@solongate/proxy 0.83.5 → 0.83.6

package/hooks/audit.mjs

@@ -11,7 +11,7 @@ import { homedir } from 'node:os';
 // Bump on every audit hook change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 23;
+const HOOK_VERSION = 24;
 
 function loadEnvKey(dir) {
   try {
@@ -375,9 +375,12 @@ function loadLocalLogs() {
       const c = JSON.parse(readFileSync(f, 'utf-8'));
       const l = c && c.security && c.security.localLogs;
       if (l && l.enabled && typeof l.path === 'string' && l.path.trim()) return { path: l.path.trim() };
-      // A cache that HAS a security block and no localLogs means the project
-      // really turned local logging off — cloud it is.
-      if (c && c.security) return null;
+      // A cache that carries the key at all has an ANSWER, and the answer is
+      // "not local" — including when it is null, which is what the refresh
+      // writes for a project with no security config. Requiring it to be
+      // truthy sent that case to the device-wide marker instead, so a stale
+      // marker kept ALLOW rows on disk after local logging was switched off.
+      if (c && 'security' in c) return null;
     }
   } catch { /* unreadable cache — fall through to the marker */ }
   // No usable config (cold cache, or a refresh that failed while the key was

package/hooks/guard.bundled.mjs

@@ -6536,10 +6536,10 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 71;
+var HOOK_VERSION = 72;
 function localLogsOnly(security) {
-  if (security && typeof security === "object") {
-    const l = security.localLogs;
+  if (security !== void 0) {
+    const l = security && security.localLogs;
     return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
   }
   try {
@@ -6813,8 +6813,7 @@ async function refreshPolicyCache() {
         const body = await res.json();
         if (typeof body?.self_protection_enabled === "boolean")
           selfProtect = body.self_protection_enabled;
-        if (body?.security !== void 0)
-          security = body.security;
+        security = body?.security !== void 0 ? body.security : null;
         if (body?.hook_versions && typeof body.hook_versions === "object")
           hookVersions = body.hook_versions;
         policy = body && body.policy ? body.policy : null;

package/hooks/guard.mjs

@@ -32,20 +32,28 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 71;
+const HOOK_VERSION = 72;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
+//
+// `undefined` is the ONLY value that means "we do not know yet". `null` is an
+// answer: it is what the refresh writes when the API returns no security block,
+// i.e. this project has no local-log config, i.e. cloud. Treating null as
+// unknown is what kept logs on the machine after local logging was switched
+// off — the answer fell through to the device-wide marker, and that marker is
+// shared by every agent on the box while the policy cache is per agent, so
+// whichever one refreshed last decided where everybody's logs went.
 function localLogsOnly(security) {
-  if (security && typeof security === 'object') {
-    const l = security.localLogs;
+  if (security !== undefined) {
+    const l = security && security.localLogs;
     return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
   }
-  // security UNKNOWN (cold start / policy-cache miss / mid-toggle): consult the
-  // persisted local-mode marker so a DENY is NEVER leaked to the cloud when this
-  // device is in local-only mode. Without this fallback the first call(s) before
-  // the policy cache warms POST the denial to the cloud and fire webhooks/alerts
-  // even though the user chose local-only.
+  // Genuinely unknown (cold start, unreadable cache): consult the persisted
+  // marker so a DENY is NEVER leaked to the cloud when this device is in
+  // local-only mode. Without this fallback the first call(s) before the policy
+  // cache warms POST the denial to the cloud and fire webhooks/alerts even
+  // though the user chose local-only.
   try {
     const m = JSON.parse(readFileSync(join(resolve(homedir(), '.solongate'), '.local-logs-mode.json'), 'utf-8'));
     return !!(m && m.localOnly);
@@ -421,7 +429,12 @@ async function refreshPolicyCache() {
       if (res.ok) {
         const body = await res.json();
         if (typeof body?.self_protection_enabled === 'boolean') selfProtect = body.self_protection_enabled;
-        if (body?.security !== undefined) security = body.security;
+        // A successful answer REPLACES the security block rather than merging
+        // into it. Only overwriting when the field was present meant a config
+        // the API had stopped sending lived on in the cache forever — switch
+        // local logging off in the dashboard and this device kept writing to
+        // disk and kept skipping the cloud, with nothing to show why.
+        security = body?.security !== undefined ? body.security : null;
         if (body?.hook_versions && typeof body.hook_versions === 'object') hookVersions = body.hook_versions;
         policy = (body && body.policy) ? body.policy : null;
         noteAuthResult(true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.5",
+  "version": "0.83.6",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {