@solongate/proxy 0.25.5 → 0.25.6

package/dist/index.js

@@ -6148,17 +6148,26 @@ DENY if the tool call could, directly or indirectly:
 - Read, display, copy, move, or exfiltrate any protected file \u2014 even through:
   - Shell glob patterns (e.g., "cred*" could match "credentials.json")
   - Command substitution ($(...), backticks)
-  - Variable interpolation or string concatenation
+  - Process substitution (<(cat file), <(command file)) \u2014 ALWAYS check inside <(...) for protected files
+  - Variable interpolation or string concatenation (e.g., f=".en"; cat ${f}v builds ".env")
+  - Partial variable construction \u2014 if shell variables are concatenated to form a filename, analyze the RESULT
   - Input redirection (< file)
   - Script files that might read protected files
   - Find/exec patterns
-  - Any Unix/Windows utility that reads file content (cat, head, tail, less, more, type, perl, awk, sed, sort, diff, comm, paste, tee, xxd, od, strings, dd, tr, etc.)
+  - Multi-stage operations: if command A archives/copies a protected file and command B reads the copy, DENY the ENTIRE chain (e.g., "tar czf /tmp/x.tgz .env && tar xzf /tmp/x.tgz -O")
+  - Any Unix/Windows utility that reads file content (cat, head, tail, less, more, type, perl, awk, sed, sort, diff, comm, paste, tee, xxd, od, strings, dd, tr, tar, zip, etc.)
 - Delete, modify, or overwrite any protected file or path
 - Send data to external URLs, webhooks, or attacker-controlled endpoints
 - Execute remotely downloaded code (curl|bash, wget|sh, etc.)
 - Leak environment variables (printenv, env, /proc/self/environ, npm run env, process.env)
 - Create scripts that bypass security controls
 
+CRITICAL patterns to watch for:
+- <(cat .env) or <(cat ANYPROTECTEDFILE) \u2014 process substitution ALWAYS reads the file
+- Compound commands with && or ; where ANY part touches a protected file \u2014 DENY the whole thing
+- Variable tricks like f=".en"; cat ${f}v \u2014 mentally evaluate the variable to see if it resolves to a protected filename
+- tar/zip/cp that archives a protected file, even if the second command reads the archive \u2014 DENY both
+
 ALLOW if:
 - The action is a normal development operation (ls, git status, npm build, etc.)
 - The action does not touch any protected file or path
@@ -6921,7 +6930,7 @@ ${msg.content.text}`;
       if (rule.effect === "DENY" && rule.enabled !== false) {
         const denied = rule.filenameConstraints?.denied;
         if (denied) {
-          for (const f of denied) files.add(f);
+          for (const f2 of denied) files.add(f2);
         }
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.25.5",
+  "version": "0.25.6",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {