@solongate/proxy 0.19.0 → 0.21.0

package/hooks/guard.mjs

@@ -291,10 +291,13 @@ process.stdin.on('end', async () => {
 
     // ── Self-protection: block access to hook files and settings ──
     // Hardcoded, no bypass possible — runs before policy/PI config
+    // Fully protected: block ALL access (read, write, delete, move)
     const protectedPaths = [
       '.solongate', '.claude', '.cursor', '.gemini', '.antigravity', '.openclaw', '.perplexity',
       'policy.json', '.mcp.json',
     ];
+    // Write-protected: block write/delete/modify, allow read (cat, grep, head, etc.)
+    const writeProtectedPaths = ['.env', '.gitignore'];
 
     // Block helper — logs to cloud + exits with code 2
     async function blockSelfProtection(reason) {
@@ -346,7 +349,7 @@ process.stdin.on('end', async () => {
       return stripShellQuotes(decodeAnsiC(s));
     }
 
-    // 4. Extract inner commands from eval, bash -c, sh -c, pipe to bash/sh
+    // 4. Extract inner commands from eval, bash -c, sh -c, pipe to bash/sh, heredoc, process substitution
     function extractInnerCommands(s) {
       const inner = [];
       // eval "cmd" or eval 'cmd' or eval cmd
@@ -358,6 +361,13 @@ process.stdin.on('end', async () => {
       for (const m of s.matchAll(/(?:echo|printf)\s+["']([^"']+)["']\s*\|\s*(?:bash|sh)\b/gi)) inner.push(m[1]);
       // find ... -name "pattern" ... -exec ...
       for (const m of s.matchAll(/-name\s+["']?([^\s"']+)["']?/gi)) inner.push(m[1]);
+      // Heredoc: bash << 'EOF'\n...\nEOF or bash <<- EOF\n...\nEOF
+      for (const m of s.matchAll(/<<-?\s*['"]?(\w+)['"]?\s*\n([\s\S]*?)\n\s*\1/gi)) inner.push(m[2]);
+      // Herestring: bash <<< "cmd"
+      for (const m of s.matchAll(/<<<\s*["']([^"']+)["']/gi)) inner.push(m[1]);
+      for (const m of s.matchAll(/<<<\s*([^\s;&|]+)/gi)) inner.push(m[1]);
+      // Process substitution: <(cmd) or >(cmd)
+      for (const m of s.matchAll(/[<>]\(\s*([^)]+)\s*\)/gi)) inner.push(m[1]);
       return inner;
     }
 
@@ -377,25 +387,50 @@ process.stdin.on('end', async () => {
 
     // 6. Check if a glob/wildcard could match any protected path
     function globMatchesProtected(s) {
-      if (!s.includes('*') && !s.includes('?')) return null;
+      const hasWild = s.includes('*') || s.includes('?') || /\[.+\]/.test(s);
+      if (!hasWild) return null;
       const segments = s.split('/').filter(Boolean);
       const candidates = [s, ...segments];
       for (const candidate of candidates) {
-        if (!candidate.includes('*') && !candidate.includes('?')) continue;
+        const candHasWild = candidate.includes('*') || candidate.includes('?') || /\[.+\]/.test(candidate);
+        if (!candHasWild) continue;
         // Prefix match: ".antig*" → prefix ".antig"
-        const starIdx = candidate.indexOf('*');
-        const qIdx = candidate.indexOf('?');
-        const firstWild = starIdx === -1 ? qIdx : qIdx === -1 ? starIdx : Math.min(starIdx, qIdx);
+        const firstWild = Math.min(
+          candidate.includes('*') ? candidate.indexOf('*') : Infinity,
+          candidate.includes('?') ? candidate.indexOf('?') : Infinity,
+          /\[/.test(candidate) ? candidate.indexOf('[') : Infinity,
+        );
         const prefix = candidate.slice(0, firstWild).toLowerCase();
         if (prefix.length > 0) {
           for (const p of protectedPaths) {
             if (p.startsWith(prefix)) return p;
           }
         }
-        // Regex match for patterns like ".cl?ude"
+        // Regex match — convert shell glob to regex
+        // Handles *, ?, and [...] character classes
         try {
-          const escaped = candidate.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\\\*/g, '.*').replace(/\\\?/g, '.');
-          const re = new RegExp('^' + escaped + '$', 'i');
+          let regex = '';
+          let i = 0;
+          const c = candidate.toLowerCase();
+          while (i < c.length) {
+            if (c[i] === '*') { regex += '.*'; i++; }
+            else if (c[i] === '?') { regex += '.'; i++; }
+            else if (c[i] === '[') {
+              // Pass through [...] as regex character class
+              const close = c.indexOf(']', i + 1);
+              if (close !== -1) {
+                regex += c.slice(i, close + 1);
+                i = close + 1;
+              } else {
+                regex += '\\['; i++;
+              }
+            }
+            else {
+              regex += c[i].replace(/[.+^${}()|\\]/g, '\\$&');
+              i++;
+            }
+          }
+          const re = new RegExp('^' + regex + '$', 'i');
           for (const p of protectedPaths) {
             if (re.test(p)) return p;
           }
@@ -452,10 +487,107 @@ process.stdin.on('end', async () => {
       }
     }
 
+    // ── Write-protection for .env, .gitignore ──
+    // These files can be READ but not written/deleted/moved
+    const toolNameLower = (data.tool_name || '').toLowerCase();
+    const isWriteTool = toolNameLower === 'write' || toolNameLower === 'edit' || toolNameLower === 'notebookedit';
+    const isBashTool = toolNameLower === 'bash';
+    const bashDestructive = /\b(?:rm|rmdir|del|unlink|mv|move|rename|cp|chmod|chown|truncate|shred)\b/i;
+    const fullCmd = rawStrings.join(' ');
+
+    for (const wp of writeProtectedPaths) {
+      if (isWriteTool) {
+        // Check file_path and all strings for write-protected paths
+        for (const s of allStrings) {
+          if (s.includes(wp)) {
+            await blockSelfProtection('SOLONGATE: Write to protected file "' + wp + '" is blocked');
+          }
+        }
+      }
+      if (isBashTool && bashDestructive.test(fullCmd)) {
+        for (const s of allStrings) {
+          if (s.includes(wp)) {
+            await blockSelfProtection('SOLONGATE: Destructive operation on "' + wp + '" is blocked');
+          }
+        }
+      }
+    }
+
+    // Also apply glob/wildcard checks for write-protected paths in destructive contexts
+    if (isBashTool && bashDestructive.test(fullCmd)) {
+      for (const s of allStrings) {
+        const hasWild = s.includes('*') || s.includes('?') || /\[.+\]/.test(s);
+        if (!hasWild) continue;
+        // Convert glob to regex and test against write-protected paths
+        try {
+          let regex = '';
+          let i = 0;
+          const c = s.toLowerCase();
+          while (i < c.length) {
+            if (c[i] === '*') { regex += '.*'; i++; }
+            else if (c[i] === '?') { regex += '.'; i++; }
+            else if (c[i] === '[') {
+              const close = c.indexOf(']', i + 1);
+              if (close !== -1) { regex += c.slice(i, close + 1); i = close + 1; }
+              else { regex += '\\['; i++; }
+            }
+            else { regex += c[i].replace(/[.+^${}()|\\]/g, '\\$&'); i++; }
+          }
+          const re = new RegExp('^' + regex + '$', 'i');
+          for (const wp of writeProtectedPaths) {
+            if (re.test(wp)) {
+              await blockSelfProtection('SOLONGATE: Wildcard "' + s + '" matches write-protected "' + wp + '" — blocked');
+            }
+          }
+        } catch {}
+      }
+    }
+
     // ── Layer 7: Block ALL inline code execution & dangerous patterns ──
     // Runtime string construction (atob, Buffer.from, fromCharCode, array.join)
     // makes static analysis impossible. Blanket-block these patterns.
-    const fullCmd = rawStrings.join(' ');
+
+    // 7-pre. Blanket rule: destructive command + dot-prefixed glob = BLOCK
+    // Catches: rm -rf .[a-z]*, mv .[!.]* /tmp, etc.
+    // Any glob starting with "." combined with a destructive op is dangerous
+    const destructiveOps = /\b(?:rm|rmdir|del|unlink|mv|move|rename)\b/i;
+    const dotGlob = /\.\[|\.[\*\?]|\.{[^}]+}/; // .[a-z]*, .*, .?, .{foo,bar}
+    if (destructiveOps.test(fullCmd) && dotGlob.test(fullCmd)) {
+      await blockSelfProtection('SOLONGATE: Destructive command + dot-glob pattern — blocked');
+    }
+
+    // 7-pre2. Heredoc to interpreter — BLOCK
+    // bash << 'EOF' / bash <<< "cmd" / sh << TAG
+    if (/\b(?:bash|sh|node|python[23]?|perl|ruby)\s+<</i.test(fullCmd)) {
+      await blockSelfProtection('SOLONGATE: Heredoc to interpreter — blocked');
+    }
+
+    // 7-pre3. Command substitution + destructive = BLOCK
+    // Catches: rm -rf $(node scan.mjs), rm `node scan.mjs`, rm $(bash scan.sh)
+    // Pattern: destructive command + $() or `` containing interpreter call
+    const hasDestructive = /\b(?:rm|rmdir|del|unlink|mv|move|rename|shred)\b/i.test(fullCmd);
+    const hasCmdSubInterpreter = /\$\(\s*(?:node|bash|sh|python[23]?|perl|ruby)\b/i.test(fullCmd)
+      || /`\s*(?:node|bash|sh|python[23]?|perl|ruby)\b/i.test(fullCmd);
+    if (hasDestructive && hasCmdSubInterpreter) {
+      await blockSelfProtection('SOLONGATE: Command substitution + destructive op — blocked');
+    }
+
+    // 7-pre4. Pipe from interpreter to destructive loop = BLOCK
+    // Catches: node scan.mjs | while read d; do rm -rf "$d"; done
+    //          node scan.mjs | xargs rm -rf
+    //          bash scan.sh | while read ...
+    const pipeFromInterpreter = /\b(?:node|bash|sh|python[23]?|perl|ruby)\s+\S+\s*\|/i;
+    if (pipeFromInterpreter.test(fullCmd) && hasDestructive) {
+      await blockSelfProtection('SOLONGATE: Pipe from script to destructive command — blocked');
+    }
+
+    // 7-pre5. Script chaining: interpreter + destructive in same command chain
+    // Catches: node scan.mjs && rm -rf $(cat /tmp/targets.txt)
+    //          bash scan.sh; while read d < targets.txt; do rm -rf "$d"; done
+    const hasScriptExec = /\b(?:node|bash|sh|python[23]?|perl|ruby)\s+\S+\.\S+/i.test(fullCmd);
+    if (hasScriptExec && hasDestructive) {
+      await blockSelfProtection('SOLONGATE: Script execution + destructive command in chain — blocked');
+    }
 
     // 7a. Inline interpreter execution — TOTAL BLOCK (no content scan needed)
     // These can construct ANY string at runtime, bypassing all static analysis
@@ -478,7 +610,8 @@ process.stdin.on('end', async () => {
 
     // 7b. Pipe-to-interpreter — TOTAL BLOCK
     // Any content piped to an interpreter can construct arbitrary commands at runtime
-    const pipeToInterpreter = /\|\s*(?:node|bash|sh|python[23]?|perl|ruby|php)\b/i;
+    // Also catches: | xargs node, | xargs bash, etc.
+    const pipeToInterpreter = /\|\s*(?:xargs\s+)?(?:node|bash|sh|python[23]?|perl|ruby|php)\b/i;
     if (pipeToInterpreter.test(fullCmd)) {
       await blockSelfProtection('SOLONGATE: Pipe to interpreter blocked — runtime bypass risk');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {