@solongate/proxy 0.83.51 → 0.83.52

package/hooks/guard.bundled.mjs

@@ -6579,7 +6579,7 @@ function sweepLegacyFlagDir() {
   } catch {
   }
 }
-var HOOK_VERSION = 89;
+var HOOK_VERSION = 90;
 var SG_REFRESH_ARG = process.argv.includes("--sg-refresh-policy");
 var SG_STDIN = SG_REFRESH_ARG ? "" : (() => {
   try {
@@ -8813,6 +8813,7 @@ if (!REFRESH_MODE) {
       if (process.env.SOLONGATE_DEBUG) {
       }
       let reason = selfProtectEnabled ? tamperCheck(toolName, args) : null;
+      let pendingGhostPatch = null;
       if (!reason && securityCfg && securityCfg.ghost) {
         const ghostHit = ghostBlock(toolName, args, securityCfg.ghost);
         if (ghostHit) {
@@ -8842,7 +8843,7 @@ if (!REFRESH_MODE) {
         if (toolName === "Bash" || toolName === "run_command" || guessPermission(toolName) === "EXECUTE") {
           const rw = ghostListingRewrite(args, securityCfg.ghost);
           if (rw)
-            rewriteTool({ command: rw });
+            pendingGhostPatch = { command: rw };
         }
       }
       if (!reason)
@@ -8876,9 +8877,12 @@ if (!REFRESH_MODE) {
           reason = "Security layer (DLP): reading a file that contains a secret is blocked. Blocked by SolonGate.";
           opaRoute = "black";
         } else if (plan && plan.rewrite) {
-          rewriteTool(plan.rewrite);
+          rewriteTool({ ...pendingGhostPatch || {}, ...plan.rewrite });
+          pendingGhostPatch = null;
         }
       }
+      if (!reason && pendingGhostPatch)
+        rewriteTool(pendingGhostPatch);
       if (AGENT_TYPE !== "codex")
         process.stderr.write(`[SolonGate ROUTE] ${opaRoute.toUpperCase()} (${reason ? "block" : "allow"})
 `);

package/hooks/guard.mjs

@@ -82,7 +82,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 89;
+const HOOK_VERSION = 90;
 
 // ── The Go guard, when there is one and it is the right one ──────────────────
 //
@@ -2968,6 +2968,9 @@ if (!REFRESH_MODE) { input += SG_STDIN; }
     // Tamper / self-protection — runs before policy eval. ON by default; the
     // per-project cloud setting can disable it (fail safe: stays on if unread).
     let reason = selfProtectEnabled ? tamperCheck(toolName, args) : null;
+    // A ghost listing rewrite decided BELOW but applied at the very end, so that
+    // rewriting a call is never the same thing as approving it.
+    let pendingGhostPatch = null;
     // Ghost paths — handled BEFORE the other layers and emitted as a STEALTH
     // block: a mutating op on a hidden path is denied with a bare OS-style
     // "No such file or directory" and NOTHING else (no ROUTE line, no SolonGate
@@ -3000,7 +3003,13 @@ if (!REFRESH_MODE) { input += SG_STDIN; }
       // PreToolUse `overwrite` replaces the command before it runs (hooks.md).
       if (toolName === 'Bash' || toolName === 'run_command' || guessPermission(toolName) === 'EXECUTE') {
         const rw = ghostListingRewrite(args, securityCfg.ghost);
-        if (rw) rewriteTool({ command: rw }); // verdict first, update later
+        // HELD, not emitted. Emitting a rewrite ends the hook, so doing it here
+        // meant the DLP argument scan, the rate limit and the POLICY never ran
+        // for any call ghost touched — under a whitelist, `ls` in a project with
+        // a ghost route was allowed whatever the policy said. Same reasoning as
+        // the DLP read-redaction below, which was moved after policy eval for
+        // exactly this failure. Applied at the end, once every layer has spoken.
+        if (rw) pendingGhostPatch = { command: rw };
       }
     }
     // Extra security layers run after tamper, before policy. Block reason wins
@@ -3070,10 +3079,18 @@ if (!REFRESH_MODE) { input += SG_STDIN; }
         reason = 'Security layer (DLP): reading a file that contains a secret is blocked. Blocked by SolonGate.';
         opaRoute = 'black';
       } else if (plan && plan.rewrite) {
-        rewriteTool(plan.rewrite); // verdict first, update later
+        // Both patches can be live at once (a listing ghost filters, pointed at a
+        // redacted copy). Redaction wins any key they share: it is the one that
+        // keeps a secret out of the agent's hands.
+        rewriteTool({ ...(pendingGhostPatch || {}), ...plan.rewrite }); // verdict first, update later
+        pendingGhostPatch = null;
       }
     }
 
+    // The held ghost rewrite, applied only now that tamper, DLP, the rate limit
+    // and the policy have all had their say and none of them blocked.
+    if (!reason && pendingGhostPatch) rewriteTool(pendingGhostPatch);
+
     // Diagnostic line for the terminal. NOT written on Codex: there the hook's
     // ENTIRE stderr becomes the block reason shown to the model (exit 2), so this
     // would prefix every denial with "[SolonGate ROUTE] BLACK (block)".

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.51",
+  "version": "0.83.52",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {
@@ -61,12 +61,12 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@solongate/guard-linux-x64": "0.83.51",
-    "@solongate/guard-linux-arm64": "0.83.51",
-    "@solongate/guard-darwin-x64": "0.83.51",
-    "@solongate/guard-darwin-arm64": "0.83.51",
-    "@solongate/guard-win32-x64": "0.83.51",
-    "@solongate/guard-win32-arm64": "0.83.51"
+    "@solongate/guard-linux-x64": "0.83.52",
+    "@solongate/guard-linux-arm64": "0.83.52",
+    "@solongate/guard-darwin-x64": "0.83.52",
+    "@solongate/guard-darwin-arm64": "0.83.52",
+    "@solongate/guard-win32-x64": "0.83.52",
+    "@solongate/guard-win32-arm64": "0.83.52"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",