   useEffect7(() => {
     let live2 = true;
@@ -5326,15 +5291,6 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add account (enter \u2014 device login in the browser)" })
         ] });
-      case "allowance": {
-        const left = Math.max(0, r.limit - r.used);
-        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-          cursor(r),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "allowance".padEnd(11) }),
-          /* @__PURE__ */ jsx8(Text8, { color: left === 0 ? theme.bad : left <= 20 ? theme.warn : theme.ok, bold: true, children: `${r.used}/${r.limit} tool calls` }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: left === 0 ? "   used up \u2014 every call is denied \xB7 create an account to carry on" : `   ${left} left on this guest account \xB7 create an account for no limit` })
-        ] });
-      }
       case "guard":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -5440,7 +5396,7 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
@@ -5610,23 +5566,7 @@ function App() {
   const acctIdx = Math.max(0, accounts.findIndex((a) => a.apiKey === viewKey));
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
-  const isGuestAccount2 = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const acctLabel2 = !cur ? "not logged in" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
-  const [guestSpent, setGuestSpent] = useState9(false);
-  useEffect8(() => {
-    if (!isGuestAccount2) {
-      setGuestSpent(false);
-      return;
-    }
-    let alive = true;
-    api.auth.me().then((r) => {
-      if (alive) setGuestSpent(r.guest?.exhausted === true);
-    }).catch(() => {
-    });
-    return () => {
-      alive = false;
-    };
-  }, [isGuestAccount2, cur?.apiKey]);
+  const acctLabel2 = !cur ? "not logged in" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -5712,12 +5652,7 @@ function App() {
       /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
         /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "account: " }),
         /* @__PURE__ */ jsx9(Text9, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
-        locked ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : guestSpent ? (
-          // Said on this line rather than on a new one: every panel budgets its
-          // height against a fixed shell, so one more line up here silently clips
-          // a row off whichever panel is open.
-          /* @__PURE__ */ jsx9(Text9, { color: theme.bad, bold: true, children: "  \xB7 allowance used up \xB7 every call denied \xB7 create an account to carry on" })
-        ) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
+        locked ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
         update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : update2.kind === "available" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} out \xB7 Settings \u2192 UPDATES` }) : update2.kind === "needs-admin" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} needs admin rights \xB7 Settings \u2192 UPDATES` }) : null
       ] }),
       /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
@@ -5766,11 +5701,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join11(homedir11(), ".solongate", "dataroom-debug.log");
+  const debugLog = join10(homedir10(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync7(join11(homedir11(), ".solongate"), { recursive: true });
+      mkdirSync7(join10(homedir10(), ".solongate"), { recursive: true });
       appendFileSync(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 70;
+var HOOK_VERSION = 71;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -7951,53 +7951,10 @@ function rateLimitCheck(agentKey, limits) {
     return null;
   }
 }
-function quotaTally(used) {
-  const dir = resolve(homedir(), ".solongate");
-  const markFile = join(dir, ".quota-mark");
-  const tallyFile = join(dir, ".quota-tally");
-  let n = 0;
-  try {
-    let mark = null;
-    if (existsSync(markFile)) {
-      try {
-        mark = readFileSync(markFile, "utf-8").trim();
-      } catch {
-      }
-    }
-    if (mark !== String(used)) {
-      writeFileSync(markFile, String(used));
-      writeFileSync(tallyFile, "");
-    } else if (existsSync(tallyFile)) {
-      try {
-        n = statSync(tallyFile).size;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return {
-    n,
-    add() {
-      try {
-        appendFileSync(tallyFile, ".");
-      } catch {
-      }
-    }
-  };
-}
 function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg)
     return null;
   try {
-    const q = cfg.guestQuota;
-    if (q) {
-      const tally = quotaTally(q.used ?? 0);
-      const spent = (q.used ?? 0) + tally.n;
-      if (q.exhausted || spent >= q.limit) {
-        return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on. Your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate, Settings, guard, then press d.`;
-      }
-      tally.add();
-    }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);
       if (hit)

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 70;
+const HOOK_VERSION = 71;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -1761,62 +1761,10 @@ function rateLimitCheck(agentKey, limits) {
   }
 }
 
-// The allowance figure the API sends is built from audit rows, and those are
-// written AFTER a call runs. Under a burst of parallel tool calls every hook
-// therefore reads the same pre-burst figure, and the allowance overshoots by
-// roughly a batch before the count catches up.
-//
-// The guard is the thing making the calls, so it can close that gap without
-// another round trip: it tallies what it has already let through since the
-// server's figure last moved, and adds it in. One byte is appended per call and
-// the file's LENGTH is the count, because many hooks run at once and a
-// read-modify-write would lose increments; an O_APPEND write of a single byte
-// does not interleave.
-function quotaTally(used) {
-  const dir = resolve(homedir(), '.solongate');
-  const markFile = join(dir, '.quota-mark');
-  const tallyFile = join(dir, '.quota-tally');
-  let n = 0;
-  try {
-    let mark = null;
-    if (existsSync(markFile)) { try { mark = readFileSync(markFile, 'utf-8').trim(); } catch {} }
-    // A figure that has moved means the audit rows caught up and absorbed the
-    // local tally, so it starts again from there.
-    if (mark !== String(used)) {
-      writeFileSync(markFile, String(used));
-      writeFileSync(tallyFile, '');
-    } else if (existsSync(tallyFile)) {
-      try { n = statSync(tallyFile).size; } catch {}
-    }
-  } catch { /* a missing tally only costs accuracy near the edge, never the gate */ }
-  return {
-    n,
-    add() { try { appendFileSync(tallyFile, '.'); } catch {} },
-  };
-}
-
 // Runs all enabled enforcement layers; returns a deny reason or null (allow).
 function securityLayerCheck(toolName, args, cfg, agentKey) {
   if (!cfg) return null;
   try {
-    // Guest allowance. A guest account is a trial, so past its allowance every
-    // call is denied without exception rather than quietly running unguarded:
-    // an agent that believes it is protected and is not is worse off than one
-    // that is stopped and told why. Checked first, so no other layer can let a
-    // call through after the allowance is gone.
-    const q = cfg.guestQuota;
-    if (q) {
-      // The server's figure plus what this device has run since, so a burst
-      // cannot spend past the allowance while the audit rows are still in flight.
-      const tally = quotaTally(q.used ?? 0);
-      const spent = (q.used ?? 0) + tally.n;
-      if (q.exhausted || spent >= q.limit) {
-        return `Guest allowance used up (${q.limit} tool calls). Create an account at https://auth.solongate.com to carry on. Your project, its policy and everything recorded carry over, and this device keeps working. To stop guarding this machine instead: solongate, Settings, guard, then press d.`;
-      }
-      // Counted here rather than after the verdict, because a call the policy
-      // goes on to deny is still recorded and still spends the allowance.
-      tally.add();
-    }
     if (cfg.dlpBlock) {
       const hit = dlpScan(args, cfg.dlpBlock);
       if (hit) return 'Security layer (DLP): blocked - arguments contain a ' + hit +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.4",
+  "version": "0.83.5",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {