@solongate/proxy 0.83.56 → 0.83.58

package/hooks/conversation.mjs

@@ -43,7 +43,7 @@ import { resolve } from 'node:path';
 import { homedir } from 'node:os';
 
 // Bump on every change to this file, alongside the other hooks.
-const HOOK_VERSION = 1;
+const HOOK_VERSION = 2;
 
 const AGENT_ID = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
 
@@ -121,6 +121,59 @@ function readStdin() {
   try { return readFileSync(0, 'utf-8'); } catch { return ''; }
 }
 
+// send is one turn, redacted, to the API. Both payload shapes end here.
+async function send(sessionId, role, body, agentName) {
+  if (!sessionId || !String(body).trim()) return;
+
+  const cfg = loadGlobalCloudConfig();
+  const apiKey = process.env.SOLONGATE_API_KEY || cfg.apiKey || '';
+  const apiUrl = process.env.SOLONGATE_API_URL || cfg.apiUrl || 'https://api.solongate.com';
+  if (!apiKey) return;
+
+  const cache = loadPolicyCache();
+  if (localLogsOn(cache)) return;
+
+  const cleaned = redact(body, cache);
+  try {
+    await fetch(`${apiUrl}/api/v1/conversations`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        session_id: sessionId,
+        role,
+        body: cleaned.text,
+        redacted: cleaned.masked,
+        agent_id: AGENT_ID,
+        agent_name: agentName || '',
+        source: `${AGENT_ID}-hook`,
+        hook_version: HOOK_VERSION,
+      }),
+    });
+  } catch { /* silent: a record that could not be sent must not fail a turn */ }
+}
+
+// sendAntigravity writes both halves of the exchange from one Stop payload.
+//
+// The prompt goes first and the reply second, and they are sent in that order
+// rather than concurrently: the rows are ordered by their timestamps, and two
+// requests in flight at once can land in the other order on a fast link — which
+// would draw the answer above the question.
+async function sendAntigravity(common, stop) {
+  const sessionId = common.conversationId || common.conversation_id ||
+    common.sessionId || common.session_id || '';
+  if (!sessionId) return;
+  const name = common.agentName || common.agent_name || 'Antigravity';
+
+  const prompt = common.lastUserInput || common.last_user_input || '';
+  if (String(prompt).trim()) await send(sessionId, 'prompt', prompt, name);
+
+  const reply = stop ? (stop.finalModelOutput || stop.final_model_output || '') : '';
+  if (String(reply).trim()) await send(sessionId, 'reply', reply, name);
+}
+
 (async () => {
   // Whatever happens below, this hook allows the turn. It has no opinion about
   // whether the work should proceed; it is a record of it.
@@ -130,6 +183,36 @@ function readStdin() {
   try { data = JSON.parse(readStdin() || '{}'); } catch { return; }
 
   const event = data.hook_event_name || data.hookEventName || '';
+
+  // ANTIGRAVITY sends a different shape, and one hook carries both halves.
+  //
+  // Its payload is `{common: {lastUserInput, conversationId, ...}, args: {...}}`
+  // — the person's last message rides on EVERY hook rather than on an event of
+  // its own, and the answer arrives as `stopHookArgs.finalModelOutput`. So one
+  // Stop registration records the whole exchange, where Claude Code and Codex
+  // need two events to do the same thing.
+  //
+  // It is detected by shape rather than by a flag, because the client name is
+  // an argv argument this hook is also given for the other three, and a payload
+  // is a fact while an argument is a claim.
+  // OPENCODE calls this hook directly from its plugin, which already knows
+  // which half it holds — its two halves arrive by different routes (a
+  // chat.message hook for the prompt, streamed text parts for the reply), so
+  // the plugin does the deciding and this file does the sending.
+  if (data.opencode === true) {
+    await send(data.session_id || '', data.role === 'reply' ? 'reply' : 'prompt',
+      data.body || '', 'OpenCode');
+    return;
+  }
+
+  const agCommon = data.common || (data.hookArgs && data.hookArgs.common) || null;
+  const agStop = data.stopHookArgs || (data.args && data.args.stopHookArgs) ||
+    (data.hookArgs && data.hookArgs.stopHookArgs) || null;
+  if (agCommon && (agStop || agCommon.lastUserInput)) {
+    await sendAntigravity(agCommon, agStop);
+    return;
+  }
+
   // The two halves. Nothing else is listened for: PreToolUse and PostToolUse
   // already have hooks and are about tool calls rather than about words.
   let role = '';
@@ -151,33 +234,5 @@ function readStdin() {
   const sessionId = data.session_id || data.sessionId || data.conversation_id || '';
   if (!sessionId) return;
 
-  const cfg = loadGlobalCloudConfig();
-  const apiKey = process.env.SOLONGATE_API_KEY || cfg.apiKey || '';
-  const apiUrl = process.env.SOLONGATE_API_URL || cfg.apiUrl || 'https://api.solongate.com';
-  if (!apiKey) return;
-
-  const cache = loadPolicyCache();
-  if (localLogsOn(cache)) return;
-
-  const cleaned = redact(body, cache);
-
-  try {
-    await fetch(`${apiUrl}/api/v1/conversations`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${apiKey}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        session_id: sessionId,
-        role,
-        body: cleaned.text,
-        redacted: cleaned.masked,
-        agent_id: AGENT_ID,
-        agent_name: data.agent_name || '',
-        source: `${AGENT_ID}-hook`,
-        hook_version: HOOK_VERSION,
-      }),
-    });
-  } catch { /* silent: a record that could not be sent must not fail a turn */ }
+  await send(sessionId, role, body, data.agent_name || '');
 })();

package/hooks/opencode-plugin.mjs

@@ -36,6 +36,7 @@ import { join } from 'node:path';
 const HOOKS_DIR = join(homedir(), '.solongate', 'hooks');
 const GUARD = join(HOOKS_DIR, 'guard.mjs');
 const AUDIT = join(HOOKS_DIR, 'audit.mjs');
+const CONVERSATION = join(HOOKS_DIR, 'conversation.mjs');
 
 // The node binary, written in by the installer.
 //
@@ -48,6 +49,25 @@ const AUDIT = join(HOOKS_DIR, 'audit.mjs');
 const NODE_BAKED = '__SOLONGATE_NODE__';
 const NODE = NODE_BAKED.startsWith('__SOLONGATE') || !existsSync(NODE_BAKED) ? 'node' : NODE_BAKED;
 
+// On POSIX the spawn goes through the shared launcher instead, which resolves
+// node at RUN time and leaves the beat every other client leaves.
+//
+// The baked path above is `process.execPath` from the install, and on a Mac
+// that is a Homebrew Cellar path or an nvm version directory — both deleted by
+// a routine upgrade. The `'node'` fallback then needs PATH to have one, which
+// is exactly the assumption that does not hold inside a hook environment. The
+// launcher tries the baked path first, then PATH, then everywhere a Mac keeps a
+// node.
+const LAUNCHER = join(HOOKS_DIR, 'sg-run.sh');
+const USE_LAUNCHER = process.platform !== 'win32' && existsSync(LAUNCHER);
+
+/** The argv for one hook run: through the launcher when there is one. */
+function spawnArgs(script) {
+  return USE_LAUNCHER
+    ? ['/bin/sh', [LAUNCHER, script, 'opencode', 'OpenCode']]
+    : [NODE, [script, 'opencode', 'OpenCode']];
+}
+
 // The guard carries its own 8s backstop; this is the outer bound for the whole
 // round trip so a wedged process can never hang the editor.
 const GUARD_TIMEOUT_MS = 15000;
@@ -63,7 +83,8 @@ function runHook(script, payload, timeoutMs) {
     const finish = (v) => { if (!done) { done = true; resolve(v); } };
     let child;
     try {
-      child = spawn(NODE, [script, 'opencode', 'OpenCode'], {
+      const [bin, argv] = spawnArgs(script);
+      child = spawn(bin, argv, {
         stdio: ['pipe', 'pipe', 'pipe'],
         windowsHide: true,
       });
@@ -104,6 +125,26 @@ function rewritePatch(res) {
   return null;
 }
 
+// The assistant text held between the part events and the message completing.
+//
+// Keyed by message id, cleared on flush, and dropped whole past a bound: a
+// plugin that grows a buffer for the life of an editor session is a leak in
+// somebody's editor, which is a worse bug than a missing transcript.
+const pending = new Map();
+const MAX_PENDING = 64;
+
+// textOf joins the text parts of a message and ignores the rest — a file
+// attachment or a tool call is not something a person said. A synthetic part
+// is one OpenCode wrote itself, which is not either.
+function textOf(parts) {
+  if (!Array.isArray(parts)) return '';
+  return parts
+    .filter((x) => x && x.type === 'text' && typeof x.text === 'string' && !x.synthetic)
+    .map((x) => x.text)
+    .join('\n')
+    .trim();
+}
+
 export const SolonGate = async ({ directory, worktree } = {}) => {
   const cwd = directory || worktree || process.cwd();
 
@@ -135,6 +176,58 @@ export const SolonGate = async ({ directory, worktree } = {}) => {
       }
     },
 
+    // ── the conversation record ──────────────────────────────────────────
+    //
+    // OpenCode is the third client to record this and the only one that needs
+    // two different hooks to do it, because its halves arrive by different
+    // routes: `chat.message` carries what the person wrote, and the answer is
+    // streamed as text PARTS which are only final when the assistant message
+    // is.
+    //
+    // So the parts are held per message id and flushed when that message
+    // completes.
+    'chat.message': async (input, output) => {
+      const text = textOf(output?.parts);
+      if (!text) return;
+      void runHook(CONVERSATION, {
+        opencode: true,
+        role: 'prompt',
+        body: text,
+        session_id: input?.sessionID ?? output?.message?.sessionID ?? '',
+      }, GUARD_TIMEOUT_MS);
+    },
+
+    event: async ({ event } = {}) => {
+      if (!event || typeof event !== 'object') return;
+
+      // A text part of a message. `text` is the WHOLE text so far rather than a
+      // delta, so the last one wins and nothing is concatenated.
+      if (event.type === 'message.part.updated') {
+        const part = event.properties?.part;
+        if (part?.type === 'text' && part.messageID && typeof part.text === 'string') {
+          if (pending.size > MAX_PENDING) pending.clear();
+          pending.set(part.messageID, { text: part.text, sessionID: part.sessionID ?? '' });
+        }
+        return;
+      }
+
+      // The message finished. Anything else — a user message, one still being
+      // written — is not a completed answer and is left alone.
+      if (event.type === 'message.updated') {
+        const info = event.properties?.info;
+        if (!info || info.role !== 'assistant' || !info.time?.completed) return;
+        const held = pending.get(info.id);
+        pending.delete(info.id);
+        if (!held || !held.text.trim()) return;
+        void runHook(CONVERSATION, {
+          opencode: true,
+          role: 'reply',
+          body: held.text,
+          session_id: info.sessionID || held.sessionID || '',
+        }, GUARD_TIMEOUT_MS);
+      }
+    },
+
     'tool.execute.after': async (input, output) => {
       // The ALLOW-path audit record. Fire and forget: it must never delay the
       // editor, and losing one line is better than a stalled tool.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.56",
+  "version": "0.83.58",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {
@@ -61,12 +61,12 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@solongate/guard-linux-x64": "0.83.55",
-    "@solongate/guard-linux-arm64": "0.83.55",
-    "@solongate/guard-darwin-x64": "0.83.55",
-    "@solongate/guard-darwin-arm64": "0.83.55",
-    "@solongate/guard-win32-x64": "0.83.55",
-    "@solongate/guard-win32-arm64": "0.83.55"
+    "@solongate/guard-linux-x64": "0.83.58",
+    "@solongate/guard-linux-arm64": "0.83.58",
+    "@solongate/guard-darwin-x64": "0.83.58",
+    "@solongate/guard-darwin-arm64": "0.83.58",
+    "@solongate/guard-win32-x64": "0.83.58",
+    "@solongate/guard-win32-arm64": "0.83.58"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",