@solongate/proxy 0.16.0 → 0.16.1

package/dist/index.js

@@ -306,6 +306,7 @@ var init_exports = {};
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
 import { resolve as resolve2, join, dirname as dirname2 } from "path";
 import { fileURLToPath } from "url";
+import { execSync } from "child_process";
 import { createInterface } from "readline";
 function findConfigFile(explicitPath, createIfMissing = false) {
   if (explicitPath) {
@@ -514,10 +515,37 @@ function installHooks(selectedTools = []) {
     console.log(`  Created ${settingsPath}`);
     activatedNames.push(client.name);
   }
+  const protectedDirs = [".solongate", ...clients.map((c3) => c3.dir)];
+  try {
+    if (process.platform === "win32") {
+      for (const dir of protectedDirs) {
+        const fullDir = resolve2(dir);
+        if (existsSync3(fullDir)) {
+          try {
+            execSync(`attrib +R /S /D "${fullDir}"`, { stdio: "ignore" });
+          } catch {
+          }
+        }
+      }
+    } else {
+      for (const dir of protectedDirs) {
+        const fullDir = resolve2(dir);
+        if (existsSync3(fullDir)) {
+          try {
+            execSync(`chmod -R a-w "${fullDir}"`, { stdio: "ignore" });
+          } catch {
+          }
+        }
+      }
+    }
+    console.log("  OS-level read-only protection applied");
+  } catch {
+  }
   console.log("");
   console.log("  Hooks installed:");
   console.log("  guard.mjs  \u2192 blocks policy-violating calls (pre-execution)");
   console.log("  audit.mjs  \u2192 logs all calls to dashboard (post-execution)");
+  console.log("  File system \u2192 read-only (OS-level protection)");
   console.log(`  Activated for: ${activatedNames.join(", ")}`);
 }
 function ensureEnvFile() {
@@ -804,7 +832,7 @@ var init_init = __esm({
 var inject_exports = {};
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, copyFileSync } from "fs";
 import { resolve as resolve3 } from "path";
-import { execSync } from "child_process";
+import { execSync as execSync2 } from "child_process";
 function parseInjectArgs(argv) {
   const args = argv.slice(2);
   const opts = {
@@ -951,7 +979,7 @@ function installSdk() {
   const cmd = pm === "yarn" ? "yarn add @solongate/sdk" : `${pm} install @solongate/sdk`;
   log3(`  Installing @solongate/sdk via ${pm}...`);
   try {
-    execSync(cmd, { stdio: "pipe", cwd: process.cwd() });
+    execSync2(cmd, { stdio: "pipe", cwd: process.cwd() });
     return true;
   } catch (err) {
     log3(`  Failed to install: ${err instanceof Error ? err.message : String(err)}`);
@@ -1176,7 +1204,7 @@ var init_inject = __esm({
 var create_exports = {};
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
 import { resolve as resolve4, join as join2 } from "path";
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 function log4(msg) {
   process.stderr.write(msg + "\n");
 }
@@ -1420,7 +1448,7 @@ async function main3() {
   });
   if (!opts.noInstall) {
     withSpinner("Installing dependencies...", () => {
-      execSync2("npm install", { cwd: dir, stdio: "pipe" });
+      execSync3("npm install", { cwd: dir, stdio: "pipe" });
     });
   }
   log4("");

package/dist/init.js

@@ -4,6 +4,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
 import { resolve, join, dirname } from "path";
 import { fileURLToPath } from "url";
+import { execSync } from "child_process";
 import { createInterface } from "readline";
 var SEARCH_PATHS = [
   ".mcp.json",
@@ -221,10 +222,37 @@ function installHooks(selectedTools = []) {
     console.log(`  Created ${settingsPath}`);
     activatedNames.push(client.name);
   }
+  const protectedDirs = [".solongate", ...clients.map((c) => c.dir)];
+  try {
+    if (process.platform === "win32") {
+      for (const dir of protectedDirs) {
+        const fullDir = resolve(dir);
+        if (existsSync(fullDir)) {
+          try {
+            execSync(`attrib +R /S /D "${fullDir}"`, { stdio: "ignore" });
+          } catch {
+          }
+        }
+      }
+    } else {
+      for (const dir of protectedDirs) {
+        const fullDir = resolve(dir);
+        if (existsSync(fullDir)) {
+          try {
+            execSync(`chmod -R a-w "${fullDir}"`, { stdio: "ignore" });
+          } catch {
+          }
+        }
+      }
+    }
+    console.log("  OS-level read-only protection applied");
+  } catch {
+  }
   console.log("");
   console.log("  Hooks installed:");
   console.log("  guard.mjs  \u2192 blocks policy-violating calls (pre-execution)");
   console.log("  audit.mjs  \u2192 logs all calls to dashboard (post-execution)");
+  console.log("  File system \u2192 read-only (OS-level protection)");
   console.log(`  Activated for: ${activatedNames.join(", ")}`);
 }
 function ensureEnvFile() {

package/hooks/guard.mjs

@@ -452,6 +452,68 @@ process.stdin.on('end', async () => {
       }
     }
 
+    // ── Layer 7: Dangerous execution pattern detection ──
+    // These can construct ANY string at runtime — block when touching protected dirs
+    const fullCmd = rawStrings.join(' ');
+
+    // 7a. Inline interpreter execution: node -e, python -c, perl -e, ruby -e
+    // Extract the -e/-c argument and scan it
+    const interpreterPatterns = [
+      /\bnode\s+(?:-e|--eval)\s+["']([^"']+)["']/gi,
+      /\bnode\s+(?:-e|--eval)\s+([^;&|"']+)/gi,
+      /\bpython[23]?\s+-c\s+["']([^"']+)["']/gi,
+      /\bperl\s+-e\s+["']([^"']+)["']/gi,
+      /\bruby\s+-e\s+["']([^"']+)["']/gi,
+    ];
+    for (const pat of interpreterPatterns) {
+      for (const m of fullCmd.matchAll(pat)) {
+        const code = m[1].toLowerCase();
+        for (const p of protectedPaths) {
+          if (code.includes(p)) {
+            await blockSelfProtection('SOLONGATE: Interpreter code targets "' + p + '" — blocked');
+          }
+        }
+        // Also check the normalized version
+        const normCode = normalizeShell(code);
+        for (const p of protectedPaths) {
+          if (normCode.includes(p)) {
+            await blockSelfProtection('SOLONGATE: Interpreter code targets "' + p + '" — blocked');
+          }
+        }
+      }
+    }
+
+    // 7b. Base64 decode piped to execution — always block
+    if (/\bbase64\s+-d\b.*\|\s*(?:bash|sh|node|python|perl|ruby)\b/i.test(fullCmd) ||
+        /\bbase64\s+--decode\b.*\|\s*(?:bash|sh|node|python|perl|ruby)\b/i.test(fullCmd)) {
+      await blockSelfProtection('SOLONGATE: base64 decode piped to interpreter — blocked');
+    }
+
+    // 7c. Temp script file execution: bash /path/file, sh /path/file
+    // If "bash <file>" or "sh <file>" and the file is not a well-known script
+    if (/\b(?:bash|sh)\s+(?:\/tmp\/|\/var\/tmp\/|~\/\.|\.\/[^.s])/i.test(fullCmd)) {
+      await blockSelfProtection('SOLONGATE: Temp script execution detected — blocked');
+    }
+
+    // 7d. Process substitution and here-strings that could construct protected paths
+    if (/>\s*\(\s*(?:rm|mv|cp|cat)\b/i.test(fullCmd) || /<<<.*(?:rm|mv|cp|cat)\b/i.test(fullCmd)) {
+      for (const p of protectedPaths) {
+        const prefix = p.slice(0, 4); // e.g. ".sol", ".cla"
+        if (fullCmd.includes(prefix)) {
+          await blockSelfProtection('SOLONGATE: Process substitution near protected path "' + p + '" — blocked');
+        }
+      }
+    }
+
+    // 7e. xargs with destructive operations
+    if (/\bxargs\b.*\b(?:rm|mv|cp|rmdir|unlink)\b/i.test(fullCmd)) {
+      for (const p of protectedPaths) {
+        if (fullCmd.includes(p.slice(0, 4))) {
+          await blockSelfProtection('SOLONGATE: xargs with destructive op near "' + p + '" — blocked');
+        }
+      }
+    }
+
     // ── Fetch PI config from Cloud ──
     let piCfg = { piEnabled: true, piThreshold: 0.5, piMode: 'block', piWhitelist: [], piToolConfig: {}, piCustomPatterns: [], piWebhookUrl: null };
     if (API_KEY && API_KEY.startsWith('sg_live_')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {