@solongate/proxy 0.81.33 → 0.81.34

package/hooks/.solongate/.eval-ring.jsonl

@@ -2,3 +2,7 @@
 {"ms":4,"ts":1784136544239,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}
 {"ms":2,"ts":1784136555335,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}
 {"ms":4,"ts":1784136601528,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}
+{"ms":2,"ts":1784137482457,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}
+{"ms":4,"ts":1784137524268,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}
+{"ms":5,"ts":1784138159970,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}
+{"ms":2,"ts":1784138167398,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}

package/hooks/.solongate/.last-deny

@@ -1 +1 @@
-{"tool":"Bash","ts":1784136546307}
+{"tool":"Bash","ts":1784138162061}

package/hooks/.solongate/.last-eval

@@ -1 +1 @@
-{"ms":4,"ts":1784136601528,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}
+{"ms":2,"ts":1784138167398,"tool":"Bash","session":"4aefeb66-3bff-4335-b710-e4f70d3adadf"}

package/hooks/.solongate/.last-tool-call

@@ -1 +1 @@
-1784136557479
+1784138162060

package/hooks/audit.mjs

@@ -8,10 +8,10 @@ import { readFileSync, existsSync, writeFileSync, mkdirSync, appendFileSync } fr
 import { resolve, join, isAbsolute } from 'node:path';
 import { homedir } from 'node:os';
 
-// Bump on every audit.mjs change. The cloud serves the newest version; the guard
+// Bump on every audit hook change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 15;
+const HOOK_VERSION = 16;
 
 function loadEnvKey(dir) {
   try {
@@ -268,6 +268,81 @@ function loadDlpRedact() {
   } catch { return null; }
 }
 
+// ── DETECT-mode observation ──
+// In DETECT mode the guard doesn't block (and doesn't log) — the call is ALLOWED
+// and reaches THIS PostToolUse hook. To make "detect" mean observe-AND-record
+// (not silent), we scan the ARGUMENTS for DLP hits and flag rate-limit bursts
+// here, on the ALLOW entry. Block-mode hits are DENIED upstream and carry their
+// own reason, so this only fires for detect-mode ALLOWs. Everything is wrapped
+// fail-safe: any error just omits the field.
+
+// Which DLP patterns match the stringified tool arguments (uses the enabled set
+// the guard cached; block+detect both populate dlpRedact). Names only.
+function dlpScanArgs(argsSummary, dlpCfg) {
+  try {
+    if (!dlpCfg || !Array.isArray(dlpCfg.patterns) || !dlpCfg.patterns.length) return [];
+    const text = typeof argsSummary === 'string' ? argsSummary : JSON.stringify(argsSummary || {});
+    if (!text) return [];
+    const enabled = new Set(dlpCfg.patterns);
+    const hits = [];
+    for (const p of DLP_PATTERNS) {
+      if (!enabled.has(p.name)) continue;
+      try { p.re.lastIndex = 0; if (p.re.test(text)) hits.push(p.name); } catch { /* skip */ }
+      if (hits.length >= 5) break;
+    }
+    for (const c of (dlpCfg.custom || [])) {
+      try { if (c && c.re && dlpGlobToRe(c.re, 'gi').test(text)) hits.push(c.name || 'custom'); } catch { /* skip */ }
+      if (hits.length >= 5) break;
+    }
+    return hits;
+  } catch { return []; }
+}
+
+// Detect-mode rate-limit config (delivered only when mode === 'detect').
+function loadRateLimitObserve() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || process.argv[2] || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const f = resolve(homedir(), '.solongate', '.policy-cache-' + sel + '.json');
+    if (!existsSync(f)) return null;
+    const c = JSON.parse(readFileSync(f, 'utf-8'));
+    const r = c && c.security && c.security.rateLimitObserve;
+    return r && typeof r === 'object' ? r : null;
+  } catch { return null; }
+}
+
+// Sliding-window burst check for DETECT mode. Uses a SEPARATE stamps file from
+// the guard's enforcement file so observation never interferes with blocking.
+// Returns true when this call is at/over an enabled window's limit.
+function rateLimitObserveBurst(agentKey, limits) {
+  try {
+    if (!limits) return false;
+    const key = String(agentKey || 'default').replace(/[^a-zA-Z0-9_-]/g, '_');
+    const file = resolve(homedir(), '.solongate', '.ratelimit-observe-' + key + '.json');
+    const now = Date.now();
+    let stamps = [];
+    if (existsSync(file)) { try { stamps = JSON.parse(readFileSync(file, 'utf-8')); } catch { stamps = []; } }
+    if (!Array.isArray(stamps)) stamps = [];
+    stamps = stamps.filter((t) => typeof t === 'number' && now - t < 86400000);
+    if (stamps.length > 50000) stamps = stamps.slice(-50000);
+    const windows = [
+      { key: 'perDay', ms: 86400000 },
+      { key: 'perHour', ms: 3600000 },
+      { key: 'perMinute', ms: 60000 },
+    ];
+    let burst = false;
+    for (const w of windows) {
+      const limit = limits[w.key];
+      if (limit > 0) {
+        const count = stamps.reduce((n, t) => (now - t < w.ms ? n + 1 : n), 0);
+        if (count >= limit) { burst = true; break; }
+      }
+    }
+    stamps.push(now);
+    try { writeFileSync(file, JSON.stringify(stamps)); } catch { /* best-effort */ }
+    return burst;
+  } catch { return false; }
+}
+
 // Local log storage: the user can opt to keep a full copy of every audit entry
 // in a file of their choosing (set from the dashboard survey / Settings, then
 // delivered to us via the same policy cache the guard writes). We append one
@@ -560,6 +635,17 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
     const permission = guessPermission(toolName);
     const evaluationTimeMs = readLastEvalMs(toolName, sessionId);
 
+    // DETECT-mode observation: record DLP matches / rate-limit bursts on this
+    // ALLOW entry so "detect" means observe-AND-log (not silent). Fail-safe —
+    // any error leaves the fields off. Only meaningful on ALLOW (block-mode hits
+    // are DENIED upstream with their own reason).
+    let dlpMatches = [];
+    let rateLimitBurst = false;
+    if (decision === 'ALLOW') {
+      try { dlpMatches = dlpScanArgs(argsSummary, loadDlpRedact()); } catch { dlpMatches = []; }
+      try { rateLimitBurst = rateLimitObserveBurst(AGENT_ID, loadRateLimitObserve()); } catch { rateLimitBurst = false; }
+    }
+
     // Local log storage (opt-in): when ON, logs are kept LOCAL ONLY — we append
     // this entry to the user's chosen file and do NOT send it to the cloud.
     const localLogs = loadLocalLogs();
@@ -568,6 +654,8 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
         ts: new Date().toISOString(),
         tool: toolName, arguments: argsSummary, decision, reason, permission,
         evaluation_time_ms: evaluationTimeMs, agent_id: AGENT_ID, agent_name: AGENT_NAME, session_id: sessionId,
+        ...(dlpMatches.length ? { dlp: dlpMatches } : {}),
+        ...(rateLimitBurst ? { rate_limit_burst: true } : {}),
       });
       fetchDone = true;
       maybeExit();
@@ -594,6 +682,8 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
           agent_id: AGENT_ID,
           agent_name: AGENT_NAME,
           session_id: sessionId,
+          ...(dlpMatches.length ? { dlp: dlpMatches } : {}),
+          ...(rateLimitBurst ? { rate_limit_burst: true } : {}),
         }),
         signal: AbortSignal.timeout(5000),
       }).catch(() => {}).finally(() => { fetchDone = true; maybeExit(); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.33",
+  "version": "0.81.34",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {