@solongate/proxy 0.81.4 → 0.81.6

package/hooks/audit.mjs

@@ -497,6 +497,10 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
           if (tr && typeof tr === 'object' && typeof tr.stdout === 'string') updated = { ...tr, stdout: out };
           else if (tr && typeof tr === 'object' && typeof tr.content === 'string') updated = { ...tr, content: out };
           else if (tr && typeof tr === 'object' && Array.isArray(tr.content)) updated = { ...tr, content: [{ type: 'text', text: out }] };
+          // Read / NotebookRead nest the file body at file.content. It's a STRUCTURED
+          // result, so a bare-string replacement is rejected ("PostToolUse:Read hook
+          // warning") and the raw secret leaks through — preserve the shape instead.
+          else if (tr && typeof tr === 'object' && tr.file && typeof tr.file.content === 'string') updated = { ...tr, file: { ...tr.file, content: out } };
           else updated = out;
           EMITTED_PAYLOAD = JSON.stringify({
             hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: updated },

package/hooks/guard.bundled.mjs

@@ -6787,8 +6787,14 @@ function blockTool(reason) {
     }));
     sgFinish(0);
   } else {
-    process.stderr.write(reason);
-    sgFinish(2);
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason
+      }
+    }));
+    sgFinish(0);
   }
 }
 function allowTool() {
@@ -7845,8 +7851,8 @@ if (!REFRESH_MODE) {
             process.stdout.write(JSON.stringify({ decision: "deny", reason: ghostHit }));
             sgFinish(0);
           }
-          process.stderr.write(ghostHit);
-          sgFinish(2);
+          process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: ghostHit } }));
+          sgFinish(0);
         }
         if (AGENT_TYPE !== "gemini-cli" && toolName === "Bash") {
           const rw = ghostListingRewrite(args, securityCfg.ghost);

package/hooks/guard.mjs

@@ -326,9 +326,20 @@ function blockTool(reason) {
     }));
     sgFinish(0);
   } else {
-    // Claude Code — exit code 2
-    process.stderr.write(reason);
-    sgFinish(2);
+    // Claude Code — signal the block via the JSON PreToolUse protocol on stdout,
+    // NOT exit code 2. On Windows the hook runs through PowerShell, which does not
+    // reliably propagate a native process's exit code back to Claude Code, so an
+    // `exit 2` block was being seen as a "non-blocking status code" and the tool ran
+    // anyway. Claude only processes this JSON on exit 0 (JSON is ignored if you exit
+    // 2), so we MUST exit 0 here. This is shell-independent and works everywhere.
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: reason,
+      },
+    }));
+    sgFinish(0);
   }
 }
 
@@ -1640,8 +1651,10 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         } catch {}
         await maybeSelfUpdate();
         if (AGENT_TYPE === 'gemini-cli') { process.stdout.write(JSON.stringify({ decision: 'deny', reason: ghostHit })); sgFinish(0); }
-        process.stderr.write(ghostHit);
-        sgFinish(2);
+        // Claude Code: JSON deny on stdout + exit 0 (see blockTool — exit codes are
+        // not reliable through PowerShell on Windows; JSON is ignored on exit 2).
+        process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: ghostHit } }));
+        sgFinish(0);
       }
       // No direct hit: if this is a listing command, rewrite it so hidden
       // entries are filtered out of its output (Claude Code only).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.4",
+  "version": "0.81.6",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {