@solongate/proxy 0.18.0 → 0.19.0

package/hooks/guard.mjs

@@ -476,17 +476,24 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // 7b. Base64 decode in ANY context — block when piped to anything
+    // 7b. Pipe-to-interpreter — TOTAL BLOCK
+    // Any content piped to an interpreter can construct arbitrary commands at runtime
+    const pipeToInterpreter = /\|\s*(?:node|bash|sh|python[23]?|perl|ruby|php)\b/i;
+    if (pipeToInterpreter.test(fullCmd)) {
+      await blockSelfProtection('SOLONGATE: Pipe to interpreter blocked — runtime bypass risk');
+    }
+
+    // 7c. Base64 decode in ANY context — block when piped to anything
     if (/\bbase64\s+(?:-d|--decode)\b/i.test(fullCmd) && /\|/i.test(fullCmd)) {
       await blockSelfProtection('SOLONGATE: base64 decode in pipe chain — blocked');
     }
 
-    // 7c. Temp/arbitrary script file execution
+    // 7d. Temp/arbitrary script file execution
     if (/\b(?:bash|sh)\s+(?:\/tmp\/|\/var\/tmp\/|~\/|\/dev\/)/i.test(fullCmd)) {
       await blockSelfProtection('SOLONGATE: Script execution from temp path — blocked');
     }
 
-    // 7d. xargs with destructive operations
+    // 7e. xargs with destructive operations
     if (/\bxargs\b.*\b(?:rm|mv|cp|rmdir|unlink|del)\b/i.test(fullCmd)) {
       for (const p of protectedPaths) {
         if (fullCmd.includes(p.slice(0, 4))) {
@@ -495,7 +502,7 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // 7e. cmd.exe /c with encoded/constructed commands
+    // 7f. cmd.exe /c with encoded/constructed commands
     if (/\bcmd(?:\.exe)?\s+\/c\b/i.test(fullCmd)) {
       for (const p of protectedPaths) {
         if (fullCmd.includes(p) || fullCmd.includes(p.slice(0, 4))) {
@@ -504,6 +511,48 @@ process.stdin.on('end', async () => {
       }
     }
 
+    // 7g. Script file execution — scan file content for discovery+destruction combo
+    // Catches: bash script.sh / node script.mjs where the script uses readdirSync + rmSync
+    const scriptExecMatch = fullCmd.match(/\b(?:bash|sh|node|python[23]?|perl|ruby)\s+([^\s;&|]+)/i);
+    if (scriptExecMatch) {
+      const scriptPath = scriptExecMatch[1];
+      try {
+        const hookCwdForScript = data.cwd || process.cwd();
+        const absPath = scriptPath.startsWith('/') || scriptPath.includes(':')
+          ? scriptPath
+          : resolve(hookCwdForScript, scriptPath);
+        if (existsSync(absPath)) {
+          const scriptContent = readFileSync(absPath, 'utf-8').toLowerCase();
+          // Check for discovery+destruction combo
+          const hasDiscovery = /\breaddirsync\b|\breaddir\b|\bos\.listdir\b|\bscandir\b|\bglob(?:sync)?\b|\bls\s+-[adl]|\bls\s+\.\b|\bopendir\b|\bdir\.entries\b|\bwalkdir\b|\bls\b.*\.\[/.test(scriptContent);
+          const hasDestruction = /\brmsync\b|\brm\s+-rf\b|\bunlinksync\b|\brmdirsync\b|\bunlink\s*\(|\brimraf\b|\bremovesync\b|\bremove_tree\b|\bshutil\.rmtree\b|\bwritefilesync\b|\bexecsync\b.*\brm\b|\bchild_process\b|\bfs\.\s*(?:rm|unlink|rmdir|write)/.test(scriptContent);
+          if (hasDiscovery && hasDestruction) {
+            await blockSelfProtection('SOLONGATE: Script contains directory discovery + destructive ops — blocked');
+          }
+          // Also check for protected path names in script content (existing check, now centralized)
+          for (const p of protectedPaths) {
+            if (scriptContent.includes(p)) {
+              await blockSelfProtection('SOLONGATE: Script references protected path "' + p + '" — blocked');
+            }
+          }
+        }
+      } catch {} // File read error — skip
+    }
+
+    // 7h. Write tool content scanning — detect discovery+destruction in file content being written
+    // Catches: Write tool creating a script that uses readdirSync('.') + rmSync
+    const toolName_ = data.tool_name || '';
+    if (toolName_.toLowerCase() === 'write' || toolName_.toLowerCase() === 'edit') {
+      const fileContent = (args.content || args.new_string || '').toLowerCase();
+      if (fileContent.length > 0) {
+        const hasDiscovery = /\breaddirsync\b|\breaddir\b|\bos\.listdir\b|\bscandir\b|\bglob(?:sync)?\b|\bls\s+-[adl]|\bls\s+\.\b|\bopendir\b|\bdir\.entries\b|\bwalkdir\b|\bls\b.*\.\[/.test(fileContent);
+        const hasDestruction = /\brmsync\b|\brm\s+-rf\b|\bunlinksync\b|\brmdirsync\b|\bunlink\b|\brimraf\b|\bremovesync\b|\bremove_tree\b|\bshutil\.rmtree\b|\bwritefilesync\b|\bexecsync\b.*\brm\b|\bchild_process\b.*\brm\b|\bfs\.\s*(?:rm|unlink|rmdir)/.test(fileContent);
+        if (hasDiscovery && hasDestruction) {
+          await blockSelfProtection('SOLONGATE: File content contains discovery + destructive ops — write blocked');
+        }
+      }
+    }
+
     // ── Fetch PI config from Cloud ──
     let piCfg = { piEnabled: true, piThreshold: 0.5, piMode: 'block', piWhitelist: [], piToolConfig: {}, piCustomPatterns: [], piWebhookUrl: null };
     if (API_KEY && API_KEY.startsWith('sg_live_')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {