0sec-cli 0.24.1 → 0.26.0

package/chunks/{chunk-CGBDEST2.js → chunk-VJBEB2K6.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   getFindingPriority
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/disclose/cwe.js
 var CWE_MAP = {

package/chunks/{chunk-ILRMLA6J.js → chunk-VWE36MUN.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   VERSION
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/cli/src/tui/runtime.ts
 function getReleaseChannel(env = process.env) {

package/chunks/{chunk-RURJYCWY.js → chunk-WNWDQ2TO.js}

@@ -8,7 +8,7 @@ import {
   osecDB,
   repairOsecDatabase,
   resetOsecDatabase
-} from "./chunk-BMDG6T7D.js";
+} from "./chunk-72PU46MS.js";
 
 // packages/cli/src/commands/db.ts
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-GTED3FSZ.js → chunk-WPJMA5AK.js}

@@ -4,15 +4,16 @@ const require = __0CreateRequire(import.meta.url);
 import {
   analyzeFindingForKnownMarkers,
   detectKnownMarkers,
+  evidenceKindForFinding,
   require_dist
-} from "./chunk-IXT64DV5.js";
+} from "./chunk-XPDJE537.js";
 import {
   extractFileRefs,
   redactSensitiveHeaders
-} from "./chunk-CGBDEST2.js";
+} from "./chunk-VJBEB2K6.js";
 import {
   getFindingPriority
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   __toESM
 } from "./chunk-VCSFCHAJ.js";
@@ -790,99 +791,6 @@ function isPubliclyDisclosed(record) {
   return PUBLIC_STATUSES.has(record.status);
 }
 
-// packages/core/dist/triage/can-auto-suppress.js
-var PROTECTED_SEVERITIES = /* @__PURE__ */ new Set([
-  "critical",
-  "high"
-]);
-var HIGH_IMPACT_CATEGORIES = /* @__PURE__ */ new Set([
-  // Remote code / command / code execution
-  "command-injection",
-  "code-injection",
-  // Injection into the data store
-  "sql-injection",
-  // Unsafe deserialization is a classic RCE primitive
-  "unsafe-deserialization",
-  // Server-side request forgery (pivot / internal network reach)
-  "ssrf",
-  // Arbitrary file read/write
-  "path-traversal",
-  // Memory corruption / binary / kernel classes
-  "heap-overflow",
-  "out-of-bounds-read",
-  "out-of-bounds-write",
-  "use-after-free",
-  "stack-buffer-overflow",
-  "integer-overflow",
-  "type-confusion",
-  "double-free",
-  "format-string",
-  "uninitialized-memory",
-  "race-condition",
-  "toctou",
-  // Supply-chain compromise (known-vulnerable / malicious package)
-  "known-vulnerable-package",
-  "supply-chain",
-  // Prototype-pollution gadget → auth bypass / RCE when chained. We actively
-  // disclose these (e.g. the jsonwebtoken verify() gadget), so they must never
-  // be auto-dropped on a score alone.
-  "prototype-pollution",
-  // Cryptographic misuse — hardcoded keys/IVs, JWT alg-confusion (alg=none /
-  // HS-vs-RS), and predictable RNG for secrets are direct key-leak / auth-bypass
-  // primitives, so the class is protected from score-only auto-drop.
-  "crypto-misuse",
-  // AI-system adversarial classes — the core 0 "adversarial reliability"
-  // thesis (authorization-boundary break, unsafe tool use, data exfiltration,
-  // prompt hijack). A missed one of these is a disclosure-grade loss.
-  "prompt-injection",
-  "data-exfiltration",
-  "tool-misuse"
-]);
-function canAutoSuppressDetailed(finding) {
-  if (PROTECTED_SEVERITIES.has(finding.severity)) {
-    return {
-      canSuppress: false,
-      guard: "high_severity",
-      reason: `severity=${finding.severity} is disclosure-grade; routed to verification instead of auto-drop`
-    };
-  }
-  if (HIGH_IMPACT_CATEGORIES.has(finding.category)) {
-    return {
-      canSuppress: false,
-      guard: "high_impact_class",
-      reason: `category=${finding.category} is a high-impact class; routed to verification instead of auto-drop`
-    };
-  }
-  return {
-    canSuppress: true,
-    reason: `severity=${finding.severity}, category=${finding.category} eligible for score/heuristic auto-suppression`
-  };
-}
-
-// packages/core/dist/triage/verify-verdict.js
-var REPRODUCING_LAYERS = /* @__PURE__ */ new Set(["poc_gen", "pov_gate", "oracle"]);
-function evidenceKindForFinding(finding) {
-  const hasPocSteps = Array.isArray(finding.pocSteps) && finding.pocSteps.length > 0;
-  const reproduced = hasPocSteps && (finding.layerVerdicts ?? []).some((v) => v.verdict === "pass" && REPRODUCING_LAYERS.has(v.layer));
-  return reproduced ? "reproduced-poc" : "source-only";
-}
-function outcomeOf(verdict) {
-  return typeof verdict === "string" ? verdict : verdict.verdict;
-}
-function isDisclosureWorthy(finding, verdict) {
-  if (outcomeOf(verdict) !== "rejected") {
-    return {
-      keep: true,
-      reason: `verdict=${outcomeOf(verdict)}: not a rejection \u2014 finding kept`
-    };
-  }
-  const guard = canAutoSuppressDetailed(finding);
-  if (guard.canSuppress) {
-    return { keep: false, reason: guard.reason };
-  }
-  return { keep: true, guard: guard.guard, reason: guard.reason };
-}
-
 // packages/core/dist/disclose/evidence-pack.js
 var UnreproducedFindingError = class extends Error {
   findingId;
@@ -1284,9 +1192,6 @@ export {
   createDisclosureRecord,
   transition,
   isPubliclyDisclosed,
-  canAutoSuppressDetailed,
-  evidenceKindForFinding,
-  isDisclosureWorthy,
   UnreproducedFindingError,
   assembleEvidencePack,
   renderVendorNotificationMarkdown,

package/chunks/{chunk-5NFIY2SJ.js → chunk-XJ2TBEV7.js}

@@ -3,13 +3,13 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   createJournalWriter
-} from "./chunk-3LPBJMHB.js";
+} from "./chunk-LRD5N2TQ.js";
 import {
   verifyKernelFinding
-} from "./chunk-XA2IBHPB.js";
+} from "./chunk-B7XL6RON.js";
 import {
   homeStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/cve/adapt-loop.js
 import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

package/chunks/{chunk-PVJUPIQG.js → chunk-XOVYV7TT.js}

@@ -3,13 +3,13 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   eventBus
-} from "./chunk-5PFRE522.js";
+} from "./chunk-ULRLUXSS.js";
 import {
   redactAuthHeaders
-} from "./chunk-CGBDEST2.js";
+} from "./chunk-VJBEB2K6.js";
 import {
   ScopePolicy
-} from "./chunk-QNRYOJEB.js";
+} from "./chunk-RZZ6VPRY.js";
 import {
   allowlistedChildEnv,
   sanitizedEnv
@@ -18,10 +18,10 @@ import {
   VERSION,
   cloudStateDir,
   homeStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
-} from "./chunk-VIT5ALXF.js";
+} from "./chunk-5XOYTAOK.js";
 
 // packages/core/dist/telemetry/analytics-level.js
 var LEVEL_ORDER = {
@@ -54,7 +54,7 @@ function resolveAnalyticsLevel(env = process.env) {
     return "off";
   const raw = env[ANALYTICS_LEVEL_ENV];
   if (typeof raw !== "string")
-    return "off";
+    return "usage";
   const normalized = raw.trim().toLowerCase();
   return isAnalyticsLevel(normalized) ? normalized : "off";
 }

package/chunks/{chunk-IXT64DV5.js → chunk-XPDJE537.js}

@@ -8107,6 +8107,99 @@ function errMessage(err) {
   }
 }
 
+// packages/core/dist/triage/can-auto-suppress.js
+var PROTECTED_SEVERITIES = /* @__PURE__ */ new Set([
+  "critical",
+  "high"
+]);
+var HIGH_IMPACT_CATEGORIES = /* @__PURE__ */ new Set([
+  // Remote code / command / code execution
+  "command-injection",
+  "code-injection",
+  // Injection into the data store
+  "sql-injection",
+  // Unsafe deserialization is a classic RCE primitive
+  "unsafe-deserialization",
+  // Server-side request forgery (pivot / internal network reach)
+  "ssrf",
+  // Arbitrary file read/write
+  "path-traversal",
+  // Memory corruption / binary / kernel classes
+  "heap-overflow",
+  "out-of-bounds-read",
+  "out-of-bounds-write",
+  "use-after-free",
+  "stack-buffer-overflow",
+  "integer-overflow",
+  "type-confusion",
+  "double-free",
+  "format-string",
+  "uninitialized-memory",
+  "race-condition",
+  "toctou",
+  // Supply-chain compromise (known-vulnerable / malicious package)
+  "known-vulnerable-package",
+  "supply-chain",
+  // Prototype-pollution gadget → auth bypass / RCE when chained. We actively
+  // disclose these (e.g. the jsonwebtoken verify() gadget), so they must never
+  // be auto-dropped on a score alone.
+  "prototype-pollution",
+  // Cryptographic misuse — hardcoded keys/IVs, JWT alg-confusion (alg=none /
+  // HS-vs-RS), and predictable RNG for secrets are direct key-leak / auth-bypass
+  // primitives, so the class is protected from score-only auto-drop.
+  "crypto-misuse",
+  // AI-system adversarial classes — the core 0 "adversarial reliability"
+  // thesis (authorization-boundary break, unsafe tool use, data exfiltration,
+  // prompt hijack). A missed one of these is a disclosure-grade loss.
+  "prompt-injection",
+  "data-exfiltration",
+  "tool-misuse"
+]);
+function canAutoSuppressDetailed(finding) {
+  if (PROTECTED_SEVERITIES.has(finding.severity)) {
+    return {
+      canSuppress: false,
+      guard: "high_severity",
+      reason: `severity=${finding.severity} is disclosure-grade; routed to verification instead of auto-drop`
+    };
+  }
+  if (HIGH_IMPACT_CATEGORIES.has(finding.category)) {
+    return {
+      canSuppress: false,
+      guard: "high_impact_class",
+      reason: `category=${finding.category} is a high-impact class; routed to verification instead of auto-drop`
+    };
+  }
+  return {
+    canSuppress: true,
+    reason: `severity=${finding.severity}, category=${finding.category} eligible for score/heuristic auto-suppression`
+  };
+}
+
+// packages/core/dist/triage/verify-verdict.js
+var REPRODUCING_LAYERS = /* @__PURE__ */ new Set(["poc_gen", "pov_gate", "oracle"]);
+function evidenceKindForFinding(finding) {
+  const hasPocSteps = Array.isArray(finding.pocSteps) && finding.pocSteps.length > 0;
+  const reproduced = hasPocSteps && (finding.layerVerdicts ?? []).some((v) => v.verdict === "pass" && REPRODUCING_LAYERS.has(v.layer));
+  return reproduced ? "reproduced-poc" : "source-only";
+}
+function outcomeOf(verdict) {
+  return typeof verdict === "string" ? verdict : verdict.verdict;
+}
+function isDisclosureWorthy(finding, verdict) {
+  if (outcomeOf(verdict) !== "rejected") {
+    return {
+      keep: true,
+      reason: `verdict=${outcomeOf(verdict)}: not a rejection \u2014 finding kept`
+    };
+  }
+  const guard = canAutoSuppressDetailed(finding);
+  if (guard.canSuppress) {
+    return { keep: false, reason: guard.reason };
+  }
+  return { keep: true, guard: guard.guard, reason: guard.reason };
+}
+
 export {
   require_dist,
   hasKnownMarkerText,
@@ -8121,5 +8214,8 @@ export {
   resolveUrl,
   mergePersonaHeaders,
   evaluateExpect,
-  aggregateVerdict
+  aggregateVerdict,
+  canAutoSuppressDetailed,
+  evidenceKindForFinding,
+  isDisclosureWorthy
 };

package/chunks/{chunk-YKWARO3T.js → chunk-YGYJ2FTH.js}

@@ -3,13 +3,13 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-PVJUPIQG.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   isScopeEnforcementEnabled
-} from "./chunk-QNRYOJEB.js";
+} from "./chunk-RZZ6VPRY.js";
 import {
   external_exports
-} from "./chunk-VIT5ALXF.js";
+} from "./chunk-5XOYTAOK.js";
 
 // packages/core/dist/bench/improvement-promotion.js
 import { createHash } from "node:crypto";
@@ -184,7 +184,7 @@ function verifyImprovementLedger(entries) {
 // packages/core/dist/improvement/config.js
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, resolve, sep } from "node:path";
 var relativePath = external_exports.string().min(1).max(512).refine((value) => !isAbsolute(value) && !value.includes("\\") && !value.includes("\0") && value !== "." && value.split("/").every((part) => part !== ".." && part !== "" && part !== "."), "must be a normalized relative file or directory path (not the entire workspace)");
 var argv = external_exports.array(external_exports.string().max(8192).refine((value) => !value.includes("\0"))).min(1).max(128).refine((value) => value[0].length > 0, "executable must not be empty");
 var finitePositive = external_exports.number().finite().positive();
@@ -200,11 +200,17 @@ var schema = external_exports.object({
   kind: external_exports.enum(["source", "skill", "router", "lens"]).default("source"),
   command: argv,
   buildCommand: argv.optional(),
+  observationStorePath: external_exports.string().min(1).max(4096).optional(),
   cases: external_exports.array(external_exports.object({
     id: external_exports.string().min(1).max(128),
     lane: external_exports.enum(["development", "held-out", "negative-control"]),
     input: external_exports.unknown(),
-    expected: external_exports.unknown()
+    expected: external_exports.unknown(),
+    curation: external_exports.object({
+      observationId: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      approvalDigest: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/),
+      fixtureDigest: external_exports.string().regex(/^(?:sha256:)?[a-f0-9]{64}$/)
+    }).strict().optional()
   }).strict()).min(3).max(1e3),
   repeats: external_exports.number().int().min(2).max(20).default(3),
   maxIterations: external_exports.number().int().min(1).max(100).default(3),
@@ -229,12 +235,24 @@ var schema = external_exports.object({
     minimumHeldOutLift: finitePositive.max(1).default(DEFAULT_IMPROVEMENT_PROMOTION_POLICY.minimumHeldOutLift),
     maximumNegativeControlFpDelta: external_exports.literal(0).default(0),
     maximumCostMultiplier: finitePositive.max(10).default(DEFAULT_IMPROVEMENT_PROMOTION_POLICY.maximumCostMultiplier)
-  }).strict().default({}),
+  }).strict().prefault({}),
   safety: external_exports.object({
     enabled: external_exports.boolean().default(false),
-    holdoutExposureLimit: external_exports.number().int().min(1).max(1e6)
+    holdoutExposureLimit: external_exports.number().int().min(1).max(1e6),
+    workerModel: external_exports.object({
+      provider: external_exports.string().min(1).max(128),
+      model: external_exports.string().min(1).max(256),
+      maxCostUsdPerExecution: finitePositive.max(1e3)
+    }).strict().optional()
   }).strict().optional(),
-  maxAlternativeParents: external_exports.number().int().min(0).max(10).optional()
+  maxAlternativeParents: external_exports.number().int().min(0).max(10).optional(),
+  retentionPolicy: external_exports.object({
+    profileId: external_exports.string().min(1).max(128),
+    version: external_exports.number().int().min(1),
+    criticalCaseIds: external_exports.array(external_exports.string().min(1).max(128)).min(1).max(128),
+    previousProfileDigest: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    rotationApprovalRef: external_exports.string().min(1).max(512).optional()
+  }).strict().optional()
 }).strict();
 function canonicalEvolutionJson(value) {
   if (value === null || typeof value === "string" || typeof value === "boolean")
@@ -248,8 +266,27 @@ function canonicalEvolutionJson(value) {
   }
   throw new Error("evolution cases must contain finite JSON values only");
 }
+function physicalProspectivePath(path) {
+  let cursor = path;
+  const suffix = [];
+  while (!existsSync(cursor)) {
+    const parent = dirname(cursor);
+    if (parent === cursor)
+      throw new Error("cannot resolve evolution path authority");
+    suffix.unshift(basename(cursor));
+    cursor = parent;
+  }
+  return resolve(realpathSync(cursor), ...suffix);
+}
 function parseEvolutionConfig(raw, baseDir = process.cwd()) {
   const parsed = schema.parse(raw);
+  if (parsed.safety?.workerModel && !parsed.safety.enabled) {
+    throw new Error("model-backed evolution workers require enabled durable safety accounting");
+  }
+  if (parsed.cases.some((entry) => entry.curation) && !parsed.observationStorePath)
+    throw new Error("curated fixtures require an authoritative observation store");
+  if (parsed.observationStorePath)
+    parsed.observationStorePath = resolve(baseDir, parsed.observationStorePath);
   const admitted = isAdmittedSmolvmWorkbench();
   if (admitted) {
     if (parsed.imageArchive)
@@ -286,6 +323,17 @@ function parseEvolutionConfig(raw, baseDir = process.cwd()) {
       throw new Error(`${lane} requires at least ${parsed.promotionPolicy.minimumCases} distinct cases`);
     }
   }
+  if (parsed.retentionPolicy) {
+    const ids = parsed.retentionPolicy.criticalCaseIds;
+    if (new Set(ids).size !== ids.length)
+      throw new Error("retention panel contains duplicate cases");
+    for (const id of ids) {
+      const fixture = parsed.cases.find((entry) => entry.id === id);
+      if (!fixture || fixture.lane === "development") {
+        throw new Error("retention panel must reference existing sealed held-out or negative-control cases");
+      }
+    }
+  }
   for (const edit of parsed.editablePaths) {
     if (!parsed.sourcePaths.some((source) => edit === source || edit.startsWith(`${source}/`))) {
       throw new Error(`editable path ${edit} is not inside a selected source path`);
@@ -297,6 +345,11 @@ function parseEvolutionConfig(raw, baseDir = process.cwd()) {
     throw new Error("evolution store cannot be the source workspace");
   for (const selected of parsed.sourcePaths) {
     const source = resolve(sourceRoot, selected);
+    const observationStore = parsed.observationStorePath && physicalProspectivePath(parsed.observationStorePath);
+    const physicalSource = observationStore ? physicalProspectivePath(source) : source;
+    if (observationStore && (observationStore === physicalSource || observationStore.startsWith(`${physicalSource}${sep}`))) {
+      throw new Error("private observation queue cannot overlap selected model-readable source paths");
+    }
     if (storePath === source || storePath.startsWith(`${source}/`) || source.startsWith(`${storePath}/`)) {
       throw new Error("evolution store and selected source paths must not overlap");
     }
@@ -624,7 +677,7 @@ async function evaluateVerificationSpec(spec, repoRoot) {
 // packages/core/dist/improvement/artifacts.js
 import { randomUUID } from "node:crypto";
 import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync as readFileSync2, realpathSync as realpathSync2, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute as isAbsolute3, join as join2, parse, resolve as resolve3, sep as sep3 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute3, join as join2, parse, resolve as resolve3, sep as sep3 } from "node:path";
 var MAX_ARTIFACT_BYTES = 128 * 1024 * 1024;
 function hasCode(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
@@ -686,7 +739,7 @@ function ensureEvolutionDirectory(path) {
   return inspectDirectories(path, true);
 }
 function readEvolutionArtifact(path) {
-  inspectDirectories(dirname(path), false);
+  inspectDirectories(dirname2(path), false);
   const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
     const stat = fstatSync(fd);
@@ -704,7 +757,7 @@ function publishEvolutionArtifact(path, value) {
   const content = canonicalEvolutionJson(value);
   if (Buffer.byteLength(content) > MAX_ARTIFACT_BYTES)
     throw new Error("evolution artifact exceeds retention limit");
-  const directory = ensureEvolutionDirectory(dirname(path));
+  const directory = ensureEvolutionDirectory(dirname2(path));
   const temporary = join2(directory, `.artifact-${randomUUID()}.tmp`);
   const fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
   try {
@@ -737,7 +790,7 @@ function publishEvolutionArtifact(path, value) {
 
 // packages/core/dist/agent/apply-patch.js
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 var BEGIN = "*** Begin Patch";
 var END = "*** End Patch";
 function parsePatch(input) {
@@ -848,7 +901,7 @@ function applyPatchOps(ops, pathResolver) {
       if (!op.overwrite && existsSync2(abs)) {
         throw new Error(`apply_patch: Add File "${op.path}" failed \u2014 file already exists. Use "*** Replace File: ${op.path}" to overwrite.`);
       }
-      mkdirSync2(dirname2(abs), { recursive: true });
+      mkdirSync2(dirname3(abs), { recursive: true });
       writeFileSync2(abs, op.contents, "utf-8");
       applied.push({ kind: "add", path: op.path });
       continue;
@@ -930,9 +983,20 @@ function applyOneHunk(lines, anchorIdx, hunk, logicalPath) {
   return { newLines, consumed: cursor - anchorIdx };
 }
 
+// packages/core/dist/scope/local-source-boundary.js
+import { AsyncLocalStorage } from "node:async_hooks";
+import { realpathSync as realpathSync3 } from "node:fs";
+var boundary = new AsyncLocalStorage();
+function getLocalSourceBoundary() {
+  return boundary.getStore();
+}
+function withLocalSourceBoundary(root, run) {
+  return root === void 0 ? run() : boundary.run(realpathSync3(root), run);
+}
+
 // packages/core/dist/agent/tools/scope-path.js
-import { lstatSync as lstatSync2, realpathSync as realpathSync3 } from "node:fs";
-import { basename, dirname as dirname3, isAbsolute as isAbsolute4, resolve as resolve4, sep as sep4 } from "node:path";
+import { lstatSync as lstatSync2, realpathSync as realpathSync4 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute4, resolve as resolve4, sep as sep4 } from "node:path";
 function pathEntryExists(path) {
   try {
     lstatSync2(path);
@@ -947,26 +1011,34 @@ function canonicalizePath(path) {
   const missingSegments = [];
   let existingPath = path;
   while (!pathEntryExists(existingPath)) {
-    const parent = dirname3(existingPath);
+    const parent = dirname4(existingPath);
     if (parent === existingPath) {
       throw new Error(`Path does not have an existing parent: ${path}`);
     }
-    missingSegments.unshift(basename(existingPath));
+    missingSegments.unshift(basename2(existingPath));
     existingPath = parent;
   }
-  return resolve4(realpathSync3(existingPath), ...missingSegments);
+  return resolve4(realpathSync4(existingPath), ...missingSegments);
 }
 function isScopedPath(scopePath, inputPath) {
-  const root = realpathSync3(scopePath);
+  const root = realpathSync4(scopePath);
   const logicalCandidate = isAbsolute4(inputPath) ? resolve4(inputPath) : resolve4(root, inputPath);
   const candidate = canonicalizePath(logicalCandidate);
-  return candidate === root || candidate.startsWith(root + sep4);
+  const prefix = root.endsWith(sep4) ? root : root + sep4;
+  return candidate === root || candidate.startsWith(prefix);
 }
 function resolveScopedPath(scopePath, inputPath) {
+  const boundary2 = getLocalSourceBoundary();
+  if (boundary2) {
+    const base = scopePath ? realpathSync4(scopePath) : process.cwd();
+    const candidate = isAbsolute4(inputPath) ? resolve4(inputPath) : resolve4(base, inputPath);
+    if (!isScopedPath(boundary2, candidate))
+      throw new Error(`Path escapes the approved source folder: ${inputPath}`);
+  }
   if (isScopeEnforcementEnabled() && (!scopePath || !isScopedPath(scopePath, inputPath))) {
     throw new Error(`Path escapes the allowed scope: ${inputPath}`);
   }
-  const root = scopePath ? realpathSync3(scopePath) : process.cwd();
+  const root = scopePath ? realpathSync4(scopePath) : process.cwd();
   const logicalCandidate = isAbsolute4(inputPath) ? resolve4(inputPath) : resolve4(root, inputPath);
   return canonicalizePath(logicalCandidate);
 }
@@ -986,5 +1058,7 @@ export {
   evaluateVerificationSpec,
   parsePatch,
   applyPatchOps,
+  getLocalSourceBoundary,
+  withLocalSourceBoundary,
   resolveScopedPath
 };