@solongate/proxy 0.81.10 → 0.81.12

package/dist/index.js

@@ -10927,7 +10927,7 @@ function redactString(s, cfg) {
   for (const p of DLP_PATTERNS) if (allow.has(p.name)) out2 = out2.replace(p.re, `[REDACTED: ${p.name}]`);
   for (const c2 of cfg.custom) {
     try {
-      out2 = out2.replace(dlpGlobToRe(c2.re, "g"), `[REDACTED: ${c2.name || "custom"}]`);
+      out2 = out2.replace(dlpGlobToRe(c2.re, "gi"), `[REDACTED: ${c2.name || "custom"}]`);
     } catch {
     }
   }
@@ -10960,9 +10960,9 @@ function pickUpstream() {
   }
 }
 function startProxy(upstream) {
-  const cfg = loadCfg();
   const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
   const server = createServer((req, res) => {
+    const cfg = loadCfg();
     const chunks = [];
     req.on("data", (c2) => chunks.push(c2));
     req.on("end", () => {
@@ -11072,7 +11072,7 @@ var init_shield = __esm({
 `);
     DLP_PATTERNS = [
       { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },
-      { name: "private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+      { name: "Private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
       { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
       { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
       { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },

package/dist/shield.js

@@ -10,7 +10,7 @@ var log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).joi
 `);
 var DLP_PATTERNS = [
   { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },
-  { name: "private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { name: "Private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
   { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
   { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
   { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
@@ -168,7 +168,7 @@ function redactString(s, cfg) {
   for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
   for (const c of cfg.custom) {
     try {
-      out = out.replace(dlpGlobToRe(c.re, "g"), `[REDACTED: ${c.name || "custom"}]`);
+      out = out.replace(dlpGlobToRe(c.re, "gi"), `[REDACTED: ${c.name || "custom"}]`);
     } catch {
     }
   }
@@ -201,9 +201,9 @@ function pickUpstream() {
   }
 }
 function startProxy(upstream) {
-  const cfg = loadCfg();
   const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
   const server = createServer((req, res) => {
+    const cfg = loadCfg();
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {

package/hooks/audit.mjs

@@ -241,7 +241,7 @@ function buildGhostOutput(toolName, toolInput, toolResponse, toolOutput, pats) {
 // the quote handling is exact — no escaping artifacts.
 const DLP_PATTERNS = [
   { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/g },
-  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { name: 'Private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
   { name: 'Anthropic key', re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
   { name: 'OpenAI key', re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
   { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
@@ -337,7 +337,7 @@ function dlpRedactText(text, cfg) {
     if (allow.has(p.name)) out = out.replace(p.re, '[REDACTED:' + p.name + ']');
   }
   for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
-    try { out = out.replace(dlpGlobToRe(c.re, 'g'), '[REDACTED:' + (c.name || 'custom') + ']'); } catch { /* skip invalid */ }
+    try { out = out.replace(dlpGlobToRe(c.re, 'gi'), '[REDACTED:' + (c.name || 'custom') + ']'); } catch { /* skip invalid */ }
   }
   return out;
 }

package/hooks/guard.bundled.mjs

@@ -7135,7 +7135,7 @@ function tamperCheck(toolName, args) {
 }
 var DLP_PATTERNS = [
   { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/ },
-  { name: "private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "Private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
   { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/ },
   { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/ },
   { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
@@ -7159,7 +7159,7 @@ function dlpGlobToRe(glob) {
     else
       re += ch;
   }
-  return new RegExp(re);
+  return new RegExp(re, "i");
 }
 function dlpScan(args, cfg) {
   if (!cfg)

package/hooks/guard.mjs

@@ -810,7 +810,7 @@ function tamperCheck(toolName, args) {
 // rules plus generic Bearer / secret-assignment catch-alls for the long tail.
 const DLP_PATTERNS = [
   { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/ },
-  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: 'Private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
   { name: 'Anthropic key', re: /sk-ant-[A-Za-z0-9_-]{20,}/ },
   { name: 'OpenAI key', re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/ },
   { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
@@ -834,7 +834,7 @@ function dlpGlobToRe(glob) {
     else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
     else re += ch;
   }
-  return new RegExp(re);
+  return new RegExp(re, 'i');
 }
 // Scan args against the enabled built-in patterns + any user custom patterns.
 // `cfg` = { patterns: string[], custom: {name,re}[] }.

package/hooks/shield.mjs

@@ -29,7 +29,7 @@ const log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).j
 
 const DLP_PATTERNS = [
   { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/g },
-  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { name: 'Private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
   { name: 'Anthropic key', re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
   { name: 'OpenAI key', re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
   { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
@@ -176,7 +176,7 @@ function redactString(s, cfg) {
   let out = s;
   for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
   for (const c of cfg.custom) {
-    try { out = out.replace(dlpGlobToRe(c.re, 'g'), `[REDACTED: ${c.name || 'custom'}]`); } catch { /* skip */ }
+    try { out = out.replace(dlpGlobToRe(c.re, 'gi'), `[REDACTED: ${c.name || 'custom'}]`); } catch { /* skip */ }
   }
   return out;
 }
@@ -210,9 +210,13 @@ function pickUpstream() {
 }
 
 function startProxy(upstream) {
-  const cfg = loadCfg();
   const forward = upstream.protocol === 'https:' ? httpsRequest : httpRequest;
   const server = createServer((req, res) => {
+    // Re-read the DLP config on every request (cheap: a small JSON) so changing
+    // DLP mode / patterns in the dashboard takes effect WITHOUT restarting claude —
+    // the guard rewrites this cache within ~one call, matching how the audit hook
+    // already re-reads per call. Loading once at startup left the shield stale.
+    const cfg = loadCfg();
     const chunks = [];
     req.on('data', (c) => chunks.push(c));
     req.on('end', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.10",
+  "version": "0.81.12",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {