@solongate/proxy 0.51.0 → 0.52.0

package/dist/login.js

@@ -96,6 +96,7 @@ function protectedTargets() {
     join(p.hooksDir, "guard.mjs"),
     join(p.hooksDir, "audit.mjs"),
     join(p.hooksDir, "stop.mjs"),
+    join(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -135,6 +136,71 @@ function ask(question) {
     res(a.trim());
   }));
 }
+var SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
+var SHIM_END = "# <<< SolonGate shield <<<";
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function resolveRealClaude() {
+  try {
+    const finder = process.platform === "win32" ? "where" : "which";
+    const out = execFileSync(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    return out[0] || null;
+  } catch {
+    return null;
+  }
+}
+function shimTargets() {
+  if (process.platform === "win32") {
+    try {
+      const prof = execFileSync("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      return prof ? [prof] : [];
+    } catch {
+      return [];
+    }
+  }
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join(homedir(), f)).filter((f) => existsSync(f));
+}
+function writeShimBlock(file, block) {
+  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
+  let content = existsSync(file) ? readFileSync(file, "utf-8") : "";
+  content = content.replace(re, "");
+  if (block) {
+    if (content.length && !content.endsWith("\n")) content += "\n";
+    content += block + "\n";
+  }
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, content);
+}
+function installClaudeShim(shieldPath) {
+  const real = resolveRealClaude();
+  if (!real) {
+    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
+    return;
+  }
+  const node = process.execPath.replace(/\\/g, "/");
+  const shield = shieldPath.replace(/\\/g, "/");
+  const win = process.platform === "win32";
+  const block = win ? `${SHIM_BEGIN}
+function claude { & "${node}" "${shield}" -- "${real}" @args }
+${SHIM_END}` : `${SHIM_BEGIN}
+claude() { "${node}" "${shield}" -- "${real}" "$@"; }
+${SHIM_END}`;
+  const targets = shimTargets();
+  if (targets.length === 0) {
+    console.log("  (No shell profile found for auto-shield; run `claude` via `solongate shield -- claude` manually.)");
+    return;
+  }
+  for (const file of targets) {
+    try {
+      writeShimBlock(file, block);
+      console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
+    } catch (e) {
+      console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);
+    }
+  }
+  console.log("  Open a NEW terminal for it to take effect.");
+}
 async function runGlobalInstall(opts = {}) {
   const p = globalPaths();
   let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
@@ -159,7 +225,9 @@ async function runGlobalInstall(opts = {}) {
   writeFileSync(join(p.hooksDir, "guard.mjs"), readGuard());
   writeFileSync(join(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
   writeFileSync(join(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync(join(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
+  installClaudeShim(join(p.hooksDir, "shield.mjs"));
   writeFileSync(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};

package/dist/shield.d.ts

@@ -0,0 +1 @@
+export declare function runShield(): Promise<void>;

package/dist/shield.js

@@ -0,0 +1,171 @@
+// src/shield.ts
+import { createServer, request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { spawn } from "child_process";
+import { URL } from "url";
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+import { homedir } from "os";
+var log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}
+`);
+var DLP_PATTERNS = [
+  { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },
+  { name: "private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+  { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
+  { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
+  { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },
+  { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },
+  { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+  { name: "Google API key", re: /AIza[0-9A-Za-z_-]{35}/g },
+  { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
+  { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
+  { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },
+  { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },
+  { name: "JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+  { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
+  { name: "secret assignment", re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/gi }
+];
+function loadCfg() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
+    const f = resolve(homedir(), ".solongate", ".policy-cache-" + sel + ".json");
+    if (existsSync(f)) {
+      const c = JSON.parse(readFileSync(f, "utf-8"));
+      const d = c?.security?.dlpRedact;
+      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [] };
+    }
+  } catch {
+  }
+  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [] };
+}
+function redactString(s, cfg) {
+  if (!cfg || typeof s !== "string" || !s) return s;
+  const allow = new Set(cfg.patterns);
+  let out = s;
+  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
+  for (const c of cfg.custom) {
+    try {
+      out = out.replace(new RegExp(c.re, "g"), `[REDACTED: ${c.name || "custom"}]`);
+    } catch {
+    }
+  }
+  return out;
+}
+function redactDeep(value, cfg) {
+  if (typeof value === "string") return redactString(value, cfg);
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, cfg));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v, cfg);
+    return out;
+  }
+  return value;
+}
+function pickUpstream() {
+  const raw = process.env.SOLONGATE_SHIELD_UPSTREAM || process.env.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
+  try {
+    return new URL(raw);
+  } catch {
+    return new URL("https://api.anthropic.com");
+  }
+}
+function startProxy(upstream) {
+  const cfg = loadCfg();
+  const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
+  const server = createServer((req, res) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      let body = Buffer.concat(chunks);
+      try {
+        if (body.length && (req.headers["content-type"] || "").includes("json")) {
+          const parsed = JSON.parse(body.toString("utf-8"));
+          const redacted = redactDeep(parsed, cfg);
+          body = Buffer.from(JSON.stringify(redacted), "utf-8");
+        }
+      } catch {
+      }
+      const headers = { ...req.headers };
+      delete headers["host"];
+      delete headers["content-length"];
+      delete headers["accept-encoding"];
+      headers["content-length"] = String(body.length);
+      const upstreamReq = forward(
+        {
+          protocol: upstream.protocol,
+          hostname: upstream.hostname,
+          port: upstream.port || (upstream.protocol === "https:" ? 443 : 80),
+          method: req.method,
+          path: req.url,
+          headers: { ...headers, host: upstream.host }
+        },
+        (upRes) => {
+          res.writeHead(upRes.statusCode || 502, upRes.headers);
+          upRes.pipe(res);
+        }
+      );
+      upstreamReq.on("error", (e) => {
+        log("upstream error:", e.message);
+        if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" });
+        res.end("shield upstream error");
+      });
+      upstreamReq.end(body);
+    });
+    req.on("error", () => {
+      try {
+        res.destroy();
+      } catch {
+      }
+    });
+  });
+  return new Promise((resolveP) => {
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      resolveP({ port, close: () => server.close() });
+    });
+  });
+}
+async function runShield() {
+  const sep = process.argv.indexOf("--");
+  const cmd = sep !== -1 ? process.argv.slice(sep + 1) : [];
+  if (cmd.length === 0) {
+    log("usage: npx @solongate/proxy shield -- <command> [args...]   (e.g. shield -- claude)");
+    process.exit(1);
+  }
+  const upstream = pickUpstream();
+  const { port, close } = await startProxy(upstream);
+  log(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`);
+  const child = spawn(cmd[0], cmd.slice(1), {
+    stdio: "inherit",
+    env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
+    shell: process.platform === "win32"
+    // resolve `claude.cmd` etc. on Windows
+  });
+  const shutdown = () => {
+    try {
+      close();
+    } catch {
+    }
+  };
+  child.on("exit", (code, signal) => {
+    shutdown();
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+  child.on("error", (e) => {
+    log("failed to launch command:", e.message);
+    shutdown();
+    process.exit(1);
+  });
+  for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
+    try {
+      child.kill(sig);
+    } catch {
+    }
+  });
+}
+export {
+  runShield
+};