@solongate/proxy 0.58.0 → 0.59.0

package/hooks/audit.mjs

@@ -1,544 +1,565 @@
-#!/usr/bin/env node
-/**
- * SolonGate Audit Hook for Claude Code (PostToolUse)
- * Logs tool execution results to SolonGate Cloud.
- * Auto-installed by: npx @solongate/proxy login
- */
-import { readFileSync, existsSync, writeFileSync, mkdirSync, appendFileSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { homedir } from 'node:os';
-
-// Bump on every audit.mjs change. The cloud serves the newest version; the guard
-// hook installs it on its next run (no re-login needed). See guard.mjs
-// fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 14;
-
-function loadEnvKey(dir) {
-  try {
-    const envPath = resolve(dir, '.env');
-    if (!existsSync(envPath)) return {};
-    const lines = readFileSync(envPath, 'utf-8').split('\n');
-    const env = {};
-    for (const line of lines) {
-      const m = line.match(/^([A-Z_]+)=(.*)$/);
-      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
-    }
-    return env;
-  } catch { return {}; }
-}
-
-// Global cloud config written by `init --global` (~/.solongate/cloud-guard.json).
-// A system-wide PostToolUse hook runs from any cwd, so a project .env can't be
-// relied on for the key — read the absolute global config too.
-function loadGlobalCloudConfig() {
-  try {
-    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
-    if (!existsSync(p)) return {};
-    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
-    return (cfg && typeof cfg === 'object') ? cfg : {};
-  } catch { return {}; }
-}
-
-// The guard (PreToolUse) measures the policy-eval time and drops it in a flag
-// file; this hook logs the ALLOW path but can't time the guard itself, so it
-// reads that value back. The flag carries the tool (and session) it was measured
-// for, so a long-running tool (a 10-minute Bash build) still gets ITS eval time
-// instead of a stale-TTL zero. Returns null when no matching measurement exists —
-// an unknown eval time must be stored as null, not a fake 0 that drags averages.
-function readLastEvalMs(toolName, sessionId) {
-  try {
-    const p = resolve('.solongate', '.last-eval');
-    if (!existsSync(p)) return null;
-    const c = JSON.parse(readFileSync(p, 'utf-8'));
-    if (!c || typeof c.ms !== 'number' || typeof c.ts !== 'number') return null;
-    if (typeof c.tool === 'string') {
-      // New flag format: match this invocation (tool + session when both known);
-      // 2h ceiling only guards against a truly abandoned flag file.
-      if (c.tool !== toolName) return null;
-      if (c.session && sessionId && c.session !== sessionId) return null;
-      if (Date.now() - c.ts > 2 * 3600 * 1000) return null;
-      return Math.max(0, Math.round(c.ms));
-    }
-    // Legacy flag (no tool info): keep the old conservative 30s freshness rule.
-    if (Date.now() - c.ts < 30000) return Math.max(0, Math.round(c.ms));
-    return null;
-  } catch { return null; }
-}
-
-// ── Ghost paths (PostToolUse twin of guard.mjs) ──
-// The guard's PreToolUse hook blocks MUTATIONS to hidden paths; here we make
-// hidden paths invisible to READS and LISTINGS by rewriting the tool output the
-// model sees (Claude Code `updatedToolOutput`). The matcher below is mirrored
-// verbatim from guard.mjs — keep the two in sync. Config is read from the policy
-// cache the guard just wrote (same PreToolUse call), so no extra API request.
-function ghostGlobToRegExp(glob) {
-  let re = '';
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === '*') {
-      if (glob[i + 1] === '*') { re += '.*'; i++; }
-      else re += '[^/]*';
-    } else if (c === '?') re += '[^/]';
-    else if ('\\^$.|+()[]{}'.indexOf(c) !== -1) re += '\\' + c;
-    else re += c;
-  }
-  try { return new RegExp('^' + re + '$'); } catch { return null; }
-}
-function ghostMatch(targetPath, patterns) {
-  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
-  const norm = String(targetPath).replace(/\\/g, '/').replace(/\/+$/, '');
-  if (!norm) return false;
-  const segments = norm.split('/').filter(Boolean);
-  const base = segments.length ? segments[segments.length - 1] : norm;
-  for (let pat of patterns) {
-    pat = String(pat || '').trim();
-    if (!pat) continue;
-    let dirOnly = false;
-    if (pat.endsWith('/')) { dirOnly = true; pat = pat.slice(0, -1); }
-    if (!pat) continue;
-    const hasSlash = pat.indexOf('/') !== -1;
-    const hasWild = /[*?]/.test(pat);
-    const re = ghostGlobToRegExp(pat);
-    if (!re) continue;
-    if (dirOnly) {
-      if (!hasSlash && !hasWild) { if (segments.indexOf(pat) !== -1) return true; continue; }
-      let acc = '';
-      for (const s of segments) { acc = acc ? acc + '/' + s : s; if (re.test(acc) || re.test(s)) return true; }
-      continue;
-    }
-    if (!hasSlash) {
-      if (re.test(base)) return true;
-      if (segments.some((s) => re.test(s))) return true;
-      continue;
-    }
-    if (re.test(norm)) return true;
-  }
-  return false;
-}
-function ghostCleanToken(tok) {
-  let t = String(tok || '').trim();
-  t = t.replace(/^[<>|;&(]+/, '').replace(/[);&|]+$/, '');
-  t = t.replace(/^['"]+/, '').replace(/['"]+$/, '');
-  t = t.replace(/^\d*>>?/, '');
-  return t.trim();
-}
-// Drop listing lines that reference a ghost entry. `find`/glob output (one path
-// per line) drops the whole line; multi-column `ls -l` rows drop entirely; a
-// bare space-separated `ls` row drops only the matching names.
-function ghostStripLines(text, pats) {
-  const lines = String(text).split('\n');
-  const kept = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) { kept.push(line); continue; }
-    if (ghostMatch(trimmed, pats)) continue; // full-path listing line
-    const toks = trimmed.split(/\s+/);
-    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
-    if (!anyHit) { kept.push(line); continue; }
-    if (toks.length > 3) continue; // ls -l style row → drop entirely
-    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
-    if (remaining.length === 0) continue;
-    kept.push(remaining.join('  '));
-  }
-  return kept.join('\n');
-}
-// Read ghost patterns from the policy cache the guard wrote on the matching
-// PreToolUse call. Same agent-key derivation as guard.mjs.
-function loadGhostPatterns() {
-  try {
-    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
-    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
-    if (!existsSync(f)) return [];
-    const c = JSON.parse(readFileSync(f, 'utf-8'));
-    const g = c && c.security && c.security.ghost;
-    return g && Array.isArray(g.patterns) ? g.patterns : [];
-  } catch { return []; }
-}
-// Returns the rewritten output text, or null if nothing is hidden.
-function buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, pats) {
-  if (!Array.isArray(pats) || pats.length === 0) return null;
-  const name = toolName || '';
-  // Use the SAME broad extraction as DLP redaction (Read file.content, array
-  // content, stdout, …). Previously this was narrower, so ghost-strip silently
-  // skipped tool shapes DLP still scanned — a ghosted file then survived in a
-  // listing (e.g. the LS tool) even though names elsewhere got redacted.
-  const getText = () => extractOutputText(toolResponse, toolOutput);
-  try {
-    // Direct read of a hidden file → looks like it doesn't exist.
-    if (name === 'Read' || name === 'NotebookRead') {
-      const p = toolInput && (toolInput.file_path || toolInput.notebook_path);
-      if (p && ghostMatch(p, pats)) return p + ': No such file or directory';
-      return null;
-    }
-    if (name === 'Bash' || name === 'BashOutput') {
-      const text = getText();
-      if (text == null) return null;
-      const cmd = String((toolInput && toolInput.command) || '');
-      for (const raw of cmd.split(/\s+/)) {
-        const t = ghostCleanToken(raw);
-        // A command that names the hidden path directly (cat A/Y/.data, ls A/Y)
-        // → not-found, regardless of what the command actually returned. Skip
-        // flags and any token carrying regex/shell metacharacters: the guard's
-        // PreToolUse listing rewrite injects a ghost REGEX (e.g.
-        // ")([^/]*ghosttest[^/]*)(/|$)") into the command, and tokenizing that
-        // would falsely "match" and emit a bogus not-found string as the result.
-        if (!t || t[0] === '-' || /[()|[\]^$*?]/.test(t)) continue;
-        if (ghostMatch(t, pats)) return t + ': No such file or directory';
-      }
-      const stripped = ghostStripLines(text, pats);
-      return stripped === text ? null : stripped;
-    }
-    // MCP filesystem direct reads → make a hidden file look absent, mirroring
-    // the native Read branch above (these never reach the Bash/LS branches).
-    if (name === 'mcp__filesystem__read_file' || name === 'mcp__filesystem__read_text_file' ||
-        name === 'mcp__filesystem__read_media_file' || name === 'mcp__filesystem__get_file_info') {
-      const p = toolInput && (toolInput.path || toolInput.file_path);
-      if (p && ghostMatch(p, pats)) return String(p) + ': No such file or directory';
-    }
-    // Every OTHER tool that returns listing-like text → strip hidden entries.
-    // Native Glob/Grep/LS plus any non-shell lister (MCP filesystem
-    // list_directory / directory_tree / search_files, and future tools). Bash
-    // listings are already covered above (and via the guard's PreToolUse command
-    // rewrite); this catch-all is the post-hoc safety net so a ghost entry can't
-    // survive in ANY listing shape — previously only the hard-coded
-    // Glob/Grep/LS names were stripped, so an MCP/unknown lister leaked it.
-    {
-      const text = getText();
-      if (text == null) return null;
-      const stripped = ghostStripLines(text, pats);
-      return stripped === text ? null : stripped;
-    }
-  } catch { /* fail open */ }
-  return null;
-}
-
-// ── DLP output redaction (PostToolUse) ──
-// Same family as ghost, but ghost hides files/dirs by PATH while this masks
-// secret VALUES inside the tool OUTPUT the model sees (file reads, stdout,
-// fetched pages). Active whenever DLP is on (detect OR block) — the server
-// delivers the enabled pattern set as `security.dlpRedact` in the policy cache.
-// Patterns mirror guard.mjs / apps/api/src/lib/security-layers.ts (global flag
-// so every occurrence is replaced). Scanning RAW output text (not JSON) means
-// the quote handling is exact — no escaping artifacts.
-const DLP_PATTERNS = [
-  { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/g },
-  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
-  { name: 'Anthropic key', re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-  { name: 'OpenAI key', re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
-  { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
-  { name: 'GitHub fine-grained PAT', re: /github_pat_[A-Za-z0-9_]{20,}/g },
-  { name: 'GitLab token', re: /glpat-[A-Za-z0-9_-]{20,}/g },
-  { name: 'Slack token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { name: 'Stripe key', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
-  { name: 'SendGrid key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
-  { name: 'Twilio key', re: /SK[0-9a-fA-F]{32}/g },
-  { name: 'npm token', re: /npm_[A-Za-z0-9]{36}/g },
-  { name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
-  { name: 'Bearer token', re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
-];
-
-// Read the redaction config the guard cached on the matching PreToolUse call.
-function loadDlpRedact() {
-  try {
-    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
-    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
-    if (!existsSync(f)) return null;
-    const c = JSON.parse(readFileSync(f, 'utf-8'));
-    const d = c && c.security && c.security.dlpRedact;
-    return d && Array.isArray(d.patterns) ? d : null;
-  } catch { return null; }
-}
-
-// Local log storage: the user can opt to keep a full copy of every audit entry
-// in a file of their choosing (set from the dashboard survey / Settings, then
-// delivered to us via the same policy cache the guard writes). We append one
-// JSON object per line (JSONL) to that path. Fully local, best-effort, and
-// never blocks the tool call or the cloud audit POST.
-function loadLocalLogs() {
-  try {
-    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
-    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
-    if (!existsSync(f)) return null;
-    const c = JSON.parse(readFileSync(f, 'utf-8'));
-    const l = c && c.security && c.security.localLogs;
-    if (l && l.enabled && typeof l.path === 'string' && l.path.trim()) return { path: l.path.trim() };
-    return null;
-  } catch { return null; }
-}
-
-// The path is a FOLDER; we write solongate-audit.jsonl inside it (creating the
-// folder if missing), then append one JSON line.
-function appendLocalLog(cfg, entry) {
-  try {
-    const dir = cfg.path.replace(/[\\/]+$/, '');
-    try { mkdirSync(dir, { recursive: true }); } catch { /* ignore */ }
-    appendFileSync(join(dir, 'solongate-audit.jsonl'), JSON.stringify(entry) + '\n');
-  } catch { /* best-effort: never disturb the tool call */ }
-}
-
-// Replace every secret match with a labelled placeholder. cfg = { patterns:
-// string[] (enabled built-in names), custom: {name,re}[] }.
-// Custom patterns are GLOBs: `*` = any run of non-whitespace (so a fragment
-// matches a whole token), same wildcard mechanic as policy/ghost.
-function dlpGlobToRe(glob, flags) {
-  let re = '';
-  for (const ch of String(glob || '')) {
-    if (ch === '*') re += '[^\\s]*';
-    else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
-    else re += ch;
-  }
-  return new RegExp(re, flags);
-}
-function dlpRedactText(text, cfg) {
-  if (!cfg || typeof text !== 'string' || !text) return text;
-  const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
-  let out = text;
-  for (const p of DLP_PATTERNS) {
-    if (allow.has(p.name)) out = out.replace(p.re, '[REDACTED:' + p.name + ']');
-  }
-  for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
-    try { out = out.replace(dlpGlobToRe(c.re, 'g'), '[REDACTED:' + (c.name || 'custom') + ']'); } catch { /* skip invalid */ }
-  }
-  return out;
-}
-
-// Best-effort extraction of the model-visible text from a tool_response. Shapes
-// are undocumented, so probe the known fields (Bash stdout, Read file.content,
-// string/array content) and fall back to a raw string output.
-function extractOutputText(toolResponse, toolOutput) {
-  const r = toolResponse;
-  if (typeof r === 'string') return r;
-  if (r && typeof r === 'object') {
-    if (typeof r.stdout === 'string' && r.stdout) return r.stdout;
-    if (typeof r.content === 'string' && r.content) return r.content;
-    if (r.file && typeof r.file.content === 'string') return r.file.content;
-    if (Array.isArray(r.content)) {
-      const t = r.content.filter((x) => x && x.type === 'text' && typeof x.text === 'string').map((x) => x.text).join('\n');
-      if (t) return t;
-    }
-    // Native Glob delivers its hits as a `filenames` string[] with NO stdout/
-    // content field, so getText() returned null and the ghost/DLP strip silently
-    // skipped it — a ghosted file then survived in the Glob listing the model saw
-    // (the exact leak: a `*ghosttest*` path showed up in a Glob result). Join to
-    // one-path-per-line so ghostStripLines/dlpRedactText can act on it; the
-    // PostToolUse updatedToolOutput then replaces the model-visible list.
-    if (Array.isArray(r.filenames)) {
-      const t = r.filenames.filter((x) => typeof x === 'string').join('\n');
-      if (t) return t;
-    }
-  }
-  if (typeof toolOutput === 'string' && toolOutput) return toolOutput;
-  return null;
-}
-
-function guessPermission(toolName) {
-  const name = (toolName || '').toLowerCase();
-  if (name.includes('exec') || name.includes('shell') || name.includes('run') || name.includes('eval') || name === 'bash') return 'EXECUTE';
-  if (name.includes('fetch') || name.includes('http') || name.includes('request') || name.includes('curl') || name.includes('network') || name.includes('download') || name.includes('upload') || name === 'websearch') return 'NETWORK';
-  if (name.includes('write') || name.includes('create') || name.includes('delete') || name.includes('update') || name.includes('set') || name.includes('edit') || name.includes('remove') || name.includes('insert')) return 'WRITE';
-  return 'READ';
-}
-
-const dotenv = loadEnvKey(process.cwd());
-const globalCfg = loadGlobalCloudConfig();
-const API_KEY = process.env.SOLONGATE_API_KEY || dotenv.SOLONGATE_API_KEY || globalCfg.apiKey || '';
-const API_URL = process.env.SOLONGATE_API_URL || dotenv.SOLONGATE_API_URL || globalCfg.apiUrl || 'https://api.solongate.com';
-
-// Agent identity from CLI args: node audit.mjs <agent_id> <agent_name>
-const AGENT_ID = process.argv[2] || 'claude-code';
-const AGENT_NAME = process.argv[3] || 'Claude Code';
-
-// Accept both live and test keys (test keys are used for trials / sandboxes).
-if (!API_KEY || !(API_KEY.startsWith('sg_live_') || API_KEY.startsWith('sg_test_'))) process.exit(0);
-
-let input = '';
-process.stdin.on('data', c => input += c);
-process.stdin.on('end', async () => {
-  try {
-    const data = JSON.parse(input);
-    let EMITTED_PAYLOAD = null;
-
-    // Debug: append raw stdin to file for agent detection troubleshooting.
-    // Opt-in (SOLONGATE_DEBUG) so a global hook doesn't litter every cwd.
-    if (process.env.SOLONGATE_DEBUG) {
-      try {
-        const debugLine = JSON.stringify({ ts: new Date().toISOString(), argv: process.argv.slice(2), tool_name: data.tool_name || data.toolName, agent_id: AGENT_ID }) + '\n';
-        const { appendFileSync: afs, mkdirSync: mds } = await import('node:fs');
-        mds(resolve('.solongate'), { recursive: true });
-        afs(resolve('.solongate', '.debug-audit-log'), debugLine);
-      } catch {}
-    }
-
-    let toolName = data.tool_name || data.toolName || '';
-    let toolInput = data.tool_input || data.toolInput || data.params || {};
-    if (!toolName) toolName = 'unknown';
-
-    if (toolName === 'Bash' && JSON.stringify(toolInput).includes('audit-logs')) {
-      process.exit(0);
-    }
-
-    // Check if guard.mjs already logged a DENY for this tool (avoid duplicate ALLOW after DENY)
-    let guardDenied = false;
-    try {
-      const denyFlagPath = resolve('.solongate', '.last-deny');
-      if (existsSync(denyFlagPath)) {
-        const flag = JSON.parse(readFileSync(denyFlagPath, 'utf-8'));
-        // If deny was recent (< 10s) and same tool, this postToolUse is a duplicate
-        if (flag.ts && Date.now() - flag.ts < 10000 && flag.tool === toolName) {
-          guardDenied = true;
-        }
-      }
-    } catch {}
-
-    const toolResponse = data.tool_response || data.toolResponse || {};
-    const toolOutput = data.tool_output || data.toolOutput || '';
-    const resultJson = data.result_json ? (typeof data.result_json === 'string' ? data.result_json : JSON.stringify(data.result_json)) : '';
-
-    // Ghost paths: rewrite the output the model sees so hidden files/dirs are
-    // stripped from listings and direct reads look like "no such file". Emit the
-    // updated output BEFORE the (fire-and-forget) audit log. Fail-open: any
-    // error leaves the original output untouched.
-    let ghostFired = false;
-    try {
-      const ghostPats = loadGhostPatterns();
-      const dlpCfg = loadDlpRedact();
-      const redactName = (s) => (dlpCfg && typeof s === 'string') ? dlpRedactText(s, dlpCfg) : s;
-
-      // Glob (and Grep in files mode) deliver a STRUCTURED result:
-      //   { filenames: string[], numFiles, truncated, totalMatches, ... }
-      // Claude Code REJECTS a plain-string updatedToolOutput for such a tool —
-      // it prints "PostToolUse:Glob hook warning" and keeps the ORIGINAL result,
-      // so the ghost entry leaks into the listing the model sees. The fix is to
-      // return the SAME shape: the filenames array with ghost entries dropped
-      // (and secret-looking names masked), preserving every other field.
-      if (toolResponse && typeof toolResponse === 'object' && Array.isArray(toolResponse.filenames)) {
-        const orig = toolResponse.filenames;
-        const kept = orig.filter((f) => !(ghostPats.length && ghostMatch(String(f), ghostPats)));
-        ghostFired = kept.length !== orig.length;
-        const masked = kept.map((f) => redactName(String(f)));
-        const changed = ghostFired || masked.some((f, i) => f !== String(kept[i]));
-        if (changed) {
-          const updated = { ...toolResponse, filenames: masked, numFiles: masked.length };
-          if (typeof toolResponse.totalMatches === 'number') updated.totalMatches = masked.length;
-          EMITTED_PAYLOAD = JSON.stringify({
-            hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: updated },
-          });
-        }
-      } else {
-        // String-output tools (Bash, Read, text Grep, MCP listers): strip ghost
-        // lines and redact secrets in the TEXT, return a STRING.
-        const ghostText = buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, ghostPats);
-        ghostFired = typeof ghostText === 'string';
-        let out = typeof ghostText === 'string' ? ghostText : null;
-        if (dlpCfg) {
-          const base = typeof ghostText === 'string' ? ghostText : extractOutputText(toolResponse, toolOutput);
-          if (typeof base === 'string') {
-            const redacted = dlpRedactText(base, dlpCfg);
-            if (redacted !== base || typeof ghostText === 'string') out = redacted;
-          }
-        }
-        if (typeof out === 'string') {
-          // Preserve the tool's result SHAPE. Bash and other tools deliver a
-          // STRUCTURED result ({ stdout, stderr, ... } or { content }); Claude
-          // Code rejects a bare-string replacement for those (hook warning) and
-          // keeps the original. Clone the object and swap its text field; only a
-          // genuinely string-typed result is replaced with a string.
-          const tr = toolResponse;
-          let updated;
-          if (tr && typeof tr === 'object' && typeof tr.stdout === 'string') updated = { ...tr, stdout: out };
-          else if (tr && typeof tr === 'object' && typeof tr.content === 'string') updated = { ...tr, content: out };
-          else if (tr && typeof tr === 'object' && Array.isArray(tr.content)) updated = { ...tr, content: [{ type: 'text', text: out }] };
-          else updated = out;
-          EMITTED_PAYLOAD = JSON.stringify({
-            hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: updated },
-          });
-        }
-      }
-    } catch {}
-
-    const hasError = guardDenied ||
-      toolResponse.error ||
-      toolResponse.exitCode > 0 ||
-      toolResponse.isError ||
-      (toolOutput && typeof toolOutput === 'string' && toolOutput.includes('"error"')) ||
-      (resultJson && resultJson.includes('"error"'));
-
-    // Keep the full command/args for audit review (the dashboard shows them in
-    // the detail view). Only cap pathologically large values.
-    const argsSummary = {};
-    for (const [k, v] of Object.entries(toolInput)) {
-      argsSummary[k] = typeof v === 'string' && v.length > 8000
-        ? v.slice(0, 8000) + '…'
-        : v;
-    }
-
-    // Write flag so stop.mjs knows tool calls happened (skip text-only ALLOW)
-    try {
-      const flagDir = resolve('.solongate');
-      mkdirSync(flagDir, { recursive: true });
-      writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
-    } catch {}
-
-    // Flush the model-visible replacement to stdout, THEN exit. On Windows a
-    // bare process.exit() can truncate an un-drained pipe write, so Claude Code
-    // receives malformed hook JSON, prints "PostToolUse hook warning", and
-    // DISCARDS the replacement — leaving the ghost entry visible. Gate the exit
-    // on the write's flush callback (and on the fire-and-forget audit POST).
-    let flushed = (typeof EMITTED_PAYLOAD !== 'string');
-    let fetchDone = false;
-    const maybeExit = () => { if (flushed && fetchDone) process.exit(0); };
-    if (typeof EMITTED_PAYLOAD === 'string') {
-      try { process.stdout.write(EMITTED_PAYLOAD, () => { flushed = true; maybeExit(); }); }
-      catch { flushed = true; }
-    }
-
-    const sessionId = data.session_id || data.sessionId || data.conversation_id || '';
-    const decision = hasError ? 'DENY' : 'ALLOW';
-    const reason = guardDenied ? 'blocked by policy guard' : hasError ? 'tool returned error' : ghostFired ? 'ghost path (hidden from agent)' : 'allowed';
-    const permission = guessPermission(toolName);
-    const evaluationTimeMs = readLastEvalMs(toolName, sessionId);
-
-    // Local log storage (opt-in): when ON, logs are kept LOCAL ONLY — we append
-    // this entry to the user's chosen file and do NOT send it to the cloud.
-    const localLogs = loadLocalLogs();
-    if (localLogs) {
-      appendLocalLog(localLogs, {
-        ts: new Date().toISOString(),
-        tool: toolName, arguments: argsSummary, decision, reason, permission,
-        evaluation_time_ms: evaluationTimeMs, agent_id: AGENT_ID, agent_name: AGENT_NAME, session_id: sessionId,
-      });
-      fetchDone = true;
-      maybeExit();
-    } else {
-      // Fire-and-forget: don't block tool execution waiting for API response
-      fetch(`${API_URL}/api/v1/audit-logs`, {
-        method: 'POST',
-        headers: {
-          'Authorization': `Bearer ${API_KEY}`,
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({
-          tool: toolName,
-          arguments: argsSummary,
-          // Ghost-on-a-listing is NOT a denial: the call was ALLOWED and succeeded,
-          // we just hid ghost entries from its result. Log it as ALLOW but carry the
-          // ghost reason so the dashboard can badge it Ghost (the allow-side twin of
-          // the guard's DENY+Ghost for a direct ghost hit). Real denials stay DENY.
-          decision,
-          reason,
-          permission,
-          source: `${AGENT_ID}-hook`,
-          evaluationTimeMs,
-          agent_id: AGENT_ID,
-          agent_name: AGENT_NAME,
-          session_id: sessionId,
-        }),
-        signal: AbortSignal.timeout(5000),
-      }).catch(() => {}).finally(() => { fetchDone = true; maybeExit(); });
-    }
-    // Hard backstop: exit even if the write callback or fetch never settles.
-    setTimeout(() => process.exit(0), 3000);
-  } catch {
-    process.exit(0);
-  }
-});
+#!/usr/bin/env node
+/**
+ * SolonGate Audit Hook for Claude Code (PostToolUse)
+ * Logs tool execution results to SolonGate Cloud.
+ * Auto-installed by: npx @solongate/proxy login
+ */
+import { readFileSync, existsSync, writeFileSync, mkdirSync, appendFileSync } from 'node:fs';
+import { resolve, join, isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+
+// Bump on every audit.mjs change. The cloud serves the newest version; the guard
+// hook installs it on its next run (no re-login needed). See guard.mjs
+// fetchAndInstallHook / maybeSelfUpdate.
+const HOOK_VERSION = 14;
+
+function loadEnvKey(dir) {
+  try {
+    const envPath = resolve(dir, '.env');
+    if (!existsSync(envPath)) return {};
+    const lines = readFileSync(envPath, 'utf-8').split('\n');
+    const env = {};
+    for (const line of lines) {
+      const m = line.match(/^([A-Z_]+)=(.*)$/);
+      if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '').trim();
+    }
+    return env;
+  } catch { return {}; }
+}
+
+// Global cloud config written by `init --global` (~/.solongate/cloud-guard.json).
+// A system-wide PostToolUse hook runs from any cwd, so a project .env can't be
+// relied on for the key — read the absolute global config too.
+function loadGlobalCloudConfig() {
+  try {
+    const p = resolve(homedir(), '.solongate', 'cloud-guard.json');
+    if (!existsSync(p)) return {};
+    const cfg = JSON.parse(readFileSync(p, 'utf-8'));
+    return (cfg && typeof cfg === 'object') ? cfg : {};
+  } catch { return {}; }
+}
+
+// The guard (PreToolUse) measures the policy-eval time and drops it in a flag
+// file; this hook logs the ALLOW path but can't time the guard itself, so it
+// reads that value back. The flag carries the tool (and session) it was measured
+// for, so a long-running tool (a 10-minute Bash build) still gets ITS eval time
+// instead of a stale-TTL zero. Returns null when no matching measurement exists —
+// an unknown eval time must be stored as null, not a fake 0 that drags averages.
+function readLastEvalMs(toolName, sessionId) {
+  try {
+    const p = resolve('.solongate', '.last-eval');
+    if (!existsSync(p)) return null;
+    const c = JSON.parse(readFileSync(p, 'utf-8'));
+    if (!c || typeof c.ms !== 'number' || typeof c.ts !== 'number') return null;
+    if (typeof c.tool === 'string') {
+      // New flag format: match this invocation (tool + session when both known);
+      // 2h ceiling only guards against a truly abandoned flag file.
+      if (c.tool !== toolName) return null;
+      if (c.session && sessionId && c.session !== sessionId) return null;
+      if (Date.now() - c.ts > 2 * 3600 * 1000) return null;
+      return Math.max(0, Math.round(c.ms));
+    }
+    // Legacy flag (no tool info): keep the old conservative 30s freshness rule.
+    if (Date.now() - c.ts < 30000) return Math.max(0, Math.round(c.ms));
+    return null;
+  } catch { return null; }
+}
+
+// ── Ghost paths (PostToolUse twin of guard.mjs) ──
+// The guard's PreToolUse hook blocks MUTATIONS to hidden paths; here we make
+// hidden paths invisible to READS and LISTINGS by rewriting the tool output the
+// model sees (Claude Code `updatedToolOutput`). The matcher below is mirrored
+// verbatim from guard.mjs — keep the two in sync. Config is read from the policy
+// cache the guard just wrote (same PreToolUse call), so no extra API request.
+function ghostGlobToRegExp(glob) {
+  let re = '';
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === '*') {
+      if (glob[i + 1] === '*') { re += '.*'; i++; }
+      else re += '[^/]*';
+    } else if (c === '?') re += '[^/]';
+    else if ('\\^$.|+()[]{}'.indexOf(c) !== -1) re += '\\' + c;
+    else re += c;
+  }
+  try { return new RegExp('^' + re + '$'); } catch { return null; }
+}
+function ghostMatch(targetPath, patterns) {
+  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
+  const norm = String(targetPath).replace(/\\/g, '/').replace(/\/+$/, '');
+  if (!norm) return false;
+  const segments = norm.split('/').filter(Boolean);
+  const base = segments.length ? segments[segments.length - 1] : norm;
+  for (let pat of patterns) {
+    pat = String(pat || '').trim();
+    if (!pat) continue;
+    let dirOnly = false;
+    if (pat.endsWith('/')) { dirOnly = true; pat = pat.slice(0, -1); }
+    if (!pat) continue;
+    const hasSlash = pat.indexOf('/') !== -1;
+    const hasWild = /[*?]/.test(pat);
+    const re = ghostGlobToRegExp(pat);
+    if (!re) continue;
+    if (dirOnly) {
+      if (!hasSlash && !hasWild) { if (segments.indexOf(pat) !== -1) return true; continue; }
+      let acc = '';
+      for (const s of segments) { acc = acc ? acc + '/' + s : s; if (re.test(acc) || re.test(s)) return true; }
+      continue;
+    }
+    if (!hasSlash) {
+      if (re.test(base)) return true;
+      if (segments.some((s) => re.test(s))) return true;
+      continue;
+    }
+    if (re.test(norm)) return true;
+  }
+  return false;
+}
+function ghostCleanToken(tok) {
+  let t = String(tok || '').trim();
+  t = t.replace(/^[<>|;&(]+/, '').replace(/[);&|]+$/, '');
+  t = t.replace(/^['"]+/, '').replace(/['"]+$/, '');
+  t = t.replace(/^\d*>>?/, '');
+  return t.trim();
+}
+// Drop listing lines that reference a ghost entry. `find`/glob output (one path
+// per line) drops the whole line; multi-column `ls -l` rows drop entirely; a
+// bare space-separated `ls` row drops only the matching names.
+function ghostStripLines(text, pats) {
+  const lines = String(text).split('\n');
+  const kept = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) { kept.push(line); continue; }
+    if (ghostMatch(trimmed, pats)) continue; // full-path listing line
+    const toks = trimmed.split(/\s+/);
+    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
+    if (!anyHit) { kept.push(line); continue; }
+    if (toks.length > 3) continue; // ls -l style row → drop entirely
+    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
+    if (remaining.length === 0) continue;
+    kept.push(remaining.join('  '));
+  }
+  return kept.join('\n');
+}
+// Read ghost patterns from the policy cache the guard wrote on the matching
+// PreToolUse call. Same agent-key derivation as guard.mjs.
+function loadGhostPatterns() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
+    if (!existsSync(f)) return [];
+    const c = JSON.parse(readFileSync(f, 'utf-8'));
+    const g = c && c.security && c.security.ghost;
+    return g && Array.isArray(g.patterns) ? g.patterns : [];
+  } catch { return []; }
+}
+// Returns the rewritten output text, or null if nothing is hidden.
+function buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, pats) {
+  if (!Array.isArray(pats) || pats.length === 0) return null;
+  const name = toolName || '';
+  // Use the SAME broad extraction as DLP redaction (Read file.content, array
+  // content, stdout, …). Previously this was narrower, so ghost-strip silently
+  // skipped tool shapes DLP still scanned — a ghosted file then survived in a
+  // listing (e.g. the LS tool) even though names elsewhere got redacted.
+  const getText = () => extractOutputText(toolResponse, toolOutput);
+  try {
+    // Direct read of a hidden file → looks like it doesn't exist.
+    if (name === 'Read' || name === 'NotebookRead') {
+      const p = toolInput && (toolInput.file_path || toolInput.notebook_path);
+      if (p && ghostMatch(p, pats)) return p + ': No such file or directory';
+      return null;
+    }
+    if (name === 'Bash' || name === 'BashOutput') {
+      const text = getText();
+      if (text == null) return null;
+      const cmd = String((toolInput && toolInput.command) || '');
+      for (const raw of cmd.split(/\s+/)) {
+        const t = ghostCleanToken(raw);
+        // A command that names the hidden path directly (cat A/Y/.data, ls A/Y)
+        // → not-found, regardless of what the command actually returned. Skip
+        // flags and any token carrying regex/shell metacharacters: the guard's
+        // PreToolUse listing rewrite injects a ghost REGEX (e.g.
+        // ")([^/]*ghosttest[^/]*)(/|$)") into the command, and tokenizing that
+        // would falsely "match" and emit a bogus not-found string as the result.
+        if (!t || t[0] === '-' || /[()|[\]^$*?]/.test(t)) continue;
+        if (ghostMatch(t, pats)) return t + ': No such file or directory';
+      }
+      const stripped = ghostStripLines(text, pats);
+      return stripped === text ? null : stripped;
+    }
+    // MCP filesystem direct reads → make a hidden file look absent, mirroring
+    // the native Read branch above (these never reach the Bash/LS branches).
+    if (name === 'mcp__filesystem__read_file' || name === 'mcp__filesystem__read_text_file' ||
+        name === 'mcp__filesystem__read_media_file' || name === 'mcp__filesystem__get_file_info') {
+      const p = toolInput && (toolInput.path || toolInput.file_path);
+      if (p && ghostMatch(p, pats)) return String(p) + ': No such file or directory';
+    }
+    // Every OTHER tool that returns listing-like text → strip hidden entries.
+    // Native Glob/Grep/LS plus any non-shell lister (MCP filesystem
+    // list_directory / directory_tree / search_files, and future tools). Bash
+    // listings are already covered above (and via the guard's PreToolUse command
+    // rewrite); this catch-all is the post-hoc safety net so a ghost entry can't
+    // survive in ANY listing shape — previously only the hard-coded
+    // Glob/Grep/LS names were stripped, so an MCP/unknown lister leaked it.
+    {
+      const text = getText();
+      if (text == null) return null;
+      const stripped = ghostStripLines(text, pats);
+      return stripped === text ? null : stripped;
+    }
+  } catch { /* fail open */ }
+  return null;
+}
+
+// ── DLP output redaction (PostToolUse) ──
+// Same family as ghost, but ghost hides files/dirs by PATH while this masks
+// secret VALUES inside the tool OUTPUT the model sees (file reads, stdout,
+// fetched pages). Active whenever DLP is on (detect OR block) — the server
+// delivers the enabled pattern set as `security.dlpRedact` in the policy cache.
+// Patterns mirror guard.mjs / apps/api/src/lib/security-layers.ts (global flag
+// so every occurrence is replaced). Scanning RAW output text (not JSON) means
+// the quote handling is exact — no escaping artifacts.
+const DLP_PATTERNS = [
+  { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/g },
+  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { name: 'Anthropic key', re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+  { name: 'OpenAI key', re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
+  { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
+  { name: 'GitHub fine-grained PAT', re: /github_pat_[A-Za-z0-9_]{20,}/g },
+  { name: 'GitLab token', re: /glpat-[A-Za-z0-9_-]{20,}/g },
+  { name: 'Slack token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+  { name: 'Stripe key', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
+  { name: 'SendGrid key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
+  { name: 'Twilio key', re: /SK[0-9a-fA-F]{32}/g },
+  { name: 'npm token', re: /npm_[A-Za-z0-9]{36}/g },
+  { name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+  { name: 'Bearer token', re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
+];
+
+// Read the redaction config the guard cached on the matching PreToolUse call.
+function loadDlpRedact() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
+    if (!existsSync(f)) return null;
+    const c = JSON.parse(readFileSync(f, 'utf-8'));
+    const d = c && c.security && c.security.dlpRedact;
+    return d && Array.isArray(d.patterns) ? d : null;
+  } catch { return null; }
+}
+
+// Local log storage: the user can opt to keep a full copy of every audit entry
+// in a file of their choosing (set from the dashboard survey / Settings, then
+// delivered to us via the same policy cache the guard writes). We append one
+// JSON object per line (JSONL) to that path. Fully local, best-effort, and
+// never blocks the tool call or the cloud audit POST.
+function loadLocalLogs() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
+    if (!existsSync(f)) return null;
+    const c = JSON.parse(readFileSync(f, 'utf-8'));
+    const l = c && c.security && c.security.localLogs;
+    if (l && l.enabled && typeof l.path === 'string' && l.path.trim()) return { path: l.path.trim() };
+    return null;
+  } catch { return null; }
+}
+
+// Resolve the FOLDER local logs may be written into. It MUST be absolute on
+// THIS machine. A relative path — e.g. a Windows "C:/Users/…" path evaluated on
+// Linux, where Node treats it as relative — would be created under the agent's
+// current working directory and pollute whatever project it happens to run in.
+// When the configured path isn't absolute here, fall back to a fixed home folder
+// so entries are never lost and never leak into a project, and record the bad
+// path so the dashboard/user can be told their path isn't valid on this device.
+function resolveLocalLogDir(rawPath) {
+  const dir = String(rawPath || '').trim().replace(/[\\/]+$/, '');
+  if (!dir) return null;
+  if (isAbsolute(dir)) return dir;
+  const fallback = resolve(homedir(), '.solongate', 'local-logs');
+  try {
+    mkdirSync(resolve(homedir(), '.solongate'), { recursive: true });
+    writeFileSync(resolve(homedir(), '.solongate', '.local-logs-invalid-path'),
+      JSON.stringify({ configured: dir, fallback, ts: Date.now() }));
+  } catch { /* ignore */ }
+  return fallback;
+}
+
+// The path is a FOLDER; we write solongate-audit.jsonl inside it (creating the
+// folder if missing), then append one JSON line.
+function appendLocalLog(cfg, entry) {
+  try {
+    const dir = resolveLocalLogDir(cfg.path);
+    if (!dir) return;
+    try { mkdirSync(dir, { recursive: true }); } catch { /* ignore */ }
+    appendFileSync(join(dir, 'solongate-audit.jsonl'), JSON.stringify(entry) + '\n');
+  } catch { /* best-effort: never disturb the tool call */ }
+}
+
+// Replace every secret match with a labelled placeholder. cfg = { patterns:
+// string[] (enabled built-in names), custom: {name,re}[] }.
+// Custom patterns are GLOBs: `*` = any run of non-whitespace (so a fragment
+// matches a whole token), same wildcard mechanic as policy/ghost.
+function dlpGlobToRe(glob, flags) {
+  let re = '';
+  for (const ch of String(glob || '')) {
+    if (ch === '*') re += '[^\\s]*';
+    else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
+    else re += ch;
+  }
+  return new RegExp(re, flags);
+}
+function dlpRedactText(text, cfg) {
+  if (!cfg || typeof text !== 'string' || !text) return text;
+  const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
+  let out = text;
+  for (const p of DLP_PATTERNS) {
+    if (allow.has(p.name)) out = out.replace(p.re, '[REDACTED:' + p.name + ']');
+  }
+  for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
+    try { out = out.replace(dlpGlobToRe(c.re, 'g'), '[REDACTED:' + (c.name || 'custom') + ']'); } catch { /* skip invalid */ }
+  }
+  return out;
+}
+
+// Best-effort extraction of the model-visible text from a tool_response. Shapes
+// are undocumented, so probe the known fields (Bash stdout, Read file.content,
+// string/array content) and fall back to a raw string output.
+function extractOutputText(toolResponse, toolOutput) {
+  const r = toolResponse;
+  if (typeof r === 'string') return r;
+  if (r && typeof r === 'object') {
+    if (typeof r.stdout === 'string' && r.stdout) return r.stdout;
+    if (typeof r.content === 'string' && r.content) return r.content;
+    if (r.file && typeof r.file.content === 'string') return r.file.content;
+    if (Array.isArray(r.content)) {
+      const t = r.content.filter((x) => x && x.type === 'text' && typeof x.text === 'string').map((x) => x.text).join('\n');
+      if (t) return t;
+    }
+    // Native Glob delivers its hits as a `filenames` string[] with NO stdout/
+    // content field, so getText() returned null and the ghost/DLP strip silently
+    // skipped it — a ghosted file then survived in the Glob listing the model saw
+    // (the exact leak: a `*ghosttest*` path showed up in a Glob result). Join to
+    // one-path-per-line so ghostStripLines/dlpRedactText can act on it; the
+    // PostToolUse updatedToolOutput then replaces the model-visible list.
+    if (Array.isArray(r.filenames)) {
+      const t = r.filenames.filter((x) => typeof x === 'string').join('\n');
+      if (t) return t;
+    }
+  }
+  if (typeof toolOutput === 'string' && toolOutput) return toolOutput;
+  return null;
+}
+
+function guessPermission(toolName) {
+  const name = (toolName || '').toLowerCase();
+  if (name.includes('exec') || name.includes('shell') || name.includes('run') || name.includes('eval') || name === 'bash') return 'EXECUTE';
+  if (name.includes('fetch') || name.includes('http') || name.includes('request') || name.includes('curl') || name.includes('network') || name.includes('download') || name.includes('upload') || name === 'websearch') return 'NETWORK';
+  if (name.includes('write') || name.includes('create') || name.includes('delete') || name.includes('update') || name.includes('set') || name.includes('edit') || name.includes('remove') || name.includes('insert')) return 'WRITE';
+  return 'READ';
+}
+
+const dotenv = loadEnvKey(process.cwd());
+const globalCfg = loadGlobalCloudConfig();
+const API_KEY = process.env.SOLONGATE_API_KEY || dotenv.SOLONGATE_API_KEY || globalCfg.apiKey || '';
+const API_URL = process.env.SOLONGATE_API_URL || dotenv.SOLONGATE_API_URL || globalCfg.apiUrl || 'https://api.solongate.com';
+
+// Agent identity from CLI args: node audit.mjs <agent_id> <agent_name>
+const AGENT_ID = process.argv[2] || 'claude-code';
+const AGENT_NAME = process.argv[3] || 'Claude Code';
+
+// Accept both live and test keys (test keys are used for trials / sandboxes).
+if (!API_KEY || !(API_KEY.startsWith('sg_live_') || API_KEY.startsWith('sg_test_'))) process.exit(0);
+
+let input = '';
+process.stdin.on('data', c => input += c);
+process.stdin.on('end', async () => {
+  try {
+    const data = JSON.parse(input);
+    let EMITTED_PAYLOAD = null;
+
+    // Debug: append raw stdin to file for agent detection troubleshooting.
+    // Opt-in (SOLONGATE_DEBUG) so a global hook doesn't litter every cwd.
+    if (process.env.SOLONGATE_DEBUG) {
+      try {
+        const debugLine = JSON.stringify({ ts: new Date().toISOString(), argv: process.argv.slice(2), tool_name: data.tool_name || data.toolName, agent_id: AGENT_ID }) + '\n';
+        const { appendFileSync: afs, mkdirSync: mds } = await import('node:fs');
+        mds(resolve('.solongate'), { recursive: true });
+        afs(resolve('.solongate', '.debug-audit-log'), debugLine);
+      } catch {}
+    }
+
+    let toolName = data.tool_name || data.toolName || '';
+    let toolInput = data.tool_input || data.toolInput || data.params || {};
+    if (!toolName) toolName = 'unknown';
+
+    if (toolName === 'Bash' && JSON.stringify(toolInput).includes('audit-logs')) {
+      process.exit(0);
+    }
+
+    // Check if guard.mjs already logged a DENY for this tool (avoid duplicate ALLOW after DENY)
+    let guardDenied = false;
+    try {
+      const denyFlagPath = resolve('.solongate', '.last-deny');
+      if (existsSync(denyFlagPath)) {
+        const flag = JSON.parse(readFileSync(denyFlagPath, 'utf-8'));
+        // If deny was recent (< 10s) and same tool, this postToolUse is a duplicate
+        if (flag.ts && Date.now() - flag.ts < 10000 && flag.tool === toolName) {
+          guardDenied = true;
+        }
+      }
+    } catch {}
+
+    const toolResponse = data.tool_response || data.toolResponse || {};
+    const toolOutput = data.tool_output || data.toolOutput || '';
+    const resultJson = data.result_json ? (typeof data.result_json === 'string' ? data.result_json : JSON.stringify(data.result_json)) : '';
+
+    // Ghost paths: rewrite the output the model sees so hidden files/dirs are
+    // stripped from listings and direct reads look like "no such file". Emit the
+    // updated output BEFORE the (fire-and-forget) audit log. Fail-open: any
+    // error leaves the original output untouched.
+    let ghostFired = false;
+    try {
+      const ghostPats = loadGhostPatterns();
+      const dlpCfg = loadDlpRedact();
+      const redactName = (s) => (dlpCfg && typeof s === 'string') ? dlpRedactText(s, dlpCfg) : s;
+
+      // Glob (and Grep in files mode) deliver a STRUCTURED result:
+      //   { filenames: string[], numFiles, truncated, totalMatches, ... }
+      // Claude Code REJECTS a plain-string updatedToolOutput for such a tool —
+      // it prints "PostToolUse:Glob hook warning" and keeps the ORIGINAL result,
+      // so the ghost entry leaks into the listing the model sees. The fix is to
+      // return the SAME shape: the filenames array with ghost entries dropped
+      // (and secret-looking names masked), preserving every other field.
+      if (toolResponse && typeof toolResponse === 'object' && Array.isArray(toolResponse.filenames)) {
+        const orig = toolResponse.filenames;
+        const kept = orig.filter((f) => !(ghostPats.length && ghostMatch(String(f), ghostPats)));
+        ghostFired = kept.length !== orig.length;
+        const masked = kept.map((f) => redactName(String(f)));
+        const changed = ghostFired || masked.some((f, i) => f !== String(kept[i]));
+        if (changed) {
+          const updated = { ...toolResponse, filenames: masked, numFiles: masked.length };
+          if (typeof toolResponse.totalMatches === 'number') updated.totalMatches = masked.length;
+          EMITTED_PAYLOAD = JSON.stringify({
+            hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: updated },
+          });
+        }
+      } else {
+        // String-output tools (Bash, Read, text Grep, MCP listers): strip ghost
+        // lines and redact secrets in the TEXT, return a STRING.
+        const ghostText = buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, ghostPats);
+        ghostFired = typeof ghostText === 'string';
+        let out = typeof ghostText === 'string' ? ghostText : null;
+        if (dlpCfg) {
+          const base = typeof ghostText === 'string' ? ghostText : extractOutputText(toolResponse, toolOutput);
+          if (typeof base === 'string') {
+            const redacted = dlpRedactText(base, dlpCfg);
+            if (redacted !== base || typeof ghostText === 'string') out = redacted;
+          }
+        }
+        if (typeof out === 'string') {
+          // Preserve the tool's result SHAPE. Bash and other tools deliver a
+          // STRUCTURED result ({ stdout, stderr, ... } or { content }); Claude
+          // Code rejects a bare-string replacement for those (hook warning) and
+          // keeps the original. Clone the object and swap its text field; only a
+          // genuinely string-typed result is replaced with a string.
+          const tr = toolResponse;
+          let updated;
+          if (tr && typeof tr === 'object' && typeof tr.stdout === 'string') updated = { ...tr, stdout: out };
+          else if (tr && typeof tr === 'object' && typeof tr.content === 'string') updated = { ...tr, content: out };
+          else if (tr && typeof tr === 'object' && Array.isArray(tr.content)) updated = { ...tr, content: [{ type: 'text', text: out }] };
+          else updated = out;
+          EMITTED_PAYLOAD = JSON.stringify({
+            hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: updated },
+          });
+        }
+      }
+    } catch {}
+
+    const hasError = guardDenied ||
+      toolResponse.error ||
+      toolResponse.exitCode > 0 ||
+      toolResponse.isError ||
+      (toolOutput && typeof toolOutput === 'string' && toolOutput.includes('"error"')) ||
+      (resultJson && resultJson.includes('"error"'));
+
+    // Keep the full command/args for audit review (the dashboard shows them in
+    // the detail view). Only cap pathologically large values.
+    const argsSummary = {};
+    for (const [k, v] of Object.entries(toolInput)) {
+      argsSummary[k] = typeof v === 'string' && v.length > 8000
+        ? v.slice(0, 8000) + '…'
+        : v;
+    }
+
+    // Write flag so stop.mjs knows tool calls happened (skip text-only ALLOW)
+    try {
+      const flagDir = resolve('.solongate');
+      mkdirSync(flagDir, { recursive: true });
+      writeFileSync(join(flagDir, '.last-tool-call'), Date.now().toString());
+    } catch {}
+
+    // Flush the model-visible replacement to stdout, THEN exit. On Windows a
+    // bare process.exit() can truncate an un-drained pipe write, so Claude Code
+    // receives malformed hook JSON, prints "PostToolUse hook warning", and
+    // DISCARDS the replacement — leaving the ghost entry visible. Gate the exit
+    // on the write's flush callback (and on the fire-and-forget audit POST).
+    let flushed = (typeof EMITTED_PAYLOAD !== 'string');
+    let fetchDone = false;
+    const maybeExit = () => { if (flushed && fetchDone) process.exit(0); };
+    if (typeof EMITTED_PAYLOAD === 'string') {
+      try { process.stdout.write(EMITTED_PAYLOAD, () => { flushed = true; maybeExit(); }); }
+      catch { flushed = true; }
+    }
+
+    const sessionId = data.session_id || data.sessionId || data.conversation_id || '';
+    const decision = hasError ? 'DENY' : 'ALLOW';
+    const reason = guardDenied ? 'blocked by policy guard' : hasError ? 'tool returned error' : ghostFired ? 'ghost path (hidden from agent)' : 'allowed';
+    const permission = guessPermission(toolName);
+    const evaluationTimeMs = readLastEvalMs(toolName, sessionId);
+
+    // Local log storage (opt-in): when ON, logs are kept LOCAL ONLY — we append
+    // this entry to the user's chosen file and do NOT send it to the cloud.
+    const localLogs = loadLocalLogs();
+    if (localLogs) {
+      appendLocalLog(localLogs, {
+        ts: new Date().toISOString(),
+        tool: toolName, arguments: argsSummary, decision, reason, permission,
+        evaluation_time_ms: evaluationTimeMs, agent_id: AGENT_ID, agent_name: AGENT_NAME, session_id: sessionId,
+      });
+      fetchDone = true;
+      maybeExit();
+    } else {
+      // Fire-and-forget: don't block tool execution waiting for API response
+      fetch(`${API_URL}/api/v1/audit-logs`, {
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${API_KEY}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          tool: toolName,
+          arguments: argsSummary,
+          // Ghost-on-a-listing is NOT a denial: the call was ALLOWED and succeeded,
+          // we just hid ghost entries from its result. Log it as ALLOW but carry the
+          // ghost reason so the dashboard can badge it Ghost (the allow-side twin of
+          // the guard's DENY+Ghost for a direct ghost hit). Real denials stay DENY.
+          decision,
+          reason,
+          permission,
+          source: `${AGENT_ID}-hook`,
+          evaluationTimeMs,
+          agent_id: AGENT_ID,
+          agent_name: AGENT_NAME,
+          session_id: sessionId,
+        }),
+        signal: AbortSignal.timeout(5000),
+      }).catch(() => {}).finally(() => { fetchDone = true; maybeExit(); });
+    }
+    // Hard backstop: exit even if the write callback or fetch never settles.
+    setTimeout(() => process.exit(0), 3000);
+  } catch {
+    process.exit(0);
+  }
+});