@solongate/proxy 0.81.74 → 0.81.76

package/dist/index.js

@@ -9390,9 +9390,9 @@ function DlpPanel({ focused }) {
       entry: idx
     });
   });
-  header("h:custom", "custom patterns", "regex over tool args \xB7 a add \xB7 d remove");
-  note("n:custom-help", "  a JS regex, e.g.  sk-[a-z0-9]{20}   AKIA[0-9A-Z]{16}   password=\\S+");
-  if ((dlp?.custom.length ?? 0) === 0) note("n:custom", "  (none \u2014 press a to add a name + regex)");
+  header("h:custom", "custom patterns", "a add \xB7 d remove");
+  note("n:custom-help", "  same glob syntax as ghost, * = any chars, e.g.  sk-*   AKIA*   *PRIVATE KEY*");
+  if ((dlp?.custom.length ?? 0) === 0) note("n:custom", "  (none \u2014 press a to add a name + pattern)");
   (dlp?.custom ?? []).forEach((c2, i) => {
     const isCur = focused && ei === selC;
     const idx = ei++;
@@ -9420,7 +9420,7 @@ function DlpPanel({ focused }) {
       entry: idx
     });
   });
-  const editRows = adding === "re" ? 2 : adding ? 1 : 0;
+  const editRows = adding ? 1 : 0;
   const headerRows = 2 + editRows + (status ? 1 : 0);
   const budget = Math.max(3, rows - headerRows - 1);
   const selLine = Math.max(0, lines.findIndex((l) => l.entry === selC));
@@ -9437,59 +9437,40 @@ function DlpPanel({ focused }) {
       dirty ? /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: "   \u25CF unsaved (s save \xB7 x discard)" }) : null
     ] }),
     /* @__PURE__ */ jsx5(Text5, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 move \xB7 space on/off \xB7 m mode \xB7 a add pattern \xB7 r add route \xB7 d remove \xB7 g ghost \xB7 s save${moreAbove ? ` \xB7 \u25B2${moreAbove}` : ""}${moreBelow ? ` \xB7 \u25BC${moreBelow}` : ""}` : "press \u2192 to edit" }),
-    adding ? /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs5(Box5, { children: [
-        /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: adding === "name" ? "new pattern name: " : adding === "re" ? `regex for "${newName}" (e.g. sk-[a-z0-9]{20}): ` : "ghost path to hide (glob, * = any chars, e.g. */.env  *.pem): " }),
-        /* @__PURE__ */ jsx5(
-          TextInput3,
-          {
-            value: input,
-            onChange: setInput,
-            onSubmit: (v) => {
-              const t = v.trim();
-              if (adding === "name") {
-                if (!t) return setAdding(null);
-                setNewName(t);
-                setInput("");
-                setAdding("re");
-              } else if (adding === "re") {
-                if (t && dlp) mutate({ ...dlp, custom: [...dlp.custom, { name: newName, re: t }] });
-                setAdding(null);
-              } else {
-                if (t && !ghostPats.includes(t)) {
-                  setGhostPats((ps) => [...ps, t]);
-                  setDirty(true);
-                  setStatus(null);
-                }
-                setAdding(null);
+    adding ? /* @__PURE__ */ jsx5(Box5, { flexDirection: "column", children: /* @__PURE__ */ jsxs5(Box5, { children: [
+      /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: adding === "name" ? "new pattern name: " : adding === "re" ? `pattern for "${newName}" (glob, * = any chars, e.g. sk-*  AKIA*): ` : "ghost path to hide (glob, * = any chars, e.g. */.env  *.pem): " }),
+      /* @__PURE__ */ jsx5(
+        TextInput3,
+        {
+          value: input,
+          onChange: setInput,
+          onSubmit: (v) => {
+            const t = v.trim();
+            if (adding === "name") {
+              if (!t) return setAdding(null);
+              setNewName(t);
+              setInput("");
+              setAdding("re");
+            } else if (adding === "re") {
+              if (t && dlp) mutate({ ...dlp, custom: [...dlp.custom, { name: newName, re: t }] });
+              setAdding(null);
+            } else {
+              if (t && !ghostPats.includes(t)) {
+                setGhostPats((ps) => [...ps, t]);
+                setDirty(true);
+                setStatus(null);
               }
+              setAdding(null);
             }
           }
-        )
-      ] }),
-      adding === "re" ? /* @__PURE__ */ jsx5(RegexTest, { re: input }) : null
-    ] }) : null,
+        }
+      )
+    ] }) }) : null,
     /* @__PURE__ */ jsx5(Box5, { marginTop: 1, flexDirection: "column", height: budget, overflow: "hidden", children: win.map((l) => l.node) }),
     status ? /* @__PURE__ */ jsx5(Text5, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, wrap: "truncate", children: status }) : null
   ] }) : null });
 }
-function RegexTest({ re }) {
-  if (!re.trim()) return /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "  regex: type a pattern\u2026" });
-  let rx = null;
-  let err2 = "";
-  try {
-    rx = new RegExp(re);
-  } catch (e) {
-    err2 = e instanceof Error ? e.message : String(e);
-  }
-  if (!rx) return /* @__PURE__ */ jsx5(Text5, { color: theme.bad, children: `  \u2717 invalid: ${err2.slice(0, 50)}` });
-  const hits = SAMPLES.filter((s) => rx.test(s));
-  return /* @__PURE__ */ jsxs5(Text5, { wrap: "truncate", children: [
-    /* @__PURE__ */ jsx5(Text5, { color: theme.ok, children: "  \u2713 valid" }),
-    /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: hits.length ? `  matches ${hits.length}/${SAMPLES.length} samples: ${hits.map((h) => h.slice(0, 8)).join(", ")}` : "  (no sample match \u2014 will only catch your custom secrets)" })
-  ] });
-}
-var MODES2, SAMPLES;
+var MODES2;
 var init_Dlp = __esm({
   "src/tui/panels/Dlp.tsx"() {
     "use strict";
@@ -9498,7 +9479,6 @@ var init_Dlp = __esm({
     init_hooks();
     init_theme();
     MODES2 = ["off", "detect", "block"];
-    SAMPLES = ["AKIA1234567890ABCD00", "sk-ant-api03-xxxxxxxx", "ghp_16chars0000000000000000000000000000", "password=hunter2", "Bearer eyJhbGciOi"];
   }
 });
 
@@ -11156,7 +11136,7 @@ var init_App = __esm({
       ["Live", [["\u2191\u2193", "select a stream row"], ["enter", "full entry content"], ["w", "whitelist the selected DENY"], ["b", "block the selected ALLOW"], ["d / x / r", "filter denies / dlp / rate-limit"], ["f", "local / cloud filter"], ["/", "search"], ["s", "sessions (\u2191\u2193 pick, enter open)"], ["space", "copy mode (freeze)"]]],
       ["Policies", [["\u2191\u2193", "browse / select"], ["a", "activate (pin) selected policy"], ["x", "deactivate \u2014 no active policy"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["s", "save"], ["x", "discard"]]],
       ["Rate limit", [["\u2191\u2193", "field"], ["\u2190\u2192", "adjust (shift = \xB110)"], ["s", "save"]]],
-      ["DLP", [["\u2191\u2193", "move"], ["space", "toggle a built-in pattern on/off"], ["m", "cycle mode"], ["a", "add custom pattern (name \u2192 regex)"], ["r", "add a ghost route (path to hide)"], ["d", "remove custom / route"], ["g", "ghost on/off"], ["s", "save \xB7 x discard"]]],
+      ["DLP", [["\u2191\u2193", "move"], ["space", "toggle a built-in pattern on/off"], ["m", "cycle mode"], ["a", "add custom pattern (name \u2192 glob, * = any chars)"], ["r", "add a ghost route (glob path to hide)"], ["d", "remove custom / route"], ["g", "ghost on/off"], ["s", "save \xB7 x discard"]]],
       ["Audit", [["v", "logs \u2194 sessions"], ["s", "source: cloud \u2194 local"], ["\u2190 \u2192", "prev / next page (500 each)"], ["\u2191\u2193", "select (list scrolls)"], ["enter", "full entry / session logs"], ["f / g", "decision / signal filter"], ["t / n / /", "tool / agent / search"], ["x / X", "delete entry / ALL (press twice)"], ["c", "clear filters"]]],
       ["Settings", [["\u2191\u2193", "move"], ["enter / space", "toggle \xB7 edit \xB7 add"], ["e", "webhook events"], ["d d", "delete"], ["r", "refresh"]]],
       ["Accounts", [["a", "switch account (view another account logged in on this device)"], ["", "the header shows which account you are viewing; guard/logging keep the active key"]]]
@@ -12687,6 +12667,7 @@ function redactDeep(value, cfg) {
   if (typeof value === "string") {
     let out2 = redactString(value, cfg);
     if (ghost && ghost.length) out2 = ghostStripLines(out2, ghost);
+    if (out2 === "" && value !== "") out2 = "\n";
     return out2;
   }
   if (Array.isArray(value)) {

package/dist/shield.js

@@ -182,6 +182,7 @@ function redactDeep(value, cfg) {
   if (typeof value === "string") {
     let out = redactString(value, cfg);
     if (ghost && ghost.length) out = ghostStripLines(out, ghost);
+    if (out === "" && value !== "") out = "\n";
     return out;
   }
   if (Array.isArray(value)) {

package/dist/tui/index.js

@@ -2438,9 +2438,9 @@ function DlpPanel({ focused }) {
       entry: idx
     });
   });
-  header("h:custom", "custom patterns", "regex over tool args \xB7 a add \xB7 d remove");
-  note("n:custom-help", "  a JS regex, e.g.  sk-[a-z0-9]{20}   AKIA[0-9A-Z]{16}   password=\\S+");
-  if ((dlp?.custom.length ?? 0) === 0) note("n:custom", "  (none \u2014 press a to add a name + regex)");
+  header("h:custom", "custom patterns", "a add \xB7 d remove");
+  note("n:custom-help", "  same glob syntax as ghost, * = any chars, e.g.  sk-*   AKIA*   *PRIVATE KEY*");
+  if ((dlp?.custom.length ?? 0) === 0) note("n:custom", "  (none \u2014 press a to add a name + pattern)");
   (dlp?.custom ?? []).forEach((c2, i) => {
     const isCur = focused && ei === selC;
     const idx = ei++;
@@ -2468,7 +2468,7 @@ function DlpPanel({ focused }) {
       entry: idx
     });
   });
-  const editRows = adding === "re" ? 2 : adding ? 1 : 0;
+  const editRows = adding ? 1 : 0;
   const headerRows = 2 + editRows + (status ? 1 : 0);
   const budget = Math.max(3, rows - headerRows - 1);
   const selLine = Math.max(0, lines.findIndex((l) => l.entry === selC));
@@ -2485,59 +2485,39 @@ function DlpPanel({ focused }) {
       dirty ? /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: "   \u25CF unsaved (s save \xB7 x discard)" }) : null
     ] }),
     /* @__PURE__ */ jsx5(Text5, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 move \xB7 space on/off \xB7 m mode \xB7 a add pattern \xB7 r add route \xB7 d remove \xB7 g ghost \xB7 s save${moreAbove ? ` \xB7 \u25B2${moreAbove}` : ""}${moreBelow ? ` \xB7 \u25BC${moreBelow}` : ""}` : "press \u2192 to edit" }),
-    adding ? /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs5(Box5, { children: [
-        /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: adding === "name" ? "new pattern name: " : adding === "re" ? `regex for "${newName}" (e.g. sk-[a-z0-9]{20}): ` : "ghost path to hide (glob, * = any chars, e.g. */.env  *.pem): " }),
-        /* @__PURE__ */ jsx5(
-          TextInput3,
-          {
-            value: input,
-            onChange: setInput,
-            onSubmit: (v) => {
-              const t = v.trim();
-              if (adding === "name") {
-                if (!t) return setAdding(null);
-                setNewName(t);
-                setInput("");
-                setAdding("re");
-              } else if (adding === "re") {
-                if (t && dlp) mutate({ ...dlp, custom: [...dlp.custom, { name: newName, re: t }] });
-                setAdding(null);
-              } else {
-                if (t && !ghostPats.includes(t)) {
-                  setGhostPats((ps) => [...ps, t]);
-                  setDirty(true);
-                  setStatus(null);
-                }
-                setAdding(null);
+    adding ? /* @__PURE__ */ jsx5(Box5, { flexDirection: "column", children: /* @__PURE__ */ jsxs5(Box5, { children: [
+      /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: adding === "name" ? "new pattern name: " : adding === "re" ? `pattern for "${newName}" (glob, * = any chars, e.g. sk-*  AKIA*): ` : "ghost path to hide (glob, * = any chars, e.g. */.env  *.pem): " }),
+      /* @__PURE__ */ jsx5(
+        TextInput3,
+        {
+          value: input,
+          onChange: setInput,
+          onSubmit: (v) => {
+            const t = v.trim();
+            if (adding === "name") {
+              if (!t) return setAdding(null);
+              setNewName(t);
+              setInput("");
+              setAdding("re");
+            } else if (adding === "re") {
+              if (t && dlp) mutate({ ...dlp, custom: [...dlp.custom, { name: newName, re: t }] });
+              setAdding(null);
+            } else {
+              if (t && !ghostPats.includes(t)) {
+                setGhostPats((ps) => [...ps, t]);
+                setDirty(true);
+                setStatus(null);
               }
+              setAdding(null);
             }
           }
-        )
-      ] }),
-      adding === "re" ? /* @__PURE__ */ jsx5(RegexTest, { re: input }) : null
-    ] }) : null,
+        }
+      )
+    ] }) }) : null,
     /* @__PURE__ */ jsx5(Box5, { marginTop: 1, flexDirection: "column", height: budget, overflow: "hidden", children: win.map((l) => l.node) }),
     status ? /* @__PURE__ */ jsx5(Text5, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, wrap: "truncate", children: status }) : null
   ] }) : null });
 }
-var SAMPLES = ["AKIA1234567890ABCD00", "sk-ant-api03-xxxxxxxx", "ghp_16chars0000000000000000000000000000", "password=hunter2", "Bearer eyJhbGciOi"];
-function RegexTest({ re }) {
-  if (!re.trim()) return /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "  regex: type a pattern\u2026" });
-  let rx = null;
-  let err = "";
-  try {
-    rx = new RegExp(re);
-  } catch (e) {
-    err = e instanceof Error ? e.message : String(e);
-  }
-  if (!rx) return /* @__PURE__ */ jsx5(Text5, { color: theme.bad, children: `  \u2717 invalid: ${err.slice(0, 50)}` });
-  const hits = SAMPLES.filter((s) => rx.test(s));
-  return /* @__PURE__ */ jsxs5(Text5, { wrap: "truncate", children: [
-    /* @__PURE__ */ jsx5(Text5, { color: theme.ok, children: "  \u2713 valid" }),
-    /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: hits.length ? `  matches ${hits.length}/${SAMPLES.length} samples: ${hits.map((h) => h.slice(0, 8)).join(", ")}` : "  (no sample match \u2014 will only catch your custom secrets)" })
-  ] });
-}
 
 // src/tui/panels/Audit.tsx
 import { Box as Box6, Text as Text6, useInput as useInput5 } from "ink";
@@ -4121,7 +4101,7 @@ var HELP = [
   ["Live", [["\u2191\u2193", "select a stream row"], ["enter", "full entry content"], ["w", "whitelist the selected DENY"], ["b", "block the selected ALLOW"], ["d / x / r", "filter denies / dlp / rate-limit"], ["f", "local / cloud filter"], ["/", "search"], ["s", "sessions (\u2191\u2193 pick, enter open)"], ["space", "copy mode (freeze)"]]],
   ["Policies", [["\u2191\u2193", "browse / select"], ["a", "activate (pin) selected policy"], ["x", "deactivate \u2014 no active policy"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["s", "save"], ["x", "discard"]]],
   ["Rate limit", [["\u2191\u2193", "field"], ["\u2190\u2192", "adjust (shift = \xB110)"], ["s", "save"]]],
-  ["DLP", [["\u2191\u2193", "move"], ["space", "toggle a built-in pattern on/off"], ["m", "cycle mode"], ["a", "add custom pattern (name \u2192 regex)"], ["r", "add a ghost route (path to hide)"], ["d", "remove custom / route"], ["g", "ghost on/off"], ["s", "save \xB7 x discard"]]],
+  ["DLP", [["\u2191\u2193", "move"], ["space", "toggle a built-in pattern on/off"], ["m", "cycle mode"], ["a", "add custom pattern (name \u2192 glob, * = any chars)"], ["r", "add a ghost route (glob path to hide)"], ["d", "remove custom / route"], ["g", "ghost on/off"], ["s", "save \xB7 x discard"]]],
   ["Audit", [["v", "logs \u2194 sessions"], ["s", "source: cloud \u2194 local"], ["\u2190 \u2192", "prev / next page (500 each)"], ["\u2191\u2193", "select (list scrolls)"], ["enter", "full entry / session logs"], ["f / g", "decision / signal filter"], ["t / n / /", "tool / agent / search"], ["x / X", "delete entry / ALL (press twice)"], ["c", "clear filters"]]],
   ["Settings", [["\u2191\u2193", "move"], ["enter / space", "toggle \xB7 edit \xB7 add"], ["e", "webhook events"], ["d d", "delete"], ["r", "refresh"]]],
   ["Accounts", [["a", "switch account (view another account logged in on this device)"], ["", "the header shows which account you are viewing; guard/logging keep the active key"]]]

package/hooks/audit.mjs

@@ -565,6 +565,13 @@ try { input += readFileSync(0, 'utf-8'); } catch {}
           }
         }
         if (typeof out === 'string') {
+          // Never emit EMPTY content. When ghost/DLP stripping removes every line
+          // (e.g. a grep/cat that hit only hidden or secret lines) and the tool
+          // ALSO errored, the resulting tool_result is is_error:true with empty
+          // content — which the API rejects ("content cannot be empty if is_error
+          // is true") and hard-crashes the whole agent conversation. Fall back to
+          // a bare newline: still looks like empty output, but is non-empty.
+          if (out === '') out = '\n';
           // Preserve the tool's result SHAPE. Bash and other tools deliver a
           // STRUCTURED result ({ stdout, stderr, ... } or { content }); Claude
           // Code rejects a bare-string replacement for those (hook warning) and

package/hooks/guard.bundled.mjs

@@ -6808,7 +6808,10 @@ function blockTool(reason) {
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
         permissionDecision: "deny",
-        permissionDecisionReason: reason
+        // Never empty: a deny with an empty reason becomes an is_error tool_result
+        // with empty content, which the API rejects and crashes the agent. Always
+        // carry a SolonGate-worded reason so the block says WHAT stopped it.
+        permissionDecisionReason: reason || "[SolonGate] Blocked by policy"
       }
     }));
     sgFinish(0);

package/hooks/guard.mjs

@@ -395,7 +395,10 @@ function blockTool(reason) {
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
         permissionDecision: 'deny',
-        permissionDecisionReason: reason,
+        // Never empty: a deny with an empty reason becomes an is_error tool_result
+        // with empty content, which the API rejects and crashes the agent. Always
+        // carry a SolonGate-worded reason so the block says WHAT stopped it.
+        permissionDecisionReason: reason || '[SolonGate] Blocked by policy',
       },
     }));
     sgFinish(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.74",
+  "version": "0.81.76",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {