@solongate/proxy 0.56.0 → 0.57.0

package/README.md

@@ -16,14 +16,11 @@ AI agent ──(tool call)──> SolonGate guard ──> Tool runs
                           [allow / block / audit]
 ```
 
-SolonGate comes in two editions that share the same policy model and dashboard:
-
-- **Cloud** — managed, nothing to host. Pair your machine with one command and manage policies + audit logs at [dashboard.solongate.com](https://dashboard.solongate.com).
-- **Local / air-gapped** — run the whole stack on your own hardware with Docker, zero outbound connectivity, no API keys.
+SolonGate is fully managed — nothing to host. Pair your machine with one command and manage policies + audit logs at [dashboard.solongate.com](https://dashboard.solongate.com).
 
 ---
 
-## Quick start (Cloud)
+## Quick start
 
 **You need:** a free [SolonGate account](https://auth.solongate.com), Node.js 18+ on the machine you want to protect, and an AI tool that makes tool calls (Claude Code; Gemini CLI is also supported).
 
@@ -65,7 +62,6 @@ AI agents get direct access to your system — shell, file system, databases, ne
 
 - **Docs:** [solongate.com/docs](https://solongate.com/docs)
 - **Dashboard:** [dashboard.solongate.com](https://dashboard.solongate.com)
-- **Air-gapped guide:** [solongate.com/docs/local](https://solongate.com/docs/local)
 
 ## License
 

package/hooks/.solongate/.last-deny

@@ -0,0 +1 @@
+{"tool":"Bash","ts":1782827530142}

package/hooks/.solongate/.last-tool-call

@@ -0,0 +1 @@
+1782827550450

package/hooks/audit.mjs

@@ -4,10 +4,15 @@
  * Logs tool execution results to SolonGate Cloud.
  * Auto-installed by: npx @solongate/proxy login
  */
-import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
+import { readFileSync, existsSync, writeFileSync, mkdirSync, appendFileSync } from 'node:fs';
 import { resolve, join } from 'node:path';
 import { homedir } from 'node:os';
 
+// Bump on every audit.mjs change. The cloud serves the newest version; the guard
+// hook installs it on its next run (no re-login needed). See guard.mjs
+// fetchAndInstallHook / maybeSelfUpdate.
+const HOOK_VERSION = 14;
+
 function loadEnvKey(dir) {
   try {
     const envPath = resolve(dir, '.env');
@@ -34,6 +39,32 @@ function loadGlobalCloudConfig() {
   } catch { return {}; }
 }
 
+// The guard (PreToolUse) measures the policy-eval time and drops it in a flag
+// file; this hook logs the ALLOW path but can't time the guard itself, so it
+// reads that value back. The flag carries the tool (and session) it was measured
+// for, so a long-running tool (a 10-minute Bash build) still gets ITS eval time
+// instead of a stale-TTL zero. Returns null when no matching measurement exists —
+// an unknown eval time must be stored as null, not a fake 0 that drags averages.
+function readLastEvalMs(toolName, sessionId) {
+  try {
+    const p = resolve('.solongate', '.last-eval');
+    if (!existsSync(p)) return null;
+    const c = JSON.parse(readFileSync(p, 'utf-8'));
+    if (!c || typeof c.ms !== 'number' || typeof c.ts !== 'number') return null;
+    if (typeof c.tool === 'string') {
+      // New flag format: match this invocation (tool + session when both known);
+      // 2h ceiling only guards against a truly abandoned flag file.
+      if (c.tool !== toolName) return null;
+      if (c.session && sessionId && c.session !== sessionId) return null;
+      if (Date.now() - c.ts > 2 * 3600 * 1000) return null;
+      return Math.max(0, Math.round(c.ms));
+    }
+    // Legacy flag (no tool info): keep the old conservative 30s freshness rule.
+    if (Date.now() - c.ts < 30000) return Math.max(0, Math.round(c.ms));
+    return null;
+  } catch { return null; }
+}
+
 // ── Ghost paths (PostToolUse twin of guard.mjs) ──
 // The guard's PreToolUse hook blocks MUTATIONS to hidden paths; here we make
 // hidden paths invisible to READS and LISTINGS by rewriting the tool output the
@@ -146,14 +177,32 @@ function buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, pats) {
       for (const raw of cmd.split(/\s+/)) {
         const t = ghostCleanToken(raw);
         // A command that names the hidden path directly (cat A/Y/.data, ls A/Y)
-        // → not-found, regardless of what the command actually returned.
-        if (t && t[0] !== '-' && ghostMatch(t, pats)) return t + ': No such file or directory';
+        // → not-found, regardless of what the command actually returned. Skip
+        // flags and any token carrying regex/shell metacharacters: the guard's
+        // PreToolUse listing rewrite injects a ghost REGEX (e.g.
+        // ")([^/]*ghosttest[^/]*)(/|$)") into the command, and tokenizing that
+        // would falsely "match" and emit a bogus not-found string as the result.
+        if (!t || t[0] === '-' || /[()|[\]^$*?]/.test(t)) continue;
+        if (ghostMatch(t, pats)) return t + ': No such file or directory';
       }
       const stripped = ghostStripLines(text, pats);
       return stripped === text ? null : stripped;
     }
-    // Listing-style tools → strip hidden entries from the result.
-    if (name === 'Glob' || name === 'Grep' || name === 'LS') {
+    // MCP filesystem direct reads → make a hidden file look absent, mirroring
+    // the native Read branch above (these never reach the Bash/LS branches).
+    if (name === 'mcp__filesystem__read_file' || name === 'mcp__filesystem__read_text_file' ||
+        name === 'mcp__filesystem__read_media_file' || name === 'mcp__filesystem__get_file_info') {
+      const p = toolInput && (toolInput.path || toolInput.file_path);
+      if (p && ghostMatch(p, pats)) return String(p) + ': No such file or directory';
+    }
+    // Every OTHER tool that returns listing-like text → strip hidden entries.
+    // Native Glob/Grep/LS plus any non-shell lister (MCP filesystem
+    // list_directory / directory_tree / search_files, and future tools). Bash
+    // listings are already covered above (and via the guard's PreToolUse command
+    // rewrite); this catch-all is the post-hoc safety net so a ghost entry can't
+    // survive in ANY listing shape — previously only the hard-coded
+    // Glob/Grep/LS names were stripped, so an MCP/unknown lister leaked it.
+    {
       const text = getText();
       if (text == null) return null;
       const stripped = ghostStripLines(text, pats);
@@ -180,14 +229,12 @@ const DLP_PATTERNS = [
   { name: 'GitHub fine-grained PAT', re: /github_pat_[A-Za-z0-9_]{20,}/g },
   { name: 'GitLab token', re: /glpat-[A-Za-z0-9_-]{20,}/g },
   { name: 'Slack token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { name: 'Google API key', re: /AIza[0-9A-Za-z_-]{35}/g },
   { name: 'Stripe key', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
   { name: 'SendGrid key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
   { name: 'Twilio key', re: /SK[0-9a-fA-F]{32}/g },
   { name: 'npm token', re: /npm_[A-Za-z0-9]{36}/g },
   { name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
   { name: 'Bearer token', re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
-  { name: 'secret assignment', re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/gi },
 ];
 
 // Read the redaction config the guard cached on the matching PreToolUse call.
@@ -202,6 +249,33 @@ function loadDlpRedact() {
   } catch { return null; }
 }
 
+// Local log storage: the user can opt to keep a full copy of every audit entry
+// in a file of their choosing (set from the dashboard survey / Settings, then
+// delivered to us via the same policy cache the guard writes). We append one
+// JSON object per line (JSONL) to that path. Fully local, best-effort, and
+// never blocks the tool call or the cloud audit POST.
+function loadLocalLogs() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
+    if (!existsSync(f)) return null;
+    const c = JSON.parse(readFileSync(f, 'utf-8'));
+    const l = c && c.security && c.security.localLogs;
+    if (l && l.enabled && typeof l.path === 'string' && l.path.trim()) return { path: l.path.trim() };
+    return null;
+  } catch { return null; }
+}
+
+// The path is a FOLDER; we write solongate-audit.jsonl inside it (creating the
+// folder if missing), then append one JSON line.
+function appendLocalLog(cfg, entry) {
+  try {
+    const dir = cfg.path.replace(/[\\/]+$/, '');
+    try { mkdirSync(dir, { recursive: true }); } catch { /* ignore */ }
+    appendFileSync(join(dir, 'solongate-audit.jsonl'), JSON.stringify(entry) + '\n');
+  } catch { /* best-effort: never disturb the tool call */ }
+}
+
 // Replace every secret match with a labelled placeholder. cfg = { patterns:
 // string[] (enabled built-in names), custom: {name,re}[] }.
 // Custom patterns are GLOBs: `*` = any run of non-whitespace (so a fragment
@@ -242,6 +316,16 @@ function extractOutputText(toolResponse, toolOutput) {
       const t = r.content.filter((x) => x && x.type === 'text' && typeof x.text === 'string').map((x) => x.text).join('\n');
       if (t) return t;
     }
+    // Native Glob delivers its hits as a `filenames` string[] with NO stdout/
+    // content field, so getText() returned null and the ghost/DLP strip silently
+    // skipped it — a ghosted file then survived in the Glob listing the model saw
+    // (the exact leak: a `*ghosttest*` path showed up in a Glob result). Join to
+    // one-path-per-line so ghostStripLines/dlpRedactText can act on it; the
+    // PostToolUse updatedToolOutput then replaces the model-visible list.
+    if (Array.isArray(r.filenames)) {
+      const t = r.filenames.filter((x) => typeof x === 'string').join('\n');
+      if (t) return t;
+    }
   }
   if (typeof toolOutput === 'string' && toolOutput) return toolOutput;
   return null;
@@ -272,6 +356,7 @@ process.stdin.on('data', c => input += c);
 process.stdin.on('end', async () => {
   try {
     const data = JSON.parse(input);
+    let EMITTED_PAYLOAD = null;
 
     // Debug: append raw stdin to file for agent detection troubleshooting.
     // Opt-in (SOLONGATE_DEBUG) so a global hook doesn't litter every cwd.
@@ -313,26 +398,61 @@ process.stdin.on('end', async () => {
     // stripped from listings and direct reads look like "no such file". Emit the
     // updated output BEFORE the (fire-and-forget) audit log. Fail-open: any
     // error leaves the original output untouched.
+    let ghostFired = false;
     try {
-      const ghostText = buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, loadGhostPatterns());
-      // Layer DLP redaction on top: mask any secret VALUES in the output the
-      // model would see. If ghost already rewrote the output, redact that;
-      // otherwise redact the raw output. Only emit when something changed.
+      const ghostPats = loadGhostPatterns();
       const dlpCfg = loadDlpRedact();
-      let out = typeof ghostText === 'string' ? ghostText : null;
-      if (dlpCfg) {
-        const base = typeof ghostText === 'string' ? ghostText : extractOutputText(toolResponse, toolOutput);
-        if (typeof base === 'string') {
-          const redacted = dlpRedactText(base, dlpCfg);
-          if (redacted !== base || typeof ghostText === 'string') out = redacted;
+      const redactName = (s) => (dlpCfg && typeof s === 'string') ? dlpRedactText(s, dlpCfg) : s;
+
+      // Glob (and Grep in files mode) deliver a STRUCTURED result:
+      //   { filenames: string[], numFiles, truncated, totalMatches, ... }
+      // Claude Code REJECTS a plain-string updatedToolOutput for such a tool —
+      // it prints "PostToolUse:Glob hook warning" and keeps the ORIGINAL result,
+      // so the ghost entry leaks into the listing the model sees. The fix is to
+      // return the SAME shape: the filenames array with ghost entries dropped
+      // (and secret-looking names masked), preserving every other field.
+      if (toolResponse && typeof toolResponse === 'object' && Array.isArray(toolResponse.filenames)) {
+        const orig = toolResponse.filenames;
+        const kept = orig.filter((f) => !(ghostPats.length && ghostMatch(String(f), ghostPats)));
+        ghostFired = kept.length !== orig.length;
+        const masked = kept.map((f) => redactName(String(f)));
+        const changed = ghostFired || masked.some((f, i) => f !== String(kept[i]));
+        if (changed) {
+          const updated = { ...toolResponse, filenames: masked, numFiles: masked.length };
+          if (typeof toolResponse.totalMatches === 'number') updated.totalMatches = masked.length;
+          EMITTED_PAYLOAD = JSON.stringify({
+            hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: updated },
+          });
+        }
+      } else {
+        // String-output tools (Bash, Read, text Grep, MCP listers): strip ghost
+        // lines and redact secrets in the TEXT, return a STRING.
+        const ghostText = buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, ghostPats);
+        ghostFired = typeof ghostText === 'string';
+        let out = typeof ghostText === 'string' ? ghostText : null;
+        if (dlpCfg) {
+          const base = typeof ghostText === 'string' ? ghostText : extractOutputText(toolResponse, toolOutput);
+          if (typeof base === 'string') {
+            const redacted = dlpRedactText(base, dlpCfg);
+            if (redacted !== base || typeof ghostText === 'string') out = redacted;
+          }
+        }
+        if (typeof out === 'string') {
+          // Preserve the tool's result SHAPE. Bash and other tools deliver a
+          // STRUCTURED result ({ stdout, stderr, ... } or { content }); Claude
+          // Code rejects a bare-string replacement for those (hook warning) and
+          // keeps the original. Clone the object and swap its text field; only a
+          // genuinely string-typed result is replaced with a string.
+          const tr = toolResponse;
+          let updated;
+          if (tr && typeof tr === 'object' && typeof tr.stdout === 'string') updated = { ...tr, stdout: out };
+          else if (tr && typeof tr === 'object' && typeof tr.content === 'string') updated = { ...tr, content: out };
+          else if (tr && typeof tr === 'object' && Array.isArray(tr.content)) updated = { ...tr, content: [{ type: 'text', text: out }] };
+          else updated = out;
+          EMITTED_PAYLOAD = JSON.stringify({
+            hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: updated },
+          });
         }
-      }
-      if (typeof out === 'string') {
-        // updatedToolOutput must be a PLAIN STRING (an object form is silently
-        // ignored by Claude Code). This replaces the tool result the model sees.
-        process.stdout.write(JSON.stringify({
-          hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: out },
-        }));
       }
     } catch {}
 
@@ -359,28 +479,64 @@ process.stdin.on('end', async () => {
       writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
     } catch {}
 
-    // Fire-and-forget: don't block tool execution waiting for API response
-    fetch(`${API_URL}/api/v1/audit-logs`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${API_KEY}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        tool: toolName,
-        arguments: argsSummary,
-        decision: hasError ? 'DENY' : 'ALLOW',
-        reason: guardDenied ? 'blocked by policy guard' : hasError ? 'tool returned error' : 'allowed',
-        permission: guessPermission(toolName),
-        source: `${AGENT_ID}-hook`,
-        evaluationTimeMs: 0,
-        agent_id: AGENT_ID,
-        agent_name: AGENT_NAME,
-        session_id: data.session_id || data.sessionId || data.conversation_id || '',
-      }),
-      signal: AbortSignal.timeout(5000),
-    }).catch(() => {}).finally(() => process.exit(0));
-    // Exit after short delay if fetch hangs on DNS/connect
+    // Flush the model-visible replacement to stdout, THEN exit. On Windows a
+    // bare process.exit() can truncate an un-drained pipe write, so Claude Code
+    // receives malformed hook JSON, prints "PostToolUse hook warning", and
+    // DISCARDS the replacement — leaving the ghost entry visible. Gate the exit
+    // on the write's flush callback (and on the fire-and-forget audit POST).
+    let flushed = (typeof EMITTED_PAYLOAD !== 'string');
+    let fetchDone = false;
+    const maybeExit = () => { if (flushed && fetchDone) process.exit(0); };
+    if (typeof EMITTED_PAYLOAD === 'string') {
+      try { process.stdout.write(EMITTED_PAYLOAD, () => { flushed = true; maybeExit(); }); }
+      catch { flushed = true; }
+    }
+
+    const sessionId = data.session_id || data.sessionId || data.conversation_id || '';
+    const decision = hasError ? 'DENY' : 'ALLOW';
+    const reason = guardDenied ? 'blocked by policy guard' : hasError ? 'tool returned error' : ghostFired ? 'ghost path (hidden from agent)' : 'allowed';
+    const permission = guessPermission(toolName);
+    const evaluationTimeMs = readLastEvalMs(toolName, sessionId);
+
+    // Local log storage (opt-in): when ON, logs are kept LOCAL ONLY — we append
+    // this entry to the user's chosen file and do NOT send it to the cloud.
+    const localLogs = loadLocalLogs();
+    if (localLogs) {
+      appendLocalLog(localLogs, {
+        ts: new Date().toISOString(),
+        tool: toolName, arguments: argsSummary, decision, reason, permission,
+        evaluation_time_ms: evaluationTimeMs, agent_id: AGENT_ID, agent_name: AGENT_NAME, session_id: sessionId,
+      });
+      fetchDone = true;
+      maybeExit();
+    } else {
+      // Fire-and-forget: don't block tool execution waiting for API response
+      fetch(`${API_URL}/api/v1/audit-logs`, {
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${API_KEY}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          tool: toolName,
+          arguments: argsSummary,
+          // Ghost-on-a-listing is NOT a denial: the call was ALLOWED and succeeded,
+          // we just hid ghost entries from its result. Log it as ALLOW but carry the
+          // ghost reason so the dashboard can badge it Ghost (the allow-side twin of
+          // the guard's DENY+Ghost for a direct ghost hit). Real denials stay DENY.
+          decision,
+          reason,
+          permission,
+          source: `${AGENT_ID}-hook`,
+          evaluationTimeMs,
+          agent_id: AGENT_ID,
+          agent_name: AGENT_NAME,
+          session_id: sessionId,
+        }),
+        signal: AbortSignal.timeout(5000),
+      }).catch(() => {}).finally(() => { fetchDone = true; maybeExit(); });
+    }
+    // Hard backstop: exit even if the write callback or fetch never settles.
     setTimeout(() => process.exit(0), 3000);
   } catch {
     process.exit(0);

package/hooks/guard.bundled.mjs

@@ -6530,12 +6530,30 @@ var init_src = __esm({
 });
 
 // hooks/guard.mjs
-import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync } from "node:fs";
-import { resolve, join } from "node:path";
+import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from "node:fs";
+import { resolve, join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 19;
+var HOOK_VERSION = 30;
+function localLogsOnly(security) {
+  const l = security && security.localLogs;
+  return !!(l && l.enabled && typeof l.path === "string" && l.path.trim());
+}
+function writeLocalLog(security, entry) {
+  try {
+    const l = security && security.localLogs;
+    if (!l || !l.enabled || typeof l.path !== "string" || !l.path.trim())
+      return;
+    const dir = l.path.trim().replace(/[\\/]+$/, "");
+    try {
+      mkdirSync(dir, { recursive: true });
+    } catch {
+    }
+    appendFileSync(join(dir, "solongate-audit.jsonl"), JSON.stringify(entry) + "\n");
+  } catch {
+  }
+}
 var MAX_FILE_READ = 1024 * 1024;
 function safeReadFileSync(filePath, encoding = "utf-8") {
   try {
@@ -6602,24 +6620,13 @@ var globalCfg = loadGlobalCloudConfig();
 var API_URL = process.env.SOLONGATE_API_URL || dotenv.SOLONGATE_API_URL || globalCfg.apiUrl || "https://api.solongate.com";
 var API_KEY = [process.env.SOLONGATE_API_KEY, dotenv.SOLONGATE_API_KEY, globalCfg.apiKey].find(isRealKey) || "";
 var AUTH_HEADERS = API_KEY ? { "Authorization": "Bearer " + API_KEY, "X-API-Key": API_KEY } : {};
-async function maybeSelfUpdate() {
-  if (!API_KEY)
-    return;
+async function fetchAndInstallHook(endpoint, fileName, currentVersion, marker, minLen) {
   try {
-    const sgDir = resolve(homedir(), ".solongate");
-    const stamp = join(sgDir, ".hook-update-check");
-    const last = parseInt(safeReadFileSync(stamp) || "0", 10);
-    if (Number.isFinite(last) && Date.now() - last < 6 * 3600 * 1e3)
-      return;
-    try {
-      writeFileSync(stamp, String(Date.now()));
-    } catch {
-    }
-    const res = await fetch(API_URL + "/api/v1/hooks/guard", { headers: AUTH_HEADERS, signal: AbortSignal.timeout(5e3) });
+    const res = await fetch(API_URL + "/api/v1/hooks/" + endpoint, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(5e3) });
     if (!res.ok)
       return;
     const data = await res.json();
-    if (!data || typeof data.version !== "number" || data.version <= HOOK_VERSION)
+    if (!data || typeof data.version !== "number" || data.version <= currentVersion)
       return;
     if (typeof data.content !== "string" || typeof data.sha256 !== "string")
       return;
@@ -6627,16 +6634,59 @@ async function maybeSelfUpdate() {
     if (createHash("sha256").update(buf).digest("hex") !== data.sha256)
       return;
     const text = buf.toString("utf-8");
-    if (!text.startsWith("#!/usr/bin/env node") || text.length < 5e4 || !text.includes("SolonGate Cloud Policy Guard"))
+    if (!text.startsWith("#!/usr/bin/env node") || text.length < minLen || !text.includes(marker))
       return;
-    const hooksDir = join(sgDir, "hooks");
-    const tmp = join(hooksDir, ".guard.mjs.tmp");
+    const hooksDir = join(resolve(homedir(), ".solongate"), "hooks");
+    const tmp = join(hooksDir, "." + fileName + ".tmp");
     writeFileSync(tmp, text);
     try {
-      chmodSync(join(hooksDir, "guard.mjs"), 420);
+      chmodSync(join(hooksDir, fileName), 420);
     } catch {
     }
-    renameSync(tmp, join(hooksDir, "guard.mjs"));
+    renameSync(tmp, join(hooksDir, fileName));
+  } catch {
+  }
+}
+function installedHookVersion(fileName) {
+  try {
+    const f = join(resolve(homedir(), ".solongate"), "hooks", fileName);
+    const m = (safeReadFileSync(f) || "").match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : 0;
+  } catch {
+    return 0;
+  }
+}
+var CLOUD_HOOK_VERSIONS = null;
+function hooksBehindCloud() {
+  const v = CLOUD_HOOK_VERSIONS;
+  if (!v || typeof v !== "object")
+    return false;
+  if (Number(v.guard) > HOOK_VERSION)
+    return true;
+  if (Number(v.audit) > installedHookVersion("audit.mjs"))
+    return true;
+  if (Number(v.shield) > installedHookVersion("shield.mjs"))
+    return true;
+  return false;
+}
+async function maybeSelfUpdate() {
+  if (!API_KEY)
+    return;
+  try {
+    const sgDir = resolve(homedir(), ".solongate");
+    const stamp = join(sgDir, ".hook-update-check");
+    if (!hooksBehindCloud()) {
+      const last = parseInt(safeReadFileSync(stamp) || "0", 10);
+      if (Number.isFinite(last) && Date.now() - last < 6 * 3600 * 1e3)
+        return;
+    }
+    try {
+      writeFileSync(stamp, String(Date.now()));
+    } catch {
+    }
+    await fetchAndInstallHook("guard", "guard.mjs", HOOK_VERSION, "SolonGate Cloud Policy Guard", 5e4);
+    await fetchAndInstallHook("audit", "audit.mjs", installedHookVersion("audit.mjs"), "SolonGate Audit Hook", 1500);
+    await fetchAndInstallHook("shield", "shield.mjs", installedHookVersion("shield.mjs"), "SolonGate Shield", 1500);
   } catch {
   }
 }
@@ -7001,14 +7051,12 @@ var DLP_PATTERNS = [
   { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/ },
   { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/ },
   { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
-  { name: "Google API key", re: /AIza[0-9A-Za-z_-]{35}/ },
   { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/ },
   { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/ },
   { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/ },
   { name: "npm token", re: /npm_[A-Za-z0-9]{36}/ },
   { name: "JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
-  { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
-  { name: "secret assignment", re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/i }
+  { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/i }
 ];
 function dlpGlobToRe(glob) {
   let re = "";
@@ -7592,6 +7640,8 @@ process.stdin.on("end", async () => {
               selfProtectEnabled = cached.selfProtect;
             if (cached.security !== void 0)
               securityCfg = cached.security;
+            if (cached.hookVersions)
+              CLOUD_HOOK_VERSIONS = cached.hookVersions;
           }
         }
       } catch {
@@ -7605,10 +7655,12 @@ process.stdin.on("end", async () => {
               selfProtectEnabled = body.self_protection_enabled;
             if (body?.security !== void 0)
               securityCfg = body.security;
+            if (body?.hook_versions && typeof body.hook_versions === "object")
+              CLOUD_HOOK_VERSIONS = body.hook_versions;
             if (body && body.policy)
               dashboardPolicy = body.policy;
             try {
-              writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: dashboardPolicy || null, selfProtect: selfProtectEnabled, security: securityCfg }));
+              writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: dashboardPolicy || null, selfProtect: selfProtectEnabled, security: securityCfg, hookVersions: CLOUD_HOOK_VERSIONS }));
             } catch {
             }
           }
@@ -7655,24 +7707,26 @@ process.stdin.on("end", async () => {
           writeDenyFlag(toolName);
         } catch {
         }
+        writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), tool: toolName, arguments: args, decision: "DENY", reason: "ghost path (hidden from agent)", permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: data.session_id || "", evaluation_time_ms: Date.now() - _evalStart });
         try {
-          await fetch(API_URL + "/api/v1/audit-logs", {
-            method: "POST",
-            headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-            body: JSON.stringify({
-              tool: toolName,
-              arguments: args,
-              decision: "DENY",
-              reason: "ghost path (hidden from agent)",
-              permission: guessPermission(toolName),
-              source: `${AGENT_TYPE}-guard`,
-              agent_id: AGENT_TYPE,
-              agent_name: AGENT_NAME,
-              session_id: data.session_id || "",
-              evaluation_time_ms: Date.now() - _evalStart
-            }),
-            signal: AbortSignal.timeout(3e3)
-          });
+          if (!localLogsOnly(securityCfg))
+            await fetch(API_URL + "/api/v1/audit-logs", {
+              method: "POST",
+              headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+              body: JSON.stringify({
+                tool: toolName,
+                arguments: args,
+                decision: "DENY",
+                reason: "ghost path (hidden from agent)",
+                permission: guessPermission(toolName),
+                source: `${AGENT_TYPE}-guard`,
+                agent_id: AGENT_TYPE,
+                agent_name: AGENT_NAME,
+                session_id: data.session_id || "",
+                evaluation_time_ms: Date.now() - _evalStart
+              }),
+              signal: AbortSignal.timeout(3e3)
+            });
         } catch {
         }
         await maybeSelfUpdate();
@@ -7717,6 +7771,12 @@ process.stdin.on("end", async () => {
     }
     process.stderr.write(`[SolonGate ROUTE] ${opaRoute.toUpperCase()} (${reason ? "block" : "allow"})
 `);
+    try {
+      const _fd = resolve(".solongate");
+      mkdirSync(_fd, { recursive: true });
+      writeFileSync(join(_fd, ".last-eval"), JSON.stringify({ ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || "" }));
+    } catch {
+    }
     if (reason) {
       if (true) {
         try {
@@ -7732,12 +7792,14 @@ process.stdin.on("end", async () => {
             session_id: data.session_id || "",
             evaluation_time_ms: Date.now() - _evalStart
           };
-          await fetch(API_URL + "/api/v1/audit-logs", {
-            method: "POST",
-            headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
-            body: JSON.stringify(logEntry),
-            signal: AbortSignal.timeout(3e3)
-          });
+          writeLocalLog(securityCfg, { ts: (/* @__PURE__ */ new Date()).toISOString(), ...logEntry });
+          if (!localLogsOnly(securityCfg))
+            await fetch(API_URL + "/api/v1/audit-logs", {
+              method: "POST",
+              headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+              body: JSON.stringify(logEntry),
+              signal: AbortSignal.timeout(3e3)
+            });
         } catch {
         }
       }

package/hooks/guard.mjs

@@ -21,8 +21,8 @@
  * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
  * Auto-installed by: npx @solongate/proxy init --global
  */
-import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync } from 'node:fs';
-import { resolve, join } from 'node:path';
+import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from 'node:fs';
+import { resolve, join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { gunzipSync } from 'node:zlib';
 import { createHash } from 'node:crypto';
@@ -31,7 +31,27 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 19;
+const HOOK_VERSION = 30;
+
+// True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
+// nothing is sent to the cloud audit log.
+function localLogsOnly(security) {
+  const l = security && security.localLogs;
+  return !!(l && l.enabled && typeof l.path === 'string' && l.path.trim());
+}
+
+// Local log storage (opt-in): write solongate-audit.jsonl inside the user's
+// chosen FOLDER. The audit hook does the ALLOW path; the guard does DENY (a
+// blocked call never reaches PostToolUse). `security` is the resolved config.
+function writeLocalLog(security, entry) {
+  try {
+    const l = security && security.localLogs;
+    if (!l || !l.enabled || typeof l.path !== 'string' || !l.path.trim()) return;
+    const dir = l.path.trim().replace(/[\\/]+$/, '');
+    try { mkdirSync(dir, { recursive: true }); } catch { /* ignore */ }
+    appendFileSync(join(dir, 'solongate-audit.jsonl'), JSON.stringify(entry) + '\n');
+  } catch { /* best-effort */ }
+}
 
 // Safe file read with size limit (1MB max) to prevent DoS via large files
 const MAX_FILE_READ = 1024 * 1024; // 1MB
@@ -119,30 +139,74 @@ const AUTH_HEADERS = API_KEY ? { 'Authorization': 'Bearer ' + API_KEY, 'X-API-Ke
 // version is higher AND the sha256 verifies AND the payload looks like this guard
 // hook, it atomically replaces its own file. Any failure is swallowed so a bad
 // update can never break enforcement — the current code simply keeps running.
-async function maybeSelfUpdate() {
-  if (!API_KEY) return;
+// Fetch one hook bundle from the cloud and atomically replace the installed file
+// if the served version is newer AND the sha256 verifies AND it looks like the
+// right hook. Any failure is swallowed.
+async function fetchAndInstallHook(endpoint, fileName, currentVersion, marker, minLen) {
   try {
-    const sgDir = resolve(homedir(), '.solongate');
-    const stamp = join(sgDir, '.hook-update-check');
-    const last = parseInt(safeReadFileSync(stamp) || '0', 10);
-    if (Number.isFinite(last) && Date.now() - last < 6 * 3600 * 1000) return;
-    try { writeFileSync(stamp, String(Date.now())); } catch { /* ignore */ }
-
-    const res = await fetch(API_URL + '/api/v1/hooks/guard', { headers: AUTH_HEADERS, signal: AbortSignal.timeout(5000) });
+    const res = await fetch(API_URL + '/api/v1/hooks/' + endpoint, { headers: AUTH_HEADERS, signal: AbortSignal.timeout(5000) });
     if (!res.ok) return;
     const data = await res.json();
-    if (!data || typeof data.version !== 'number' || data.version <= HOOK_VERSION) return;
+    if (!data || typeof data.version !== 'number' || data.version <= currentVersion) return;
     if (typeof data.content !== 'string' || typeof data.sha256 !== 'string') return;
     const buf = Buffer.from(data.content, 'base64');
     if (createHash('sha256').update(buf).digest('hex') !== data.sha256) return;
     const text = buf.toString('utf-8');
-    // Sanity gate: must look like THIS guard hook before we overwrite ourselves.
-    if (!text.startsWith('#!/usr/bin/env node') || text.length < 50000 || !text.includes('SolonGate Cloud Policy Guard')) return;
-    const hooksDir = join(sgDir, 'hooks');
-    const tmp = join(hooksDir, '.guard.mjs.tmp');
+    if (!text.startsWith('#!/usr/bin/env node') || text.length < minLen || !text.includes(marker)) return;
+    const hooksDir = join(resolve(homedir(), '.solongate'), 'hooks');
+    const tmp = join(hooksDir, '.' + fileName + '.tmp');
     writeFileSync(tmp, text);
-    try { chmodSync(join(hooksDir, 'guard.mjs'), 0o644); } catch { /* may be locked read-only */ }
-    renameSync(tmp, join(hooksDir, 'guard.mjs')); // atomic swap, takes effect next call
+    try { chmodSync(join(hooksDir, fileName), 0o644); } catch { /* may be locked read-only */ }
+    renameSync(tmp, join(hooksDir, fileName)); // atomic swap, takes effect next call
+  } catch { /* never break enforcement on update failure */ }
+}
+
+// Read the HOOK_VERSION baked into an installed sibling hook (0 if absent/old).
+function installedHookVersion(fileName) {
+  try {
+    const f = join(resolve(homedir(), '.solongate'), 'hooks', fileName);
+    const m = (safeReadFileSync(f) || '').match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : 0;
+  } catch { return 0; }
+}
+
+// Latest hook versions the cloud reports on /policies/active (hook_versions).
+// Captured during the policy fetch of THIS run (or its short-lived cache); lets
+// maybeSelfUpdate() know it is behind and bypass the 6h stamp entirely.
+let CLOUD_HOOK_VERSIONS = null;
+
+function hooksBehindCloud() {
+  const v = CLOUD_HOOK_VERSIONS;
+  if (!v || typeof v !== 'object') return false;
+  if (Number(v.guard) > HOOK_VERSION) return true;
+  if (Number(v.audit) > installedHookVersion('audit.mjs')) return true;
+  if (Number(v.shield) > installedHookVersion('shield.mjs')) return true;
+  return false;
+}
+
+// Once per ~6h: update the guard itself AND its sibling hooks (audit, shield).
+// The guard is the only hook that self-updates from the cloud, so it carries the
+// others — that's why a new audit/shield reaches every device with NO re-login:
+// the guard fetches and installs them on its next run.
+//
+// The 6h stamp only rate-limits the BLIND check. When the policy response says
+// the cloud serves a NEWER hook (hook_versions), we update immediately — so a
+// fresh release lands on the next executed command, and a stamp refreshed by an
+// earlier run (e.g. before the release finished deploying) can't delay it.
+async function maybeSelfUpdate() {
+  if (!API_KEY) return;
+  try {
+    const sgDir = resolve(homedir(), '.solongate');
+    const stamp = join(sgDir, '.hook-update-check');
+    if (!hooksBehindCloud()) {
+      const last = parseInt(safeReadFileSync(stamp) || '0', 10);
+      if (Number.isFinite(last) && Date.now() - last < 6 * 3600 * 1000) return;
+    }
+    try { writeFileSync(stamp, String(Date.now())); } catch { /* ignore */ }
+    // Guard compares to its OWN running version; siblings to their installed file.
+    await fetchAndInstallHook('guard', 'guard.mjs', HOOK_VERSION, 'SolonGate Cloud Policy Guard', 50000);
+    await fetchAndInstallHook('audit', 'audit.mjs', installedHookVersion('audit.mjs'), 'SolonGate Audit Hook', 1500);
+    await fetchAndInstallHook('shield', 'shield.mjs', installedHookVersion('shield.mjs'), 'SolonGate Shield', 1500);
   } catch { /* never break enforcement on update failure */ }
 }
 
@@ -655,14 +719,12 @@ const DLP_PATTERNS = [
   { name: 'GitHub fine-grained PAT', re: /github_pat_[A-Za-z0-9_]{20,}/ },
   { name: 'GitLab token', re: /glpat-[A-Za-z0-9_-]{20,}/ },
   { name: 'Slack token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
-  { name: 'Google API key', re: /AIza[0-9A-Za-z_-]{35}/ },
   { name: 'Stripe key', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/ },
   { name: 'SendGrid key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/ },
   { name: 'Twilio key', re: /SK[0-9a-fA-F]{32}/ },
   { name: 'npm token', re: /npm_[A-Za-z0-9]{36}/ },
   { name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
   { name: 'Bearer token', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
-  { name: 'secret assignment', re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/i },
 ];
 
 // Custom patterns are GLOBs: `*` = any run of non-whitespace, same wildcard
@@ -1353,6 +1415,7 @@ process.stdin.on('end', async () => {
             if (cached.policy) dashboardPolicy = cached.policy;
             if (typeof cached.selfProtect === 'boolean') selfProtectEnabled = cached.selfProtect;
             if (cached.security !== undefined) securityCfg = cached.security;
+            if (cached.hookVersions) CLOUD_HOOK_VERSIONS = cached.hookVersions;
           }
         }
       } catch {}
@@ -1367,8 +1430,9 @@ process.stdin.on('end', async () => {
             // Capture the self-protection flag even when no cloud policy is set.
             if (typeof body?.self_protection_enabled === 'boolean') selfProtectEnabled = body.self_protection_enabled;
             if (body?.security !== undefined) securityCfg = body.security;
+            if (body?.hook_versions && typeof body.hook_versions === 'object') CLOUD_HOOK_VERSIONS = body.hook_versions;
             if (body && body.policy) dashboardPolicy = body.policy;
-            try { writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: dashboardPolicy || null, selfProtect: selfProtectEnabled, security: securityCfg })); } catch {}
+            try { writeFileSync(policyCacheFile, JSON.stringify({ _ts: Date.now(), policy: dashboardPolicy || null, selfProtect: selfProtectEnabled, security: securityCfg, hookVersions: CLOUD_HOOK_VERSIONS })); } catch {}
           }
         } catch {}
       }
@@ -1421,8 +1485,9 @@ process.stdin.on('end', async () => {
       const ghostHit = ghostBlock(toolName, args, securityCfg.ghost);
       if (ghostHit) {
         try { writeDenyFlag(toolName); } catch {}
+        writeLocalLog(securityCfg, { ts: new Date().toISOString(), tool: toolName, arguments: args, decision: 'DENY', reason: 'ghost path (hidden from agent)', permission: guessPermission(toolName), source: `${AGENT_TYPE}-guard`, agent_id: AGENT_TYPE, agent_name: AGENT_NAME, session_id: data.session_id || '', evaluation_time_ms: Date.now() - _evalStart });
         try {
-          await fetch(API_URL + '/api/v1/audit-logs', {
+          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
             body: JSON.stringify({
@@ -1498,6 +1563,12 @@ process.stdin.on('end', async () => {
 
     process.stderr.write(`[SolonGate ROUTE] ${opaRoute.toUpperCase()} (${reason ? 'block' : 'allow'})\n`);
 
+    // Hand the measured policy-eval time to the audit hook: PostToolUse logs the
+    // ALLOW path and can't time the guard itself, so it reads this file back.
+    // Keyed by tool + session so the audit hook can match THIS invocation even
+    // when the tool itself runs for minutes (a bare timestamp TTL lost those).
+    try { const _fd = resolve('.solongate'); mkdirSync(_fd, { recursive: true }); writeFileSync(join(_fd, '.last-eval'), JSON.stringify({ ms: Date.now() - _evalStart, ts: Date.now(), tool: toolName, session: data.session_id || '' })); } catch {}
+
     // Only log DENY decisions from guard hook.
     // ALLOW decisions are logged by the audit hook (PostToolUse) to avoid double-counting.
     if (reason) {
@@ -1512,8 +1583,10 @@ process.stdin.on('end', async () => {
             session_id: data.session_id || '',
             evaluation_time_ms: Date.now() - _evalStart,
           };
+          writeLocalLog(securityCfg, { ts: new Date().toISOString(), ...logEntry });
           // PI hook layer removed — piResult fields no longer attached.
-          await fetch(API_URL + '/api/v1/audit-logs', {
+          // Local-only mode: keep the log on the user's machine, skip the cloud.
+          if (!localLogsOnly(securityCfg)) await fetch(API_URL + '/api/v1/audit-logs', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
             body: JSON.stringify(logEntry),

package/hooks/shield.mjs

@@ -21,6 +21,10 @@ import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { homedir } from 'node:os';
 
+// Bump on every shield.mjs change. The cloud serves the newest version; the
+// guard hook installs it on its next run (no re-login needed).
+const HOOK_VERSION = 5;
+
 const log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(' ')}\n`);
 
 const DLP_PATTERNS = [
@@ -32,14 +36,12 @@ const DLP_PATTERNS = [
   { name: 'GitHub fine-grained PAT', re: /github_pat_[A-Za-z0-9_]{20,}/g },
   { name: 'GitLab token', re: /glpat-[A-Za-z0-9_-]{20,}/g },
   { name: 'Slack token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { name: 'Google API key', re: /AIza[0-9A-Za-z_-]{35}/g },
   { name: 'Stripe key', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
   { name: 'SendGrid key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
   { name: 'Twilio key', re: /SK[0-9a-fA-F]{32}/g },
   { name: 'npm token', re: /npm_[A-Za-z0-9]{36}/g },
   { name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
   { name: 'Bearer token', re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
-  { name: 'secret assignment', re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/gi },
 ];
 
 // Find the policy cache to read. The guard writes one per agent
@@ -73,10 +75,89 @@ function loadCfg() {
     if (f && existsSync(f)) {
       const c = JSON.parse(readFileSync(f, 'utf-8'));
       const d = c && c.security && c.security.dlpRedact;
-      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [] };
+      const g = c && c.security && c.security.ghost;
+      const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
+      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [], ghost };
+      return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost };
     }
   } catch { /* default below */ }
-  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [] };
+  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost: [] };
+}
+
+// Ghost paths: hidden files/dirs the model must not even see exist. The audit
+// PostToolUse hook strips them per tool shape, but that depends on parsing each
+// tool's response. The shield sits on the request path where EVERY tool result
+// is already a plain string, so stripping here catches every listing shape
+// (Glob/LS/Grep/MCP/Bash) uniformly. Glob mirrors policy/audit: `*` = any run of
+// non-slash, `**` = any run. Anchored, so a pattern matches a whole path segment.
+function ghostGlobToRegExp(glob) {
+  let re = '';
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === '*') { if (glob[i + 1] === '*') { re += '.*'; i++; } else re += '[^/]*'; }
+    else if (c === '?') re += '[^/]';
+    else if ('\\^$.|+()[]{}'.indexOf(c) !== -1) re += '\\' + c;
+    else re += c;
+  }
+  try { return new RegExp('^' + re + '$'); } catch { return null; }
+}
+function ghostMatch(targetPath, patterns) {
+  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
+  const norm = String(targetPath).replace(/\\/g, '/').replace(/\/+$/, '');
+  if (!norm) return false;
+  const segments = norm.split('/').filter(Boolean);
+  const base = segments.length ? segments[segments.length - 1] : norm;
+  for (let pat of patterns) {
+    pat = String(pat || '').trim();
+    if (!pat) continue;
+    let dirOnly = false;
+    if (pat.endsWith('/')) { dirOnly = true; pat = pat.slice(0, -1); }
+    if (!pat) continue;
+    const hasSlash = pat.indexOf('/') !== -1;
+    const hasWild = /[*?]/.test(pat);
+    const re = ghostGlobToRegExp(pat);
+    if (!re) continue;
+    if (dirOnly) {
+      if (!hasSlash && !hasWild) { if (segments.indexOf(pat) !== -1) return true; continue; }
+      let acc = '';
+      for (const s of segments) { acc = acc ? acc + '/' + s : s; if (re.test(acc) || re.test(s)) return true; }
+      continue;
+    }
+    if (!hasSlash) {
+      if (re.test(base)) return true;
+      if (segments.some((s) => re.test(s))) return true;
+      continue;
+    }
+    if (re.test(norm)) return true;
+  }
+  return false;
+}
+function ghostCleanToken(tok) {
+  let t = String(tok || '').trim();
+  t = t.replace(/^[<>|;&(]+/, '').replace(/[);&|]+$/, '');
+  t = t.replace(/^['"]+/, '').replace(/['"]+$/, '');
+  t = t.replace(/^\d*>>?/, '');
+  return t.trim();
+}
+// Drop any line that references a ghost entry (full-path listings, ls -l rows,
+// space-separated names). Same logic as audit.mjs ghostStripLines.
+function ghostStripLines(text, pats) {
+  if (!Array.isArray(pats) || pats.length === 0) return text;
+  const lines = String(text).split('\n');
+  const kept = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) { kept.push(line); continue; }
+    if (ghostMatch(trimmed, pats)) continue;
+    const toks = trimmed.split(/\s+/);
+    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
+    if (!anyHit) { kept.push(line); continue; }
+    if (toks.length > 3) continue;
+    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
+    if (remaining.length === 0) continue;
+    kept.push(remaining.join('  '));
+  }
+  return kept.join('\n');
 }
 
 // Custom patterns are GLOBs: `*` = any run of non-whitespace, same as policy/ghost.
@@ -101,8 +182,20 @@ function redactString(s, cfg) {
 }
 
 function redactDeep(value, cfg) {
-  if (typeof value === 'string') return redactString(value, cfg);
-  if (Array.isArray(value)) return value.map((v) => redactDeep(v, cfg));
+  const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
+  if (typeof value === 'string') {
+    let out = redactString(value, cfg);
+    if (ghost && ghost.length) out = ghostStripLines(out, ghost);
+    return out;
+  }
+  if (Array.isArray(value)) {
+    // Drop array elements that are themselves a whole ghost path (e.g. a Glob
+    // result delivered as one-path-per-element), so no empty husk remains.
+    const arr = ghost && ghost.length
+      ? value.filter((v) => !(typeof v === 'string' && ghostMatch(v.trim(), ghost)))
+      : value;
+    return arr.map((v) => redactDeep(v, cfg));
+  }
   if (value && typeof value === 'object') {
     const out = {};
     for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v, cfg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "AI tool security proxy — protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {