@solongate/proxy 0.81.7 → 0.81.9

package/dist/global-install.js

@@ -184,19 +184,13 @@ ${SHIM_END}` : `${SHIM_BEGIN}
 claude() { "${node}" "${shield}" -- "${real}" "$@"; }
 ${SHIM_END}`;
   const targets = shimTargets();
-  if (targets.length === 0) {
-    console.log("  (No shell profile found for auto-shield; run `claude` via `solongate shield -- claude` manually.)");
-    return;
-  }
+  if (targets.length === 0) return;
   for (const file of targets) {
     try {
       writeShimBlock(file, block);
-      console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
-    } catch (e) {
-      console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);
+    } catch {
     }
   }
-  console.log("  Open a NEW terminal for it to take effect.");
 }
 function removeClaudeShim() {
   for (const file of shimTargets()) {

package/dist/index.js

@@ -10528,19 +10528,13 @@ ${SHIM_END}` : `${SHIM_BEGIN}
 claude() { "${node}" "${shield}" -- "${real}" "$@"; }
 ${SHIM_END}`;
   const targets = shimTargets();
-  if (targets.length === 0) {
-    console.log("  (No shell profile found for auto-shield; run `claude` via `solongate shield -- claude` manually.)");
-    return;
-  }
+  if (targets.length === 0) return;
   for (const file of targets) {
     try {
       writeShimBlock(file, block2);
-      console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
-    } catch (e) {
-      console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);
+    } catch {
     }
   }
-  console.log("  Open a NEW terminal for it to take effect.");
 }
 function removeClaudeShim() {
   for (const file of shimTargets()) {
@@ -10976,8 +10970,16 @@ function startProxy(upstream) {
       try {
         if (body.length && (req.headers["content-type"] || "").includes("json")) {
           const parsed = JSON.parse(body.toString("utf-8"));
-          const redacted = redactDeep(parsed, cfg);
-          body = Buffer.from(JSON.stringify(redacted), "utf-8");
+          if (parsed && typeof parsed === "object" && Array.isArray(parsed["messages"])) {
+            if (parsed["system"] !== void 0) parsed["system"] = redactDeep(parsed["system"], cfg);
+            const msgs = parsed["messages"];
+            for (let i = 0; i < msgs.length; i++) {
+              if (msgs[i] && msgs[i]["role"] !== "assistant") msgs[i] = redactDeep(msgs[i], cfg);
+            }
+            body = Buffer.from(JSON.stringify(parsed), "utf-8");
+          } else {
+            body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), "utf-8");
+          }
         }
       } catch {
       }

package/dist/login.js

@@ -191,19 +191,13 @@ ${SHIM_END}` : `${SHIM_BEGIN}
 claude() { "${node}" "${shield}" -- "${real}" "$@"; }
 ${SHIM_END}`;
   const targets = shimTargets();
-  if (targets.length === 0) {
-    console.log("  (No shell profile found for auto-shield; run `claude` via `solongate shield -- claude` manually.)");
-    return;
-  }
+  if (targets.length === 0) return;
   for (const file of targets) {
     try {
       writeShimBlock(file, block);
-      console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
-    } catch (e) {
-      console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);
+    } catch {
     }
   }
-  console.log("  Open a NEW terminal for it to take effect.");
 }
 async function runGlobalInstall(opts = {}) {
   const p = globalPaths();

package/dist/shield.js

@@ -211,8 +211,16 @@ function startProxy(upstream) {
       try {
         if (body.length && (req.headers["content-type"] || "").includes("json")) {
           const parsed = JSON.parse(body.toString("utf-8"));
-          const redacted = redactDeep(parsed, cfg);
-          body = Buffer.from(JSON.stringify(redacted), "utf-8");
+          if (parsed && typeof parsed === "object" && Array.isArray(parsed["messages"])) {
+            if (parsed["system"] !== void 0) parsed["system"] = redactDeep(parsed["system"], cfg);
+            const msgs = parsed["messages"];
+            for (let i = 0; i < msgs.length; i++) {
+              if (msgs[i] && msgs[i]["role"] !== "assistant") msgs[i] = redactDeep(msgs[i], cfg);
+            }
+            body = Buffer.from(JSON.stringify(parsed), "utf-8");
+          } else {
+            body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), "utf-8");
+          }
         }
       } catch {
       }

package/hooks/shield.mjs

@@ -220,21 +220,25 @@ function startProxy(upstream) {
       try {
         if (body.length && String(req.headers['content-type'] || '').includes('json')) {
           const parsed = JSON.parse(body.toString('utf-8'));
-          // Only the NEW turn needs scanning. The model re-sends the WHOLE
-          // conversation on every request, but every prior message was already
-          // redacted when it was itself the latest turn — so re-scanning all of
-          // history each call is pure waste that grows with the session (this was
-          // the source of the intermittent stalls). Redact ONLY the last message:
-          // the fresh user input + tool results (e.g. an `ls` result → ghost-strip
-          // hidden paths, DLP-redact secret patterns). We deliberately do NOT scan
-          // the model's own generated prose — only inputs and tool results matter.
-          const msgs = parsed && Array.isArray(parsed.messages) ? parsed.messages : null;
-          if (msgs && msgs.length > 0) {
-            const i = msgs.length - 1;
-            msgs[i] = redactDeep(msgs[i], cfg);
+          // Redact EVERY request, not just the last message. Claude Code re-sends
+          // the ORIGINAL (unredacted) conversation on every call — it stores the raw
+          // history and rebuilds the request each time, so the shield must re-scan
+          // it every request. Redacting only the newest message leaked any secret
+          // sitting in an earlier message: the user's own turn often lands at
+          // messages[0] with later messages after it, and a one-shot `-p` run has no
+          // prior request in which history could have been redacted. Scan the system
+          // prompt and every USER-role message (fresh input + tool results like an
+          // `ls`/Read result); skip ASSISTANT-role messages (model-generated prose —
+          // the bulk of a long session and not a secret source) so cost stays low.
+          if (parsed && typeof parsed === 'object' && Array.isArray(parsed.messages)) {
+            if (parsed.system !== undefined) parsed.system = redactDeep(parsed.system, cfg);
+            for (let i = 0; i < parsed.messages.length; i++) {
+              const m = parsed.messages[i];
+              if (m && m.role !== 'assistant') parsed.messages[i] = redactDeep(m, cfg);
+            }
             body = Buffer.from(JSON.stringify(parsed), 'utf-8');
           } else {
-            // Non-messages payload (rare) → redact it once.
+            // Non-messages payload (rare) → redact it whole.
             body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), 'utf-8');
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.7",
+  "version": "0.81.9",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {