@solongate/proxy 0.83.8 → 0.83.10

package/hooks/audit.mjs

@@ -11,7 +11,7 @@ import { homedir } from 'node:os';
 // Bump on every audit hook change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 24;
+const HOOK_VERSION = 26;
 
 function loadEnvKey(dir) {
   try {

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 73;
+var HOOK_VERSION = 75;
 function localLogsOnly(security) {
   if (security !== void 0) {
     const l = security && security.localLogs;
@@ -8461,7 +8461,7 @@ if (!REFRESH_MODE) {
         try {
           if (existsSync(policyCacheFile)) {
             const cached = JSON.parse(readFileSync(policyCacheFile, "utf-8"));
-            if (cached && cached.policy)
+            if (cached)
               staleCache = cached;
             if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
               refreshDue = false;
@@ -8566,15 +8566,12 @@ if (!REFRESH_MODE) {
               });
           } catch {
           }
-          await maybeSelfUpdate();
           blockTool(ghostHit, true);
         }
         if (toolName === "Bash" || toolName === "run_command" || guessPermission(toolName) === "EXECUTE") {
           const rw = ghostListingRewrite(args, securityCfg.ghost);
-          if (rw) {
-            await maybeSelfUpdate();
+          if (rw)
             rewriteTool({ command: rw });
-          }
         }
       }
       if (!reason)
@@ -8608,7 +8605,6 @@ if (!REFRESH_MODE) {
           reason = "Security layer (DLP): reading a file that contains a secret is blocked. Blocked by SolonGate.";
           opaRoute = "black";
         } else if (plan && plan.rewrite) {
-          await maybeSelfUpdate();
           rewriteTool(plan.rewrite);
         }
       }
@@ -8659,7 +8655,6 @@ if (!REFRESH_MODE) {
           }
         }
         writeDenyFlag(toolName);
-        await maybeSelfUpdate();
         blockTool(reason);
       }
     } catch {

package/hooks/guard.mjs

@@ -32,10 +32,11 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 73;
+const HOOK_VERSION = 75;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
-// nothing is sent to the cloud audit log.
+// nothing is sent to the cloud audit log — local and cloud are one or the
+// other, never both.
 //
 // `undefined` is the ONLY value that means "we do not know yet". `null` is an
 // answer: it is what the refresh writes when the API returns no security block,
@@ -125,14 +126,13 @@ function writeLocalLog(security, entry) {
     const mark = accountMark();
     if (mark) entry = { ...entry, acct: mark };
     const l = security && security.localLogs;
-    // The cloud POST is skipped whenever localLogsOnly() says this device is in
-    // local-only mode — and that answer can come from the persisted marker alone,
-    // i.e. WITHOUT a resolved config (empty/cold policy cache, or a refresh that
-    // failed while the key was being rotated). In that state this function used
-    // to return early: no cloud write, no local write, entry gone. A denial must
-    // never disappear, so fall back to the per-device default folder and keep it.
+    // No usable folder in the resolved config. The answer can still be "local is
+    // on" from the persisted marker alone, i.e. WITHOUT a resolved config (empty
+    // or cold policy cache, or a refresh that failed while the key was being
+    // rotated) — in which case keep the copy in the per-device default folder
+    // rather than dropping it.
     if (!l || !l.enabled || typeof l.path !== 'string' || !l.path.trim()) {
-      if (!localLogsOnly(security)) return; // cloud is handling it — nothing to do
+      if (!localLogsOnly(security)) return; // local logging is off — cloud only
       const fallbackDir = resolve(homedir(), '.solongate', 'local-logs');
       const fallbackLine = JSON.stringify(entry) + '\n';
       const fallbackPayload = Buffer.from(JSON.stringify({ dir: fallbackDir, line: fallbackLine }), 'utf-8').toString('base64');
@@ -2484,7 +2484,13 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
       try {
         if (existsSync(policyCacheFile)) {
           const cached = JSON.parse(readFileSync(policyCacheFile, 'utf-8'));
-          if (cached && cached.policy) staleCache = cached;
+          // Kept whenever it parses, NOT only when it carries a policy. The
+          // security layers (DLP, rate limit, ghost) are configured separately
+          // from the policy, so gating the last-known-good on a policy existing
+          // meant a project with DLP on and no policy lost DLP entirely the
+          // moment this cache went past its 10s TTL — which is almost always,
+          // since it only refreshes on activity.
+          if (cached) staleCache = cached;
           if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
             refreshDue = false;
             if (cached.policy) dashboardPolicy = cached.policy;
@@ -2585,7 +2591,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
             signal: AbortSignal.timeout(3000),
           });
         } catch {}
-        await maybeSelfUpdate();
+        // NOT maybeSelfUpdate() first: see the deny at the end of this flow.
         // Stealth deny: ghostHit is a bare "No such file or directory", and the
         // stealth flag keeps the adapter from adding any SolonGate branding, so
         // the path looks like it simply is not there on every client.
@@ -2597,7 +2603,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
       // PreToolUse `overwrite` replaces the command before it runs (hooks.md).
       if (toolName === 'Bash' || toolName === 'run_command' || guessPermission(toolName) === 'EXECUTE') {
         const rw = ghostListingRewrite(args, securityCfg.ghost);
-        if (rw) { await maybeSelfUpdate(); rewriteTool({ command: rw }); }
+        if (rw) rewriteTool({ command: rw }); // verdict first, update later
       }
     }
     // Extra security layers run after tamper, before policy. Block reason wins
@@ -2667,8 +2673,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         reason = 'Security layer (DLP): reading a file that contains a secret is blocked. Blocked by SolonGate.';
         opaRoute = 'black';
       } else if (plan && plan.rewrite) {
-        await maybeSelfUpdate();
-        rewriteTool(plan.rewrite);
+        rewriteTool(plan.rewrite); // verdict first, update later
       }
     }
 
@@ -2723,7 +2728,13 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         } catch {}
       }
       writeDenyFlag(toolName);
-      await maybeSelfUpdate();
+      // The verdict is emitted BEFORE the hook self-update, never after.
+      // maybeSelfUpdate() fetches three hooks at up to 5s each, and the
+      // whole process carries an 8s backstop that force-exits with
+      // `process.exitCode || 0` — i.e. ALLOW. So a slow network on the update
+      // path turned a decided DENY into a permitted call. Measured: 8043ms,
+      // exit 0, on a call DLP had already refused. Updating is a background
+      // nicety; it still runs on every allow, which is nearly every call.
       blockTool(reason);
     }
   } catch {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.8",
+  "version": "0.83.10",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {