@solongate/proxy 0.6.2 → 0.6.3

package/dist/index.js

@@ -985,17 +985,13 @@ function matchGlob(str, pattern) {
 
 // \u2500\u2500 Path Glob (supports **) \u2500\u2500
 function matchPathGlob(path, pattern) {
-  const p = path.replace(/\\\\\\\\/g, '/').toLowerCase();
-  const g = pattern.replace(/\\\\\\\\/g, '/').toLowerCase();
+  const p = path.replace(/\\\\/g, '/').toLowerCase();
+  const g = pattern.replace(/\\\\/g, '/').toLowerCase();
   if (p === g) return true;
   if (g.includes('**')) {
-    const parts = g.split('**');
-    if (parts.length === 2) {
-      const [pre, suf] = parts;
-      const matchPre = !pre || p.startsWith(pre) || p.includes(pre);
-      const matchSuf = !suf || p.endsWith(suf) || p.includes(suf.slice(1));
-      return matchPre && matchSuf;
-    }
+    const parts = g.split('**').filter(s => s.length > 0);
+    if (parts.length === 0) return true; // just ** or ****
+    return parts.every(segment => p.includes(segment));
   }
   return matchGlob(p, g);
 }
@@ -1024,14 +1020,14 @@ function extractFilenames(args) {
   for (const s of scanStrings(args)) {
     if (/^https?:\\/\\//i.test(s)) continue;
     if (s.includes('/') || s.includes('\\\\')) {
-      const base = s.replace(/\\\\\\\\/g, '/').split('/').pop();
+      const base = s.replace(/\\\\/g, '/').split('/').pop();
       if (base) names.add(base);
       continue;
     }
     if (s.includes(' ')) {
       for (const tok of s.split(/\\s+/)) {
         if (tok.includes('/') || tok.includes('\\\\')) {
-          const b = tok.replace(/\\\\\\\\/g, '/').split('/').pop();
+          const b = tok.replace(/\\\\/g, '/').split('/').pop();
           if (b && looksLikeFilename(b)) names.add(b);
         } else if (looksLikeFilename(tok)) names.add(tok);
       }
@@ -1132,7 +1128,7 @@ process.stdin.on('end', async () => {
     const args = data.tool_input || {};
 
     // \u2500\u2500 Self-protection: block access to hook files and settings \u2500\u2500
-    const allStrings = scanStrings(args).map(s => s.replace(/\\\\\\\\/g, '/').toLowerCase());
+    const allStrings = scanStrings(args).map(s => s.replace(/\\\\/g, '/').toLowerCase());
     const protectedPaths = ['.solongate', '.claude/settings.json', '.cursor/settings.json', 'policy.json'];
     for (const s of allStrings) {
       for (const p of protectedPaths) {
@@ -1144,10 +1140,12 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // Load policy
+    // Load policy (use cwd from hook data if available)
+    const hookCwd = data.cwd || process.cwd();
     let policy;
     try {
-      policy = JSON.parse(readFileSync(resolve('policy.json'), 'utf-8'));
+      const policyPath = resolve(hookCwd, 'policy.json');
+      policy = JSON.parse(readFileSync(policyPath, 'utf-8'));
     } catch {
       process.exit(0); // No policy = allow all
     }

package/dist/init.js

@@ -174,17 +174,13 @@ function matchGlob(str, pattern) {
 
 // \u2500\u2500 Path Glob (supports **) \u2500\u2500
 function matchPathGlob(path, pattern) {
-  const p = path.replace(/\\\\\\\\/g, '/').toLowerCase();
-  const g = pattern.replace(/\\\\\\\\/g, '/').toLowerCase();
+  const p = path.replace(/\\\\/g, '/').toLowerCase();
+  const g = pattern.replace(/\\\\/g, '/').toLowerCase();
   if (p === g) return true;
   if (g.includes('**')) {
-    const parts = g.split('**');
-    if (parts.length === 2) {
-      const [pre, suf] = parts;
-      const matchPre = !pre || p.startsWith(pre) || p.includes(pre);
-      const matchSuf = !suf || p.endsWith(suf) || p.includes(suf.slice(1));
-      return matchPre && matchSuf;
-    }
+    const parts = g.split('**').filter(s => s.length > 0);
+    if (parts.length === 0) return true; // just ** or ****
+    return parts.every(segment => p.includes(segment));
   }
   return matchGlob(p, g);
 }
@@ -213,14 +209,14 @@ function extractFilenames(args) {
   for (const s of scanStrings(args)) {
     if (/^https?:\\/\\//i.test(s)) continue;
     if (s.includes('/') || s.includes('\\\\')) {
-      const base = s.replace(/\\\\\\\\/g, '/').split('/').pop();
+      const base = s.replace(/\\\\/g, '/').split('/').pop();
       if (base) names.add(base);
       continue;
     }
     if (s.includes(' ')) {
       for (const tok of s.split(/\\s+/)) {
         if (tok.includes('/') || tok.includes('\\\\')) {
-          const b = tok.replace(/\\\\\\\\/g, '/').split('/').pop();
+          const b = tok.replace(/\\\\/g, '/').split('/').pop();
           if (b && looksLikeFilename(b)) names.add(b);
         } else if (looksLikeFilename(tok)) names.add(tok);
       }
@@ -321,7 +317,7 @@ process.stdin.on('end', async () => {
     const args = data.tool_input || {};
 
     // \u2500\u2500 Self-protection: block access to hook files and settings \u2500\u2500
-    const allStrings = scanStrings(args).map(s => s.replace(/\\\\\\\\/g, '/').toLowerCase());
+    const allStrings = scanStrings(args).map(s => s.replace(/\\\\/g, '/').toLowerCase());
     const protectedPaths = ['.solongate', '.claude/settings.json', '.cursor/settings.json', 'policy.json'];
     for (const s of allStrings) {
       for (const p of protectedPaths) {
@@ -333,10 +329,12 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // Load policy
+    // Load policy (use cwd from hook data if available)
+    const hookCwd = data.cwd || process.cwd();
     let policy;
     try {
-      policy = JSON.parse(readFileSync(resolve('policy.json'), 'utf-8'));
+      const policyPath = resolve(hookCwd, 'policy.json');
+      policy = JSON.parse(readFileSync(policyPath, 'utf-8'));
     } catch {
       process.exit(0); // No policy = allow all
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {