@solongate/proxy 0.82.20 → 0.82.22

package/dist/inject.js

@@ -1,375 +0,0 @@
-#!/usr/bin/env node
-
-// src/inject.ts
-import { readFileSync, writeFileSync, existsSync, copyFileSync } from "fs";
-import { resolve } from "path";
-import { execSync } from "child_process";
-
-// src/cli-utils.ts
-var c = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  italic: "\x1B[3m",
-  white: "\x1B[97m",
-  gray: "\x1B[90m",
-  blue1: "\x1B[38;2;20;50;160m",
-  blue2: "\x1B[38;2;40;80;190m",
-  blue3: "\x1B[38;2;60;110;215m",
-  blue4: "\x1B[38;2;90;140;230m",
-  blue5: "\x1B[38;2;130;170;240m",
-  blue6: "\x1B[38;2;170;200;250m",
-  green: "\x1B[38;2;80;200;120m",
-  red: "\x1B[38;2;220;80;80m",
-  cyan: "\x1B[38;2;100;200;220m",
-  yellow: "\x1B[38;2;220;200;80m",
-  bgBlue: "\x1B[48;2;20;50;160m"
-};
-function log(msg) {
-  process.stderr.write(msg + "\n");
-}
-var BANNER_FULL = [
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
-  " \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D",
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2557  ",
-  " \u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u255D  ",
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
-  " \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
-];
-var BANNER_COLORS = [c.blue1, c.blue2, c.blue3, c.blue4, c.blue5, c.blue6];
-function printBanner(subtitle) {
-  log("");
-  for (let i = 0; i < BANNER_FULL.length; i++) {
-    log(`${c.bold}${BANNER_COLORS[i]}${BANNER_FULL[i]}${c.reset}`);
-  }
-  log("");
-  log(`  ${c.dim}${c.italic}${subtitle}${c.reset}`);
-  log("");
-}
-
-// src/inject.ts
-function parseInjectArgs(argv) {
-  const args = argv.slice(2);
-  const opts = {
-    dryRun: false,
-    restore: false,
-    skipInstall: false
-  };
-  for (let i = 0; i < args.length; i++) {
-    switch (args[i]) {
-      case "--file":
-        opts.file = args[++i];
-        break;
-      case "--dry-run":
-        opts.dryRun = true;
-        break;
-      case "--restore":
-        opts.restore = true;
-        break;
-      case "--skip-install":
-        opts.skipInstall = true;
-        break;
-      case "--help":
-      case "-h":
-        printHelp();
-        process.exit(0);
-    }
-  }
-  return opts;
-}
-function printHelp() {
-  log(`
-SolonGate Inject \u2014 Add security to your MCP server in seconds
-
-USAGE
-  npx @solongate/proxy inject [options]
-
-OPTIONS
-  --file <path>       Entry file to modify (default: auto-detect)
-  --dry-run           Preview changes without writing
-  --restore           Restore original file from backup
-  --skip-install      Don't install SDK package
-  -h, --help          Show this help message
-
-EXAMPLES
-  npx @solongate/proxy inject                    # Auto-detect and inject
-  npx @solongate/proxy inject --file src/main.ts # Specify entry file
-  npx @solongate/proxy inject --dry-run          # Preview changes
-  npx @solongate/proxy inject --restore          # Undo injection
-
-WHAT IT DOES
-  Replaces McpServer with SecureMcpServer (2 lines changed)
-  All tool() calls are automatically protected by SolonGate.
-`);
-}
-function detectProject() {
-  if (!existsSync(resolve("package.json"))) return false;
-  try {
-    const pkg = JSON.parse(readFileSync(resolve("package.json"), "utf-8"));
-    const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    return !!(allDeps["@modelcontextprotocol/sdk"] || allDeps["@modelcontextprotocol/server"]);
-  } catch {
-    return false;
-  }
-}
-function findTsEntryFile() {
-  try {
-    const pkg = JSON.parse(readFileSync(resolve("package.json"), "utf-8"));
-    if (pkg.bin) {
-      const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
-      if (typeof binPath === "string") {
-        const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync(resolve(srcPath))) return resolve(srcPath);
-        if (existsSync(resolve(binPath))) return resolve(binPath);
-      }
-    }
-    if (pkg.main) {
-      const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync(resolve(srcPath))) return resolve(srcPath);
-    }
-  } catch {
-  }
-  const candidates = [
-    "src/index.ts",
-    "src/server.ts",
-    "src/main.ts",
-    "index.ts",
-    "server.ts",
-    "main.ts"
-  ];
-  for (const c2 of candidates) {
-    const full = resolve(c2);
-    if (existsSync(full)) {
-      try {
-        const content = readFileSync(full, "utf-8");
-        if (content.includes("McpServer") || content.includes("McpServer")) {
-          return full;
-        }
-      } catch {
-      }
-    }
-  }
-  for (const c2 of candidates) {
-    if (existsSync(resolve(c2))) return resolve(c2);
-  }
-  return null;
-}
-function detectPackageManager() {
-  if (existsSync(resolve("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync(resolve("yarn.lock"))) return "yarn";
-  return "npm";
-}
-function installSdk() {
-  try {
-    const pkg = JSON.parse(readFileSync(resolve("package.json"), "utf-8"));
-    const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    if (allDeps["@solongate/proxy"]) {
-      log("  @solongate/proxy already installed");
-      return true;
-    }
-  } catch {
-  }
-  const pm = detectPackageManager();
-  const cmd = pm === "yarn" ? "yarn add @solongate/proxy" : `${pm} install @solongate/proxy`;
-  log(`  Installing @solongate/proxy via ${pm}...`);
-  try {
-    execSync(cmd, { stdio: "pipe", cwd: process.cwd() });
-    return true;
-  } catch (err) {
-    log(`  Failed to install: ${err instanceof Error ? err.message : String(err)}`);
-    log("  You can install manually: npm install @solongate/proxy");
-    return false;
-  }
-}
-function injectTypeScript(filePath) {
-  const original = readFileSync(filePath, "utf-8");
-  const changes = [];
-  let modified = original;
-  if (modified.includes("SecureMcpServer")) {
-    return { file: filePath, changes: ["Already injected \u2014 skipping"], original, modified };
-  }
-  const mcpImportPatterns = [
-    // Solo import: import { McpServer } from '...'
-    /import\s*\{\s*McpServer\s*\}\s*from\s*['"][^'"]+['"]/,
-    // Import with others: import { McpServer, ... } from '...'
-    /import\s*\{[^}]*McpServer[^}]*\}\s*from\s*['"][^'"]+['"]/
-  ];
-  let importReplaced = false;
-  for (const pattern of mcpImportPatterns) {
-    const match = modified.match(pattern);
-    if (match) {
-      const importLine = match[0];
-      const namedImports = importLine.match(/\{([^}]+)\}/)?.[1] ?? "";
-      const importNames = namedImports.split(",").map((s) => s.trim()).filter(Boolean);
-      if (importNames.length === 1 && importNames[0] === "McpServer") {
-        modified = modified.replace(
-          importLine,
-          `import { SecureMcpServer } from '@solongate/proxy'`
-        );
-        changes.push("Replaced McpServer import with SecureMcpServer from @solongate/proxy");
-      } else {
-        const otherImports = importNames.filter((n) => n !== "McpServer");
-        const fromModule = importLine.match(/from\s*['"]([^'"]+)['"]/)?.[1] ?? "";
-        modified = modified.replace(
-          importLine,
-          `import { ${otherImports.join(", ")} } from '${fromModule}';
-import { SecureMcpServer } from '@solongate/proxy'`
-        );
-        changes.push("Removed McpServer from existing import, added SecureMcpServer import from @solongate/proxy");
-      }
-      importReplaced = true;
-      break;
-    }
-  }
-  if (!importReplaced) {
-    const insertPos = findImportInsertPosition(modified);
-    modified = modified.slice(0, insertPos) + `import { SecureMcpServer } from '@solongate/proxy';
-` + modified.slice(insertPos);
-    changes.push("Added SecureMcpServer import from @solongate/proxy");
-  }
-  const constructorPattern = /new\s+McpServer\s*\(/g;
-  const constructorCount = (modified.match(constructorPattern) || []).length;
-  if (constructorCount > 0) {
-    modified = modified.replace(constructorPattern, "new SecureMcpServer(");
-    changes.push(`Replaced ${constructorCount} McpServer constructor(s) with SecureMcpServer`);
-  }
-  return { file: filePath, changes, original, modified };
-}
-function findImportInsertPosition(content) {
-  let pos = 0;
-  if (content.startsWith("#!")) {
-    pos = content.indexOf("\n") + 1;
-  }
-  const lines = content.slice(pos).split("\n");
-  let offset = pos;
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (trimmed === "" || trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*") || trimmed.startsWith("*/")) {
-      offset += line.length + 1;
-    } else {
-      break;
-    }
-  }
-  const importRegex = /^import\s+.+$/gm;
-  let lastImportEnd = offset;
-  let importMatch;
-  while ((importMatch = importRegex.exec(content)) !== null) {
-    lastImportEnd = importMatch.index + importMatch[0].length + 1;
-  }
-  return lastImportEnd > offset ? lastImportEnd : offset;
-}
-function showDiff(result) {
-  if (result.original === result.modified) {
-    log("  No changes needed.");
-    return;
-  }
-  const origLines = result.original.split("\n");
-  const modLines = result.modified.split("\n");
-  log("");
-  log(`  File: ${result.file}`);
-  log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  const maxLines = Math.max(origLines.length, modLines.length);
-  let diffCount = 0;
-  for (let i = 0; i < maxLines; i++) {
-    const orig = origLines[i];
-    const mod = modLines[i];
-    if (orig !== mod) {
-      if (diffCount < 30) {
-        if (orig !== void 0) log(`  - ${orig}`);
-        if (mod !== void 0) log(`  + ${mod}`);
-      }
-      diffCount++;
-    }
-  }
-  if (diffCount > 30) {
-    log(`  ... and ${diffCount - 30} more line changes`);
-  }
-  log("");
-}
-async function main() {
-  const opts = parseInjectArgs(process.argv);
-  printBanner("Inject SDK");
-  if (!detectProject()) {
-    log("  Could not detect a TypeScript MCP server project.");
-    log("  Make sure you are in a project directory with:");
-    log("    package.json + @modelcontextprotocol/sdk in dependencies");
-    log("");
-    log("  To create a new MCP server: npx @solongate/proxy create <name>");
-    process.exit(1);
-  }
-  log("  Language: TypeScript");
-  const entryFile = opts.file ? resolve(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync(entryFile)) {
-    log(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
-    log("");
-    log("  Specify it manually: --file <path>");
-    log("");
-    log("  Common entry points:");
-    log("    src/index.ts, src/server.ts, index.ts");
-    process.exit(1);
-  }
-  log(`  Entry:    ${entryFile}`);
-  log("");
-  const backupPath = entryFile + ".solongate-backup";
-  if (opts.restore) {
-    if (!existsSync(backupPath)) {
-      log("  No backup found. Nothing to restore.");
-      process.exit(1);
-    }
-    copyFileSync(backupPath, entryFile);
-    log(`  Restored original file from backup.`);
-    log(`  Backup: ${backupPath}`);
-    process.exit(0);
-  }
-  if (!opts.skipInstall && !opts.dryRun) {
-    installSdk();
-    log("");
-  }
-  const result = injectTypeScript(entryFile);
-  log(`  Changes (${result.changes.length}):`);
-  for (const change of result.changes) {
-    log(`    - ${change}`);
-  }
-  if (result.changes.length === 1 && result.changes[0].includes("Already injected")) {
-    log("");
-    log("  Your MCP server is already protected by SolonGate!");
-    process.exit(0);
-  }
-  if (result.original === result.modified) {
-    log("");
-    log("  No changes were made. The file may not contain recognizable MCP patterns.");
-    log("  See docs: https://solongate.com/docs/integration");
-    process.exit(0);
-  }
-  if (opts.dryRun) {
-    log("");
-    log("  --- DRY RUN (no changes written) ---");
-    showDiff(result);
-    log("  To apply: npx @solongate/proxy inject");
-    process.exit(0);
-  }
-  if (!existsSync(backupPath)) {
-    copyFileSync(entryFile, backupPath);
-    log("");
-    log(`  Backup: ${backupPath}`);
-  }
-  writeFileSync(entryFile, result.modified);
-  log("");
-  log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-  log("  \u2502  SolonGate SDK injected successfully!         \u2502");
-  log("  \u2502                                               \u2502");
-  log("  \u2502  McpServer \u2192 SecureMcpServer                  \u2502");
-  log("  \u2502  All tool() calls are now auto-protected.     \u2502");
-  log("  \u2502                                               \u2502");
-  log("  \u2502  Set your API key:                             \u2502");
-  log("  \u2502    export SOLONGATE_API_KEY=sg_live_xxx        \u2502");
-  log("  \u2502                                               \u2502");
-  log("  \u2502  To undo:                                     \u2502");
-  log("  \u2502    npx @solongate/proxy inject --restore       \u2502");
-  log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-  log("");
-}
-main().catch((err) => {
-  log(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
-  process.exit(1);
-});

package/dist/shield.d.ts

@@ -1 +0,0 @@
-export declare function runShield(): Promise<void>;

package/dist/shield.js

@@ -1,314 +0,0 @@
-// src/shield.ts
-import { createServer, request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-import { spawn } from "child_process";
-import { URL } from "url";
-import { readFileSync, existsSync, readdirSync, statSync } from "fs";
-import { resolve } from "path";
-import { homedir } from "os";
-var log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}
-`);
-var DLP_PATTERNS = [
-  { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },
-  { name: "Private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
-  { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-  { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
-  { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
-  { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },
-  { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },
-  { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
-  { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
-  { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },
-  { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },
-  { name: "JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
-  { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi }
-];
-function findCacheFile() {
-  const dir = resolve(homedir(), ".solongate");
-  const envSel = process.env.SOLONGATE_AGENT_ID;
-  if (envSel) {
-    const f = resolve(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync(f)) return f;
-  }
-  let best = null, bestTs = -1;
-  try {
-    for (const name of readdirSync(dir)) {
-      if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
-        const full = resolve(dir, name);
-        const ts = statSync(full).mtimeMs;
-        if (ts > bestTs) {
-          bestTs = ts;
-          best = full;
-        }
-      }
-    }
-  } catch {
-  }
-  return best;
-}
-function loadCfg() {
-  try {
-    const f = findCacheFile();
-    if (f && existsSync(f)) {
-      const c = JSON.parse(readFileSync(f, "utf-8"));
-      const d = c?.security?.dlpRedact;
-      const g = c?.security?.ghost;
-      const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
-      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [], ghost };
-      return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost };
-    }
-  } catch {
-  }
-  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost: [] };
-}
-function ghostGlobToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        re += ".*";
-        i++;
-      } else re += "[^/]*";
-    } else if (c === "?") re += "[^/]";
-    else if ("\\^$.|+()[]{}".indexOf(c) !== -1) re += "\\" + c;
-    else re += c;
-  }
-  try {
-    return new RegExp("^" + re + "$");
-  } catch {
-    return null;
-  }
-}
-function ghostMatch(targetPath, patterns) {
-  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
-  const norm = String(targetPath).replace(/\\/g, "/").replace(/\/+$/, "");
-  if (!norm) return false;
-  const segments = norm.split("/").filter(Boolean);
-  const base = segments.length ? segments[segments.length - 1] : norm;
-  for (let pat of patterns) {
-    pat = String(pat || "").trim();
-    if (!pat) continue;
-    let dirOnly = false;
-    if (pat.endsWith("/")) {
-      dirOnly = true;
-      pat = pat.slice(0, -1);
-    }
-    if (!pat) continue;
-    const hasSlash = pat.indexOf("/") !== -1;
-    const hasWild = /[*?]/.test(pat);
-    const re = ghostGlobToRegExp(pat);
-    if (!re) continue;
-    if (dirOnly) {
-      if (!hasSlash && !hasWild) {
-        if (segments.indexOf(pat) !== -1) return true;
-        continue;
-      }
-      let acc = "";
-      for (const s of segments) {
-        acc = acc ? acc + "/" + s : s;
-        if (re.test(acc) || re.test(s)) return true;
-      }
-      continue;
-    }
-    if (!hasSlash) {
-      if (re.test(base)) return true;
-      if (segments.some((s) => re.test(s))) return true;
-      continue;
-    }
-    if (re.test(norm)) return true;
-  }
-  return false;
-}
-function ghostCleanToken(tok) {
-  let t = String(tok || "").trim();
-  t = t.replace(/^[<>|;&(]+/, "").replace(/[);&|]+$/, "");
-  t = t.replace(/^['"]+/, "").replace(/['"]+$/, "");
-  t = t.replace(/^\d*>>?/, "");
-  return t.trim();
-}
-function ghostStripLines(text, pats) {
-  if (!Array.isArray(pats) || pats.length === 0) return text;
-  const lines = String(text).split("\n");
-  const kept = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      kept.push(line);
-      continue;
-    }
-    if (ghostMatch(trimmed, pats)) continue;
-    const toks = trimmed.split(/\s+/);
-    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
-    if (!anyHit) {
-      kept.push(line);
-      continue;
-    }
-    if (toks.length > 3) continue;
-    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
-    if (remaining.length === 0) continue;
-    kept.push(remaining.join("  "));
-  }
-  return kept.join("\n");
-}
-function dlpGlobToRe(glob, flags) {
-  let re = "";
-  for (const ch of String(glob || "")) {
-    if (ch === "*") re += "[^\\s]*";
-    else if (".+?^${}()|[]\\".indexOf(ch) !== -1) re += "\\" + ch;
-    else re += ch;
-  }
-  return new RegExp(re, flags);
-}
-function redactString(s, cfg) {
-  if (!cfg || typeof s !== "string" || !s) return s;
-  const allow = new Set(cfg.patterns);
-  const NUL = String.fromCharCode(0);
-  const labels = [];
-  const stash = (label) => NUL + (labels.push(label) - 1) + NUL;
-  let out = s;
-  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, () => stash(`[REDACTED: ${p.name}]`));
-  for (const c of cfg.custom) {
-    try {
-      out = out.replace(dlpGlobToRe(c.re, "gi"), () => stash(`[REDACTED: ${c.name || "custom"}]`));
-    } catch {
-    }
-  }
-  return out.replace(new RegExp(NUL + "(\\d+)" + NUL, "g"), (_, i) => labels[+i] || "");
-}
-function redactDeep(value, cfg) {
-  const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
-  if (typeof value === "string") {
-    let out = redactString(value, cfg);
-    if (ghost && ghost.length) out = ghostStripLines(out, ghost);
-    if (out === "" && value !== "") out = "\n";
-    return out;
-  }
-  if (Array.isArray(value)) {
-    const arr = ghost && ghost.length ? value.filter((v) => !(typeof v === "string" && ghostMatch(v.trim(), ghost))) : value;
-    return arr.map((v) => redactDeep(v, cfg));
-  }
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v, cfg);
-    return out;
-  }
-  return value;
-}
-function pickUpstream() {
-  const raw = process.env.SOLONGATE_SHIELD_UPSTREAM || process.env.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
-  try {
-    return new URL(raw);
-  } catch {
-    return new URL("https://api.anthropic.com");
-  }
-}
-function startProxy(upstream) {
-  const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
-  const server = createServer((req, res) => {
-    const cfg = loadCfg();
-    const chunks = [];
-    req.on("data", (c) => chunks.push(c));
-    req.on("end", () => {
-      let body = Buffer.concat(chunks);
-      try {
-        if (body.length && (req.headers["content-type"] || "").includes("json")) {
-          const parsed = JSON.parse(body.toString("utf-8"));
-          if (parsed && typeof parsed === "object" && Array.isArray(parsed["messages"])) {
-            if (parsed["system"] !== void 0) parsed["system"] = redactDeep(parsed["system"], cfg);
-            const msgs = parsed["messages"];
-            for (let i = 0; i < msgs.length; i++) {
-              const m = msgs[i];
-              if (m && m["role"] !== "assistant") msgs[i] = redactDeep(m, cfg);
-            }
-            body = Buffer.from(JSON.stringify(parsed), "utf-8");
-          } else {
-            body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), "utf-8");
-          }
-        }
-      } catch {
-      }
-      const headers = { ...req.headers };
-      delete headers["host"];
-      delete headers["content-length"];
-      delete headers["accept-encoding"];
-      headers["content-length"] = String(body.length);
-      const upstreamReq = forward(
-        {
-          protocol: upstream.protocol,
-          hostname: upstream.hostname,
-          port: upstream.port || (upstream.protocol === "https:" ? 443 : 80),
-          method: req.method,
-          path: req.url,
-          headers: { ...headers, host: upstream.host }
-        },
-        (upRes) => {
-          res.writeHead(upRes.statusCode || 502, upRes.headers);
-          upRes.pipe(res);
-        }
-      );
-      upstreamReq.on("error", (e) => {
-        log("upstream error:", e.message);
-        if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" });
-        res.end("shield upstream error");
-      });
-      upstreamReq.end(body);
-    });
-    req.on("error", () => {
-      try {
-        res.destroy();
-      } catch {
-      }
-    });
-  });
-  return new Promise((resolveP) => {
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      resolveP({ port, close: () => server.close() });
-    });
-  });
-}
-async function runShield() {
-  const sep = process.argv.indexOf("--");
-  const cmd = sep !== -1 ? process.argv.slice(sep + 1) : [];
-  if (cmd.length === 0) {
-    log("usage: npx @solongate/proxy shield -- <command> [args...]   (e.g. shield -- claude)");
-    process.exit(1);
-  }
-  const upstream = pickUpstream();
-  const { port, close } = await startProxy(upstream);
-  log(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`);
-  const child = spawn(cmd[0], cmd.slice(1), {
-    stdio: "inherit",
-    env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
-    shell: process.platform === "win32"
-    // resolve `claude.cmd` etc. on Windows
-  });
-  const shutdown = () => {
-    try {
-      close();
-    } catch {
-    }
-  };
-  child.on("exit", (code, signal) => {
-    shutdown();
-    if (signal) process.kill(process.pid, signal);
-    else process.exit(code ?? 0);
-  });
-  child.on("error", (e) => {
-    log("failed to launch command:", e.message);
-    shutdown();
-    process.exit(1);
-  });
-  for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
-    try {
-      child.kill(sig);
-    } catch {
-    }
-  });
-}
-export {
-  runShield
-};