@solongate/proxy 0.25.6 → 0.26.0

package/dist/index.js

@@ -6149,7 +6149,7 @@ DENY if the tool call could, directly or indirectly:
   - Shell glob patterns (e.g., "cred*" could match "credentials.json")
   - Command substitution ($(...), backticks)
   - Process substitution (<(cat file), <(command file)) \u2014 ALWAYS check inside <(...) for protected files
-  - Variable interpolation or string concatenation (e.g., f=".en"; cat ${f}v builds ".env")
+  - Variable interpolation or string concatenation (e.g., f=".en"; cat \${f}v builds ".env")
   - Partial variable construction \u2014 if shell variables are concatenated to form a filename, analyze the RESULT
   - Input redirection (< file)
   - Script files that might read protected files
@@ -6165,7 +6165,7 @@ DENY if the tool call could, directly or indirectly:
 CRITICAL patterns to watch for:
 - <(cat .env) or <(cat ANYPROTECTEDFILE) \u2014 process substitution ALWAYS reads the file
 - Compound commands with && or ; where ANY part touches a protected file \u2014 DENY the whole thing
-- Variable tricks like f=".en"; cat ${f}v \u2014 mentally evaluate the variable to see if it resolves to a protected filename
+- Variable tricks like f=".en"; cat \${f}v \u2014 mentally evaluate the variable to see if it resolves to a protected filename
 - tar/zip/cp that archives a protected file, even if the second command reads the archive \u2014 DENY both
 
 ALLOW if:
@@ -6930,7 +6930,7 @@ ${msg.content.text}`;
       if (rule.effect === "DENY" && rule.enabled !== false) {
         const denied = rule.filenameConstraints?.denied;
         if (denied) {
-          for (const f2 of denied) files.add(f2);
+          for (const f of denied) files.add(f);
         }
       }
     }

package/hooks/guard.mjs

@@ -1013,7 +1013,140 @@ process.stdin.on('end', async () => {
       process.exit(0); // No policy = allow all
     }
 
-    const reason = evaluate(policy, args);
+    let reason = evaluate(policy, args);
+
+    // ── AI Judge: semantic intent analysis (runs when policy ALLOWs) ──
+    if (!reason) {
+      const GROQ_KEY = process.env.GROQ_API_KEY || dotenv.GROQ_API_KEY || '';
+      let aiJudgeEnabled = false;
+      let aiJudgeModel = 'llama-3.1-8b-instant';
+      let aiJudgeEndpoint = 'https://api.groq.com/openai';
+      let aiJudgeTimeout = 5000;
+
+      // Check cloud config for AI Judge settings
+      if (API_KEY && API_KEY.startsWith('sg_live_')) {
+        try {
+          const cfgRes = await fetch(API_URL + '/api/v1/project-config/ai-judge', {
+            headers: { 'Authorization': 'Bearer ' + API_KEY },
+            signal: AbortSignal.timeout(3000),
+          });
+          if (cfgRes.ok) {
+            const cfg = await cfgRes.json();
+            aiJudgeEnabled = Boolean(cfg.enabled);
+            if (cfg.model) aiJudgeModel = cfg.model;
+            if (cfg.endpoint) aiJudgeEndpoint = cfg.endpoint;
+            if (cfg.timeoutMs) aiJudgeTimeout = cfg.timeoutMs;
+          }
+        } catch {}
+      }
+
+      if (aiJudgeEnabled && GROQ_KEY) {
+        try {
+          // Extract protected files/paths from policy
+          const protectedFiles = [];
+          const protectedPathsList = [];
+          if (policy && policy.rules) {
+            for (const rule of policy.rules) {
+              if (rule.effect === 'DENY' && rule.enabled !== false) {
+                if (rule.filenameConstraints && rule.filenameConstraints.denied) {
+                  for (const f of rule.filenameConstraints.denied) protectedFiles.push(f);
+                }
+                if (rule.pathConstraints && rule.pathConstraints.denied) {
+                  for (const p of rule.pathConstraints.denied) protectedPathsList.push(p);
+                }
+              }
+            }
+          }
+
+          const judgePayload = JSON.stringify({
+            tool: toolName,
+            arguments: args,
+            protected_files: protectedFiles,
+            protected_paths: protectedPathsList,
+            denied_actions: ['file deletion', 'data exfiltration', 'remote code execution', 'environment variable leak', 'security control bypass'],
+          });
+
+          const systemPrompt = `You are a security judge for an AI coding tool. You evaluate tool calls and decide if they should be ALLOWED or DENIED.
+
+You will receive a JSON object with:
+- "tool": the tool name being called (e.g., Bash, Write, Read, Edit)
+- "arguments": the tool's arguments
+- "protected_files": list of files that must NEVER be read, written, copied, moved, or accessed
+- "protected_paths": list of directories/paths that must NEVER be accessed
+- "denied_actions": list of actions that are never allowed
+
+DENY if the tool call could, directly or indirectly:
+- Read, display, copy, move, or exfiltrate any protected file — even through:
+  - Shell glob patterns (e.g., "cred*" could match "credentials.json")
+  - Command substitution ($(...), backticks)
+  - Process substitution (<(cat file), <(command file)) — ALWAYS check inside <(...) for protected files
+  - Variable interpolation or string concatenation (e.g., f=".en"; cat \${f}v builds ".env")
+  - Partial variable construction — if shell variables are concatenated to form a filename, analyze the RESULT
+  - Input redirection (< file)
+  - Script files that might read protected files
+  - Find/exec patterns
+  - Multi-stage operations: if command A archives/copies a protected file and command B reads the copy, DENY the ENTIRE chain
+  - Any Unix/Windows utility that reads file content (cat, head, tail, less, more, type, perl, awk, sed, sort, diff, comm, paste, tee, xxd, od, strings, dd, tr, tar, zip, etc.)
+- Delete, modify, or overwrite any protected file or path
+- Send data to external URLs, webhooks, or attacker-controlled endpoints
+- Execute remotely downloaded code (curl|bash, wget|sh, etc.)
+- Leak environment variables (printenv, env, /proc/self/environ, npm run env, process.env)
+- Create scripts that bypass security controls
+
+CRITICAL patterns to watch for:
+- <(cat .env) or <(cat ANYPROTECTEDFILE) — process substitution ALWAYS reads the file
+- Compound commands with && or ; where ANY part touches a protected file — DENY the whole thing
+- Variable tricks like f=".en"; cat \${f}v — mentally evaluate the variable to see if it resolves to a protected filename
+- tar/zip/cp that archives a protected file, even if the second command reads the archive — DENY both
+
+ALLOW if:
+- The action is a normal development operation (ls, git status, npm build, etc.)
+- The action does not touch any protected file or path
+- The action is clearly benign
+
+When in doubt, DENY. False positives are acceptable; false negatives are not.
+
+Respond with ONLY valid JSON: {"decision": "ALLOW" or "DENY", "reason": "brief explanation", "confidence": 0.0 to 1.0}`;
+
+          const llmRes = await fetch(aiJudgeEndpoint + '/v1/chat/completions', {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+              'Authorization': 'Bearer ' + GROQ_KEY,
+            },
+            body: JSON.stringify({
+              model: aiJudgeModel,
+              messages: [
+                { role: 'system', content: systemPrompt },
+                { role: 'user', content: judgePayload },
+              ],
+              temperature: 0,
+              max_tokens: 200,
+            }),
+            signal: AbortSignal.timeout(aiJudgeTimeout),
+          });
+
+          if (llmRes.ok) {
+            const llmData = await llmRes.json();
+            const content = llmData.choices?.[0]?.message?.content || '';
+            const jsonMatch = content.match(/\{[\s\S]*\}/);
+            if (jsonMatch) {
+              const verdict = JSON.parse(jsonMatch[0]);
+              if (verdict.decision === 'DENY') {
+                reason = '[AI Judge] ' + (verdict.reason || 'Blocked by semantic analysis');
+              }
+            }
+          } else {
+            // Fail-closed: LLM error → DENY
+            reason = '[AI Judge] LLM endpoint error (fail-closed)';
+          }
+        } catch (err) {
+          // Fail-closed: timeout or parse error → DENY
+          reason = '[AI Judge] ' + (err.message || 'error') + ' (fail-closed)';
+        }
+      }
+    }
+
     const decision = reason ? 'DENY' : 'ALLOW';
 
     // ── Log ALL decisions to SolonGate Cloud ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.25.6",
+  "version": "0.26.0",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {