@solongate/proxy 0.83.57 → 0.83.59

package/dist/global-install.js

@@ -412,6 +412,9 @@ var ANTIGRAVITY_GROUP = "solongate-guard";
 function antigravityHookCommand(guardAbs) {
   return hookCommandFor(dirname(guardAbs), basename(guardAbs), "antigravity", "Antigravity");
 }
+function antigravityConversationCommand(guardAbs) {
+  return hookCommandFor(dirname(guardAbs), "conversation.mjs", "antigravity", "Antigravity");
+}
 function installAntigravityGuard(p, guardAbs) {
   mkdirSync(p.antigravityDir, { recursive: true });
   let existing = {};
@@ -427,7 +430,8 @@ function installAntigravityGuard(p, guardAbs) {
   const merged = {
     ...existing,
     [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: antigravityConversationCommand(guardAbs) }] }]
     }
   };
   writeFileSync(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");

package/dist/index.js

@@ -6644,6 +6644,9 @@ function installGoBinaries(binDir) {
 function antigravityHookCommand(guardAbs) {
   return hookCommandFor(dirname(guardAbs), basename(guardAbs), "antigravity", "Antigravity");
 }
+function antigravityConversationCommand(guardAbs) {
+  return hookCommandFor(dirname(guardAbs), "conversation.mjs", "antigravity", "Antigravity");
+}
 function installAntigravityGuard(p, guardAbs) {
   mkdirSync3(p.antigravityDir, { recursive: true });
   let existing = {};
@@ -6659,7 +6662,8 @@ function installAntigravityGuard(p, guardAbs) {
   const merged = {
     ...existing,
     [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: antigravityConversationCommand(guardAbs) }] }]
     }
   };
   writeFileSync3(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");

package/dist/tui/index.js

@@ -422,6 +422,9 @@ function installGoBinaries(binDir) {
 function antigravityHookCommand(guardAbs) {
   return hookCommandFor(dirname(guardAbs), basename(guardAbs), "antigravity", "Antigravity");
 }
+function antigravityConversationCommand(guardAbs) {
+  return hookCommandFor(dirname(guardAbs), "conversation.mjs", "antigravity", "Antigravity");
+}
 function installAntigravityGuard(p, guardAbs) {
   mkdirSync(p.antigravityDir, { recursive: true });
   let existing = {};
@@ -437,7 +440,8 @@ function installAntigravityGuard(p, guardAbs) {
   const merged = {
     ...existing,
     [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: antigravityConversationCommand(guardAbs) }] }]
     }
   };
   writeFileSync2(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");

package/hooks/conversation.mjs

@@ -16,12 +16,10 @@
  *   UserPromptSubmit → user_input        what the person typed
  *   Stop             → last_assistant_message   what the agent said back
  *
- * WHAT IS SENT, AND WHEN NOTHING IS. Three gates, cheapest first:
+ * WHAT IS SENT, AND WHEN NOTHING IS. Two gates, cheapest first:
  *
  *   1. No credential → nothing. The same rule every hook here follows.
- *   2. Local-logs mode → nothing. Somebody who has asked for their logs to stay
- *      on their machine has asked about this more than about anything else.
- *   3. Not in a fleet → the SERVER drops it. This hook cannot know whether a
+ *   2. Not in a fleet → the SERVER drops it. This hook cannot know whether a
  *      grant exists, and asking would be a round trip before every send; the
  *      API answers 204 and the row is never written. That check is on the
  *      server deliberately: a check that lived here would live on the machine
@@ -43,7 +41,7 @@ import { resolve } from 'node:path';
 import { homedir } from 'node:os';
 
 // Bump on every change to this file, alongside the other hooks.
-const HOOK_VERSION = 1;
+const HOOK_VERSION = 3;
 
 const AGENT_ID = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
 
@@ -108,19 +106,80 @@ function redact(text, cache) {
   return { text: out, masked };
 }
 
-// Local-logs mode means the person has asked for their records to stay on their
-// machine. Of everything this package sends, this is the one they meant most.
-function localLogsOn(cache) {
-  try {
-    const v = cache && cache.security && cache.security.localLogs;
-    return !!(v && (v === true || v.enabled === true || v.path));
-  } catch { return false; }
-}
+// There is no local-logs gate here any more, and its absence is deliberate.
+//
+// It read the local-log setting and sent nothing when it looked on — which it
+// did for anybody who had ever typed a folder into that field, because the
+// predicate counted the PATH as well as the switch and the path survives
+// turning the feature off. So the record was silently empty on accounts whose
+// settings said local logging was off, with nothing anywhere to say so.
+//
+// Fixing the predicate was the small answer. The gate itself is the wrong idea:
+// this record exists ONLY for a machine in a fleet, where a host is answerable
+// for what runs there, and a setting on the guest's own machine that switches
+// off the host's view of it is a self-disarm — the exact shape this product
+// exists to prevent everywhere else. Local logging decides where a machine
+// keeps its OWN copy; it was never a claim on somebody else's record.
+//
+// What still applies is unchanged and is what actually protects people: no
+// credential, nothing sent; no accepted grant, the server drops it; and secrets
+// are removed before the text leaves the machine.
 
 function readStdin() {
   try { return readFileSync(0, 'utf-8'); } catch { return ''; }
 }
 
+// send is one turn, redacted, to the API. Both payload shapes end here.
+async function send(sessionId, role, body, agentName) {
+  if (!sessionId || !String(body).trim()) return;
+
+  const cfg = loadGlobalCloudConfig();
+  const apiKey = process.env.SOLONGATE_API_KEY || cfg.apiKey || '';
+  const apiUrl = process.env.SOLONGATE_API_URL || cfg.apiUrl || 'https://api.solongate.com';
+  if (!apiKey) return;
+
+  const cache = loadPolicyCache();
+  const cleaned = redact(body, cache);
+  try {
+    await fetch(`${apiUrl}/api/v1/conversations`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        session_id: sessionId,
+        role,
+        body: cleaned.text,
+        redacted: cleaned.masked,
+        agent_id: AGENT_ID,
+        agent_name: agentName || '',
+        source: `${AGENT_ID}-hook`,
+        hook_version: HOOK_VERSION,
+      }),
+    });
+  } catch { /* silent: a record that could not be sent must not fail a turn */ }
+}
+
+// sendAntigravity writes both halves of the exchange from one Stop payload.
+//
+// The prompt goes first and the reply second, and they are sent in that order
+// rather than concurrently: the rows are ordered by their timestamps, and two
+// requests in flight at once can land in the other order on a fast link — which
+// would draw the answer above the question.
+async function sendAntigravity(common, stop) {
+  const sessionId = common.conversationId || common.conversation_id ||
+    common.sessionId || common.session_id || '';
+  if (!sessionId) return;
+  const name = common.agentName || common.agent_name || 'Antigravity';
+
+  const prompt = common.lastUserInput || common.last_user_input || '';
+  if (String(prompt).trim()) await send(sessionId, 'prompt', prompt, name);
+
+  const reply = stop ? (stop.finalModelOutput || stop.final_model_output || '') : '';
+  if (String(reply).trim()) await send(sessionId, 'reply', reply, name);
+}
+
 (async () => {
   // Whatever happens below, this hook allows the turn. It has no opinion about
   // whether the work should proceed; it is a record of it.
@@ -130,6 +189,36 @@ function readStdin() {
   try { data = JSON.parse(readStdin() || '{}'); } catch { return; }
 
   const event = data.hook_event_name || data.hookEventName || '';
+
+  // ANTIGRAVITY sends a different shape, and one hook carries both halves.
+  //
+  // Its payload is `{common: {lastUserInput, conversationId, ...}, args: {...}}`
+  // — the person's last message rides on EVERY hook rather than on an event of
+  // its own, and the answer arrives as `stopHookArgs.finalModelOutput`. So one
+  // Stop registration records the whole exchange, where Claude Code and Codex
+  // need two events to do the same thing.
+  //
+  // It is detected by shape rather than by a flag, because the client name is
+  // an argv argument this hook is also given for the other three, and a payload
+  // is a fact while an argument is a claim.
+  // OPENCODE calls this hook directly from its plugin, which already knows
+  // which half it holds — its two halves arrive by different routes (a
+  // chat.message hook for the prompt, streamed text parts for the reply), so
+  // the plugin does the deciding and this file does the sending.
+  if (data.opencode === true) {
+    await send(data.session_id || '', data.role === 'reply' ? 'reply' : 'prompt',
+      data.body || '', 'OpenCode');
+    return;
+  }
+
+  const agCommon = data.common || (data.hookArgs && data.hookArgs.common) || null;
+  const agStop = data.stopHookArgs || (data.args && data.args.stopHookArgs) ||
+    (data.hookArgs && data.hookArgs.stopHookArgs) || null;
+  if (agCommon && (agStop || agCommon.lastUserInput)) {
+    await sendAntigravity(agCommon, agStop);
+    return;
+  }
+
   // The two halves. Nothing else is listened for: PreToolUse and PostToolUse
   // already have hooks and are about tool calls rather than about words.
   let role = '';
@@ -151,33 +240,5 @@ function readStdin() {
   const sessionId = data.session_id || data.sessionId || data.conversation_id || '';
   if (!sessionId) return;
 
-  const cfg = loadGlobalCloudConfig();
-  const apiKey = process.env.SOLONGATE_API_KEY || cfg.apiKey || '';
-  const apiUrl = process.env.SOLONGATE_API_URL || cfg.apiUrl || 'https://api.solongate.com';
-  if (!apiKey) return;
-
-  const cache = loadPolicyCache();
-  if (localLogsOn(cache)) return;
-
-  const cleaned = redact(body, cache);
-
-  try {
-    await fetch(`${apiUrl}/api/v1/conversations`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${apiKey}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        session_id: sessionId,
-        role,
-        body: cleaned.text,
-        redacted: cleaned.masked,
-        agent_id: AGENT_ID,
-        agent_name: data.agent_name || '',
-        source: `${AGENT_ID}-hook`,
-        hook_version: HOOK_VERSION,
-      }),
-    });
-  } catch { /* silent: a record that could not be sent must not fail a turn */ }
+  await send(sessionId, role, body, data.agent_name || '');
 })();

package/hooks/opencode-plugin.mjs

@@ -36,6 +36,7 @@ import { join } from 'node:path';
 const HOOKS_DIR = join(homedir(), '.solongate', 'hooks');
 const GUARD = join(HOOKS_DIR, 'guard.mjs');
 const AUDIT = join(HOOKS_DIR, 'audit.mjs');
+const CONVERSATION = join(HOOKS_DIR, 'conversation.mjs');
 
 // The node binary, written in by the installer.
 //
@@ -124,6 +125,26 @@ function rewritePatch(res) {
   return null;
 }
 
+// The assistant text held between the part events and the message completing.
+//
+// Keyed by message id, cleared on flush, and dropped whole past a bound: a
+// plugin that grows a buffer for the life of an editor session is a leak in
+// somebody's editor, which is a worse bug than a missing transcript.
+const pending = new Map();
+const MAX_PENDING = 64;
+
+// textOf joins the text parts of a message and ignores the rest — a file
+// attachment or a tool call is not something a person said. A synthetic part
+// is one OpenCode wrote itself, which is not either.
+function textOf(parts) {
+  if (!Array.isArray(parts)) return '';
+  return parts
+    .filter((x) => x && x.type === 'text' && typeof x.text === 'string' && !x.synthetic)
+    .map((x) => x.text)
+    .join('\n')
+    .trim();
+}
+
 export const SolonGate = async ({ directory, worktree } = {}) => {
   const cwd = directory || worktree || process.cwd();
 
@@ -155,6 +176,58 @@ export const SolonGate = async ({ directory, worktree } = {}) => {
       }
     },
 
+    // ── the conversation record ──────────────────────────────────────────
+    //
+    // OpenCode is the third client to record this and the only one that needs
+    // two different hooks to do it, because its halves arrive by different
+    // routes: `chat.message` carries what the person wrote, and the answer is
+    // streamed as text PARTS which are only final when the assistant message
+    // is.
+    //
+    // So the parts are held per message id and flushed when that message
+    // completes.
+    'chat.message': async (input, output) => {
+      const text = textOf(output?.parts);
+      if (!text) return;
+      void runHook(CONVERSATION, {
+        opencode: true,
+        role: 'prompt',
+        body: text,
+        session_id: input?.sessionID ?? output?.message?.sessionID ?? '',
+      }, GUARD_TIMEOUT_MS);
+    },
+
+    event: async ({ event } = {}) => {
+      if (!event || typeof event !== 'object') return;
+
+      // A text part of a message. `text` is the WHOLE text so far rather than a
+      // delta, so the last one wins and nothing is concatenated.
+      if (event.type === 'message.part.updated') {
+        const part = event.properties?.part;
+        if (part?.type === 'text' && part.messageID && typeof part.text === 'string') {
+          if (pending.size > MAX_PENDING) pending.clear();
+          pending.set(part.messageID, { text: part.text, sessionID: part.sessionID ?? '' });
+        }
+        return;
+      }
+
+      // The message finished. Anything else — a user message, one still being
+      // written — is not a completed answer and is left alone.
+      if (event.type === 'message.updated') {
+        const info = event.properties?.info;
+        if (!info || info.role !== 'assistant' || !info.time?.completed) return;
+        const held = pending.get(info.id);
+        pending.delete(info.id);
+        if (!held || !held.text.trim()) return;
+        void runHook(CONVERSATION, {
+          opencode: true,
+          role: 'reply',
+          body: held.text,
+          session_id: info.sessionID || held.sessionID || '',
+        }, GUARD_TIMEOUT_MS);
+      }
+    },
+
     'tool.execute.after': async (input, output) => {
       // The ALLOW-path audit record. Fire and forget: it must never delay the
       // editor, and losing one line is better than a stalled tool.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.57",
+  "version": "0.83.59",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {
@@ -61,12 +61,12 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@solongate/guard-linux-x64": "0.83.57",
-    "@solongate/guard-linux-arm64": "0.83.57",
-    "@solongate/guard-darwin-x64": "0.83.57",
-    "@solongate/guard-darwin-arm64": "0.83.57",
-    "@solongate/guard-win32-x64": "0.83.57",
-    "@solongate/guard-win32-arm64": "0.83.57"
+    "@solongate/guard-linux-x64": "0.83.59",
+    "@solongate/guard-linux-arm64": "0.83.59",
+    "@solongate/guard-darwin-x64": "0.83.59",
+    "@solongate/guard-darwin-arm64": "0.83.59",
+    "@solongate/guard-win32-x64": "0.83.59",
+    "@solongate/guard-win32-arm64": "0.83.59"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",