@solongate/proxy 0.82.19 → 0.82.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.19",
+  "version": "0.82.21",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {

package/dist/commands/keys.d.ts

@@ -1 +0,0 @@
-export declare function run(argv: string[]): Promise<number>;

package/dist/commands/mcp.d.ts

@@ -1 +0,0 @@
-export declare function run(argv: string[]): Promise<number>;

package/dist/shield.d.ts

@@ -1 +0,0 @@
-export declare function runShield(): Promise<void>;

package/dist/shield.js

@@ -1,314 +0,0 @@
-// src/shield.ts
-import { createServer, request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-import { spawn } from "child_process";
-import { URL } from "url";
-import { readFileSync, existsSync, readdirSync, statSync } from "fs";
-import { resolve } from "path";
-import { homedir } from "os";
-var log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}
-`);
-var DLP_PATTERNS = [
-  { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },
-  { name: "Private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
-  { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-  { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
-  { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
-  { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },
-  { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },
-  { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
-  { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
-  { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },
-  { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },
-  { name: "JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
-  { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi }
-];
-function findCacheFile() {
-  const dir = resolve(homedir(), ".solongate");
-  const envSel = process.env.SOLONGATE_AGENT_ID;
-  if (envSel) {
-    const f = resolve(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync(f)) return f;
-  }
-  let best = null, bestTs = -1;
-  try {
-    for (const name of readdirSync(dir)) {
-      if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
-        const full = resolve(dir, name);
-        const ts = statSync(full).mtimeMs;
-        if (ts > bestTs) {
-          bestTs = ts;
-          best = full;
-        }
-      }
-    }
-  } catch {
-  }
-  return best;
-}
-function loadCfg() {
-  try {
-    const f = findCacheFile();
-    if (f && existsSync(f)) {
-      const c = JSON.parse(readFileSync(f, "utf-8"));
-      const d = c?.security?.dlpRedact;
-      const g = c?.security?.ghost;
-      const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
-      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [], ghost };
-      return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost };
-    }
-  } catch {
-  }
-  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost: [] };
-}
-function ghostGlobToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        re += ".*";
-        i++;
-      } else re += "[^/]*";
-    } else if (c === "?") re += "[^/]";
-    else if ("\\^$.|+()[]{}".indexOf(c) !== -1) re += "\\" + c;
-    else re += c;
-  }
-  try {
-    return new RegExp("^" + re + "$");
-  } catch {
-    return null;
-  }
-}
-function ghostMatch(targetPath, patterns) {
-  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
-  const norm = String(targetPath).replace(/\\/g, "/").replace(/\/+$/, "");
-  if (!norm) return false;
-  const segments = norm.split("/").filter(Boolean);
-  const base = segments.length ? segments[segments.length - 1] : norm;
-  for (let pat of patterns) {
-    pat = String(pat || "").trim();
-    if (!pat) continue;
-    let dirOnly = false;
-    if (pat.endsWith("/")) {
-      dirOnly = true;
-      pat = pat.slice(0, -1);
-    }
-    if (!pat) continue;
-    const hasSlash = pat.indexOf("/") !== -1;
-    const hasWild = /[*?]/.test(pat);
-    const re = ghostGlobToRegExp(pat);
-    if (!re) continue;
-    if (dirOnly) {
-      if (!hasSlash && !hasWild) {
-        if (segments.indexOf(pat) !== -1) return true;
-        continue;
-      }
-      let acc = "";
-      for (const s of segments) {
-        acc = acc ? acc + "/" + s : s;
-        if (re.test(acc) || re.test(s)) return true;
-      }
-      continue;
-    }
-    if (!hasSlash) {
-      if (re.test(base)) return true;
-      if (segments.some((s) => re.test(s))) return true;
-      continue;
-    }
-    if (re.test(norm)) return true;
-  }
-  return false;
-}
-function ghostCleanToken(tok) {
-  let t = String(tok || "").trim();
-  t = t.replace(/^[<>|;&(]+/, "").replace(/[);&|]+$/, "");
-  t = t.replace(/^['"]+/, "").replace(/['"]+$/, "");
-  t = t.replace(/^\d*>>?/, "");
-  return t.trim();
-}
-function ghostStripLines(text, pats) {
-  if (!Array.isArray(pats) || pats.length === 0) return text;
-  const lines = String(text).split("\n");
-  const kept = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      kept.push(line);
-      continue;
-    }
-    if (ghostMatch(trimmed, pats)) continue;
-    const toks = trimmed.split(/\s+/);
-    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
-    if (!anyHit) {
-      kept.push(line);
-      continue;
-    }
-    if (toks.length > 3) continue;
-    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
-    if (remaining.length === 0) continue;
-    kept.push(remaining.join("  "));
-  }
-  return kept.join("\n");
-}
-function dlpGlobToRe(glob, flags) {
-  let re = "";
-  for (const ch of String(glob || "")) {
-    if (ch === "*") re += "[^\\s]*";
-    else if (".+?^${}()|[]\\".indexOf(ch) !== -1) re += "\\" + ch;
-    else re += ch;
-  }
-  return new RegExp(re, flags);
-}
-function redactString(s, cfg) {
-  if (!cfg || typeof s !== "string" || !s) return s;
-  const allow = new Set(cfg.patterns);
-  const NUL = String.fromCharCode(0);
-  const labels = [];
-  const stash = (label) => NUL + (labels.push(label) - 1) + NUL;
-  let out = s;
-  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, () => stash(`[REDACTED: ${p.name}]`));
-  for (const c of cfg.custom) {
-    try {
-      out = out.replace(dlpGlobToRe(c.re, "gi"), () => stash(`[REDACTED: ${c.name || "custom"}]`));
-    } catch {
-    }
-  }
-  return out.replace(new RegExp(NUL + "(\\d+)" + NUL, "g"), (_, i) => labels[+i] || "");
-}
-function redactDeep(value, cfg) {
-  const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
-  if (typeof value === "string") {
-    let out = redactString(value, cfg);
-    if (ghost && ghost.length) out = ghostStripLines(out, ghost);
-    if (out === "" && value !== "") out = "\n";
-    return out;
-  }
-  if (Array.isArray(value)) {
-    const arr = ghost && ghost.length ? value.filter((v) => !(typeof v === "string" && ghostMatch(v.trim(), ghost))) : value;
-    return arr.map((v) => redactDeep(v, cfg));
-  }
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v, cfg);
-    return out;
-  }
-  return value;
-}
-function pickUpstream() {
-  const raw = process.env.SOLONGATE_SHIELD_UPSTREAM || process.env.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
-  try {
-    return new URL(raw);
-  } catch {
-    return new URL("https://api.anthropic.com");
-  }
-}
-function startProxy(upstream) {
-  const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
-  const server = createServer((req, res) => {
-    const cfg = loadCfg();
-    const chunks = [];
-    req.on("data", (c) => chunks.push(c));
-    req.on("end", () => {
-      let body = Buffer.concat(chunks);
-      try {
-        if (body.length && (req.headers["content-type"] || "").includes("json")) {
-          const parsed = JSON.parse(body.toString("utf-8"));
-          if (parsed && typeof parsed === "object" && Array.isArray(parsed["messages"])) {
-            if (parsed["system"] !== void 0) parsed["system"] = redactDeep(parsed["system"], cfg);
-            const msgs = parsed["messages"];
-            for (let i = 0; i < msgs.length; i++) {
-              const m = msgs[i];
-              if (m && m["role"] !== "assistant") msgs[i] = redactDeep(m, cfg);
-            }
-            body = Buffer.from(JSON.stringify(parsed), "utf-8");
-          } else {
-            body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), "utf-8");
-          }
-        }
-      } catch {
-      }
-      const headers = { ...req.headers };
-      delete headers["host"];
-      delete headers["content-length"];
-      delete headers["accept-encoding"];
-      headers["content-length"] = String(body.length);
-      const upstreamReq = forward(
-        {
-          protocol: upstream.protocol,
-          hostname: upstream.hostname,
-          port: upstream.port || (upstream.protocol === "https:" ? 443 : 80),
-          method: req.method,
-          path: req.url,
-          headers: { ...headers, host: upstream.host }
-        },
-        (upRes) => {
-          res.writeHead(upRes.statusCode || 502, upRes.headers);
-          upRes.pipe(res);
-        }
-      );
-      upstreamReq.on("error", (e) => {
-        log("upstream error:", e.message);
-        if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" });
-        res.end("shield upstream error");
-      });
-      upstreamReq.end(body);
-    });
-    req.on("error", () => {
-      try {
-        res.destroy();
-      } catch {
-      }
-    });
-  });
-  return new Promise((resolveP) => {
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      resolveP({ port, close: () => server.close() });
-    });
-  });
-}
-async function runShield() {
-  const sep = process.argv.indexOf("--");
-  const cmd = sep !== -1 ? process.argv.slice(sep + 1) : [];
-  if (cmd.length === 0) {
-    log("usage: npx @solongate/proxy shield -- <command> [args...]   (e.g. shield -- claude)");
-    process.exit(1);
-  }
-  const upstream = pickUpstream();
-  const { port, close } = await startProxy(upstream);
-  log(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`);
-  const child = spawn(cmd[0], cmd.slice(1), {
-    stdio: "inherit",
-    env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
-    shell: process.platform === "win32"
-    // resolve `claude.cmd` etc. on Windows
-  });
-  const shutdown = () => {
-    try {
-      close();
-    } catch {
-    }
-  };
-  child.on("exit", (code, signal) => {
-    shutdown();
-    if (signal) process.kill(process.pid, signal);
-    else process.exit(code ?? 0);
-  });
-  child.on("error", (e) => {
-    log("failed to launch command:", e.message);
-    shutdown();
-    process.exit(1);
-  });
-  for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
-    try {
-      child.kill(sig);
-    } catch {
-    }
-  });
-}
-export {
-  runShield
-};