@solongate/proxy 0.82.55 → 0.82.57

package/hooks/audit.mjs

@@ -11,7 +11,7 @@ import { homedir } from 'node:os';
 // Bump on every audit hook change. The cloud serves the newest version; the guard
 // hook installs it on its next run (no re-login needed). See guard.mjs
 // fetchAndInstallHook / maybeSelfUpdate.
-const HOOK_VERSION = 16;
+const HOOK_VERSION = 17;
 
 function loadEnvKey(dir) {
   try {
@@ -131,6 +131,15 @@ function ghostMatch(targetPath, patterns) {
       continue;
     }
     if (re.test(norm)) return true;
+    // A path ghost must also hide the file when a tool lists it by BARE name —
+    // `ls dir/` prints just "secret-plan.txt" (no slash), which a slash-pattern
+    // like `*/secret-plan.txt` would otherwise miss. Match the pattern's last
+    // segment against the target's basename.
+    const patBase = pat.slice(pat.lastIndexOf('/') + 1);
+    if (patBase && patBase !== pat) {
+      const reBase = ghostGlobToRegExp(patBase);
+      if (reBase && reBase.test(base)) return true;
+    }
   }
   return false;
 }
@@ -151,6 +160,10 @@ function ghostStripLines(text, pats) {
     const trimmed = line.trim();
     if (!trimmed) { kept.push(line); continue; }
     if (ghostMatch(trimmed, pats)) continue; // full-path listing line
+    // grep -n / ripgrep output is `path:line:content` (or `path:content`) — the
+    // path is the first colon field. Drop the whole match line if it's a ghost.
+    const firstField = trimmed.split(':')[0];
+    if (firstField && firstField !== trimmed && ghostMatch(firstField, pats)) continue;
     const toks = trimmed.split(/\s+/);
     const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
     if (!anyHit) { kept.push(line); continue; }

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 47;
+var HOOK_VERSION = 48;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;
@@ -7161,6 +7161,73 @@ function extractTargetPaths(args) {
   }
   return out;
 }
+function ghostGlobToRe(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += ".*";
+        i++;
+      } else
+        re += "[^/]*";
+    } else if (c === "?")
+      re += "[^/]";
+    else if ("\\^$.|+()[]{}".indexOf(c) !== -1)
+      re += "\\" + c;
+    else
+      re += c;
+  }
+  try {
+    return new RegExp("^" + re + "$");
+  } catch {
+    return null;
+  }
+}
+function ghostPathMatch(p, patterns) {
+  if (!p)
+    return false;
+  const norm = String(p).replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  if (!norm)
+    return false;
+  const base = norm.split("/").filter(Boolean).pop() || norm;
+  for (let pat of patterns) {
+    pat = String(pat || "").trim().toLowerCase();
+    if (!pat)
+      continue;
+    const re = ghostGlobToRe(pat);
+    if (re && (re.test(norm) || re.test(base)))
+      return true;
+    const patBase = pat.slice(pat.lastIndexOf("/") + 1);
+    if (patBase && patBase !== pat) {
+      const rb = ghostGlobToRe(patBase);
+      if (rb && rb.test(base))
+        return true;
+    }
+  }
+  return false;
+}
+function ghostCheck(toolName, args, sec) {
+  try {
+    const pats = sec && sec.ghost && Array.isArray(sec.ghost.patterns) ? sec.ghost.patterns : [];
+    if (!pats.length)
+      return null;
+    for (const p of extractTargetPaths(args)) {
+      if (ghostPathMatch(p, pats))
+        return String(p) + ": No such file or directory";
+    }
+    for (const cmd of extractCommands(args)) {
+      const c = String(cmd || "").toLowerCase();
+      for (let pat of pats) {
+        const patBase = String(pat || "").trim().toLowerCase().slice(String(pat).lastIndexOf("/") + 1).replace(/[*?]/g, "");
+        if (patBase && patBase.length > 2 && c.includes(patBase))
+          return patBase + ": No such file or directory";
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 function tamperCheck(toolName, args) {
   const tn = String(toolName || "").toLowerCase();
   const isExec = TAMPER_GUARD_TOOLS_EXEC.has(tn) || /bash|shell|exec|powershell|cmd|run|eval/.test(tn);
@@ -7830,12 +7897,14 @@ if (!REFRESH_MODE) {
         } catch {
         }
         const _tr = _cacheOk && _selfProt ? tamperCheck(toolName, args) : null;
-        if (_tr) {
+        const _gr = !_tr && _cacheOk ? ghostCheck(toolName, args, _sec) : null;
+        const _deny = _tr || _gr;
+        if (_deny) {
           const _logEntry = {
             tool: toolName,
             arguments: args,
             decision: "DENY",
-            reason: _tr,
+            reason: _deny,
             permission: guessPermission(toolName),
             source: `${AGENT_TYPE}-guard`,
             agent_id: AGENT_TYPE,
@@ -7860,7 +7929,7 @@ if (!REFRESH_MODE) {
           process.stderr.write(`[SolonGate ROUTE] BLACK (block)
 `);
           writeDenyFlag(toolName);
-          blockTool(_tr);
+          blockTool(_deny);
         }
       } catch (_e) {
         if (_e === SG_DONE)

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 47;
+const HOOK_VERSION = 48;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -874,6 +874,57 @@ function extractTargetPaths(args) {
   return out;
 }
 
+// Ghost paths at PreToolUse: deny any tool call that DIRECTLY targets a hidden
+// path (read/cat/edit/open it). This is the only ghost enforcement possible
+// without rewriting tool OUTPUT — which needs a PostToolUse hook that Antigravity
+// does not run — so a plain `ls dir/` listing (which never names the file) can't
+// be hidden here; only direct access is. On Claude Code the PostToolUse audit
+// additionally strips listings. Deny reason mimics a missing file.
+function ghostGlobToRe(glob) {
+  let re = '';
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === '*') { if (glob[i + 1] === '*') { re += '.*'; i++; } else re += '[^/]*'; }
+    else if (c === '?') re += '[^/]';
+    else if ('\\^$.|+()[]{}'.indexOf(c) !== -1) re += '\\' + c;
+    else re += c;
+  }
+  try { return new RegExp('^' + re + '$'); } catch { return null; }
+}
+function ghostPathMatch(p, patterns) {
+  if (!p) return false;
+  const norm = String(p).replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+  if (!norm) return false;
+  const base = norm.split('/').filter(Boolean).pop() || norm;
+  for (let pat of patterns) {
+    pat = String(pat || '').trim().toLowerCase();
+    if (!pat) continue;
+    const re = ghostGlobToRe(pat);
+    if (re && (re.test(norm) || re.test(base))) return true;
+    const patBase = pat.slice(pat.lastIndexOf('/') + 1);
+    if (patBase && patBase !== pat) { const rb = ghostGlobToRe(patBase); if (rb && rb.test(base)) return true; }
+  }
+  return false;
+}
+function ghostCheck(toolName, args, sec) {
+  try {
+    const pats = sec && sec.ghost && Array.isArray(sec.ghost.patterns) ? sec.ghost.patterns : [];
+    if (!pats.length) return null;
+    for (const p of extractTargetPaths(args)) {
+      if (ghostPathMatch(p, pats)) return String(p) + ': No such file or directory';
+    }
+    // A shell command that names the hidden file (cat/less/head/open <path>).
+    for (const cmd of extractCommands(args)) {
+      const c = String(cmd || '').toLowerCase();
+      for (let pat of pats) {
+        const patBase = String(pat || '').trim().toLowerCase().slice(String(pat).lastIndexOf('/') + 1).replace(/[*?]/g, '');
+        if (patBase && patBase.length > 2 && c.includes(patBase)) return patBase + ': No such file or directory';
+      }
+    }
+  } catch {}
+  return null;
+}
+
 function tamperCheck(toolName, args) {
   const tn = String(toolName || '').toLowerCase();
   const isExec = TAMPER_GUARD_TOOLS_EXEC.has(tn) || /bash|shell|exec|powershell|cmd|run|eval/.test(tn);
@@ -1675,10 +1726,14 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
       // localLogs config). On a cache miss, fall through to the full flow, which
       // resolves the policy properly and still blocks tamper.
       const _tr = (_cacheOk && _selfProt) ? tamperCheck(toolName, args) : null;
-      if (_tr) {
+      // Ghost is a separate layer (not gated by selfProtect): deny direct access
+      // to a hidden path here so it works even where PostToolUse never runs (agy).
+      const _gr = (!_tr && _cacheOk) ? ghostCheck(toolName, args, _sec) : null;
+      const _deny = _tr || _gr;
+      if (_deny) {
         const _logEntry = {
           tool: toolName, arguments: args,
-          decision: 'DENY', reason: _tr,
+          decision: 'DENY', reason: _deny,
           permission: guessPermission(toolName),
           source: `${AGENT_TYPE}-guard`,
           agent_id: AGENT_TYPE, agent_name: AGENT_NAME,
@@ -1696,7 +1751,7 @@ if (!REFRESH_MODE) { try { input += readFileSync(0, 'utf-8'); } catch {} }
         } catch {}
         process.stderr.write(`[SolonGate ROUTE] BLACK (block)\n`);
         writeDenyFlag(toolName);
-        blockTool(_tr); // throws SG_DONE — skips the slow policy path entirely
+        blockTool(_deny); // throws SG_DONE — skips the slow policy path entirely
       }
     } catch (_e) { if (_e === SG_DONE) throw _e; /* else: fall through to full flow */ }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.55",
+  "version": "0.82.57",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {