@solongate/proxy 0.83.8 → 0.83.9

package/dist/index.js

@@ -12363,12 +12363,6 @@ function SettingsPanel({
         ] }, "h:" + sec)
       );
       lineKey.push("");
-      if ((sec === "WEBHOOKS" || sec === "ALERTS") && local?.enabled) {
-        lineEls.push(
-          /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: theme.warn, children: `  \u26A0 local logs on \u2014 real denials stay on this machine, so ${sec.toLowerCase()} do NOT fire${sec === "WEBHOOKS" ? " (t test still works)" : ""}` }, "warn:" + sec)
-        );
-        lineKey.push("");
-      }
     }
     lineEls.push(/* @__PURE__ */ jsx8(Box8, { children: rowLine(r) }, keyOf(r)));
     lineKey.push(keyOf(r));

package/dist/tui/index.js

@@ -5489,12 +5489,6 @@ function SettingsPanel({
         ] }, "h:" + sec)
       );
       lineKey.push("");
-      if ((sec === "WEBHOOKS" || sec === "ALERTS") && local?.enabled) {
-        lineEls.push(
-          /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: theme.warn, children: `  \u26A0 local logs on \u2014 real denials stay on this machine, so ${sec.toLowerCase()} do NOT fire${sec === "WEBHOOKS" ? " (t test still works)" : ""}` }, "warn:" + sec)
-        );
-        lineKey.push("");
-      }
     }
     lineEls.push(/* @__PURE__ */ jsx8(Box8, { children: rowLine(r) }, keyOf(r)));
     lineKey.push(keyOf(r));

package/hooks/audit.mjs

@@ -11,7 +11,7 @@ import { homedir } from 'node:os';
 // Bump on every audit hook change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 24;
+const HOOK_VERSION = 25;
 
 function loadEnvKey(dir) {
   try {
@@ -748,8 +748,11 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
       try { rateLimitBurst = rateLimitObserveBurst(AGENT_ID, loadRateLimitObserve()); } catch { rateLimitBurst = false; }
     }
 
-    // Local log storage (opt-in): when ON, logs are kept LOCAL ONLY — we append
-    // this entry to the user's chosen file and do NOT send it to the cloud.
+    // Local log storage (opt-in) MIRRORS: the entry is appended to the user's
+    // chosen file AND still sent to the cloud. It used to divert instead, so a
+    // project with local logs on saw an empty dashboard with nothing to say the
+    // emptiness was deliberate — while the dataroom called the same setting
+    // "mirror every decision to a file".
     const localLogs = loadLocalLogs();
     if (localLogs) {
       appendLocalLog(localLogs, {
@@ -759,9 +762,8 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
         ...(dlpMatches.length ? { dlp: dlpMatches } : {}),
         ...(rateLimitBurst ? { rate_limit_burst: true } : {}),
       });
-      fetchDone = true;
-      maybeExit();
-    } else {
+    }
+    {
       // Fire-and-forget: don't block tool execution waiting for API response
       fetch(`${API_URL}/api/v1/audit-logs`, {
         method: 'POST',

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 73;
+var HOOK_VERSION = 74;
 function localLogsOnly(security) {
   if (security !== void 0) {
     const l = security && security.localLogs;
@@ -8428,13 +8428,12 @@ if (!REFRESH_MODE) {
           } catch {
           }
           try {
-            if (!localLogsOnly(_sec))
-              await fetch(API_URL + "/api/v1/audit-logs", {
-                method: "POST",
-                headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-                body: JSON.stringify(_logEntry),
-                signal: AbortSignal.timeout(3e3)
-              });
+            await fetch(API_URL + "/api/v1/audit-logs", {
+              method: "POST",
+              headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+              body: JSON.stringify(_logEntry),
+              signal: AbortSignal.timeout(3e3)
+            });
           } catch {
           }
           if (AGENT_TYPE !== "codex")
@@ -8461,7 +8460,7 @@ if (!REFRESH_MODE) {
         try {
           if (existsSync(policyCacheFile)) {
             const cached = JSON.parse(readFileSync(policyCacheFile, "utf-8"));
-            if (cached && cached.policy)
+            if (cached)
               staleCache = cached;
             if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
               refreshDue = false;
@@ -8546,35 +8545,31 @@ if (!REFRESH_MODE) {
           }
           writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), tool: toolName, arguments: args, decision: "DENY", reason: "ghost path (hidden from agent)", permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: call.sessionId, evaluation_time_ms: Date.now() - _evalStart });
           try {
-            if (!localLogsOnly(securityCfg))
-              await fetch(API_URL + "/api/v1/audit-logs", {
-                method: "POST",
-                headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-                body: JSON.stringify({
-                  tool: toolName,
-                  arguments: args,
-                  decision: "DENY",
-                  reason: "ghost path (hidden from agent)",
-                  permission: guessPermission(toolName),
-                  source: `${AGENT_TYPE}-guard`,
-                  agent_id: AGENT_TYPE,
-                  agent_name: AGENT_NAME,
-                  session_id: call.sessionId,
-                  evaluation_time_ms: Date.now() - _evalStart
-                }),
-                signal: AbortSignal.timeout(3e3)
-              });
+            await fetch(API_URL + "/api/v1/audit-logs", {
+              method: "POST",
+              headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+              body: JSON.stringify({
+                tool: toolName,
+                arguments: args,
+                decision: "DENY",
+                reason: "ghost path (hidden from agent)",
+                permission: guessPermission(toolName),
+                source: `${AGENT_TYPE}-guard`,
+                agent_id: AGENT_TYPE,
+                agent_name: AGENT_NAME,
+                session_id: call.sessionId,
+                evaluation_time_ms: Date.now() - _evalStart
+              }),
+              signal: AbortSignal.timeout(3e3)
+            });
           } catch {
           }
-          await maybeSelfUpdate();
           blockTool(ghostHit, true);
         }
         if (toolName === "Bash" || toolName === "run_command" || guessPermission(toolName) === "EXECUTE") {
           const rw = ghostListingRewrite(args, securityCfg.ghost);
-          if (rw) {
-            await maybeSelfUpdate();
+          if (rw)
             rewriteTool({ command: rw });
-          }
         }
       }
       if (!reason)
@@ -8608,7 +8603,6 @@ if (!REFRESH_MODE) {
           reason = "Security layer (DLP): reading a file that contains a secret is blocked. Blocked by SolonGate.";
           opaRoute = "black";
         } else if (plan && plan.rewrite) {
-          await maybeSelfUpdate();
           rewriteTool(plan.rewrite);
         }
       }
@@ -8648,18 +8642,16 @@ if (!REFRESH_MODE) {
               evaluation_time_ms: Date.now() - _evalStart
             };
             writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), ...logEntry });
-            if (!localLogsOnly(securityCfg))
-              await fetch(API_URL + "/api/v1/audit-logs", {
-                method: "POST",
-                headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-                body: JSON.stringify(logEntry),
-                signal: AbortSignal.timeout(3e3)
-              });
+            await fetch(API_URL + "/api/v1/audit-logs", {
+              method: "POST",
+              headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+              body: JSON.stringify(logEntry),
+              signal: AbortSignal.timeout(3e3)
+            });
           } catch {
           }
         }
         writeDenyFlag(toolName);
-        await maybeSelfUpdate();
         blockTool(reason);
       }
     } catch {

package/hooks/guard.mjs

@@ -32,10 +32,13 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 73;
+const HOOK_VERSION = 74;
 
-// True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
-// nothing is sent to the cloud audit log.
+// True when local log storage is ON — meaning a copy is written to this
+// machine. It is a MIRROR, not a diversion: the cloud audit log is written
+// either way. The dataroom always described it as "mirror every decision to a
+// file"; the code diverted instead, so a project with local logs on had nothing
+// in the dashboard and no way to tell that was deliberate.
 //
 // `undefined` is the ONLY value that means "we do not know yet". `null` is an
 // answer: it is what the refresh writes when the API returns no security block,
@@ -125,14 +128,13 @@ function writeLocalLog(security, entry) {
     const mark = accountMark();
     if (mark) entry = { ...entry, acct: mark };
     const l = security && security.localLogs;
-    // The cloud POST is skipped whenever localLogsOnly() says this device is in
-    // local-only mode — and that answer can come from the persisted marker alone,
-    // i.e. WITHOUT a resolved config (empty/cold policy cache, or a refresh that
-    // failed while the key was being rotated). In that state this function used
-    // to return early: no cloud write, no local write, entry gone. A denial must
-    // never disappear, so fall back to the per-device default folder and keep it.
+    // No usable folder in the resolved config. The answer can still be "local is
+    // on" from the persisted marker alone, i.e. WITHOUT a resolved config (empty
+    // or cold policy cache, or a refresh that failed while the key was being
+    // rotated) — in which case keep the copy in the per-device default folder
+    // rather than dropping it.
     if (!l || !l.enabled || typeof l.path !== 'string' || !l.path.trim()) {
-      if (!localLogsOnly(security)) return; // cloud is handling it — nothing to do
+      if (!localLogsOnly(security)) return; // local logging is off — cloud only
       const fallbackDir = resolve(homedir(), '.solongate', 'local-logs');
       const fallbackLine = JSON.stringify(entry) + '\n';
       const fallbackPayload = Buffer.from(JSON.stringify({ dir: fallbackDir, line: fallbackLine }), 'utf-8').toString('base64');
@@ -2424,7 +2426,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         };
         try { writeLocalLog(_sec, { ts: new Date().toISOString(), ..._logEntry }); } catch {}
         try {
-          if (!localLogsOnly(_sec)) await fetch(API_URL + '/api/v1/audit-logs', {
+          await fetch(API_URL + '/api/v1/audit-logs', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
             body: JSON.stringify(_logEntry),
@@ -2484,7 +2486,13 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
       try {
         if (existsSync(policyCacheFile)) {
           const cached = JSON.parse(readFileSync(policyCacheFile, 'utf-8'));
-          if (cached && cached.policy) staleCache = cached;
+          // Kept whenever it parses, NOT only when it carries a policy. The
+          // security layers (DLP, rate limit, ghost) are configured separately
+          // from the policy, so gating the last-known-good on a policy existing
+          // meant a project with DLP on and no policy lost DLP entirely the
+          // moment this cache went past its 10s TTL — which is almost always,
+          // since it only refreshes on activity.
+          if (cached) staleCache = cached;
           if (cached && cached._ts && Date.now() - cached._ts < POLICY_TTL_MS) {
             refreshDue = false;
             if (cached.policy) dashboardPolicy = cached.policy;
@@ -2571,7 +2579,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         try { writeDenyFlag(toolName); } catch {}
         writeLocalLog(securityCfg, { ts: new Date().toISOString(), tool: toolName, arguments: args, decision: 'DENY', reason: 'ghost path (hidden from agent)', permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: call.sessionId, evaluation_time_ms: Date.now() - _evalStart });
         try {
-          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
+          await fetch(API_URL + '/api/v1/audit-logs', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
             body: JSON.stringify({
@@ -2585,7 +2593,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
             signal: AbortSignal.timeout(3000),
           });
         } catch {}
-        await maybeSelfUpdate();
+        // NOT maybeSelfUpdate() first: see the deny at the end of this flow.
         // Stealth deny: ghostHit is a bare "No such file or directory", and the
         // stealth flag keeps the adapter from adding any SolonGate branding, so
         // the path looks like it simply is not there on every client.
@@ -2597,7 +2605,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
       // PreToolUse `overwrite` replaces the command before it runs (hooks.md).
       if (toolName === 'Bash' || toolName === 'run_command' || guessPermission(toolName) === 'EXECUTE') {
         const rw = ghostListingRewrite(args, securityCfg.ghost);
-        if (rw) { await maybeSelfUpdate(); rewriteTool({ command: rw }); }
+        if (rw) rewriteTool({ command: rw }); // verdict first, update later
       }
     }
     // Extra security layers run after tamper, before policy. Block reason wins
@@ -2667,8 +2675,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         reason = 'Security layer (DLP): reading a file that contains a secret is blocked. Blocked by SolonGate.';
         opaRoute = 'black';
       } else if (plan && plan.rewrite) {
-        await maybeSelfUpdate();
-        rewriteTool(plan.rewrite);
+        rewriteTool(plan.rewrite); // verdict first, update later
       }
     }
 
@@ -2714,7 +2721,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
           writeLocalLog(securityCfg, { ts: new Date().toISOString(), ...logEntry });
           // PI hook layer removed — piResult fields no longer attached.
           // Local-only mode: keep the log on the user's machine, skip the cloud.
-          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
+          await fetch(API_URL + '/api/v1/audit-logs', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
             body: JSON.stringify(logEntry),
@@ -2723,7 +2730,13 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         } catch {}
       }
       writeDenyFlag(toolName);
-      await maybeSelfUpdate();
+      // The verdict is emitted BEFORE the hook self-update, never after.
+      // maybeSelfUpdate() fetches three hooks at up to 5s each, and the
+      // whole process carries an 8s backstop that force-exits with
+      // `process.exitCode || 0` — i.e. ALLOW. So a slow network on the update
+      // path turned a decided DENY into a permitted call. Measured: 8043ms,
+      // exit 0, on a call DLP had already refused. Updating is a background
+      // nicety; it still runs on every allow, which is nearly every call.
       blockTool(reason);
     }
   } catch {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.8",
+  "version": "0.83.9",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {