@solongate/proxy 0.53.0 → 0.54.0

package/dist/index.js

@@ -7033,6 +7033,15 @@ function loadCfg() {
   }
   return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [] };
 }
+function dlpGlobToRe(glob, flags) {
+  let re = "";
+  for (const ch of String(glob || "")) {
+    if (ch === "*") re += "[^\\s]*";
+    else if (".+?^${}()|[]\\".indexOf(ch) !== -1) re += "\\" + ch;
+    else re += ch;
+  }
+  return new RegExp(re, flags);
+}
 function redactString(s, cfg) {
   if (!cfg || typeof s !== "string" || !s) return s;
   const allow = new Set(cfg.patterns);
@@ -7040,7 +7049,7 @@ function redactString(s, cfg) {
   for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
   for (const c3 of cfg.custom) {
     try {
-      out = out.replace(new RegExp(c3.re, "g"), `[REDACTED: ${c3.name || "custom"}]`);
+      out = out.replace(dlpGlobToRe(c3.re, "g"), `[REDACTED: ${c3.name || "custom"}]`);
     } catch {
     }
   }

package/dist/shield.js

@@ -39,6 +39,15 @@ function loadCfg() {
   }
   return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [] };
 }
+function dlpGlobToRe(glob, flags) {
+  let re = "";
+  for (const ch of String(glob || "")) {
+    if (ch === "*") re += "[^\\s]*";
+    else if (".+?^${}()|[]\\".indexOf(ch) !== -1) re += "\\" + ch;
+    else re += ch;
+  }
+  return new RegExp(re, flags);
+}
 function redactString(s, cfg) {
   if (!cfg || typeof s !== "string" || !s) return s;
   const allow = new Set(cfg.patterns);
@@ -46,7 +55,7 @@ function redactString(s, cfg) {
   for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
   for (const c of cfg.custom) {
     try {
-      out = out.replace(new RegExp(c.re, "g"), `[REDACTED: ${c.name || "custom"}]`);
+      out = out.replace(dlpGlobToRe(c.re, "g"), `[REDACTED: ${c.name || "custom"}]`);
     } catch {
     }
   }

package/hooks/audit.mjs

@@ -206,6 +206,17 @@ function loadDlpRedact() {
 
 // Replace every secret match with a labelled placeholder. cfg = { patterns:
 // string[] (enabled built-in names), custom: {name,re}[] }.
+// Custom patterns are GLOBs: `*` = any run of non-whitespace (so a fragment
+// matches a whole token), same wildcard mechanic as policy/ghost.
+function dlpGlobToRe(glob, flags) {
+  let re = '';
+  for (const ch of String(glob || '')) {
+    if (ch === '*') re += '[^\\s]*';
+    else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
+    else re += ch;
+  }
+  return new RegExp(re, flags);
+}
 function dlpRedactText(text, cfg) {
   if (!cfg || typeof text !== 'string' || !text) return text;
   const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
@@ -214,7 +225,7 @@ function dlpRedactText(text, cfg) {
     if (allow.has(p.name)) out = out.replace(p.re, '[REDACTED:' + p.name + ']');
   }
   for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
-    try { out = out.replace(new RegExp(c.re, 'g'), '[REDACTED:' + (c.name || 'custom') + ']'); } catch { /* skip invalid */ }
+    try { out = out.replace(dlpGlobToRe(c.re, 'g'), '[REDACTED:' + (c.name || 'custom') + ']'); } catch { /* skip invalid */ }
   }
   return out;
 }

package/hooks/guard.bundled.mjs

@@ -6535,7 +6535,7 @@ import { resolve, join } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 18;
+var HOOK_VERSION = 19;
 var MAX_FILE_READ = 1024 * 1024;
 function safeReadFileSync(filePath, encoding = "utf-8") {
   try {
@@ -7010,6 +7010,18 @@ var DLP_PATTERNS = [
   { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
   { name: "secret assignment", re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/i }
 ];
+function dlpGlobToRe(glob) {
+  let re = "";
+  for (const ch of String(glob || "")) {
+    if (ch === "*")
+      re += "[^\\s]*";
+    else if (".+?^${}()|[]\\".indexOf(ch) !== -1)
+      re += "\\" + ch;
+    else
+      re += ch;
+  }
+  return new RegExp(re);
+}
 function dlpScan(args, cfg) {
   if (!cfg)
     return null;
@@ -7026,7 +7038,7 @@ function dlpScan(args, cfg) {
   }
   for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
     try {
-      if (new RegExp(c.re).test(text))
+      if (dlpGlobToRe(c.re).test(text))
         return c.name || "custom pattern";
     } catch {
     }

package/hooks/guard.mjs

@@ -31,7 +31,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 18;
+const HOOK_VERSION = 19;
 
 // Safe file read with size limit (1MB max) to prevent DoS via large files
 const MAX_FILE_READ = 1024 * 1024; // 1MB
@@ -665,6 +665,17 @@ const DLP_PATTERNS = [
   { name: 'secret assignment', re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/i },
 ];
 
+// Custom patterns are GLOBs: `*` = any run of non-whitespace, same wildcard
+// mechanic as policy/ghost.
+function dlpGlobToRe(glob) {
+  let re = '';
+  for (const ch of String(glob || '')) {
+    if (ch === '*') re += '[^\\s]*';
+    else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
+    else re += ch;
+  }
+  return new RegExp(re);
+}
 // Scan args against the enabled built-in patterns + any user custom patterns.
 // `cfg` = { patterns: string[], custom: {name,re}[] }.
 function dlpScan(args, cfg) {
@@ -676,7 +687,7 @@ function dlpScan(args, cfg) {
     if (allow.has(p.name) && p.re.test(text)) return p.name;
   }
   for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
-    try { if (new RegExp(c.re).test(text)) return c.name || 'custom pattern'; } catch { /* skip invalid */ }
+    try { if (dlpGlobToRe(c.re).test(text)) return c.name || 'custom pattern'; } catch { /* skip invalid */ }
   }
   return null;
 }

package/hooks/shield.mjs

@@ -55,13 +55,23 @@ function loadCfg() {
   return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [] };
 }
 
+// Custom patterns are GLOBs: `*` = any run of non-whitespace, same as policy/ghost.
+function dlpGlobToRe(glob, flags) {
+  let re = '';
+  for (const ch of String(glob || '')) {
+    if (ch === '*') re += '[^\\s]*';
+    else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
+    else re += ch;
+  }
+  return new RegExp(re, flags);
+}
 function redactString(s, cfg) {
   if (!cfg || typeof s !== 'string' || !s) return s;
   const allow = new Set(cfg.patterns);
   let out = s;
   for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
   for (const c of cfg.custom) {
-    try { out = out.replace(new RegExp(c.re, 'g'), `[REDACTED: ${c.name || 'custom'}]`); } catch { /* skip */ }
+    try { out = out.replace(dlpGlobToRe(c.re, 'g'), `[REDACTED: ${c.name || 'custom'}]`); } catch { /* skip */ }
   }
   return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "AI tool security proxy — protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {