@solongate/proxy 0.13.0 → 0.14.0

package/hooks/guard.mjs

@@ -104,10 +104,11 @@ const PI_CATEGORIES = [
   },
 ];
 
-function detectPromptInjection(text) {
+function detectPromptInjection(text, customCategories = [], threshold = 0.5) {
   const matched = [];
   let maxWeight = 0;
-  for (const cat of PI_CATEGORIES) {
+  const allCategories = [...PI_CATEGORIES, ...customCategories];
+  for (const cat of allCategories) {
     for (const pat of cat.patterns) {
       if (pat.test(text)) {
         matched.push(cat.name);
@@ -119,7 +120,7 @@ function detectPromptInjection(text) {
   if (matched.length === 0) return null;
   const score = Math.min(1.0, maxWeight + 0.05 * (matched.length - 1));
   const trustScore = 1.0 - score;
-  return { score, trustScore, categories: matched, blocked: trustScore < 0.5 };
+  return { score, trustScore, categories: matched, blocked: trustScore < threshold };
 }
 
 // ── Glob Matching ──
@@ -314,8 +315,8 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // ── Check if PI detection is enabled for this project ──
-    let piEnabled = true;
+    // ── Fetch PI config from Cloud ──
+    let piCfg = { piEnabled: true, piThreshold: 0.5, piMode: 'block', piWhitelist: [], piToolConfig: {}, piCustomPatterns: [], piWebhookUrl: null };
     if (API_KEY && API_KEY.startsWith('sg_live_')) {
       try {
         const cfgRes = await fetch(API_URL + '/api/v1/project-config', {
@@ -324,44 +325,117 @@ process.stdin.on('end', async () => {
         });
         if (cfgRes.ok) {
           const cfg = await cfgRes.json();
-          piEnabled = cfg.piEnabled !== false;
+          piCfg = { ...piCfg, ...cfg };
         }
-      } catch {} // Fallback: enabled (safe default)
+      } catch {} // Fallback: defaults (safe)
     }
 
-    // ── Prompt Injection Detection (Stage 1: Rules) ──
+    // ── Per-tool config: check if PI scanning is disabled for this tool ──
+    const toolName = data.tool_name || '';
+    if (piCfg.piToolConfig && typeof piCfg.piToolConfig === 'object') {
+      if (piCfg.piToolConfig[toolName] === false) {
+        // PI scanning explicitly disabled for this tool — skip detection
+        piCfg.piEnabled = false;
+      }
+    }
+
+    // ── Prompt Injection Detection (Stage 1: Rules + Custom Patterns) ──
     const allText = scanStrings(args).join(' ');
-    const piResult = piEnabled ? detectPromptInjection(allText) : null;
+
+    // Check whitelist — if input matches any whitelist pattern, skip PI detection
+    let whitelisted = false;
+    if (piCfg.piEnabled !== false && Array.isArray(piCfg.piWhitelist) && piCfg.piWhitelist.length > 0) {
+      for (const wlPattern of piCfg.piWhitelist) {
+        try {
+          if (new RegExp(wlPattern, 'i').test(allText)) {
+            whitelisted = true;
+            break;
+          }
+        } catch {} // Invalid regex — skip
+      }
+    }
+
+    // Build custom patterns from config
+    const customCategories = [];
+    if (piCfg.piEnabled !== false && Array.isArray(piCfg.piCustomPatterns)) {
+      for (const cp of piCfg.piCustomPatterns) {
+        if (cp && cp.pattern) {
+          try {
+            customCategories.push({
+              name: cp.name || 'custom_pattern',
+              weight: Math.max(0, Math.min(1, Number(cp.weight) || 0.8)),
+              patterns: [new RegExp(cp.pattern, 'iu')],
+            });
+          } catch {} // Invalid regex — skip
+        }
+      }
+    }
+
+    const piResult = (piCfg.piEnabled !== false && !whitelisted)
+      ? detectPromptInjection(allText, customCategories, piCfg.piThreshold)
+      : null;
 
     if (piResult && piResult.blocked) {
-      const msg = 'SOLONGATE: Prompt injection detected (trust score: ' +
-        (piResult.trustScore * 100).toFixed(0) + '%, categories: ' +
-        piResult.categories.join(', ') + ')';
+      const isLogOnly = piCfg.piMode === 'log-only';
+      const msg = isLogOnly
+        ? 'SOLONGATE: Prompt injection detected [LOG-ONLY] (trust score: ' +
+          (piResult.trustScore * 100).toFixed(0) + '%, categories: ' +
+          piResult.categories.join(', ') + ')'
+        : 'SOLONGATE: Prompt injection detected (trust score: ' +
+          (piResult.trustScore * 100).toFixed(0) + '%, categories: ' +
+          piResult.categories.join(', ') + ')';
 
+      // Log to Cloud
       if (API_KEY && API_KEY.startsWith('sg_live_')) {
         try {
           await fetch(API_URL + '/api/v1/audit-logs', {
             method: 'POST',
             headers: { 'Authorization': 'Bearer ' + API_KEY, 'Content-Type': 'application/json' },
             body: JSON.stringify({
-              tool: data.tool_name || '',
+              tool: toolName,
               arguments: args,
-              decision: 'DENY',
+              decision: isLogOnly ? 'ALLOW' : 'DENY',
               reason: msg,
               source: 'claude-code-guard',
               pi_detected: true,
               pi_trust_score: piResult.trustScore,
-              pi_blocked: true,
+              pi_blocked: !isLogOnly,
               pi_categories: JSON.stringify(piResult.categories),
               pi_stage_scores: JSON.stringify({ rules: piResult.score, embedding: 0, classifier: 0 }),
             }),
             signal: AbortSignal.timeout(3000),
           });
         } catch {}
+
+        // Webhook notification
+        if (piCfg.piWebhookUrl) {
+          try {
+            await fetch(piCfg.piWebhookUrl, {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify({
+                event: 'prompt_injection_detected',
+                tool: toolName,
+                trustScore: piResult.trustScore,
+                categories: piResult.categories,
+                blocked: !isLogOnly,
+                mode: piCfg.piMode,
+                timestamp: new Date().toISOString(),
+              }),
+              signal: AbortSignal.timeout(3000),
+            });
+          } catch {} // Webhook failure is non-blocking
+        }
       }
 
-      process.stderr.write(msg);
-      process.exit(2);
+      // In log-only mode, warn but don't block
+      if (isLogOnly) {
+        process.stderr.write(msg);
+        // Fall through to policy evaluation (don't exit)
+      } else {
+        process.stderr.write(msg);
+        process.exit(2);
+      }
     }
 
     // Load policy (use cwd from hook data if available)
@@ -378,7 +452,7 @@ process.stdin.on('end', async () => {
             method: 'POST',
             headers: { 'Authorization': 'Bearer ' + API_KEY, 'Content-Type': 'application/json' },
             body: JSON.stringify({
-              tool: data.tool_name || '',
+              tool: toolName,
               arguments: args,
               decision: 'ALLOW',
               reason: 'Prompt injection detected but below threshold (trust: ' + (piResult.trustScore * 100).toFixed(0) + '%)',
@@ -403,7 +477,7 @@ process.stdin.on('end', async () => {
     if (API_KEY && API_KEY.startsWith('sg_live_')) {
       try {
         const logEntry = {
-          tool: data.tool_name || '', arguments: args,
+          tool: toolName, arguments: args,
           decision, reason: reason || 'allowed by policy',
           source: 'claude-code-guard',
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {