@solongate/proxy 0.58.0 → 0.59.0

package/dist/login.js

@@ -141,19 +141,6 @@ var SHIM_END = "# <<< SolonGate shield <<<";
 function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function resolveRealClaude() {
-  try {
-    const finder = process.platform === "win32" ? "where" : "which";
-    const out = execFileSync(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-    if (process.platform === "win32") {
-      const low = (s) => s.toLowerCase();
-      return out.find((l) => low(l).endsWith(".cmd")) || out.find((l) => low(l).endsWith(".exe")) || out.find((l) => low(l).endsWith(".bat")) || out[0] || null;
-    }
-    return out[0] || null;
-  } catch {
-    return null;
-  }
-}
 function shimTargets() {
   if (process.platform === "win32") {
     try {
@@ -176,34 +163,13 @@ function writeShimBlock(file, block) {
   mkdirSync(dirname(file), { recursive: true });
   writeFileSync(file, content);
 }
-function installClaudeShim(shieldPath) {
-  const real = resolveRealClaude();
-  if (!real) {
-    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
-    return;
-  }
-  const node = process.execPath.replace(/\\/g, "/");
-  const shield = shieldPath.replace(/\\/g, "/");
-  const win = process.platform === "win32";
-  const block = win ? `${SHIM_BEGIN}
-function claude { & "${node}" "${shield}" -- "${real}" @args }
-${SHIM_END}` : `${SHIM_BEGIN}
-claude() { "${node}" "${shield}" -- "${real}" "$@"; }
-${SHIM_END}`;
-  const targets = shimTargets();
-  if (targets.length === 0) {
-    console.log("  (No shell profile found for auto-shield; run `claude` via `solongate shield -- claude` manually.)");
-    return;
-  }
-  for (const file of targets) {
+function removeClaudeShim() {
+  for (const file of shimTargets()) {
     try {
-      writeShimBlock(file, block);
-      console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
-    } catch (e) {
-      console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);
+      writeShimBlock(file, null);
+    } catch {
     }
   }
-  console.log("  Open a NEW terminal for it to take effect.");
 }
 async function runGlobalInstall(opts = {}) {
   const p = globalPaths();
@@ -231,7 +197,7 @@ async function runGlobalInstall(opts = {}) {
   writeFileSync(join(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
   writeFileSync(join(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join(p.hooksDir, "shield.mjs"));
+  removeClaudeShim();
   writeFileSync(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};

package/dist/logs-server.d.ts

@@ -0,0 +1 @@
+export declare function runLogsServer(): Promise<void>;

package/dist/logs-server.js

@@ -0,0 +1,174 @@
+// src/logs-server.ts
+import { createServer } from "http";
+import { readFileSync, statSync } from "fs";
+import { resolve, join, isAbsolute } from "path";
+import { homedir } from "os";
+import { readdirSync } from "fs";
+var LOG_FILENAME = "solongate-audit.jsonl";
+var DEFAULT_PORT = 8788;
+function allowedOrigins() {
+  const base = [
+    "https://dashboard.solongate.com",
+    "http://localhost:3000",
+    "http://localhost:3005",
+    "http://127.0.0.1:3000",
+    "http://127.0.0.1:3005"
+  ];
+  const extra = (process.env.SOLONGATE_DASHBOARD_ORIGIN || "").split(",").map((s) => s.trim()).filter(Boolean);
+  return /* @__PURE__ */ new Set([...base, ...extra]);
+}
+function resolveLocalLogDir(rawPath) {
+  const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
+  if (!dir) return null;
+  if (isAbsolute(dir)) return dir;
+  return resolve(homedir(), ".solongate", "local-logs");
+}
+async function findLogDir() {
+  const base = resolve(homedir(), ".solongate");
+  try {
+    const files = readdirSync(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
+    for (const f of files) {
+      try {
+        const c = JSON.parse(readFileSync(join(base, f), "utf-8"));
+        const p = c?.security?.localLogs?.path;
+        if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
+      } catch {
+      }
+    }
+  } catch {
+  }
+  try {
+    const cfgRaw = readFileSync(join(base, "cloud-guard.json"), "utf-8");
+    const { apiKey, apiUrl } = JSON.parse(cfgRaw);
+    if (apiKey) {
+      const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
+      const res = await fetch(url, { headers: { Authorization: `Bearer ${apiKey}` } });
+      if (res.ok) {
+        const body = await res.json();
+        const p = body?.security?.localLogs?.path;
+        if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
+      }
+    }
+  } catch {
+  }
+  return { dir: null, configured: null };
+}
+function setCors(req, res) {
+  const origin = req.headers.origin;
+  if (origin && allowedOrigins().has(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+  }
+  if (req.headers["access-control-request-private-network"] === "true") {
+    res.setHeader("Access-Control-Allow-Private-Network", "true");
+  }
+  res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "If-Modified-Since, Content-Type");
+}
+function fileInfo(dir) {
+  if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
+  const file = join(dir, LOG_FILENAME);
+  try {
+    const st = statSync(file);
+    return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
+  } catch {
+    return { file, exists: false, size: 0, mtimeMs: 0 };
+  }
+}
+async function runLogsServer() {
+  const argv = process.argv.slice(3);
+  const portArg = argv[argv.indexOf("--port") + 1];
+  const port = Number(process.env.SOLONGATE_LOGS_PORT || (argv.includes("--port") ? portArg : "") || DEFAULT_PORT) || DEFAULT_PORT;
+  const server = createServer(async (req, res) => {
+    setCors(req, res);
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    if (req.method !== "GET") {
+      res.writeHead(405);
+      res.end();
+      return;
+    }
+    const url = (req.url || "/").split("?")[0];
+    const { dir, configured } = await findLogDir();
+    if (url === "/health") {
+      const info = fileInfo(dir);
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({
+        ok: true,
+        agent: "solongate-logs-server",
+        configuredPath: configured,
+        resolvedDir: dir,
+        file: info.file,
+        exists: info.exists,
+        size: info.size,
+        mtime: info.mtimeMs ? new Date(info.mtimeMs).toISOString() : null
+      }));
+      return;
+    }
+    if (url === "/local-logs") {
+      const info = fileInfo(dir);
+      if (!dir) {
+        res.writeHead(200, { "Content-Type": "text/plain", "X-Solongate-Configured": "0" });
+        res.end("");
+        return;
+      }
+      if (!info.exists) {
+        res.writeHead(200, { "Content-Type": "text/plain", "X-Solongate-Exists": "0" });
+        res.end("");
+        return;
+      }
+      const lastMod = new Date(info.mtimeMs).toUTCString();
+      const since = req.headers["if-modified-since"];
+      if (since && new Date(since).getTime() >= Math.floor(info.mtimeMs / 1e3) * 1e3) {
+        res.writeHead(304, { "Last-Modified": lastMod });
+        res.end();
+        return;
+      }
+      try {
+        const text = readFileSync(info.file, "utf-8");
+        res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
+        res.end(text);
+      } catch {
+        res.writeHead(500);
+        res.end("read error");
+      }
+      return;
+    }
+    res.writeHead(404);
+    res.end("not found");
+  });
+  server.listen(port, "127.0.0.1", async () => {
+    const { dir, configured } = await findLogDir();
+    process.stdout.write(`[SolonGate] Local logs agent listening on http://127.0.0.1:${port}
+`);
+    if (configured) {
+      process.stdout.write(`[SolonGate] Configured path: ${configured}
+`);
+      if (dir && dir !== configured.trim().replace(/[\\/]+$/, "")) {
+        process.stdout.write(`[SolonGate] That path isn't absolute on this machine \u2014 reading from: ${dir}
+`);
+      }
+    } else {
+      process.stdout.write(`[SolonGate] Local log storage not configured yet (set it in dashboard Settings).
+`);
+    }
+    process.stdout.write(`[SolonGate] Keep this running; the dashboard reads your logs live from here. Ctrl+C to stop.
+`);
+  });
+  server.on("error", (err) => {
+    if (err.code === "EADDRINUSE") {
+      process.stderr.write(`[SolonGate] Port ${port} is already in use. Pass --port <n> or set SOLONGATE_LOGS_PORT.
+`);
+    } else {
+      process.stderr.write(`[SolonGate] Local logs agent error: ${err.message}
+`);
+    }
+    process.exit(1);
+  });
+}
+export {
+  runLogsServer
+};

package/dist/shield.js

@@ -17,14 +17,12 @@ var DLP_PATTERNS = [
   { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },
   { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },
   { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { name: "Google API key", re: /AIza[0-9A-Za-z_-]{35}/g },
   { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
   { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
   { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },
   { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },
   { name: "JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
-  { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
-  { name: "secret assignment", re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/gi }
+  { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi }
 ];
 function findCacheFile() {
   const dir = resolve(homedir(), ".solongate");
@@ -55,11 +53,104 @@ function loadCfg() {
     if (f && existsSync(f)) {
       const c = JSON.parse(readFileSync(f, "utf-8"));
       const d = c?.security?.dlpRedact;
-      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [] };
+      const g = c?.security?.ghost;
+      const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
+      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [], ghost };
+      return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost };
     }
   } catch {
   }
-  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [] };
+  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost: [] };
+}
+function ghostGlobToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += ".*";
+        i++;
+      } else re += "[^/]*";
+    } else if (c === "?") re += "[^/]";
+    else if ("\\^$.|+()[]{}".indexOf(c) !== -1) re += "\\" + c;
+    else re += c;
+  }
+  try {
+    return new RegExp("^" + re + "$");
+  } catch {
+    return null;
+  }
+}
+function ghostMatch(targetPath, patterns) {
+  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
+  const norm = String(targetPath).replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!norm) return false;
+  const segments = norm.split("/").filter(Boolean);
+  const base = segments.length ? segments[segments.length - 1] : norm;
+  for (let pat of patterns) {
+    pat = String(pat || "").trim();
+    if (!pat) continue;
+    let dirOnly = false;
+    if (pat.endsWith("/")) {
+      dirOnly = true;
+      pat = pat.slice(0, -1);
+    }
+    if (!pat) continue;
+    const hasSlash = pat.indexOf("/") !== -1;
+    const hasWild = /[*?]/.test(pat);
+    const re = ghostGlobToRegExp(pat);
+    if (!re) continue;
+    if (dirOnly) {
+      if (!hasSlash && !hasWild) {
+        if (segments.indexOf(pat) !== -1) return true;
+        continue;
+      }
+      let acc = "";
+      for (const s of segments) {
+        acc = acc ? acc + "/" + s : s;
+        if (re.test(acc) || re.test(s)) return true;
+      }
+      continue;
+    }
+    if (!hasSlash) {
+      if (re.test(base)) return true;
+      if (segments.some((s) => re.test(s))) return true;
+      continue;
+    }
+    if (re.test(norm)) return true;
+  }
+  return false;
+}
+function ghostCleanToken(tok) {
+  let t = String(tok || "").trim();
+  t = t.replace(/^[<>|;&(]+/, "").replace(/[);&|]+$/, "");
+  t = t.replace(/^['"]+/, "").replace(/['"]+$/, "");
+  t = t.replace(/^\d*>>?/, "");
+  return t.trim();
+}
+function ghostStripLines(text, pats) {
+  if (!Array.isArray(pats) || pats.length === 0) return text;
+  const lines = String(text).split("\n");
+  const kept = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      kept.push(line);
+      continue;
+    }
+    if (ghostMatch(trimmed, pats)) continue;
+    const toks = trimmed.split(/\s+/);
+    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
+    if (!anyHit) {
+      kept.push(line);
+      continue;
+    }
+    if (toks.length > 3) continue;
+    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
+    if (remaining.length === 0) continue;
+    kept.push(remaining.join("  "));
+  }
+  return kept.join("\n");
 }
 function dlpGlobToRe(glob, flags) {
   let re = "";
@@ -84,8 +175,16 @@ function redactString(s, cfg) {
   return out;
 }
 function redactDeep(value, cfg) {
-  if (typeof value === "string") return redactString(value, cfg);
-  if (Array.isArray(value)) return value.map((v) => redactDeep(v, cfg));
+  const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
+  if (typeof value === "string") {
+    let out = redactString(value, cfg);
+    if (ghost && ghost.length) out = ghostStripLines(out, ghost);
+    return out;
+  }
+  if (Array.isArray(value)) {
+    const arr = ghost && ghost.length ? value.filter((v) => !(typeof v === "string" && ghostMatch(v.trim(), ghost))) : value;
+    return arr.map((v) => redactDeep(v, cfg));
+  }
   if (value && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v, cfg);

package/hooks/.solongate/.last-deny

@@ -0,0 +1 @@
+{"tool":"Bash","ts":1783610904106}

package/hooks/.solongate/.last-eval

@@ -0,0 +1 @@
+{"ms":2391,"ts":1783610920233,"tool":"Bash","session":"fc94b672-fd99-4d52-9105-c77c7906d9f0"}

package/hooks/.solongate/.last-tool-call

@@ -0,0 +1 @@
+1783610904106