@solongate/proxy 0.81.8 → 0.81.9

package/dist/index.js

@@ -10970,8 +10970,16 @@ function startProxy(upstream) {
       try {
         if (body.length && (req.headers["content-type"] || "").includes("json")) {
           const parsed = JSON.parse(body.toString("utf-8"));
-          const redacted = redactDeep(parsed, cfg);
-          body = Buffer.from(JSON.stringify(redacted), "utf-8");
+          if (parsed && typeof parsed === "object" && Array.isArray(parsed["messages"])) {
+            if (parsed["system"] !== void 0) parsed["system"] = redactDeep(parsed["system"], cfg);
+            const msgs = parsed["messages"];
+            for (let i = 0; i < msgs.length; i++) {
+              if (msgs[i] && msgs[i]["role"] !== "assistant") msgs[i] = redactDeep(msgs[i], cfg);
+            }
+            body = Buffer.from(JSON.stringify(parsed), "utf-8");
+          } else {
+            body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), "utf-8");
+          }
         }
       } catch {
       }

package/dist/shield.js

@@ -211,8 +211,16 @@ function startProxy(upstream) {
       try {
         if (body.length && (req.headers["content-type"] || "").includes("json")) {
           const parsed = JSON.parse(body.toString("utf-8"));
-          const redacted = redactDeep(parsed, cfg);
-          body = Buffer.from(JSON.stringify(redacted), "utf-8");
+          if (parsed && typeof parsed === "object" && Array.isArray(parsed["messages"])) {
+            if (parsed["system"] !== void 0) parsed["system"] = redactDeep(parsed["system"], cfg);
+            const msgs = parsed["messages"];
+            for (let i = 0; i < msgs.length; i++) {
+              if (msgs[i] && msgs[i]["role"] !== "assistant") msgs[i] = redactDeep(msgs[i], cfg);
+            }
+            body = Buffer.from(JSON.stringify(parsed), "utf-8");
+          } else {
+            body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), "utf-8");
+          }
         }
       } catch {
       }

package/hooks/shield.mjs

@@ -220,21 +220,25 @@ function startProxy(upstream) {
       try {
         if (body.length && String(req.headers['content-type'] || '').includes('json')) {
           const parsed = JSON.parse(body.toString('utf-8'));
-          // Only the NEW turn needs scanning. The model re-sends the WHOLE
-          // conversation on every request, but every prior message was already
-          // redacted when it was itself the latest turn — so re-scanning all of
-          // history each call is pure waste that grows with the session (this was
-          // the source of the intermittent stalls). Redact ONLY the last message:
-          // the fresh user input + tool results (e.g. an `ls` result → ghost-strip
-          // hidden paths, DLP-redact secret patterns). We deliberately do NOT scan
-          // the model's own generated prose — only inputs and tool results matter.
-          const msgs = parsed && Array.isArray(parsed.messages) ? parsed.messages : null;
-          if (msgs && msgs.length > 0) {
-            const i = msgs.length - 1;
-            msgs[i] = redactDeep(msgs[i], cfg);
+          // Redact EVERY request, not just the last message. Claude Code re-sends
+          // the ORIGINAL (unredacted) conversation on every call — it stores the raw
+          // history and rebuilds the request each time, so the shield must re-scan
+          // it every request. Redacting only the newest message leaked any secret
+          // sitting in an earlier message: the user's own turn often lands at
+          // messages[0] with later messages after it, and a one-shot `-p` run has no
+          // prior request in which history could have been redacted. Scan the system
+          // prompt and every USER-role message (fresh input + tool results like an
+          // `ls`/Read result); skip ASSISTANT-role messages (model-generated prose —
+          // the bulk of a long session and not a secret source) so cost stays low.
+          if (parsed && typeof parsed === 'object' && Array.isArray(parsed.messages)) {
+            if (parsed.system !== undefined) parsed.system = redactDeep(parsed.system, cfg);
+            for (let i = 0; i < parsed.messages.length; i++) {
+              const m = parsed.messages[i];
+              if (m && m.role !== 'assistant') parsed.messages[i] = redactDeep(m, cfg);
+            }
             body = Buffer.from(JSON.stringify(parsed), 'utf-8');
           } else {
-            // Non-messages payload (rare) → redact it once.
+            // Non-messages payload (rare) → redact it whole.
             body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), 'utf-8');
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.8",
+  "version": "0.81.9",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {