@solongate/proxy 0.81.11 → 0.81.13

package/dist/index.js

@@ -10923,15 +10923,18 @@ function dlpGlobToRe(glob, flags) {
 function redactString(s, cfg) {
   if (!cfg || typeof s !== "string" || !s) return s;
   const allow = new Set(cfg.patterns);
+  const NUL = String.fromCharCode(0);
+  const labels = [];
+  const stash = (label) => NUL + (labels.push(label) - 1) + NUL;
   let out2 = s;
-  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out2 = out2.replace(p.re, `[REDACTED: ${p.name}]`);
+  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out2 = out2.replace(p.re, () => stash(`[REDACTED: ${p.name}]`));
   for (const c2 of cfg.custom) {
     try {
-      out2 = out2.replace(dlpGlobToRe(c2.re, "g"), `[REDACTED: ${c2.name || "custom"}]`);
+      out2 = out2.replace(dlpGlobToRe(c2.re, "gi"), () => stash(`[REDACTED: ${c2.name || "custom"}]`));
     } catch {
     }
   }
-  return out2;
+  return out2.replace(new RegExp(NUL + "(\\d+)" + NUL, "g"), (_, i) => labels[+i] || "");
 }
 function redactDeep(value, cfg) {
   const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
@@ -10960,9 +10963,9 @@ function pickUpstream() {
   }
 }
 function startProxy(upstream) {
-  const cfg = loadCfg();
   const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
   const server = createServer((req, res) => {
+    const cfg = loadCfg();
     const chunks = [];
     req.on("data", (c2) => chunks.push(c2));
     req.on("end", () => {

package/dist/shield.js

@@ -164,15 +164,18 @@ function dlpGlobToRe(glob, flags) {
 function redactString(s, cfg) {
   if (!cfg || typeof s !== "string" || !s) return s;
   const allow = new Set(cfg.patterns);
+  const NUL = String.fromCharCode(0);
+  const labels = [];
+  const stash = (label) => NUL + (labels.push(label) - 1) + NUL;
   let out = s;
-  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
+  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, () => stash(`[REDACTED: ${p.name}]`));
   for (const c of cfg.custom) {
     try {
-      out = out.replace(dlpGlobToRe(c.re, "g"), `[REDACTED: ${c.name || "custom"}]`);
+      out = out.replace(dlpGlobToRe(c.re, "gi"), () => stash(`[REDACTED: ${c.name || "custom"}]`));
     } catch {
     }
   }
-  return out;
+  return out.replace(new RegExp(NUL + "(\\d+)" + NUL, "g"), (_, i) => labels[+i] || "");
 }
 function redactDeep(value, cfg) {
   const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
@@ -201,9 +204,9 @@ function pickUpstream() {
   }
 }
 function startProxy(upstream) {
-  const cfg = loadCfg();
   const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
   const server = createServer((req, res) => {
+    const cfg = loadCfg();
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {

package/hooks/audit.mjs

@@ -330,16 +330,19 @@ function dlpGlobToRe(glob, flags) {
   return new RegExp(re, flags);
 }
 function dlpRedactText(text, cfg) {
-  if (!cfg || typeof text !== 'string' || !text) return text;
+  if (!cfg || typeof text !== "string" || !text) return text;
   const allow = new Set(Array.isArray(cfg.patterns) ? cfg.patterns : []);
+  const NUL = String.fromCharCode(0);
+  const labels = [];
+  const stash = (label) => NUL + (labels.push(label) - 1) + NUL;
   let out = text;
   for (const p of DLP_PATTERNS) {
-    if (allow.has(p.name)) out = out.replace(p.re, '[REDACTED:' + p.name + ']');
+    if (allow.has(p.name)) out = out.replace(p.re, () => stash("[REDACTED:" + p.name + "]"));
   }
   for (const c of Array.isArray(cfg.custom) ? cfg.custom : []) {
-    try { out = out.replace(dlpGlobToRe(c.re, 'g'), '[REDACTED:' + (c.name || 'custom') + ']'); } catch { /* skip invalid */ }
+    try { out = out.replace(dlpGlobToRe(c.re, "gi"), () => stash("[REDACTED:" + (c.name || "custom") + "]")); } catch {}
   }
-  return out;
+  return out.replace(new RegExp(NUL + "(\\d+)" + NUL, "g"), (_, i) => labels[+i] || "");
 }
 
 // Best-effort extraction of the model-visible text from a tool_response. Shapes

package/hooks/guard.bundled.mjs

@@ -7159,7 +7159,7 @@ function dlpGlobToRe(glob) {
     else
       re += ch;
   }
-  return new RegExp(re);
+  return new RegExp(re, "i");
 }
 function dlpScan(args, cfg) {
   if (!cfg)

package/hooks/guard.mjs

@@ -834,7 +834,7 @@ function dlpGlobToRe(glob) {
     else if ('.+?^${}()|[]\\'.indexOf(ch) !== -1) re += '\\' + ch;
     else re += ch;
   }
-  return new RegExp(re);
+  return new RegExp(re, 'i');
 }
 // Scan args against the enabled built-in patterns + any user custom patterns.
 // `cfg` = { patterns: string[], custom: {name,re}[] }.

package/hooks/shield.mjs

@@ -171,14 +171,17 @@ function dlpGlobToRe(glob, flags) {
   return new RegExp(re, flags);
 }
 function redactString(s, cfg) {
-  if (!cfg || typeof s !== 'string' || !s) return s;
+  if (!cfg || typeof s !== "string" || !s) return s;
   const allow = new Set(cfg.patterns);
+  const NUL = String.fromCharCode(0);
+  const labels = [];
+  const stash = (label) => NUL + (labels.push(label) - 1) + NUL;
   let out = s;
-  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
+  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, () => stash(`[REDACTED: ${p.name}]`));
   for (const c of cfg.custom) {
-    try { out = out.replace(dlpGlobToRe(c.re, 'g'), `[REDACTED: ${c.name || 'custom'}]`); } catch { /* skip */ }
+    try { out = out.replace(dlpGlobToRe(c.re, "gi"), () => stash(`[REDACTED: ${c.name || "custom"}]`)); } catch {}
   }
-  return out;
+  return out.replace(new RegExp(NUL + "(\\d+)" + NUL, "g"), (_, i) => labels[+i] || "");
 }
 
 function redactDeep(value, cfg) {
@@ -210,9 +213,13 @@ function pickUpstream() {
 }
 
 function startProxy(upstream) {
-  const cfg = loadCfg();
   const forward = upstream.protocol === 'https:' ? httpsRequest : httpRequest;
   const server = createServer((req, res) => {
+    // Re-read the DLP config on every request (cheap: a small JSON) so changing
+    // DLP mode / patterns in the dashboard takes effect WITHOUT restarting claude —
+    // the guard rewrites this cache within ~one call, matching how the audit hook
+    // already re-reads per call. Loading once at startup left the shield stale.
+    const cfg = loadCfg();
     const chunks = [];
     req.on('data', (c) => chunks.push(c));
     req.on('end', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.11",
+  "version": "0.81.13",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {