@solongate/proxy 0.54.0 → 0.56.0

package/dist/index.js

@@ -7017,14 +7017,36 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn as spawn2 } from "child_process";
 import { URL as URL2 } from "url";
-import { readFileSync as readFileSync6, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync5, readdirSync, statSync } from "fs";
 import { resolve as resolve4 } from "path";
 import { homedir as homedir3 } from "os";
+function findCacheFile() {
+  const dir = resolve4(homedir3(), ".solongate");
+  const envSel = process.env.SOLONGATE_AGENT_ID;
+  if (envSel) {
+    const f = resolve4(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
+    if (existsSync5(f)) return f;
+  }
+  let best = null, bestTs = -1;
+  try {
+    for (const name of readdirSync(dir)) {
+      if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
+        const full = resolve4(dir, name);
+        const ts = statSync(full).mtimeMs;
+        if (ts > bestTs) {
+          bestTs = ts;
+          best = full;
+        }
+      }
+    }
+  } catch {
+  }
+  return best;
+}
 function loadCfg() {
   try {
-    const sel = (process.env.SOLONGATE_AGENT_ID || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
-    const f = resolve4(homedir3(), ".solongate", ".policy-cache-" + sel + ".json");
-    if (existsSync5(f)) {
+    const f = findCacheFile();
+    if (f && existsSync5(f)) {
       const c3 = JSON.parse(readFileSync6(f, "utf-8"));
       const d = c3?.security?.dlpRedact;
       if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [] };

package/dist/shield.js

@@ -3,7 +3,7 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn } from "child_process";
 import { URL } from "url";
-import { readFileSync, existsSync } from "fs";
+import { readFileSync, existsSync, readdirSync, statSync } from "fs";
 import { resolve } from "path";
 import { homedir } from "os";
 var log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}
@@ -26,11 +26,33 @@ var DLP_PATTERNS = [
   { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
   { name: "secret assignment", re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/gi }
 ];
+function findCacheFile() {
+  const dir = resolve(homedir(), ".solongate");
+  const envSel = process.env.SOLONGATE_AGENT_ID;
+  if (envSel) {
+    const f = resolve(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
+    if (existsSync(f)) return f;
+  }
+  let best = null, bestTs = -1;
+  try {
+    for (const name of readdirSync(dir)) {
+      if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
+        const full = resolve(dir, name);
+        const ts = statSync(full).mtimeMs;
+        if (ts > bestTs) {
+          bestTs = ts;
+          best = full;
+        }
+      }
+    }
+  } catch {
+  }
+  return best;
+}
 function loadCfg() {
   try {
-    const sel = (process.env.SOLONGATE_AGENT_ID || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
-    const f = resolve(homedir(), ".solongate", ".policy-cache-" + sel + ".json");
-    if (existsSync(f)) {
+    const f = findCacheFile();
+    if (f && existsSync(f)) {
       const c = JSON.parse(readFileSync(f, "utf-8"));
       const d = c?.security?.dlpRedact;
       if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [] };

package/hooks/audit.mjs

@@ -127,13 +127,11 @@ function loadGhostPatterns() {
 function buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, pats) {
   if (!Array.isArray(pats) || pats.length === 0) return null;
   const name = toolName || '';
-  const getText = () => {
-    if (typeof toolResponse === 'string') return toolResponse;
-    if (toolResponse && typeof toolResponse.stdout === 'string') return toolResponse.stdout;
-    if (toolResponse && typeof toolResponse.content === 'string') return toolResponse.content;
-    if (typeof toolOutput === 'string' && toolOutput) return toolOutput;
-    return null;
-  };
+  // Use the SAME broad extraction as DLP redaction (Read file.content, array
+  // content, stdout, …). Previously this was narrower, so ghost-strip silently
+  // skipped tool shapes DLP still scanned — a ghosted file then survived in a
+  // listing (e.g. the LS tool) even though names elsewhere got redacted.
+  const getText = () => extractOutputText(toolResponse, toolOutput);
   try {
     // Direct read of a hidden file → looks like it doesn't exist.
     if (name === 'Read' || name === 'NotebookRead') {

package/hooks/shield.mjs

@@ -17,7 +17,7 @@
 import { createServer, request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
 import { spawn } from 'node:child_process';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { homedir } from 'node:os';
 
@@ -42,11 +42,35 @@ const DLP_PATTERNS = [
   { name: 'secret assignment', re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/gi },
 ];
 
+// Find the policy cache to read. The guard writes one per agent
+// (.policy-cache-<agent>.json) - the shield wraps `claude` and doesn't know the
+// agent id, so unless SOLONGATE_AGENT_ID is set it picks the MOST RECENTLY
+// written cache (the active session's). A fixed 'default' missed the guard's
+// real cache, so custom patterns never reached the shield.
+function findCacheFile() {
+  const dir = resolve(homedir(), '.solongate');
+  const envSel = process.env.SOLONGATE_AGENT_ID;
+  if (envSel) {
+    const f = resolve(dir, '.policy-cache-' + envSel.replace(/[^a-zA-Z0-9_-]/g, '_') + '.json');
+    if (existsSync(f)) return f;
+  }
+  let best = null, bestTs = -1;
+  try {
+    for (const name of readdirSync(dir)) {
+      if (name.startsWith('.policy-cache-') && name.endsWith('.json')) {
+        const full = resolve(dir, name);
+        const ts = statSync(full).mtimeMs;
+        if (ts > bestTs) { bestTs = ts; best = full; }
+      }
+    }
+  } catch { /* dir missing */ }
+  return best;
+}
+
 function loadCfg() {
   try {
-    const sel = (process.env.SOLONGATE_AGENT_ID || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
-    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
-    if (existsSync(f)) {
+    const f = findCacheFile();
+    if (f && existsSync(f)) {
       const c = JSON.parse(readFileSync(f, 'utf-8'));
       const d = c && c.security && c.security.dlpRedact;
       if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.54.0",
+  "version": "0.56.0",
   "description": "AI tool security proxy — protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {