@solongate/proxy 0.49.1 → 0.50.0

package/hooks/audit.mjs

@@ -1,293 +1,379 @@
-#!/usr/bin/env node
-/**
- * SolonGate Audit Hook for Claude Code (PostToolUse)
- * Logs tool execution results to SolonGate Cloud.
- * Auto-installed by: npx @solongate/proxy init
- */
-import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { homedir } from 'node:os';
-
-function loadEnvKey(dir) {
-  try {
-    const envPath = resolve(dir, '.env');
-    if (!existsSync(envPath)) return {};
-    const lines = readFileSync(envPath, 'utf-8').split('\n');
-    const env = {};
-    for (const line of lines) {
-      const m = line.match(/^([A-Z_]+)=(.*)$/);
-      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
-    }
-    return env;
-  } catch { return {}; }
-}
-
-// Global cloud config written by `init --global` (~/.solongate/cloud-guard.json).
-// A system-wide PostToolUse hook runs from any cwd, so a project .env can't be
-// relied on for the key — read the absolute global config too.
-function loadGlobalCloudConfig() {
-  try {
-    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
-    if (!existsSync(p)) return {};
-    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
-    return (cfg && typeof cfg === 'object') ? cfg : {};
-  } catch { return {}; }
-}
-
-// ── Ghost paths (PostToolUse twin of guard.mjs) ──
-// The guard's PreToolUse hook blocks MUTATIONS to hidden paths; here we make
-// hidden paths invisible to READS and LISTINGS by rewriting the tool output the
-// model sees (Claude Code `updatedToolOutput`). The matcher below is mirrored
-// verbatim from guard.mjs — keep the two in sync. Config is read from the policy
-// cache the guard just wrote (same PreToolUse call), so no extra API request.
-function ghostGlobToRegExp(glob) {
-  let re = '';
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === '*') {
-      if (glob[i + 1] === '*') { re += '.*'; i++; }
-      else re += '[^/]*';
-    } else if (c === '?') re += '[^/]';
-    else if ('\\^$.|+()[]{}'.indexOf(c) !== -1) re += '\\' + c;
-    else re += c;
-  }
-  try { return new RegExp('^' + re + '$'); } catch { return null; }
-}
-function ghostMatch(targetPath, patterns) {
-  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
-  const norm = String(targetPath).replace(/\\/g, '/').replace(/\/+$/, '');
-  if (!norm) return false;
-  const segments = norm.split('/').filter(Boolean);
-  const base = segments.length ? segments[segments.length - 1] : norm;
-  for (let pat of patterns) {
-    pat = String(pat || '').trim();
-    if (!pat) continue;
-    let dirOnly = false;
-    if (pat.endsWith('/')) { dirOnly = true; pat = pat.slice(0, -1); }
-    if (!pat) continue;
-    const hasSlash = pat.indexOf('/') !== -1;
-    const hasWild = /[*?]/.test(pat);
-    const re = ghostGlobToRegExp(pat);
-    if (!re) continue;
-    if (dirOnly) {
-      if (!hasSlash && !hasWild) { if (segments.indexOf(pat) !== -1) return true; continue; }
-      let acc = '';
-      for (const s of segments) { acc = acc ? acc + '/' + s : s; if (re.test(acc) || re.test(s)) return true; }
-      continue;
-    }
-    if (!hasSlash) {
-      if (re.test(base)) return true;
-      if (segments.some((s) => re.test(s))) return true;
-      continue;
-    }
-    if (re.test(norm)) return true;
-  }
-  return false;
-}
-function ghostCleanToken(tok) {
-  let t = String(tok || '').trim();
-  t = t.replace(/^[<>|;&(]+/, '').replace(/[);&|]+$/, '');
-  t = t.replace(/^['"]+/, '').replace(/['"]+$/, '');
-  t = t.replace(/^\d*>>?/, '');
-  return t.trim();
-}
-// Drop listing lines that reference a ghost entry. `find`/glob output (one path
-// per line) drops the whole line; multi-column `ls -l` rows drop entirely; a
-// bare space-separated `ls` row drops only the matching names.
-function ghostStripLines(text, pats) {
-  const lines = String(text).split('\n');
-  const kept = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) { kept.push(line); continue; }
-    if (ghostMatch(trimmed, pats)) continue; // full-path listing line
-    const toks = trimmed.split(/\s+/);
-    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
-    if (!anyHit) { kept.push(line); continue; }
-    if (toks.length > 3) continue; // ls -l style row → drop entirely
-    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
-    if (remaining.length === 0) continue;
-    kept.push(remaining.join('  '));
-  }
-  return kept.join('\n');
-}
-// Read ghost patterns from the policy cache the guard wrote on the matching
-// PreToolUse call. Same agent-key derivation as guard.mjs.
-function loadGhostPatterns() {
-  try {
-    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
-    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
-    if (!existsSync(f)) return [];
-    const c = JSON.parse(readFileSync(f, 'utf-8'));
-    const g = c && c.security && c.security.ghost;
-    return g && Array.isArray(g.patterns) ? g.patterns : [];
-  } catch { return []; }
-}
-// Returns the rewritten output text, or null if nothing is hidden.
-function buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, pats) {
-  if (!Array.isArray(pats) || pats.length === 0) return null;
-  const name = toolName || '';
-  const getText = () => {
-    if (typeof toolResponse === 'string') return toolResponse;
-    if (toolResponse && typeof toolResponse.stdout === 'string') return toolResponse.stdout;
-    if (toolResponse && typeof toolResponse.content === 'string') return toolResponse.content;
-    if (typeof toolOutput === 'string' && toolOutput) return toolOutput;
-    return null;
-  };
-  try {
-    // Direct read of a hidden file → looks like it doesn't exist.
-    if (name === 'Read' || name === 'NotebookRead') {
-      const p = toolInput && (toolInput.file_path || toolInput.notebook_path);
-      if (p && ghostMatch(p, pats)) return p + ': No such file or directory';
-      return null;
-    }
-    if (name === 'Bash' || name === 'BashOutput') {
-      const text = getText();
-      if (text == null) return null;
-      const cmd = String((toolInput && toolInput.command) || '');
-      for (const raw of cmd.split(/\s+/)) {
-        const t = ghostCleanToken(raw);
-        // A command that names the hidden path directly (cat A/Y/.data, ls A/Y)
-        // → not-found, regardless of what the command actually returned.
-        if (t && t[0] !== '-' && ghostMatch(t, pats)) return t + ': No such file or directory';
-      }
-      const stripped = ghostStripLines(text, pats);
-      return stripped === text ? null : stripped;
-    }
-    // Listing-style tools → strip hidden entries from the result.
-    if (name === 'Glob' || name === 'Grep' || name === 'LS') {
-      const text = getText();
-      if (text == null) return null;
-      const stripped = ghostStripLines(text, pats);
-      return stripped === text ? null : stripped;
-    }
-  } catch { /* fail open */ }
-  return null;
-}
-
-function guessPermission(toolName) {
-  const name = (toolName || '').toLowerCase();
-  if (name.includes('exec') || name.includes('shell') || name.includes('run') || name.includes('eval') || name === 'bash') return 'EXECUTE';
-  if (name.includes('fetch') || name.includes('http') || name.includes('request') || name.includes('curl') || name.includes('network') || name.includes('download') || name.includes('upload') || name === 'websearch') return 'NETWORK';
-  if (name.includes('write') || name.includes('create') || name.includes('delete') || name.includes('update') || name.includes('set') || name.includes('edit') || name.includes('remove') || name.includes('insert')) return 'WRITE';
-  return 'READ';
-}
-
-const dotenv = loadEnvKey(process.cwd());
-const globalCfg = loadGlobalCloudConfig();
-const API_KEY = process.env.SOLONGATE_API_KEY || dotenv.SOLONGATE_API_KEY || globalCfg.apiKey || '';
-const API_URL = process.env.SOLONGATE_API_URL || dotenv.SOLONGATE_API_URL || globalCfg.apiUrl || 'https://api.solongate.com';
-
-// Agent identity from CLI args: node audit.mjs <agent_id> <agent_name>
-const AGENT_ID = process.argv[2] || 'claude-code';
-const AGENT_NAME = process.argv[3] || 'Claude Code';
-
-// Accept both live and test keys (test keys are used for trials / sandboxes).
-if (!API_KEY || !(API_KEY.startsWith('sg_live_') || API_KEY.startsWith('sg_test_'))) process.exit(0);
-
-let input = '';
-process.stdin.on('data', c => input += c);
-process.stdin.on('end', async () => {
-  try {
-    const data = JSON.parse(input);
-
-    // Debug: append raw stdin to file for agent detection troubleshooting.
-    // Opt-in (SOLONGATE_DEBUG) so a global hook doesn't litter every cwd.
-    if (process.env.SOLONGATE_DEBUG) {
-      try {
-        const debugLine = JSON.stringify({ ts: new Date().toISOString(), argv: process.argv.slice(2), tool_name: data.tool_name || data.toolName, agent_id: AGENT_ID }) + '\n';
-        const { appendFileSync: afs, mkdirSync: mds } = await import('node:fs');
-        mds(resolve('.solongate'), { recursive: true });
-        afs(resolve('.solongate', '.debug-audit-log'), debugLine);
-      } catch {}
-    }
-
-    let toolName = data.tool_name || data.toolName || '';
-    let toolInput = data.tool_input || data.toolInput || data.params || {};
-    if (!toolName) toolName = 'unknown';
-
-    if (toolName === 'Bash' && JSON.stringify(toolInput).includes('audit-logs')) {
-      process.exit(0);
-    }
-
-    // Check if guard.mjs already logged a DENY for this tool (avoid duplicate ALLOW after DENY)
-    let guardDenied = false;
-    try {
-      const denyFlagPath = resolve('.solongate', '.last-deny');
-      if (existsSync(denyFlagPath)) {
-        const flag = JSON.parse(readFileSync(denyFlagPath, 'utf-8'));
-        // If deny was recent (< 10s) and same tool, this postToolUse is a duplicate
-        if (flag.ts && Date.now() - flag.ts < 10000 && flag.tool === toolName) {
-          guardDenied = true;
-        }
-      }
-    } catch {}
-
-    const toolResponse = data.tool_response || data.toolResponse || {};
-    const toolOutput = data.tool_output || data.toolOutput || '';
-    const resultJson = data.result_json ? (typeof data.result_json === 'string' ? data.result_json : JSON.stringify(data.result_json)) : '';
-
-    // Ghost paths: rewrite the output the model sees so hidden files/dirs are
-    // stripped from listings and direct reads look like "no such file". Emit the
-    // updated output BEFORE the (fire-and-forget) audit log. Fail-open: any
-    // error leaves the original output untouched.
-    try {
-      const ghostText = buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, loadGhostPatterns());
-      if (typeof ghostText === 'string') {
-        // updatedToolOutput must be a PLAIN STRING (an object form is silently
-        // ignored by Claude Code). This replaces the tool result the model sees.
-        process.stdout.write(JSON.stringify({
-          hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: ghostText },
-        }));
-      }
-    } catch {}
-
-    const hasError = guardDenied ||
-      toolResponse.error ||
-      toolResponse.exitCode > 0 ||
-      toolResponse.isError ||
-      (toolOutput && typeof toolOutput === 'string' && toolOutput.includes('"error"')) ||
-      (resultJson && resultJson.includes('"error"'));
-
-    // Keep the full command/args for audit review (the dashboard shows them in
-    // the detail view). Only cap pathologically large values.
-    const argsSummary = {};
-    for (const [k, v] of Object.entries(toolInput)) {
-      argsSummary[k] = typeof v === 'string' && v.length > 8000
-        ? v.slice(0, 8000) + '…'
-        : v;
-    }
-
-    // Write flag so stop.mjs knows tool calls happened (skip text-only ALLOW)
-    try {
-      const flagDir = resolve('.solongate');
-      mkdirSync(flagDir, { recursive: true });
-      writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
-    } catch {}
-
-    // Fire-and-forget: don't block tool execution waiting for API response
-    fetch(`${API_URL}/api/v1/audit-logs`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${API_KEY}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        tool: toolName,
-        arguments: argsSummary,
-        decision: hasError ? 'DENY' : 'ALLOW',
-        reason: guardDenied ? 'blocked by policy guard' : hasError ? 'tool returned error' : 'allowed',
-        permission: guessPermission(toolName),
-        source: `${AGENT_ID}-hook`,
-        evaluationTimeMs: 0,
-        agent_id: AGENT_ID,
-        agent_name: AGENT_NAME,
-      }),
-      signal: AbortSignal.timeout(5000),
-    }).catch(() => {}).finally(() => process.exit(0));
-    // Exit after short delay if fetch hangs on DNS/connect
-    setTimeout(() => process.exit(0), 3000);
-  } catch {
-    process.exit(0);
-  }
-});
+#!/usr/bin/env node
+/**
+ * SolonGate Audit Hook for Claude Code (PostToolUse)
+ * Logs tool execution results to SolonGate Cloud.
+ * Auto-installed by: npx @solongate/proxy login
+ */
+import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { homedir } from 'node:os';
+
+function loadEnvKey(dir) {
+  try {
+    const envPath = resolve(dir, '.env');
+    if (!existsSync(envPath)) return {};
+    const lines = readFileSync(envPath, 'utf-8').split('\n');
+    const env = {};
+    for (const line of lines) {
+      const m = line.match(/^([A-Z_]+)=(.*)$/);
+      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
+    }
+    return env;
+  } catch { return {}; }
+}
+
+// Global cloud config written by `init --global` (~/.solongate/cloud-guard.json).
+// A system-wide PostToolUse hook runs from any cwd, so a project .env can't be
+// relied on for the key — read the absolute global config too.
+function loadGlobalCloudConfig() {
+  try {
+    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
+    if (!existsSync(p)) return {};
+    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
+    return (cfg && typeof cfg === 'object') ? cfg : {};
+  } catch { return {}; }
+}
+
+// ── Ghost paths (PostToolUse twin of guard.mjs) ──
+// The guard's PreToolUse hook blocks MUTATIONS to hidden paths; here we make
+// hidden paths invisible to READS and LISTINGS by rewriting the tool output the
+// model sees (Claude Code `updatedToolOutput`). The matcher below is mirrored
+// verbatim from guard.mjs — keep the two in sync. Config is read from the policy
+// cache the guard just wrote (same PreToolUse call), so no extra API request.
+function ghostGlobToRegExp(glob) {
+  let re = '';
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === '*') {
+      if (glob[i + 1] === '*') { re += '.*'; i++; }
+      else re += '[^/]*';
+    } else if (c === '?') re += '[^/]';
+    else if ('\\^$.|+()[]{}'.indexOf(c) !== -1) re += '\\' + c;
+    else re += c;
+  }
+  try { return new RegExp('^' + re + '$'); } catch { return null; }
+}
+function ghostMatch(targetPath, patterns) {
+  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
+  const norm = String(targetPath).replace(/\\/g, '/').replace(/\/+$/, '');
+  if (!norm) return false;
+  const segments = norm.split('/').filter(Boolean);
+  const base = segments.length ? segments[segments.length - 1] : norm;
+  for (let pat of patterns) {
+    pat = String(pat || '').trim();
+    if (!pat) continue;
+    let dirOnly = false;
+    if (pat.endsWith('/')) { dirOnly = true; pat = pat.slice(0, -1); }
+    if (!pat) continue;
+    const hasSlash = pat.indexOf('/') !== -1;
+    const hasWild = /[*?]/.test(pat);
+    const re = ghostGlobToRegExp(pat);
+    if (!re) continue;
+    if (dirOnly) {
+      if (!hasSlash && !hasWild) { if (segments.indexOf(pat) !== -1) return true; continue; }
+      let acc = '';
+      for (const s of segments) { acc = acc ? acc + '/' + s : s; if (re.test(acc) || re.test(s)) return true; }
+      continue;
+    }
+    if (!hasSlash) {
+      if (re.test(base)) return true;
+      if (segments.some((s) => re.test(s))) return true;
+      continue;
+    }
+    if (re.test(norm)) return true;
+  }
+  return false;
+}
+function ghostCleanToken(tok) {
+  let t = String(tok || '').trim();
+  t = t.replace(/^[<>|;&(]+/, '').replace(/[);&|]+$/, '');
+  t = t.replace(/^['"]+/, '').replace(/['"]+$/, '');
+  t = t.replace(/^\d*>>?/, '');
+  return t.trim();
+}
+// Drop listing lines that reference a ghost entry. `find`/glob output (one path
+// per line) drops the whole line; multi-column `ls -l` rows drop entirely; a
+// bare space-separated `ls` row drops only the matching names.
+function ghostStripLines(text, pats) {
+  const lines = String(text).split('\n');
+  const kept = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) { kept.push(line); continue; }
+    if (ghostMatch(trimmed, pats)) continue; // full-path listing line
+    const toks = trimmed.split(/\s+/);
+    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
+    if (!anyHit) { kept.push(line); continue; }
+    if (toks.length > 3) continue; // ls -l style row → drop entirely
+    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
+    if (remaining.length === 0) continue;
+    kept.push(remaining.join('  '));
+  }
+  return kept.join('\n');
+}
+// Read ghost patterns from the policy cache the guard wrote on the matching
+// PreToolUse call. Same agent-key derivation as guard.mjs.
+function loadGhostPatterns() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
+    if (!existsSync(f)) return [];
+    const c = JSON.parse(readFileSync(f, 'utf-8'));
+    const g = c && c.security && c.security.ghost;
+    return g && Array.isArray(g.patterns) ? g.patterns : [];
+  } catch { return []; }
+}
+// Returns the rewritten output text, or null if nothing is hidden.
+function buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, pats) {
+  if (!Array.isArray(pats) || pats.length === 0) return null;
+  const name = toolName || '';
+  const getText = () => {
+    if (typeof toolResponse === 'string') return toolResponse;
+    if (toolResponse && typeof toolResponse.stdout === 'string') return toolResponse.stdout;
+    if (toolResponse && typeof toolResponse.content === 'string') return toolResponse.content;
+    if (typeof toolOutput === 'string' && toolOutput) return toolOutput;
+    return null;
+  };
+  try {
+    // Direct read of a hidden file → looks like it doesn't exist.
+    if (name === 'Read' || name === 'NotebookRead') {
+      const p = toolInput && (toolInput.file_path || toolInput.notebook_path);
+      if (p && ghostMatch(p, pats)) return p + ': No such file or directory';
+      return null;
+    }
+    if (name === 'Bash' || name === 'BashOutput') {
+      const text = getText();
+      if (text == null) return null;
+      const cmd = String((toolInput && toolInput.command) || '');
+      for (const raw of cmd.split(/\s+/)) {
+        const t = ghostCleanToken(raw);
+        // A command that names the hidden path directly (cat A/Y/.data, ls A/Y)
+        // → not-found, regardless of what the command actually returned.
+        if (t && t[0] !== '-' && ghostMatch(t, pats)) return t + ': No such file or directory';
+      }
+      const stripped = ghostStripLines(text, pats);
+      return stripped === text ? null : stripped;
+    }
+    // Listing-style tools → strip hidden entries from the result.
+    if (name === 'Glob' || name === 'Grep' || name === 'LS') {
+      const text = getText();
+      if (text == null) return null;
+      const stripped = ghostStripLines(text, pats);
+      return stripped === text ? null : stripped;
+    }
+  } catch { /* fail open */ }
+  return null;
+}
+
+// ── DLP output redaction (PostToolUse) ──
+// Same family as ghost, but ghost hides files/dirs by PATH while this masks
+// secret VALUES inside the tool OUTPUT the model sees (file reads, stdout,
+// fetched pages). Active whenever DLP is on (detect OR block) — the server
+// delivers the enabled pattern set as `security.dlpRedact` in the policy cache.
+// Patterns mirror guard.mjs / apps/api/src/lib/security-layers.ts (global flag
+// so every occurrence is replaced). Scanning RAW output text (not JSON) means
+// the quote handling is exact — no escaping artifacts.
+const DLP_PATTERNS = [
+  { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/g },
+  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { name: 'Anthropic key', re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+  { name: 'OpenAI key', re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
+  { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
+  { name: 'GitHub fine-grained PAT', re: /github_pat_[A-Za-z0-9_]{20,}/g },
+  { name: 'GitLab token', re: /glpat-[A-Za-z0-9_-]{20,}/g },
+  { name: 'Slack token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+  { name: 'Google API key', re: /AIza[0-9A-Za-z_-]{35}/g },
+  { name: 'Stripe key', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
+  { name: 'SendGrid key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
+  { name: 'Twilio key', re: /SK[0-9a-fA-F]{32}/g },
+  { name: 'npm token', re: /npm_[A-Za-z0-9]{36}/g },
+  { name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+  { name: 'Bearer token', re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
+  { name: 'secret assignment', re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/gi },
+];
+
+// Read the redaction config the guard cached on the matching PreToolUse call.
+function loadDlpRedact() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
+    if (!existsSync(f)) return null;
+    const c = JSON.parse(readFileSync(f, 'utf-8'));
+    const d = c && c.security && c.security.dlpRedact;
+    return d && Array.isArray(d.patterns) ? d : null;
+  } catch { return null; }
+}
+
+// Replace every secret match with a labelled placeholder. cfg = { patterns:
+// string[] (enabled built-in names), custom: {name,re}[] }.
+function dlpRedactText(text, cfg) {
+  if (!cfg || typeof text !== 'string' || !text) return text;
+  const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
+  let out = text;
+  for (const p of DLP_PATTERNS) {
+    if (allow.has(p.name)) out = out.replace(p.re, '[REDACTED:' + p.name + ']');
+  }
+  for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
+    try { out = out.replace(new RegExp(c.re, 'g'), '[REDACTED:' + (c.name || 'custom') + ']'); } catch { /* skip invalid */ }
+  }
+  return out;
+}
+
+// Best-effort extraction of the model-visible text from a tool_response. Shapes
+// are undocumented, so probe the known fields (Bash stdout, Read file.content,
+// string/array content) and fall back to a raw string output.
+function extractOutputText(toolResponse, toolOutput) {
+  const r = toolResponse;
+  if (typeof r === 'string') return r;
+  if (r && typeof r === 'object') {
+    if (typeof r.stdout === 'string' && r.stdout) return r.stdout;
+    if (typeof r.content === 'string' && r.content) return r.content;
+    if (r.file && typeof r.file.content === 'string') return r.file.content;
+    if (Array.isArray(r.content)) {
+      const t = r.content.filter((x) => x && x.type === 'text' && typeof x.text === 'string').map((x) => x.text).join('\n');
+      if (t) return t;
+    }
+  }
+  if (typeof toolOutput === 'string' && toolOutput) return toolOutput;
+  return null;
+}
+
+function guessPermission(toolName) {
+  const name = (toolName || '').toLowerCase();
+  if (name.includes('exec') || name.includes('shell') || name.includes('run') || name.includes('eval') || name === 'bash') return 'EXECUTE';
+  if (name.includes('fetch') || name.includes('http') || name.includes('request') || name.includes('curl') || name.includes('network') || name.includes('download') || name.includes('upload') || name === 'websearch') return 'NETWORK';
+  if (name.includes('write') || name.includes('create') || name.includes('delete') || name.includes('update') || name.includes('set') || name.includes('edit') || name.includes('remove') || name.includes('insert')) return 'WRITE';
+  return 'READ';
+}
+
+const dotenv = loadEnvKey(process.cwd());
+const globalCfg = loadGlobalCloudConfig();
+const API_KEY = process.env.SOLONGATE_API_KEY || dotenv.SOLONGATE_API_KEY || globalCfg.apiKey || '';
+const API_URL = process.env.SOLONGATE_API_URL || dotenv.SOLONGATE_API_URL || globalCfg.apiUrl || 'https://api.solongate.com';
+
+// Agent identity from CLI args: node audit.mjs <agent_id> <agent_name>
+const AGENT_ID = process.argv[2] || 'claude-code';
+const AGENT_NAME = process.argv[3] || 'Claude Code';
+
+// Accept both live and test keys (test keys are used for trials / sandboxes).
+if (!API_KEY || !(API_KEY.startsWith('sg_live_') || API_KEY.startsWith('sg_test_'))) process.exit(0);
+
+let input = '';
+process.stdin.on('data', c => input += c);
+process.stdin.on('end', async () => {
+  try {
+    const data = JSON.parse(input);
+
+    // Debug: append raw stdin to file for agent detection troubleshooting.
+    // Opt-in (SOLONGATE_DEBUG) so a global hook doesn't litter every cwd.
+    if (process.env.SOLONGATE_DEBUG) {
+      try {
+        const debugLine = JSON.stringify({ ts: new Date().toISOString(), argv: process.argv.slice(2), tool_name: data.tool_name || data.toolName, agent_id: AGENT_ID }) + '\n';
+        const { appendFileSync: afs, mkdirSync: mds } = await import('node:fs');
+        mds(resolve('.solongate'), { recursive: true });
+        afs(resolve('.solongate', '.debug-audit-log'), debugLine);
+      } catch {}
+    }
+
+    let toolName = data.tool_name || data.toolName || '';
+    let toolInput = data.tool_input || data.toolInput || data.params || {};
+    if (!toolName) toolName = 'unknown';
+
+    if (toolName === 'Bash' && JSON.stringify(toolInput).includes('audit-logs')) {
+      process.exit(0);
+    }
+
+    // Check if guard.mjs already logged a DENY for this tool (avoid duplicate ALLOW after DENY)
+    let guardDenied = false;
+    try {
+      const denyFlagPath = resolve('.solongate', '.last-deny');
+      if (existsSync(denyFlagPath)) {
+        const flag = JSON.parse(readFileSync(denyFlagPath, 'utf-8'));
+        // If deny was recent (< 10s) and same tool, this postToolUse is a duplicate
+        if (flag.ts && Date.now() - flag.ts < 10000 && flag.tool === toolName) {
+          guardDenied = true;
+        }
+      }
+    } catch {}
+
+    const toolResponse = data.tool_response || data.toolResponse || {};
+    const toolOutput = data.tool_output || data.toolOutput || '';
+    const resultJson = data.result_json ? (typeof data.result_json === 'string' ? data.result_json : JSON.stringify(data.result_json)) : '';
+
+    // Ghost paths: rewrite the output the model sees so hidden files/dirs are
+    // stripped from listings and direct reads look like "no such file". Emit the
+    // updated output BEFORE the (fire-and-forget) audit log. Fail-open: any
+    // error leaves the original output untouched.
+    try {
+      const ghostText = buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, loadGhostPatterns());
+      // Layer DLP redaction on top: mask any secret VALUES in the output the
+      // model would see. If ghost already rewrote the output, redact that;
+      // otherwise redact the raw output. Only emit when something changed.
+      const dlpCfg = loadDlpRedact();
+      let out = typeof ghostText === 'string' ? ghostText : null;
+      if (dlpCfg) {
+        const base = typeof ghostText === 'string' ? ghostText : extractOutputText(toolResponse, toolOutput);
+        if (typeof base === 'string') {
+          const redacted = dlpRedactText(base, dlpCfg);
+          if (redacted !== base || typeof ghostText === 'string') out = redacted;
+        }
+      }
+      if (typeof out === 'string') {
+        // updatedToolOutput must be a PLAIN STRING (an object form is silently
+        // ignored by Claude Code). This replaces the tool result the model sees.
+        process.stdout.write(JSON.stringify({
+          hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: out },
+        }));
+      }
+    } catch {}
+
+    const hasError = guardDenied ||
+      toolResponse.error ||
+      toolResponse.exitCode > 0 ||
+      toolResponse.isError ||
+      (toolOutput && typeof toolOutput === 'string' && toolOutput.includes('"error"')) ||
+      (resultJson && resultJson.includes('"error"'));
+
+    // Keep the full command/args for audit review (the dashboard shows them in
+    // the detail view). Only cap pathologically large values.
+    const argsSummary = {};
+    for (const [k, v] of Object.entries(toolInput)) {
+      argsSummary[k] = typeof v === 'string' && v.length > 8000
+        ? v.slice(0, 8000) + '…'
+        : v;
+    }
+
+    // Write flag so stop.mjs knows tool calls happened (skip text-only ALLOW)
+    try {
+      const flagDir = resolve('.solongate');
+      mkdirSync(flagDir, { recursive: true });
+      writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
+    } catch {}
+
+    // Fire-and-forget: don't block tool execution waiting for API response
+    fetch(`${API_URL}/api/v1/audit-logs`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${API_KEY}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        tool: toolName,
+        arguments: argsSummary,
+        decision: hasError ? 'DENY' : 'ALLOW',
+        reason: guardDenied ? 'blocked by policy guard' : hasError ? 'tool returned error' : 'allowed',
+        permission: guessPermission(toolName),
+        source: `${AGENT_ID}-hook`,
+        evaluationTimeMs: 0,
+        agent_id: AGENT_ID,
+        agent_name: AGENT_NAME,
+        session_id: data.session_id || data.sessionId || data.conversation_id || '',
+      }),
+      signal: AbortSignal.timeout(5000),
+    }).catch(() => {}).finally(() => process.exit(0));
+    // Exit after short delay if fetch hangs on DNS/connect
+    setTimeout(() => process.exit(0), 3000);
+  } catch {
+    process.exit(0);
+  }
+});