@solongate/proxy 0.6.2 → 0.6.4

package/dist/index.js

@@ -985,17 +985,13 @@ function matchGlob(str, pattern) {
 
 // \u2500\u2500 Path Glob (supports **) \u2500\u2500
 function matchPathGlob(path, pattern) {
-  const p = path.replace(/\\\\\\\\/g, '/').toLowerCase();
-  const g = pattern.replace(/\\\\\\\\/g, '/').toLowerCase();
+  const p = path.replace(/\\\\/g, '/').toLowerCase();
+  const g = pattern.replace(/\\\\/g, '/').toLowerCase();
   if (p === g) return true;
   if (g.includes('**')) {
-    const parts = g.split('**');
-    if (parts.length === 2) {
-      const [pre, suf] = parts;
-      const matchPre = !pre || p.startsWith(pre) || p.includes(pre);
-      const matchSuf = !suf || p.endsWith(suf) || p.includes(suf.slice(1));
-      return matchPre && matchSuf;
-    }
+    const parts = g.split('**').filter(s => s.length > 0);
+    if (parts.length === 0) return true; // just ** or ****
+    return parts.every(segment => p.includes(segment));
   }
   return matchGlob(p, g);
 }
@@ -1024,14 +1020,14 @@ function extractFilenames(args) {
   for (const s of scanStrings(args)) {
     if (/^https?:\\/\\//i.test(s)) continue;
     if (s.includes('/') || s.includes('\\\\')) {
-      const base = s.replace(/\\\\\\\\/g, '/').split('/').pop();
+      const base = s.replace(/\\\\/g, '/').split('/').pop();
       if (base) names.add(base);
       continue;
     }
     if (s.includes(' ')) {
       for (const tok of s.split(/\\s+/)) {
         if (tok.includes('/') || tok.includes('\\\\')) {
-          const b = tok.replace(/\\\\\\\\/g, '/').split('/').pop();
+          const b = tok.replace(/\\\\/g, '/').split('/').pop();
           if (b && looksLikeFilename(b)) names.add(b);
         } else if (looksLikeFilename(tok)) names.add(tok);
       }
@@ -1060,7 +1056,13 @@ function extractCommands(args) {
   const fields = ['command', 'cmd', 'function', 'script', 'shell'];
   if (typeof args === 'object' && args) {
     for (const [k, v] of Object.entries(args)) {
-      if (fields.includes(k.toLowerCase()) && typeof v === 'string') cmds.push(v);
+      if (fields.includes(k.toLowerCase()) && typeof v === 'string') {
+        // Split chained commands: cd /path && npm install \u2192 [cd /path, npm install]
+        for (const part of v.split(/\\s*(?:&&|\\|\\||;|\\|)\\s*/)) {
+          const trimmed = part.trim();
+          if (trimmed) cmds.push(trimmed);
+        }
+      }
     }
   }
   return cmds;
@@ -1132,7 +1134,7 @@ process.stdin.on('end', async () => {
     const args = data.tool_input || {};
 
     // \u2500\u2500 Self-protection: block access to hook files and settings \u2500\u2500
-    const allStrings = scanStrings(args).map(s => s.replace(/\\\\\\\\/g, '/').toLowerCase());
+    const allStrings = scanStrings(args).map(s => s.replace(/\\\\/g, '/').toLowerCase());
     const protectedPaths = ['.solongate', '.claude/settings.json', '.cursor/settings.json', 'policy.json'];
     for (const s of allStrings) {
       for (const p of protectedPaths) {
@@ -1144,10 +1146,12 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // Load policy
+    // Load policy (use cwd from hook data if available)
+    const hookCwd = data.cwd || process.cwd();
     let policy;
     try {
-      policy = JSON.parse(readFileSync(resolve('policy.json'), 'utf-8'));
+      const policyPath = resolve(hookCwd, 'policy.json');
+      policy = JSON.parse(readFileSync(policyPath, 'utf-8'));
     } catch {
       process.exit(0); // No policy = allow all
     }

package/dist/init.js

@@ -174,17 +174,13 @@ function matchGlob(str, pattern) {
 
 // \u2500\u2500 Path Glob (supports **) \u2500\u2500
 function matchPathGlob(path, pattern) {
-  const p = path.replace(/\\\\\\\\/g, '/').toLowerCase();
-  const g = pattern.replace(/\\\\\\\\/g, '/').toLowerCase();
+  const p = path.replace(/\\\\/g, '/').toLowerCase();
+  const g = pattern.replace(/\\\\/g, '/').toLowerCase();
   if (p === g) return true;
   if (g.includes('**')) {
-    const parts = g.split('**');
-    if (parts.length === 2) {
-      const [pre, suf] = parts;
-      const matchPre = !pre || p.startsWith(pre) || p.includes(pre);
-      const matchSuf = !suf || p.endsWith(suf) || p.includes(suf.slice(1));
-      return matchPre && matchSuf;
-    }
+    const parts = g.split('**').filter(s => s.length > 0);
+    if (parts.length === 0) return true; // just ** or ****
+    return parts.every(segment => p.includes(segment));
   }
   return matchGlob(p, g);
 }
@@ -213,14 +209,14 @@ function extractFilenames(args) {
   for (const s of scanStrings(args)) {
     if (/^https?:\\/\\//i.test(s)) continue;
     if (s.includes('/') || s.includes('\\\\')) {
-      const base = s.replace(/\\\\\\\\/g, '/').split('/').pop();
+      const base = s.replace(/\\\\/g, '/').split('/').pop();
       if (base) names.add(base);
       continue;
     }
     if (s.includes(' ')) {
       for (const tok of s.split(/\\s+/)) {
         if (tok.includes('/') || tok.includes('\\\\')) {
-          const b = tok.replace(/\\\\\\\\/g, '/').split('/').pop();
+          const b = tok.replace(/\\\\/g, '/').split('/').pop();
           if (b && looksLikeFilename(b)) names.add(b);
         } else if (looksLikeFilename(tok)) names.add(tok);
       }
@@ -249,7 +245,13 @@ function extractCommands(args) {
   const fields = ['command', 'cmd', 'function', 'script', 'shell'];
   if (typeof args === 'object' && args) {
     for (const [k, v] of Object.entries(args)) {
-      if (fields.includes(k.toLowerCase()) && typeof v === 'string') cmds.push(v);
+      if (fields.includes(k.toLowerCase()) && typeof v === 'string') {
+        // Split chained commands: cd /path && npm install \u2192 [cd /path, npm install]
+        for (const part of v.split(/\\s*(?:&&|\\|\\||;|\\|)\\s*/)) {
+          const trimmed = part.trim();
+          if (trimmed) cmds.push(trimmed);
+        }
+      }
     }
   }
   return cmds;
@@ -321,7 +323,7 @@ process.stdin.on('end', async () => {
     const args = data.tool_input || {};
 
     // \u2500\u2500 Self-protection: block access to hook files and settings \u2500\u2500
-    const allStrings = scanStrings(args).map(s => s.replace(/\\\\\\\\/g, '/').toLowerCase());
+    const allStrings = scanStrings(args).map(s => s.replace(/\\\\/g, '/').toLowerCase());
     const protectedPaths = ['.solongate', '.claude/settings.json', '.cursor/settings.json', 'policy.json'];
     for (const s of allStrings) {
       for (const p of protectedPaths) {
@@ -333,10 +335,12 @@ process.stdin.on('end', async () => {
       }
     }
 
-    // Load policy
+    // Load policy (use cwd from hook data if available)
+    const hookCwd = data.cwd || process.cwd();
     let policy;
     try {
-      policy = JSON.parse(readFileSync(resolve('policy.json'), 'utf-8'));
+      const policyPath = resolve(hookCwd, 'policy.json');
+      policy = JSON.parse(readFileSync(policyPath, 'utf-8'));
     } catch {
       process.exit(0); // No policy = allow all
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {