@solongate/proxy 0.83.41 → 0.83.43

package/hooks/guard.bundled.mjs

@@ -6579,7 +6579,7 @@ function sweepLegacyFlagDir() {
   } catch {
   }
 }
-var HOOK_VERSION = 81;
+var HOOK_VERSION = 82;
 var SG_REFRESH_ARG = process.argv.includes("--sg-refresh-policy");
 var SG_STDIN = SG_REFRESH_ARG ? "" : (() => {
   try {
@@ -7402,6 +7402,72 @@ function extractPaths(args, isExec) {
   }
   return paths;
 }
+var SEARCH_WALK_MAX_FILES = 2e3;
+var SEARCH_WALK_MAX_DEPTH = 8;
+var SEARCH_SKIP_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  ".venv",
+  "venv",
+  "vendor",
+  "dist",
+  "build",
+  "target",
+  "__pycache__",
+  ".next",
+  ".turbo"
+]);
+function isContentSearchTool(tool) {
+  const n = String(tool || "").toLowerCase();
+  if (n.includes("websearch") || n.includes("web_search"))
+    return false;
+  return n.includes("grep") || n.includes("search") || n.includes("ripgrep");
+}
+function walkSearchRoot(root, budget, depth, out) {
+  if (budget.n <= 0 || depth > SEARCH_WALK_MAX_DEPTH)
+    return;
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (budget.n <= 0)
+      return;
+    const p = root + "/" + e.name;
+    if (e.isDirectory()) {
+      if (SEARCH_SKIP_DIRS.has(e.name))
+        continue;
+      walkSearchRoot(p, budget, depth + 1, out);
+      continue;
+    }
+    budget.n--;
+    out.push(p);
+  }
+}
+function expandSearchRoots(tool, args, cwd) {
+  if (!isContentSearchTool(tool) || !args || typeof args !== "object")
+    return [];
+  const base = cwd || process.cwd();
+  const out = [];
+  const budget = { n: SEARCH_WALK_MAX_FILES };
+  for (const v of scanStrings(args)) {
+    if (budget.n <= 0)
+      break;
+    if (/^https?:\/\//i.test(v) || !/[/\\]/.test(v))
+      continue;
+    const root = v.startsWith("/") ? v : base + "/" + v;
+    try {
+      if (!statSync(root).isDirectory())
+        continue;
+    } catch {
+      continue;
+    }
+    walkSearchRoot(root.replace(/\/+$/, ""), budget, 0, out);
+  }
+  return out;
+}
 function expandCommandGlobs(args, cwd) {
   const out = [];
   try {
@@ -8431,6 +8497,12 @@ async function evaluateWithOpa(policy, args, toolName, cwd) {
           input2.filenames.push(bn);
       }
     }
+    for (const sp of expandSearchRoots(toolName, expandedArgs, cwd)) {
+      input2.paths.push(sp);
+      const bn = sp.split("/").pop();
+      if (bn)
+        input2.filenames.push(bn);
+    }
     if (process.env.SOLONGATE_DEBUG) {
     }
     const results = opaPolicy.evaluate(input2);

package/hooks/guard.mjs

@@ -82,7 +82,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 81;
+const HOOK_VERSION = 82;
 
 // ── The Go guard, when there is one and it is the right one ──────────────────
 //
@@ -1346,6 +1346,67 @@ function extractPaths(args, isExec) {
 // the glob to `staging.env` here lets the rule see (and block) it, regardless of
 // WHICH reader the model used. Bounded to a single directory level; returns real
 // absolute paths. cwd is the agent's working dir (see hook payload).
+// The files a content-returning search rooted at these arguments could return.
+//
+// Bounded and fail-open by construction: this is hardening on top of the
+// literal match, never the thing standing between a call and a decision, so an
+// unreadable tree or an exhausted budget leaves the literal match on its own
+// rather than denying.
+const SEARCH_WALK_MAX_FILES = 2000;
+const SEARCH_WALK_MAX_DEPTH = 8;
+const SEARCH_SKIP_DIRS = new Set([
+  '.git', 'node_modules', '.venv', 'venv', 'vendor', 'dist', 'build', 'target',
+  '__pycache__', '.next', '.turbo',
+]);
+
+// `websearch` reaches the network, not the disk, and guessPermission already
+// puts it in NETWORK.
+function isContentSearchTool(tool) {
+  const n = String(tool || '').toLowerCase();
+  if (n.includes('websearch') || n.includes('web_search')) return false;
+  return n.includes('grep') || n.includes('search') || n.includes('ripgrep');
+}
+
+function walkSearchRoot(root, budget, depth, out) {
+  if (budget.n <= 0 || depth > SEARCH_WALK_MAX_DEPTH) return;
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (budget.n <= 0) return;
+    const p = root + '/' + e.name;
+    if (e.isDirectory()) {
+      if (SEARCH_SKIP_DIRS.has(e.name)) continue;
+      walkSearchRoot(p, budget, depth + 1, out);
+      continue;
+    }
+    budget.n--;
+    out.push(p);
+  }
+}
+
+function expandSearchRoots(tool, args, cwd) {
+  if (!isContentSearchTool(tool) || !args || typeof args !== 'object') return [];
+  const base = cwd || process.cwd();
+  const out = [];
+  const budget = { n: SEARCH_WALK_MAX_FILES };
+  for (const v of scanStrings(args)) {
+    if (budget.n <= 0) break;
+    if (/^https?:\/\//i.test(v) || !/[/\\]/.test(v)) continue;
+    const root = v.startsWith('/') ? v : base + '/' + v;
+    try {
+      if (!statSync(root).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    walkSearchRoot(root.replace(/\/+$/, ''), budget, 0, out);
+  }
+  return out;
+}
+
 function expandCommandGlobs(args, cwd) {
   const out = [];
   try {
@@ -2463,6 +2524,22 @@ async function evaluateWithOpa(policy, args, toolName, cwd) {
         if (bn) input.filenames.push(bn);
       }
     }
+    // A grep-style tool is a READ of every file under its root, and its
+    // arguments say none of that: they carry the root and a query, never the
+    // files whose contents come back. So the guard saw a search of a directory
+    // no rule mentions, matched nothing, and allowed it — the rule held against
+    // the read tool and was walked past by the search tool beside it.
+    //
+    // Measured on Antigravity: view_file on a denied path is refused, and
+    // grep_search rooted at the workspace returns the same file's contents.
+    //
+    // Same move as the glob expansion above: resolve what the call will actually
+    // reach so the rules already written can see it. Every bound fails OPEN.
+    for (const sp of expandSearchRoots(toolName, expandedArgs, cwd)) {
+      input.paths.push(sp);
+      const bn = sp.split('/').pop();
+      if (bn) input.filenames.push(bn);
+    }
     if (process.env.SOLONGATE_DEBUG) {
     }
     const results = opaPolicy.evaluate(input);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.41",
+  "version": "0.83.43",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {
@@ -61,12 +61,12 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@solongate/guard-linux-x64": "0.83.41",
-    "@solongate/guard-linux-arm64": "0.83.41",
-    "@solongate/guard-darwin-x64": "0.83.41",
-    "@solongate/guard-darwin-arm64": "0.83.41",
-    "@solongate/guard-win32-x64": "0.83.41",
-    "@solongate/guard-win32-arm64": "0.83.41"
+    "@solongate/guard-linux-x64": "0.83.43",
+    "@solongate/guard-linux-arm64": "0.83.43",
+    "@solongate/guard-darwin-x64": "0.83.43",
+    "@solongate/guard-darwin-arm64": "0.83.43",
+    "@solongate/guard-win32-x64": "0.83.43",
+    "@solongate/guard-win32-arm64": "0.83.43"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",