@solongate/proxy 0.18.0 → 0.20.0

package/hooks/guard.mjs

@@ -291,10 +291,13 @@ process.stdin.on('end', async () => {
 
     // ── Self-protection: block access to hook files and settings ──
     // Hardcoded, no bypass possible — runs before policy/PI config
+    // Fully protected: block ALL access (read, write, delete, move)
     const protectedPaths = [
       '.solongate', '.claude', '.cursor', '.gemini', '.antigravity', '.openclaw', '.perplexity',
       'policy.json', '.mcp.json',
     ];
+    // Write-protected: block write/delete/modify, allow read (cat, grep, head, etc.)
+    const writeProtectedPaths = ['.env', '.gitignore'];
 
     // Block helper — logs to cloud + exits with code 2
     async function blockSelfProtection(reason) {
@@ -346,7 +349,7 @@ process.stdin.on('end', async () => {
       return stripShellQuotes(decodeAnsiC(s));
     }
 
-    // 4. Extract inner commands from eval, bash -c, sh -c, pipe to bash/sh
+    // 4. Extract inner commands from eval, bash -c, sh -c, pipe to bash/sh, heredoc, process substitution
     function extractInnerCommands(s) {
       const inner = [];
       // eval "cmd" or eval 'cmd' or eval cmd
@@ -358,6 +361,13 @@ process.stdin.on('end', async () => {
       for (const m of s.matchAll(/(?:echo|printf)\s+["']([^"']+)["']\s*\|\s*(?:bash|sh)\b/gi)) inner.push(m[1]);
       // find ... -name "pattern" ... -exec ...
       for (const m of s.matchAll(/-name\s+["']?([^\s"']+)["']?/gi)) inner.push(m[1]);
+      // Heredoc: bash << 'EOF'\n...\nEOF or bash <<- EOF\n...\nEOF
+      for (const m of s.matchAll(/<<-?\s*['"]?(\w+)['"]?\s*\n([\s\S]*?)\n\s*\1/gi)) inner.push(m[2]);
+      // Herestring: bash <<< "cmd"
+      for (const m of s.matchAll(/<<<\s*["']([^"']+)["']/gi)) inner.push(m[1]);
+      for (const m of s.matchAll(/<<<\s*([^\s;&|]+)/gi)) inner.push(m[1]);
+      // Process substitution: <(cmd) or >(cmd)
+      for (const m of s.matchAll(/[<>]\(\s*([^)]+)\s*\)/gi)) inner.push(m[1]);
       return inner;
     }
 
@@ -377,25 +387,50 @@ process.stdin.on('end', async () => {
 
     // 6. Check if a glob/wildcard could match any protected path
     function globMatchesProtected(s) {
-      if (!s.includes('*') && !s.includes('?')) return null;
+      const hasWild = s.includes('*') || s.includes('?') || /\[.+\]/.test(s);
+      if (!hasWild) return null;
       const segments = s.split('/').filter(Boolean);
       const candidates = [s, ...segments];
       for (const candidate of candidates) {
-        if (!candidate.includes('*') && !candidate.includes('?')) continue;
+        const candHasWild = candidate.includes('*') || candidate.includes('?') || /\[.+\]/.test(candidate);
+        if (!candHasWild) continue;
         // Prefix match: ".antig*" → prefix ".antig"
-        const starIdx = candidate.indexOf('*');
-        const qIdx = candidate.indexOf('?');
-        const firstWild = starIdx === -1 ? qIdx : qIdx === -1 ? starIdx : Math.min(starIdx, qIdx);
+        const firstWild = Math.min(
+          candidate.includes('*') ? candidate.indexOf('*') : Infinity,
+          candidate.includes('?') ? candidate.indexOf('?') : Infinity,
+          /\[/.test(candidate) ? candidate.indexOf('[') : Infinity,
+        );
         const prefix = candidate.slice(0, firstWild).toLowerCase();
         if (prefix.length > 0) {
           for (const p of protectedPaths) {
             if (p.startsWith(prefix)) return p;
           }
         }
-        // Regex match for patterns like ".cl?ude"
+        // Regex match — convert shell glob to regex
+        // Handles *, ?, and [...] character classes
         try {
-          const escaped = candidate.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\\\*/g, '.*').replace(/\\\?/g, '.');
-          const re = new RegExp('^' + escaped + '$', 'i');
+          let regex = '';
+          let i = 0;
+          const c = candidate.toLowerCase();
+          while (i < c.length) {
+            if (c[i] === '*') { regex += '.*'; i++; }
+            else if (c[i] === '?') { regex += '.'; i++; }
+            else if (c[i] === '[') {
+              // Pass through [...] as regex character class
+              const close = c.indexOf(']', i + 1);
+              if (close !== -1) {
+                regex += c.slice(i, close + 1);
+                i = close + 1;
+              } else {
+                regex += '\\['; i++;
+              }
+            }
+            else {
+              regex += c[i].replace(/[.+^${}()|\\]/g, '\\$&');
+              i++;
+            }
+          }
+          const re = new RegExp('^' + regex + '$', 'i');
           for (const p of protectedPaths) {
             if (re.test(p)) return p;
           }
@@ -452,10 +487,80 @@ process.stdin.on('end', async () => {
       }
     }
 
+    // ── Write-protection for .env, .gitignore ──
+    // These files can be READ but not written/deleted/moved
+    const toolNameLower = (data.tool_name || '').toLowerCase();
+    const isWriteTool = toolNameLower === 'write' || toolNameLower === 'edit' || toolNameLower === 'notebookedit';
+    const isBashTool = toolNameLower === 'bash';
+    const bashDestructive = /\b(?:rm|rmdir|del|unlink|mv|move|rename|cp|chmod|chown|truncate|shred)\b/i;
+    const fullCmd = rawStrings.join(' ');
+
+    for (const wp of writeProtectedPaths) {
+      if (isWriteTool) {
+        // Check file_path and all strings for write-protected paths
+        for (const s of allStrings) {
+          if (s.includes(wp)) {
+            await blockSelfProtection('SOLONGATE: Write to protected file "' + wp + '" is blocked');
+          }
+        }
+      }
+      if (isBashTool && bashDestructive.test(fullCmd)) {
+        for (const s of allStrings) {
+          if (s.includes(wp)) {
+            await blockSelfProtection('SOLONGATE: Destructive operation on "' + wp + '" is blocked');
+          }
+        }
+      }
+    }
+
+    // Also apply glob/wildcard checks for write-protected paths in destructive contexts
+    if (isBashTool && bashDestructive.test(fullCmd)) {
+      for (const s of allStrings) {
+        const hasWild = s.includes('*') || s.includes('?') || /\[.+\]/.test(s);
+        if (!hasWild) continue;
+        // Convert glob to regex and test against write-protected paths
+        try {
+          let regex = '';
+          let i = 0;
+          const c = s.toLowerCase();
+          while (i < c.length) {
+            if (c[i] === '*') { regex += '.*'; i++; }
+            else if (c[i] === '?') { regex += '.'; i++; }
+            else if (c[i] === '[') {
+              const close = c.indexOf(']', i + 1);
+              if (close !== -1) { regex += c.slice(i, close + 1); i = close + 1; }
+              else { regex += '\\['; i++; }
+            }
+            else { regex += c[i].replace(/[.+^${}()|\\]/g, '\\$&'); i++; }
+          }
+          const re = new RegExp('^' + regex + '$', 'i');
+          for (const wp of writeProtectedPaths) {
+            if (re.test(wp)) {
+              await blockSelfProtection('SOLONGATE: Wildcard "' + s + '" matches write-protected "' + wp + '" — blocked');
+            }
+          }
+        } catch {}
+      }
+    }
+
     // ── Layer 7: Block ALL inline code execution & dangerous patterns ──
     // Runtime string construction (atob, Buffer.from, fromCharCode, array.join)
     // makes static analysis impossible. Blanket-block these patterns.
-    const fullCmd = rawStrings.join(' ');
+
+    // 7-pre. Blanket rule: destructive command + dot-prefixed glob = BLOCK
+    // Catches: rm -rf .[a-z]*, mv .[!.]* /tmp, etc.
+    // Any glob starting with "." combined with a destructive op is dangerous
+    const destructiveOps = /\b(?:rm|rmdir|del|unlink|mv|move|rename)\b/i;
+    const dotGlob = /\.\[|\.[\*\?]|\.{[^}]+}/; // .[a-z]*, .*, .?, .{foo,bar}
+    if (destructiveOps.test(fullCmd) && dotGlob.test(fullCmd)) {
+      await blockSelfProtection('SOLONGATE: Destructive command + dot-glob pattern — blocked');
+    }
+
+    // 7-pre2. Heredoc to interpreter — BLOCK
+    // bash << 'EOF' / bash <<< "cmd" / sh << TAG
+    if (/\b(?:bash|sh|node|python[23]?|perl|ruby)\s+<</i.test(fullCmd)) {
+      await blockSelfProtection('SOLONGATE: Heredoc to interpreter — blocked');
+    }
 
     // 7a. Inline interpreter execution — TOTAL BLOCK (no content scan needed)
     // These can construct ANY string at runtime, bypassing all static analysis
@@ -476,17 +581,24 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // 7b. Base64 decode in ANY context — block when piped to anything
+    // 7b. Pipe-to-interpreter — TOTAL BLOCK
+    // Any content piped to an interpreter can construct arbitrary commands at runtime
+    const pipeToInterpreter = /\|\s*(?:node|bash|sh|python[23]?|perl|ruby|php)\b/i;
+    if (pipeToInterpreter.test(fullCmd)) {
+      await blockSelfProtection('SOLONGATE: Pipe to interpreter blocked — runtime bypass risk');
+    }
+
+    // 7c. Base64 decode in ANY context — block when piped to anything
     if (/\bbase64\s+(?:-d|--decode)\b/i.test(fullCmd) && /\|/i.test(fullCmd)) {
       await blockSelfProtection('SOLONGATE: base64 decode in pipe chain — blocked');
     }
 
-    // 7c. Temp/arbitrary script file execution
+    // 7d. Temp/arbitrary script file execution
     if (/\b(?:bash|sh)\s+(?:\/tmp\/|\/var\/tmp\/|~\/|\/dev\/)/i.test(fullCmd)) {
       await blockSelfProtection('SOLONGATE: Script execution from temp path — blocked');
     }
 
-    // 7d. xargs with destructive operations
+    // 7e. xargs with destructive operations
     if (/\bxargs\b.*\b(?:rm|mv|cp|rmdir|unlink|del)\b/i.test(fullCmd)) {
       for (const p of protectedPaths) {
         if (fullCmd.includes(p.slice(0, 4))) {
@@ -495,7 +607,7 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // 7e. cmd.exe /c with encoded/constructed commands
+    // 7f. cmd.exe /c with encoded/constructed commands
     if (/\bcmd(?:\.exe)?\s+\/c\b/i.test(fullCmd)) {
       for (const p of protectedPaths) {
         if (fullCmd.includes(p) || fullCmd.includes(p.slice(0, 4))) {
@@ -504,6 +616,48 @@ process.stdin.on('end', async () => {
       }
     }
 
+    // 7g. Script file execution — scan file content for discovery+destruction combo
+    // Catches: bash script.sh / node script.mjs where the script uses readdirSync + rmSync
+    const scriptExecMatch = fullCmd.match(/\b(?:bash|sh|node|python[23]?|perl|ruby)\s+([^\s;&|]+)/i);
+    if (scriptExecMatch) {
+      const scriptPath = scriptExecMatch[1];
+      try {
+        const hookCwdForScript = data.cwd || process.cwd();
+        const absPath = scriptPath.startsWith('/') || scriptPath.includes(':')
+          ? scriptPath
+          : resolve(hookCwdForScript, scriptPath);
+        if (existsSync(absPath)) {
+          const scriptContent = readFileSync(absPath, 'utf-8').toLowerCase();
+          // Check for discovery+destruction combo
+          const hasDiscovery = /\breaddirsync\b|\breaddir\b|\bos\.listdir\b|\bscandir\b|\bglob(?:sync)?\b|\bls\s+-[adl]|\bls\s+\.\b|\bopendir\b|\bdir\.entries\b|\bwalkdir\b|\bls\b.*\.\[/.test(scriptContent);
+          const hasDestruction = /\brmsync\b|\brm\s+-rf\b|\bunlinksync\b|\brmdirsync\b|\bunlink\s*\(|\brimraf\b|\bremovesync\b|\bremove_tree\b|\bshutil\.rmtree\b|\bwritefilesync\b|\bexecsync\b.*\brm\b|\bchild_process\b|\bfs\.\s*(?:rm|unlink|rmdir|write)/.test(scriptContent);
+          if (hasDiscovery && hasDestruction) {
+            await blockSelfProtection('SOLONGATE: Script contains directory discovery + destructive ops — blocked');
+          }
+          // Also check for protected path names in script content (existing check, now centralized)
+          for (const p of protectedPaths) {
+            if (scriptContent.includes(p)) {
+              await blockSelfProtection('SOLONGATE: Script references protected path "' + p + '" — blocked');
+            }
+          }
+        }
+      } catch {} // File read error — skip
+    }
+
+    // 7h. Write tool content scanning — detect discovery+destruction in file content being written
+    // Catches: Write tool creating a script that uses readdirSync('.') + rmSync
+    const toolName_ = data.tool_name || '';
+    if (toolName_.toLowerCase() === 'write' || toolName_.toLowerCase() === 'edit') {
+      const fileContent = (args.content || args.new_string || '').toLowerCase();
+      if (fileContent.length > 0) {
+        const hasDiscovery = /\breaddirsync\b|\breaddir\b|\bos\.listdir\b|\bscandir\b|\bglob(?:sync)?\b|\bls\s+-[adl]|\bls\s+\.\b|\bopendir\b|\bdir\.entries\b|\bwalkdir\b|\bls\b.*\.\[/.test(fileContent);
+        const hasDestruction = /\brmsync\b|\brm\s+-rf\b|\bunlinksync\b|\brmdirsync\b|\bunlink\b|\brimraf\b|\bremovesync\b|\bremove_tree\b|\bshutil\.rmtree\b|\bwritefilesync\b|\bexecsync\b.*\brm\b|\bchild_process\b.*\brm\b|\bfs\.\s*(?:rm|unlink|rmdir)/.test(fileContent);
+        if (hasDiscovery && hasDestruction) {
+          await blockSelfProtection('SOLONGATE: File content contains discovery + destructive ops — write blocked');
+        }
+      }
+    }
+
     // ── Fetch PI config from Cloud ──
     let piCfg = { piEnabled: true, piThreshold: 0.5, piMode: 'block', piWhitelist: [], piToolConfig: {}, piCustomPatterns: [], piWebhookUrl: null };
     if (API_KEY && API_KEY.startsWith('sg_live_')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {