@solongate/proxy 0.82.47 → 0.82.48

package/dist/index.js

@@ -9516,7 +9516,6 @@ var init_Policies = __esm({
       { label: "Effect", kind: "effect", get: (r) => r.effect },
       { label: "Enabled", kind: "enabled", get: (r) => r.enabled ? "yes" : "no" },
       { label: "Priority", kind: "priority", get: (r) => String(r.priority) },
-      { label: "Tool pattern", kind: "text", get: (r) => r.toolPattern, set: (r, v) => ({ ...r, toolPattern: v || "*" }) },
       { label: "Description", kind: "text", get: (r) => r.description ?? "", set: (r, v) => ({ ...r, description: v }) },
       { label: "Cmd allow", kind: "text", get: (r) => constr(r, "commandConstraints", "allowed"), set: (r, v) => setConstr(r, "commandConstraints", "allowed", v) },
       { label: "Cmd deny", kind: "text", get: (r) => constr(r, "commandConstraints", "denied"), set: (r, v) => setConstr(r, "commandConstraints", "denied", v) },
@@ -13476,13 +13475,20 @@ function analyzeSecurityWarnings(policySet) {
   const allowRules = policySet.rules.filter(
     (r) => r.effect === "ALLOW" && r.enabled
   );
-  const wildcardAllows = allowRules.filter((r) => r.toolPattern === "*");
+  const hasNoConstraint = (r) => {
+    const groups = ["commandConstraints", "pathConstraints", "filenameConstraints", "urlConstraints"];
+    return !groups.some((g) => {
+      const c2 = r[g];
+      return c2 ? (c2.allowed?.length ?? 0) + (c2.denied?.length ?? 0) > 0 : false;
+    });
+  };
+  const wildcardAllows = allowRules.filter(hasNoConstraint);
   if (wildcardAllows.length > 0) {
     warnings.push({
       level: "CRITICAL",
       code: "WILDCARD_ALLOW",
       message: UNSAFE_CONFIGURATION_WARNINGS.WILDCARD_ALLOW,
-      recommendation: "Replace wildcard ALLOW rules with specific tool patterns."
+      recommendation: "Add command or path constraints so an ALLOW rule does not permit everything."
     });
   }
   return warnings;

package/dist/lib.js

@@ -7019,13 +7019,20 @@ function analyzeSecurityWarnings(policySet) {
   const allowRules = policySet.rules.filter(
     (r) => r.effect === "ALLOW" && r.enabled
   );
-  const wildcardAllows = allowRules.filter((r) => r.toolPattern === "*");
+  const hasNoConstraint = (r) => {
+    const groups = ["commandConstraints", "pathConstraints", "filenameConstraints", "urlConstraints"];
+    return !groups.some((g) => {
+      const c = r[g];
+      return c ? (c.allowed?.length ?? 0) + (c.denied?.length ?? 0) > 0 : false;
+    });
+  };
+  const wildcardAllows = allowRules.filter(hasNoConstraint);
   if (wildcardAllows.length > 0) {
     warnings.push({
       level: "CRITICAL",
       code: "WILDCARD_ALLOW",
       message: UNSAFE_CONFIGURATION_WARNINGS.WILDCARD_ALLOW,
-      recommendation: "Replace wildcard ALLOW rules with specific tool patterns."
+      recommendation: "Add command or path constraints so an ALLOW rule does not permit everything."
     });
   }
   return warnings;

package/dist/policy-engine/defaults.d.ts

@@ -11,8 +11,9 @@ export declare function createDefaultDenyPolicySet(): PolicySet;
  */
 export declare function createPermissivePolicySet(): PolicySet;
 /**
- * Creates a read-only policy set for a specific tool pattern.
- * Allows reads for VERIFIED requests only.
+ * Internal helper. Builds a read-only policy set scoped by an internal tool
+ * selector — fixed to "*" in the shipped product; no UI or CLI exposes it, so
+ * users can neither see nor change it. Allows reads for VERIFIED requests only.
  */
 export declare function createReadOnlyPolicySet(toolPattern: string): PolicySet;
 /**

package/dist/tui/index.js

@@ -2430,7 +2430,6 @@ var FIELDS = [
   { label: "Effect", kind: "effect", get: (r) => r.effect },
   { label: "Enabled", kind: "enabled", get: (r) => r.enabled ? "yes" : "no" },
   { label: "Priority", kind: "priority", get: (r) => String(r.priority) },
-  { label: "Tool pattern", kind: "text", get: (r) => r.toolPattern, set: (r, v) => ({ ...r, toolPattern: v || "*" }) },
   { label: "Description", kind: "text", get: (r) => r.description ?? "", set: (r, v) => ({ ...r, description: v }) },
   { label: "Cmd allow", kind: "text", get: (r) => constr(r, "commandConstraints", "allowed"), set: (r, v) => setConstr(r, "commandConstraints", "allowed", v) },
   { label: "Cmd deny", kind: "text", get: (r) => constr(r, "commandConstraints", "denied"), set: (r, v) => setConstr(r, "commandConstraints", "denied", v) },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.47",
+  "version": "0.82.48",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {