@solongate/proxy 0.83.55 → 0.83.57

package/dist/api-client/audit.d.ts

@@ -12,19 +12,6 @@ export interface AuditQuery {
     signal?: 'dlp' | 'ratelimit';
 }
 export declare function list(query?: AuditQuery): Promise<AuditList>;
-export declare function remove(ids: string[]): Promise<{
-    deleted: {
-        logs: number;
-        agents: number;
-    };
-}>;
-/** Deletes EVERY audit log of the project (agents/sessions are kept). */
-export declare function removeAll(): Promise<{
-    deleted: {
-        logs: number;
-        agents: number;
-    };
-}>;
 export declare function whitelist(id: string, scope?: 'exact' | 'tool'): Promise<{
     ok: true;
     deduped: boolean;

package/dist/commands/index.js

@@ -5,59 +5,118 @@ var __export = (target, all) => {
 };
 
 // src/api-client/client.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync2 } from "fs";
-import { resolve as resolve2, join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync3 } from "fs";
+import { resolve as resolve2, join as join3 } from "path";
+import { homedir as homedir3 } from "os";
 
 // src/global-install.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync, rmdirSync, readdirSync, statSync, chmodSync, copyFileSync, renameSync } from "fs";
-import { resolve, join, dirname } from "path";
-import { homedir } from "os";
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync, rmSync, rmdirSync, readdirSync, statSync as statSync2, chmodSync, copyFileSync, renameSync } from "fs";
+import { resolve, join as join2, dirname, basename } from "path";
+import { homedir as homedir2 } from "os";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
-import { execFileSync, spawn } from "child_process";
+import { execFileSync as execFileSync2, spawn } from "child_process";
+
+// src/hook-launcher.ts
+var LAUNCHER_NAME = "sg-run.sh";
+var BEAT_DIR = ".beat";
+
+// src/hook-health.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync, statSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var sgDir = () => join(homedir(), ".solongate");
+var hooksDir = () => join(sgDir(), "hooks");
+function hookCanStart() {
+  const launcher = join(hooksDir(), LAUNCHER_NAME);
+  if (process.platform === "win32") {
+    const ok = existsSync(process.execPath);
+    return { ok, node: process.execPath, detail: ok ? process.execPath : `${process.execPath} is gone` };
+  }
+  if (!existsSync(launcher)) {
+    return { ok: false, detail: "hook launcher missing - run `solongate repair`" };
+  }
+  try {
+    const out2 = execFileSync("/bin/sh", [launcher, "--sg-doctor"], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    if (!out2) return { ok: false, detail: "launcher found no node runtime - set SOLONGATE_NODE or install node" };
+    return { ok: true, node: out2, detail: out2 };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { ok: false, detail: `launcher will not run: ${msg.split("\n")[0]}` };
+  }
+}
+function hookBeats() {
+  const dir = join(sgDir(), BEAT_DIR);
+  const out2 = [];
+  for (const hook of ["guard.mjs", "audit.mjs", "conversation.mjs", "stop.mjs"]) {
+    const f = join(dir, hook);
+    try {
+      const st = statSync(f);
+      out2.push({ hook, at: st.mtime, node: readFileSync(f, "utf-8").trim() });
+    } catch {
+    }
+  }
+  return out2.sort((a, b) => b.at.getTime() - a.at.getTime());
+}
+function guardBeat() {
+  return hookBeats().find((b) => b.hook === "guard.mjs") ?? null;
+}
+function agoLabel(d) {
+  const s = Math.max(0, Math.round((Date.now() - d.getTime()) / 1e3));
+  if (s < 60) return s <= 3 ? "just now" : `${s}s ago`;
+  if (s < 3600) return `${Math.round(s / 60)}m ago`;
+  if (s < 86400) return `${Math.round(s / 3600)}h ago`;
+  return `${Math.round(s / 86400)}d ago`;
+}
+
+// src/global-install.ts
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var HOOKS_DIR = resolve(__dirname, "..", "hooks");
 function globalPaths() {
-  const home = homedir();
-  const sgDir = join(home, ".solongate");
-  const hooksDir = join(sgDir, "hooks");
-  const claudeDir = join(home, ".claude");
-  const antigravityDir = join(home, ".gemini", "config");
-  const codexDir = process.env["CODEX_HOME"] ? resolve(process.env["CODEX_HOME"]) : join(home, ".codex");
-  const opencodeDir = join(process.env["XDG_CONFIG_HOME"] ? resolve(process.env["XDG_CONFIG_HOME"]) : join(home, ".config"), "opencode");
-  const binDir = join(sgDir, "bin");
+  const home = homedir2();
+  const sgDir2 = join2(home, ".solongate");
+  const hooksDir2 = join2(sgDir2, "hooks");
+  const claudeDir = join2(home, ".claude");
+  const antigravityDir = join2(home, ".gemini", "config");
+  const codexDir = process.env["CODEX_HOME"] ? resolve(process.env["CODEX_HOME"]) : join2(home, ".codex");
+  const opencodeDir = join2(process.env["XDG_CONFIG_HOME"] ? resolve(process.env["XDG_CONFIG_HOME"]) : join2(home, ".config"), "opencode");
+  const binDir = join2(sgDir2, "bin");
   return {
     home,
-    sgDir,
-    hooksDir,
+    sgDir: sgDir2,
+    hooksDir: hooksDir2,
     binDir,
     claudeDir,
     antigravityDir,
     codexDir,
     opencodeDir,
-    settingsPath: join(claudeDir, "settings.json"),
-    backupPath: join(claudeDir, "settings.solongate.bak"),
-    configPath: join(sgDir, "cloud-guard.json"),
+    settingsPath: join2(claudeDir, "settings.json"),
+    backupPath: join2(claudeDir, "settings.solongate.bak"),
+    configPath: join2(sgDir2, "cloud-guard.json"),
     // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
     // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
     // covered by the passive session-log collector, not a hook.
-    antigravityHooksPath: join(antigravityDir, "hooks.json"),
-    antigravityBackupPath: join(antigravityDir, "hooks.solongate.bak"),
+    antigravityHooksPath: join2(antigravityDir, "hooks.json"),
+    antigravityBackupPath: join2(antigravityDir, "hooks.solongate.bak"),
     // Codex reads user-level hooks from ~/.codex/hooks.json (or a [hooks] table
     // in ~/.codex/config.toml — we use the JSON file so we never have to rewrite
     // the user's TOML, which also holds the hook TRUST state Codex manages).
-    codexHooksPath: join(codexDir, "hooks.json"),
-    codexBackupPath: join(codexDir, "hooks.solongate.bak"),
-    codexConfigPath: join(codexDir, "config.toml"),
+    codexHooksPath: join2(codexDir, "hooks.json"),
+    codexBackupPath: join2(codexDir, "hooks.solongate.bak"),
+    codexConfigPath: join2(codexDir, "config.toml"),
     // OpenCode scans its plugin folder at startup and loads every module in it.
     // Measured on 1.18.10: BOTH `plugin/` and `plugins/` are scanned, so the
     // docs and the field reports are each half right. We write the documented
     // one. There is nothing to register anywhere — dropping the file IS the
     // installation, which also means deleting the file IS the uninstall.
-    opencodePluginDir: join(opencodeDir, "plugins"),
-    opencodePluginPath: join(opencodeDir, "plugins", "solongate.js")
+    opencodePluginDir: join2(opencodeDir, "plugins"),
+    opencodePluginPath: join2(opencodeDir, "plugins", "solongate.js")
   };
 }
 function isOurCodexGroup(group) {
@@ -66,10 +125,10 @@ function isOurCodexGroup(group) {
 }
 function readCodexHooksFile(path) {
   const out2 = { hooks: {}, rest: {} };
-  if (!existsSync(path)) return out2;
+  if (!existsSync2(path)) return out2;
   let raw;
   try {
-    raw = JSON.parse(readFileSync(path, "utf-8"));
+    raw = JSON.parse(readFileSync2(path, "utf-8"));
   } catch {
     return out2;
   }
@@ -117,7 +176,7 @@ function isCodexGuardInstalled() {
 }
 function codexDetected() {
   try {
-    return existsSync(globalPaths().codexDir);
+    return existsSync2(globalPaths().codexDir);
   } catch {
     return false;
   }
@@ -127,7 +186,7 @@ function codexHooksStatus() {
   const registered = isCodexGuardInstalled();
   let trusted = false, disabled = false;
   try {
-    const toml = readFileSync(p.codexConfigPath, "utf-8");
+    const toml = readFileSync2(p.codexConfigPath, "utf-8");
     trusted = /trusted_hash\s*=/.test(toml);
     disabled = /^\s*hooks\s*=\s*false\s*$/m.test(toml);
   } catch {
@@ -136,14 +195,14 @@ function codexHooksStatus() {
 }
 function isOpencodeGuardInstalled() {
   try {
-    return readFileSync(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
+    return readFileSync2(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
   } catch {
     return false;
   }
 }
 function opencodeDetected() {
   try {
-    return existsSync(globalPaths().opencodeDir);
+    return existsSync2(globalPaths().opencodeDir);
   } catch {
     return false;
   }
@@ -151,7 +210,7 @@ function opencodeDetected() {
 function installedGuardVersion() {
   try {
     const p = globalPaths();
-    const s = readFileSync(join(p.hooksDir, "guard.mjs"), "utf-8");
+    const s = readFileSync2(join2(p.hooksDir, "guard.mjs"), "utf-8");
     const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
     return m ? parseInt(m[1], 10) : null;
   } catch {
@@ -161,8 +220,8 @@ function installedGuardVersion() {
 function isGuardInstalled() {
   try {
     const p = globalPaths();
-    if (!existsSync(p.settingsPath)) return false;
-    const s = JSON.parse(readFileSync(p.settingsPath, "utf-8"));
+    if (!existsSync2(p.settingsPath)) return false;
+    const s = JSON.parse(readFileSync2(p.settingsPath, "utf-8"));
     return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
   } catch {
     return false;
@@ -190,9 +249,9 @@ var NotAuthenticatedError = class extends Error {
 };
 function loginCredentialFile() {
   try {
-    const p = join2(homedir2(), ".solongate", "cloud-guard.json");
-    if (!existsSync2(p)) return {};
-    const c2 = JSON.parse(readFileSync2(p, "utf-8"));
+    const p = join3(homedir3(), ".solongate", "cloud-guard.json");
+    if (!existsSync3(p)) return {};
+    const c2 = JSON.parse(readFileSync3(p, "utf-8"));
     return c2 && typeof c2 === "object" ? c2 : {};
   } catch {
     return {};
@@ -201,8 +260,8 @@ function loginCredentialFile() {
 function dotenvApiKey() {
   try {
     const envPath = resolve2(".env");
-    if (!existsSync2(envPath)) return void 0;
-    for (const line of readFileSync2(envPath, "utf-8").split("\n")) {
+    if (!existsSync3(envPath)) return void 0;
+    for (const line of readFileSync3(envPath, "utf-8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
       const eq = trimmed.indexOf("=");
@@ -480,19 +539,11 @@ var audit_exports = {};
 __export(audit_exports, {
   block: () => block,
   list: () => list2,
-  remove: () => remove2,
-  removeAll: () => removeAll,
   whitelist: () => whitelist
 });
 function list2(query = {}) {
   return request("GET", "/audit-logs", { query });
 }
-function remove2(ids) {
-  return request("DELETE", "/audit-logs", { body: { ids } });
-}
-function removeAll() {
-  return request("DELETE", "/audit-logs", { body: { scope: "logs" } });
-}
 function whitelist(id, scope = "exact") {
   return request("POST", `/audit-logs/${encodeURIComponent(id)}/whitelist`, { body: { scope } });
 }
@@ -645,7 +696,7 @@ function sparkline(values) {
 }
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 
 // src/commands/args.ts
 function parse(argv) {
@@ -910,7 +961,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync3(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -1332,39 +1383,39 @@ async function runAgent(argv) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 
 // src/tui/local-log.ts
-import { closeSync, existsSync as existsSync3, openSync, readdirSync as readdirSync2, readFileSync as readFileSync4, readSync, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
+import { closeSync, existsSync as existsSync4, openSync, readdirSync as readdirSync2, readFileSync as readFileSync5, readSync, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
 import { createHash } from "crypto";
-import { isAbsolute, join as join3 } from "path";
-var DEFAULT_LOCAL_LOG = join3(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
+import { isAbsolute, join as join4 } from "path";
+var DEFAULT_LOCAL_LOG = join4(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
 function localLogFile() {
   try {
-    const sgDir = join3(homedir3(), ".solongate");
-    const caches = readdirSync2(sgDir).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
-      const p = join3(sgDir, f);
+    const sgDir2 = join4(homedir4(), ".solongate");
+    const caches = readdirSync2(sgDir2).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
+      const p = join4(sgDir2, f);
       let mtime = 0;
       try {
-        mtime = statSync2(p).mtimeMs;
+        mtime = statSync3(p).mtimeMs;
       } catch {
       }
       return { p, mtime };
     }).sort((a, b) => b.mtime - a.mtime);
     for (const { p } of caches) {
       try {
-        const c2 = JSON.parse(readFileSync4(p, "utf-8"));
+        const c2 = JSON.parse(readFileSync5(p, "utf-8"));
         const l = c2?.security?.localLogs;
         if (!l || !l.enabled || typeof l.path !== "string" || !l.path.trim()) continue;
         const dir = l.path.trim().replace(/[\\/]+$/, "");
         if (!dir) continue;
         if (!isAbsolute(dir)) return DEFAULT_LOCAL_LOG;
-        const file = join3(dir, "solongate-audit.jsonl");
-        if (existsSync3(file)) return file;
-        return existsSync3(dir) ? file : DEFAULT_LOCAL_LOG;
+        const file = join4(dir, "solongate-audit.jsonl");
+        if (existsSync4(file)) return file;
+        return existsSync4(dir) ? file : DEFAULT_LOCAL_LOG;
       } catch {
       }
     }
@@ -1422,8 +1473,32 @@ async function collectChecks() {
     ok: claudeReg,
     detail: claudeReg ? "guard registered" : "guard NOT registered - run `solongate repair`"
   });
-  if (existsSync4(globalPaths().antigravityDir)) {
-    const reg = existsSync4(globalPaths().antigravityHooksPath);
+  if (claudeReg) {
+    const start = hookCanStart();
+    checks.push({
+      name: "hook runtime",
+      ok: start.ok,
+      detail: start.ok ? `node ${start.detail}` : `${start.detail} - nothing is being enforced or logged`
+    });
+    const beat = guardBeat();
+    if (!beat) {
+      checks.push({
+        name: "guard fired",
+        ok: "warn",
+        detail: "never - open your agent and run one tool call, then check again"
+      });
+    } else if (beat.node === "no-node") {
+      checks.push({
+        name: "guard fired",
+        ok: false,
+        detail: `${agoLabel(beat.at)}, but found no node to run with - run \`solongate repair\``
+      });
+    } else {
+      checks.push({ name: "guard fired", ok: true, detail: `${agoLabel(beat.at)} \xB7 ${beat.node}` });
+    }
+  }
+  if (existsSync5(globalPaths().antigravityDir)) {
+    const reg = existsSync5(globalPaths().antigravityHooksPath);
     checks.push({
       name: "Antigravity hooks",
       ok: reg,
@@ -1451,7 +1526,7 @@ async function collectChecks() {
     });
   }
   try {
-    const raw = readFileSync5(join4(homedir4(), ".solongate", ".key-rejected.json"), "utf-8");
+    const raw = readFileSync6(join5(homedir5(), ".solongate", ".key-rejected.json"), "utf-8");
     const m = JSON.parse(raw);
     const ageMin = m.ts ? Math.round((Date.now() - m.ts) / 6e4) : null;
     checks.push({
@@ -1462,8 +1537,8 @@ async function collectChecks() {
   } catch {
   }
   const LOCAL_LOG2 = localLogFile();
-  if (existsSync4(LOCAL_LOG2)) {
-    const st = statSync3(LOCAL_LOG2);
+  if (existsSync5(LOCAL_LOG2)) {
+    const st = statSync4(LOCAL_LOG2);
     const ageMin = (Date.now() - st.mtimeMs) / 6e4;
     checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
   } else {
@@ -1493,16 +1568,16 @@ async function run7(argv) {
 }
 
 // src/commands/trace.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5, resolve as resolve3 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join6, resolve as resolve3 } from "path";
 var USAGE7 = usage("solongate trace", "what the guard saw here", [
   ["trace", "the last evaluations in this directory"],
   ["trace --limit N", "how many to show (default 20)"],
   ["trace --json", "the raw records"]
 ]);
 function readAllRings() {
-  const root = join5(homedir5(), ".solongate", "projects");
+  const root = join6(homedir6(), ".solongate", "projects");
   let dirs;
   try {
     dirs = readdirSync3(root);
@@ -1513,7 +1588,7 @@ function readAllRings() {
   for (const d of dirs) {
     let text;
     try {
-      text = readFileSync6(join5(root, d, ".eval-ring.jsonl"), "utf-8");
+      text = readFileSync7(join6(root, d, ".eval-ring.jsonl"), "utf-8");
     } catch {
       continue;
     }
@@ -1593,12 +1668,12 @@ async function run8(argv) {
 }
 
 // src/commands/watch.ts
-import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync4 } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync6, openSync as openSync2, readSync as readSync2, statSync as statSync5 } from "fs";
 var trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
 var time = (ms) => new Date(ms).toTimeString().slice(0, 8);
 function tailLocal(file, maxBytes = 131072) {
   try {
-    const size = statSync4(file).size;
+    const size = statSync5(file).size;
     const start = Math.max(0, size - maxBytes);
     const fd = openSync2(file, "r");
     const buf = Buffer.alloc(size - start);
@@ -1640,7 +1715,7 @@ async function run9(argv) {
   };
   const pollLocal = () => {
     const LOCAL_LOG2 = localLogFile();
-    if (cloudOnly || !existsSync5(LOCAL_LOG2)) return;
+    if (cloudOnly || !existsSync6(LOCAL_LOG2)) return;
     const rows = [];
     for (const line of tailLocal(LOCAL_LOG2)) {
       try {

package/dist/global-install.d.ts

@@ -1,3 +1,5 @@
+export { BEAT_DIR, LAUNCHER_NAME, launcherScript } from './hook-launcher.js';
+export { agoLabel, guardBeat, hookBeats, hookCanStart } from './hook-health.js';
 export declare function lockProtected(): void;
 export declare function unlockProtected(): void;
 /**
@@ -112,6 +114,32 @@ export declare function guardHookOutdated(): boolean;
  * guard-status (which shows the version this device last reported and lingers for
  * ~14 days), so the dataroom can show "removed" the instant you remove it.
  */
+/**
+ * The command string a client config gets for one hook.
+ *
+ * POSIX goes through the launcher, which resolves node at run time. See
+ * hook-launcher.ts for why an absolute node path recorded at install time is
+ * not survivable on a Mac.
+ *
+ * Windows keeps naming node directly. Its node lives at a fixed location under
+ * Program Files rather than in a versioned directory a package manager deletes,
+ * there is no /bin/sh to launch from, and the `&` prefix is already required
+ * because Claude Code runs hook commands through PowerShell — which reads a
+ * line starting with a quoted path as a string literal rather than a command,
+ * fails to parse it, and runs nothing.
+ *
+ * `/bin/sh <script>` rather than executing the launcher directly, so the file
+ * never needs its executable bit. npm does not preserve the mode of files
+ * outside `bin`, and a launcher that unpacks as 0644 would fail to start on
+ * every install.
+ */
+export declare function hookCommandFor(hooksDir: string, script: string, client?: string, label?: string): string;
+/**
+ * Write the launcher. Called by every install path before the configs that
+ * point at it, because a config naming a launcher that is not there is the
+ * failure this whole file exists to end.
+ */
+export declare function writeLauncher(hooksDir: string): void;
 export declare function isGuardInstalled(): boolean;
 /**
  * TUI-safe uninstall (dataroom Settings → guard → remove). Same effect as