@solongate/proxy 0.2.5 → 0.2.7

package/dist/index.js

@@ -493,6 +493,7 @@ const PATH_ARGS = ['file_path', 'path', 'pattern', 'directory', 'url', 'uri', 'n
 function checkBashCommand(cmd) {
   if (typeof cmd !== 'string') return null;
   for (const p of DANGEROUS_COMMANDS) if (p.test(cmd)) return 'Dangerous command blocked: ' + cmd.slice(0, 80);
+  for (const p of SSRF) if (p.test(cmd)) return 'SSRF attempt blocked in command: ' + cmd.slice(0, 80);
   return null;
 }
 
@@ -529,19 +530,21 @@ process.stdin.on('end', async () => {
     const ms = Date.now() - start;
 
     if (threat) {
-      // Send DENY audit log
+      // Send DENY audit log \u2014 MUST await before exit or fetch dies
       if (API_KEY && API_KEY.startsWith('sg_live_')) {
-        fetch(API_URL + '/api/v1/audit-logs', {
-          method: 'POST',
-          headers: { 'Authorization': 'Bearer ' + API_KEY, 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            tool, arguments: Object.fromEntries(Object.entries(args).map(([k,v]) =>
-              [k, typeof v === 'string' && v.length > 200 ? v.slice(0,200)+'...' : v])),
-            decision: 'DENY', reason: threat, source: 'claude-code-guard',
-            evaluationTimeMs: ms,
-          }),
-          signal: AbortSignal.timeout(5000),
-        }).catch(() => {});
+        try {
+          await fetch(API_URL + '/api/v1/audit-logs', {
+            method: 'POST',
+            headers: { 'Authorization': 'Bearer ' + API_KEY, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              tool, arguments: Object.fromEntries(Object.entries(args).map(([k,v]) =>
+                [k, typeof v === 'string' && v.length > 200 ? v.slice(0,200)+'...' : v])),
+              decision: 'DENY', reason: threat, source: 'claude-code-guard',
+              evaluationTimeMs: ms,
+            }),
+            signal: AbortSignal.timeout(3000),
+          });
+        } catch {}
       }
       // Exit 2 = BLOCK. Write to both stdout and stderr for visibility.
       const msg = 'SOLONGATE BLOCKED: ' + threat;

package/dist/init.js

@@ -212,6 +212,7 @@ const PATH_ARGS = ['file_path', 'path', 'pattern', 'directory', 'url', 'uri', 'n
 function checkBashCommand(cmd) {
   if (typeof cmd !== 'string') return null;
   for (const p of DANGEROUS_COMMANDS) if (p.test(cmd)) return 'Dangerous command blocked: ' + cmd.slice(0, 80);
+  for (const p of SSRF) if (p.test(cmd)) return 'SSRF attempt blocked in command: ' + cmd.slice(0, 80);
   return null;
 }
 
@@ -248,19 +249,21 @@ process.stdin.on('end', async () => {
     const ms = Date.now() - start;
 
     if (threat) {
-      // Send DENY audit log
+      // Send DENY audit log \u2014 MUST await before exit or fetch dies
       if (API_KEY && API_KEY.startsWith('sg_live_')) {
-        fetch(API_URL + '/api/v1/audit-logs', {
-          method: 'POST',
-          headers: { 'Authorization': 'Bearer ' + API_KEY, 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            tool, arguments: Object.fromEntries(Object.entries(args).map(([k,v]) =>
-              [k, typeof v === 'string' && v.length > 200 ? v.slice(0,200)+'...' : v])),
-            decision: 'DENY', reason: threat, source: 'claude-code-guard',
-            evaluationTimeMs: ms,
-          }),
-          signal: AbortSignal.timeout(5000),
-        }).catch(() => {});
+        try {
+          await fetch(API_URL + '/api/v1/audit-logs', {
+            method: 'POST',
+            headers: { 'Authorization': 'Bearer ' + API_KEY, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              tool, arguments: Object.fromEntries(Object.entries(args).map(([k,v]) =>
+                [k, typeof v === 'string' && v.length > 200 ? v.slice(0,200)+'...' : v])),
+              decision: 'DENY', reason: threat, source: 'claude-code-guard',
+              evaluationTimeMs: ms,
+            }),
+            signal: AbortSignal.timeout(3000),
+          });
+        } catch {}
       }
       // Exit 2 = BLOCK. Write to both stdout and stderr for visibility.
       const msg = 'SOLONGATE BLOCKED: ' + threat;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "MCP security proxy \u00e2\u20ac\u201d protect any MCP server with policies, input validation, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {