@solongate/proxy 0.81.5 → 0.81.7

package/dist/global-install.js

@@ -232,7 +232,7 @@ async function runGlobalInstall(opts = {}) {
   writeFileSync(join(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
   writeFileSync(join(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  removeClaudeShim();
+  installClaudeShim(join(p.hooksDir, "shield.mjs"));
   writeFileSync(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};

package/dist/index.js

@@ -10576,7 +10576,7 @@ async function runGlobalInstall(opts = {}) {
   writeFileSync4(join9(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
   writeFileSync4(join9(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  removeClaudeShim();
+  installClaudeShim(join9(p.hooksDir, "shield.mjs"));
   writeFileSync4(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};

package/dist/login.js

@@ -141,6 +141,19 @@ var SHIM_END = "# <<< SolonGate shield <<<";
 function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function resolveRealClaude() {
+  try {
+    const finder = process.platform === "win32" ? "where" : "which";
+    const out = execFileSync(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    if (process.platform === "win32") {
+      const low = (s) => s.toLowerCase();
+      return out.find((l) => low(l).endsWith(".cmd")) || out.find((l) => low(l).endsWith(".exe")) || out.find((l) => low(l).endsWith(".bat")) || out[0] || null;
+    }
+    return out[0] || null;
+  } catch {
+    return null;
+  }
+}
 function shimTargets() {
   if (process.platform === "win32") {
     try {
@@ -163,13 +176,34 @@ function writeShimBlock(file, block) {
   mkdirSync(dirname(file), { recursive: true });
   writeFileSync(file, content);
 }
-function removeClaudeShim() {
-  for (const file of shimTargets()) {
+function installClaudeShim(shieldPath) {
+  const real = resolveRealClaude();
+  if (!real) {
+    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
+    return;
+  }
+  const node = process.execPath.replace(/\\/g, "/");
+  const shield = shieldPath.replace(/\\/g, "/");
+  const win = process.platform === "win32";
+  const block = win ? `${SHIM_BEGIN}
+function claude { & "${node}" "${shield}" -- "${real}" @args }
+${SHIM_END}` : `${SHIM_BEGIN}
+claude() { "${node}" "${shield}" -- "${real}" "$@"; }
+${SHIM_END}`;
+  const targets = shimTargets();
+  if (targets.length === 0) {
+    console.log("  (No shell profile found for auto-shield; run `claude` via `solongate shield -- claude` manually.)");
+    return;
+  }
+  for (const file of targets) {
     try {
-      writeShimBlock(file, null);
-    } catch {
+      writeShimBlock(file, block);
+      console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
+    } catch (e) {
+      console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);
     }
   }
+  console.log("  Open a NEW terminal for it to take effect.");
 }
 async function runGlobalInstall(opts = {}) {
   const p = globalPaths();
@@ -197,7 +231,7 @@ async function runGlobalInstall(opts = {}) {
   writeFileSync(join(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
   writeFileSync(join(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  removeClaudeShim();
+  installClaudeShim(join(p.hooksDir, "shield.mjs"));
   writeFileSync(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};

package/hooks/audit.mjs

@@ -497,6 +497,10 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
           if (tr && typeof tr === 'object' && typeof tr.stdout === 'string') updated = { ...tr, stdout: out };
           else if (tr && typeof tr === 'object' && typeof tr.content === 'string') updated = { ...tr, content: out };
           else if (tr && typeof tr === 'object' && Array.isArray(tr.content)) updated = { ...tr, content: [{ type: 'text', text: out }] };
+          // Read / NotebookRead nest the file body at file.content. It's a STRUCTURED
+          // result, so a bare-string replacement is rejected ("PostToolUse:Read hook
+          // warning") and the raw secret leaks through — preserve the shape instead.
+          else if (tr && typeof tr === 'object' && tr.file && typeof tr.file.content === 'string') updated = { ...tr, file: { ...tr.file, content: out } };
           else updated = out;
           EMITTED_PAYLOAD = JSON.stringify({
             hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput: updated },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.5",
+  "version": "0.81.7",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {