@codai/axiom-mcp 2.0.0 → 2.2.0

package/dist/gate-lazy.js

@@ -1,9 +1,10 @@
 import { realpath } from "node:fs";
 import * as fs$1 from "node:fs/promises";
-import { readFile } from "node:fs/promises";
+import { lstat, readFile } from "node:fs/promises";
 import { cpus, homedir } from "node:os";
 import * as path from "node:path";
 import { parseArgs, promisify } from "node:util";
+import "node:crypto";
 import "node:child_process";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -27,6 +28,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 new TextEncoder();
+Buffer.from("302a300506032b6570032100", "hex");
+Buffer.from("302e020100300506032b657004220420", "hex");
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
 	return Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
@@ -5677,13 +5680,30 @@ const ERROR_CODES = [
 	"ERR_PROVIDER_FAILED",
 	"ERR_GUARD_TIMEOUT",
 	"ERR_GUARD_OUTPUT",
+	"ERR_FACT_DISABLED",
+	"ERR_SIGNATURE_MISSING",
+	"ERR_SIGNATURE_INVALID",
+	"ERR_TRUST_STATE_CORRUPT",
+	"ERR_ROLLBACK",
+	"ERR_EMITTER_UNKNOWN",
+	"ERR_TEMPLATE_UNKNOWN",
+	"ERR_TEMPLATE_PARAMS",
+	"ERR_PATCH_FORMAT",
+	"ERR_PATCH_PREIMAGE",
+	"ERR_PATCH_NO_MATCH",
 	"ERR_GIT_NOT_FOUND",
 	"ERR_GIT_NOT_REPO",
 	"ERR_GIT_DIRTY",
 	"ERR_GIT_BRANCH_EXISTS",
 	"ERR_GIT_BRANCH_INVALID",
 	"ERR_GIT_FAILED",
+	"ERR_TASK_NOT_FOUND",
+	"ERR_TASK_CANCELLED",
+	"ERR_PLAN_SESSION_STATE",
 	"ERR_REF_OFFLINE",
+	"ERR_NET_DISABLED",
+	"ERR_NET_DENIED",
+	"ERR_NET_FAILED",
 	"ERR_NOT_CANONICAL",
 	"ERR_UNSUPPORTED_OP",
 	"ERR_INTERNAL"
@@ -5787,7 +5807,12 @@ object({
 	findings: array(FindingSchema),
 	factsDigest: DigestRefSchema,
 	durationMs: int().nonnegative(),
-	providers: array(ProviderStatusSchema)
+	providers: array(ProviderStatusSchema),
+	preImage: _enum([
+		"verified",
+		"drifted",
+		"unverified"
+	]).optional()
 }).strict();
 const ApiVersionSchema = literal("axiom.dev/v2");
 const INLINE_CONTENT_MAX = 262144;
@@ -5826,7 +5851,17 @@ const PlanArtifactSourceSchema = discriminatedUnion("type", [
 		emitter: string().min(1),
 		template: string().min(1),
 		params: record(string(), json()).default({})
-	}).strict().describe("v2.1")
+	}).strict().describe("template source rendered by a registered emitter at compile time"),
+	object({
+		type: literal("patch"),
+		format: _enum([
+			"unified",
+			"v4a",
+			"search-replace"
+		]),
+		preImage: union([DigestRefSchema, literal("absent")]),
+		body: string().max(INLINE_CONTENT_MAX)
+	}).strict().describe("patch applied at compile time to the pre-image named by its digest")
 ]);
 const PlanArtifactSchema = object({
 	path: RelPathSchema,
@@ -5856,6 +5891,7 @@ object({
 	capabilities: array(CapabilitySchema).default([]),
 	artifacts: array(PlanArtifactSchema).min(1).max(2e3),
 	checks: array(CheckRefSchema).default([]),
+	counter: int().nonnegative().optional(),
 	metadata: record(string(), json()).default({})
 }).strict();
 const ErrorCodeSchema = _enum(ERROR_CODES);
@@ -5900,6 +5936,7 @@ object({
 	diff: string().optional(),
 	journal: string().optional(),
 	git: GitResultSchema.optional(),
+	drifted: array(RelPathSchema).optional(),
 	error: ApplyErrorSchema.optional()
 }).strict().superRefine((r, ctx) => {
 	if (r.status === "failed" && r.error === void 0) ctx.addIssue({
@@ -5960,7 +5997,8 @@ const ManifestArtifactSchema = object({
 		"inline",
 		"template",
 		"cas",
-		"ref"
+		"ref",
+		"patch"
 	]).optional()
 }).strict().superRefine((a, ctx) => {
 	if (a.op !== "delete" && a.digest === void 0) ctx.addIssue({
@@ -5974,6 +6012,10 @@ const ToolchainSchema = object({
 	axiom: string().min(1),
 	emitters: record(string(), string())
 }).strict();
+const PreImageEntrySchema = object({
+	path: RelPathSchema,
+	sha256: union([Sha256HexSchema, literal("absent")])
+}).strict();
 const ManifestBodySchema = object({
 	apiVersion: ApiVersionSchema,
 	kind: literal("Manifest"),
@@ -5982,8 +6024,16 @@ const ManifestBodySchema = object({
 	planDigest: DigestRefSchema,
 	artifacts: array(ManifestArtifactSchema).min(1).max(2e3),
 	checks: array(CheckRefSchema),
-	toolchain: ToolchainSchema
+	toolchain: ToolchainSchema,
+	counter: int().nonnegative().optional(),
+	preImage: array(PreImageEntrySchema).optional()
 }).strict().superRefine((m, ctx) => {
+	if (m.preImage !== void 0 && !isSortedUnique(m.preImage.map((p) => p.path))) ctx.addIssue({
+		code: "custom",
+		path: ["preImage"],
+		message: "preImage must be sorted by path (UTF-8 byte order) and unique",
+		params: { code: "ERR_NOT_CANONICAL" }
+	});
 	if (!isSortedUnique(m.artifacts.map((a) => a.path))) ctx.addIssue({
 		code: "custom",
 		path: ["artifacts"],
@@ -6023,11 +6073,42 @@ const DsseEnvelopeSchema = object({
 		sig: base64()
 	}).strict())
 }).strict();
+const AXIOM_MANIFEST_PAYLOAD_TYPE = "application/vnd.axiom.manifest+json";
+const AXIOM_MANIFEST_BOUND_PAYLOAD_TYPE = "application/vnd.axiom.manifest-bound+json";
+const RootIdSchema = string().min(1).max(200).regex(/^[A-Za-z0-9][A-Za-z0-9._:/@-]*$/, "rootId: letters, digits, . _ : / @ - only");
+const ManifestSignatureSchema = object({
+	payloadType: union([literal(AXIOM_MANIFEST_PAYLOAD_TYPE), literal(AXIOM_MANIFEST_BOUND_PAYLOAD_TYPE)]),
+	payload: base64(),
+	signatures: array(object({
+		keyid: string().optional(),
+		sig: base64()
+	}).strict()).min(1)
+}).strict();
+const TrustedKeySchema = object({
+	keyid: string().regex(/^[0-9a-f]{64}$/),
+	alg: literal("ed25519"),
+	publicKey: base64(),
+	name: string().min(1).max(200).optional(),
+	notBefore: int().nonnegative().optional()
+}).strict();
+object({
+	version: literal(1),
+	keys: array(TrustedKeySchema),
+	minCounter: int().nonnegative().optional(),
+	rootId: RootIdSchema.optional()
+}).strict();
+object({
+	version: literal(1),
+	lastCounter: int().nonnegative(),
+	manifestDigest: DigestRefSchema.optional(),
+	mac: string().regex(/^[0-9a-f]{64}$/).optional()
+}).strict();
 object({
 	manifest: ManifestBodySchema,
 	manifestDigest: DigestRefSchema,
 	attestation: InTotoStatementLooseSchema.optional(),
 	envelope: DsseEnvelopeSchema.optional(),
+	signatures: array(ManifestSignatureSchema).optional(),
 	blobs: record(DigestRefSchema, BlobSchema).default({})
 }).strict().superRefine((b, ctx) => {
 	let total = 0;
@@ -6062,6 +6143,28 @@ object({
 	limits: ProfileLimitsSchema.default({}),
 	facts: ProfileFactsSchema.prefault({})
 }).strict();
+const RepoSnapshotEntryKindSchema = _enum(["file", "symlink"]);
+const RepoSnapshotBodySchema = object({
+	files: array(object({
+		path: RelPathSchema,
+		bytes: int().nonnegative(),
+		sha256: Sha256HexSchema.optional(),
+		mode: ArtifactModeSchema,
+		kind: RepoSnapshotEntryKindSchema
+	}).strict()),
+	truncated: boolean(),
+	counts: object({
+		files: int().nonnegative(),
+		bytes: int().nonnegative()
+	}).strict()
+}).strict();
+object({
+	apiVersion: ApiVersionSchema,
+	kind: literal("RepoSnapshot"),
+	root: object({ kind: literal("relative") }).strict(),
+	snapshotDigest: DigestRefSchema,
+	body: RepoSnapshotBodySchema
+}).strict();
 var Diff = class {
 	diff(oldStr, newStr, options = {}) {
 		let callback;
@@ -8228,9 +8331,14 @@ var import_picomatch = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((
 function definePredicate(p) {
 	return p;
 }
+function escapeRouteGroups(glob) {
+	return glob.replace(/(^|[^\\@!?*+])\(([^()|*?[\]{}\\]+)\)/g, (_m, pre, inner) => {
+		return `${pre}\\(${inner}\\)`;
+	});
+}
 function globMatcher(globs, whenEmpty) {
 	if (globs === void 0 || globs.length === 0) return () => whenEmpty;
-	const m = (0, import_picomatch.default)([...globs], { dot: true });
+	const m = (0, import_picomatch.default)(globs.map(escapeRouteGroups), { dot: true });
 	return (p) => m(p);
 }
 function finding(f) {
@@ -8244,60 +8352,165 @@ function finding(f) {
 	if (f.path !== void 0) out.path = f.path;
 	return out;
 }
+object({
+	expression: string().min(1).max(4096),
+	message: string().max(2e3).optional(),
+	severity: _enum([
+		"error",
+		"warn",
+		"info"
+	]).optional()
+}).strict();
+object({
+	policies: string().min(1).max(65536),
+	mode: _enum(["forbid", "permit"]).default("forbid"),
+	message: string().max(2e3).optional(),
+	severity: _enum([
+		"error",
+		"warn",
+		"info"
+	]).optional()
+}).strict();
+function luhnValid(digits) {
+	let sum = 0;
+	let double = false;
+	for (let i = digits.length - 1; i >= 0; i--) {
+		let d = digits.charCodeAt(i) - 48;
+		if (d < 0 || d > 9) return false;
+		if (double) {
+			d *= 2;
+			if (d > 9) d -= 9;
+		}
+		sum += d;
+		double = !double;
+	}
+	return digits.length > 0 && sum % 10 === 0;
+}
+const UUID_RE = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi;
+const CARD_RE = /(?<![\w-])(?:\d[ -]?){12,15}\d(?![\w-])/g;
+function findCardNumber(text) {
+	const scrubbed = text.replace(UUID_RE, (m) => " ".repeat(m.length));
+	CARD_RE.lastIndex = 0;
+	for (let m = CARD_RE.exec(scrubbed); m !== null; m = CARD_RE.exec(scrubbed)) {
+		const digits = m[0].replace(/[ -]/g, "");
+		if (digits.length < 13 || digits.length > 16) continue;
+		if (/^(\d)\1+$/.test(digits)) continue;
+		if (luhnValid(digits)) return true;
+	}
+	return false;
+}
+function cnpValid(digits) {
+	if (!/^[1-9]\d{12}$/.test(digits)) return false;
+	const mm = Number(digits.slice(3, 5));
+	const dd = Number(digits.slice(5, 7));
+	const jj = Number(digits.slice(7, 9));
+	if (mm < 1 || mm > 12 || dd < 1 || dd > 31) return false;
+	if (!(jj >= 1 && jj <= 52 || jj === 70)) return false;
+	const w = "279146358279";
+	let sum = 0;
+	for (let i = 0; i < 12; i++) sum += (digits.charCodeAt(i) - 48) * (w.charCodeAt(i) - 48);
+	return (sum % 11 === 10 ? 1 : sum % 11) === digits.charCodeAt(12) - 48;
+}
+const CNP_RE = /\b[1-9]\d{12}\b/g;
+function findCnp(text) {
+	CNP_RE.lastIndex = 0;
+	for (let m = CNP_RE.exec(text); m !== null; m = CNP_RE.exec(text)) if (cnpValid(m[0])) return true;
+	return false;
+}
+const EMAIL_RE = /\b([A-Za-z0-9._%+-]+)@([A-Za-z0-9.-]+\.[A-Za-z]{2,})\b/g;
+const EMAIL_SKIP_DOMAIN = /(^|\.)(example\.(com|net|org)|example|test|invalid|localhost|localdomain)$|(^|\.)github\.com$/i;
+const EMAIL_SKIP_LOCAL = /^(git|noreply|no-reply|donotreply|do-not-reply)$/i;
+const EMAIL_SKIP_TLD_AS_EXT = /\.(png|jpe?g|gif|svg|webp|ico|css|js|ts|json|md|txt|html?|xml|yml|yaml|py)$/i;
+function findPersonalEmail(text) {
+	EMAIL_RE.lastIndex = 0;
+	for (let m = EMAIL_RE.exec(text); m !== null; m = EMAIL_RE.exec(text)) {
+		const local = m[1] ?? "";
+		const domain = m[2] ?? "";
+		if (EMAIL_SKIP_DOMAIN.test(domain)) continue;
+		if (EMAIL_SKIP_LOCAL.test(local)) continue;
+		if (EMAIL_SKIP_TLD_AS_EXT.test(domain)) continue;
+		return true;
+	}
+	return false;
+}
+const CRED_RE = /(?:^|[^A-Za-z0-9])[A-Za-z0-9_-]*?(password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|auth[_-]?token|client[_-]?secret)\b\s*[:=]\s*(?:new\s+\w+\s*\(\s*)?(["'`])([^"'`\r\n]{8,})\2/gi;
+const CRED_PLACEHOLDER = /^(\$\{|\{\{|<|%[(sd]|\$[A-Z_]|xxx|\*{3,}|\.{3,}|change[_-]?me|replace[_-]?me|your[_-]|my[_-]?(actual[_-]?)?(password|secret|token|key)|placeholder|example|dummy|sample|test(value|ing)?$|redacted|hunter2$|password$|secret$|123456)/i;
+function findCredentialLiteral(text) {
+	CRED_RE.lastIndex = 0;
+	for (let m = CRED_RE.exec(text); m !== null; m = CRED_RE.exec(text)) {
+		const value = m[3] ?? "";
+		if (CRED_PLACEHOLDER.test(value)) continue;
+		if (/^[a-z_][a-z0-9_.]*$/i.test(value) && !/\d/.test(value)) continue;
+		return true;
+	}
+	return false;
+}
 const SECRET_PATTERNS = [
 	{
 		name: "cnp",
-		re: /\b[1-9]\d{12}\b/
+		kind: "pii",
+		test: findCnp
 	},
 	{
 		name: "email",
-		re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/
+		kind: "pii",
+		test: findPersonalEmail
 	},
 	{
 		name: "phoneRo",
+		kind: "pii",
 		re: /\b(\+4|0)7\d{8}\b/
 	},
 	{
 		name: "card",
-		re: /\b(?:\d[ -]?){13,16}\b/
+		kind: "pii",
+		test: findCardNumber
 	},
 	{
 		name: "credentialAssignment",
-		re: /\b(password|secret|token|api[_-]?key)\b\s*[:=]\s*["']?[^\s"']{4,}/i
+		kind: "secret",
+		test: findCredentialLiteral
 	},
 	{
 		name: "awsKey",
+		kind: "secret",
 		re: /AKIA[0-9A-Z]{16}/
 	},
 	{
 		name: "githubToken",
+		kind: "secret",
 		re: /gh[pousr]_[A-Za-z0-9]{36,}/
 	},
 	{
 		name: "privateKey",
+		kind: "secret",
 		re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/
 	},
 	{
 		name: "jwt",
+		kind: "secret",
 		re: /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/
 	},
 	{
 		name: "slackToken",
+		kind: "secret",
 		re: /xox[abpr]-/
 	}
 ];
 SECRET_PATTERNS.map((p) => p.name);
+SECRET_PATTERNS.filter((p) => p.kind === "pii").map((p) => p.name);
 const SCAN_LIMIT = 4194304;
 const contentNoSecrets = definePredicate({
 	id: "content.noSecrets",
 	params: object({
 		disable: array(string()).default([]),
-		allowPaths: array(string().min(1)).default([])
+		allowPaths: array(string().min(1)).default([]),
+		pii: boolean().default(false)
 	}).strict(),
 	requires: ["manifest", "content"],
-	async run(ctx, { disable, allowPaths }) {
+	async run(ctx, { disable, allowPaths, pii }) {
 		const skip = globMatcher(allowPaths, false);
-		const active = SECRET_PATTERNS.filter((p) => !disable.includes(p.name));
+		const active = SECRET_PATTERNS.filter((p) => !disable.includes(p.name) && (pii || p.kind === "secret"));
 		const out = [];
 		const decoder = new TextDecoder("utf-8", { fatal: false });
 		for (const a of ctx.manifest.artifacts) {
@@ -8306,7 +8519,7 @@ const contentNoSecrets = definePredicate({
 			if (bytes === void 0) continue;
 			const text = decoder.decode(bytes.subarray(0, SCAN_LIMIT));
 			for (const p of active) {
-				if (!p.re.test(text)) continue;
+				if (!(p.test !== void 0 ? p.test(text) : p.re?.test(text) ?? false)) continue;
 				out.push(finding({
 					id: `content.noSecrets.${p.name}`,
 					predicate: "content.noSecrets",
@@ -8362,7 +8575,7 @@ object({
 	command: string().min(1),
 	args: array(string()).default([]),
 	cwd: _enum(["root", "staging"]).default("root"),
-	timeoutMs: int().min(1).max(6e4).default(3e4),
+	timeoutMs: int().min(1).max(9e5).default(3e4),
 	env: record(string(), string()).optional(),
 	stdin: _enum([
 		"bundle",
@@ -8426,9 +8639,15 @@ object({ rules: array(object({
 	when: string().min(1),
 	expect: array(object({
 		name: string().min(1),
-		match: string().min(1)
+		match: string().min(1),
+		mustChange: boolean().default(false)
 	}).strict()).min(1)
 }).strict()).min(1) }).strict();
+object({
+	minSignatures: int().min(1).max(16).default(1),
+	antiRollback: boolean().default(false),
+	trustFile: string().min(1).default(".axiom/trust/keys.json")
+}).strict();
 Math.max(1, Math.min(4, cpus().length));
 const realpathNative = promisify(realpath.native);
 const IS_WIN32 = process.platform === "win32";
@@ -8440,6 +8659,7 @@ const GateProfileSchema = object({
 	deny: array(string().min(1)).default([]),
 	allow: array(string().min(1)).optional(),
 	noSecrets: boolean().default(true),
+	pii: boolean().default(false),
 	maxBytes: int().positive().optional()
 }).strict();
 const DEFAULT_GATE_PROFILE = {
@@ -8452,7 +8672,8 @@ const DEFAULT_GATE_PROFILE = {
 		".env.*",
 		"**/node_modules/**"
 	],
-	noSecrets: true
+	noSecrets: true,
+	pii: false
 };
 async function loadGateProfile(opts) {
 	const candidates = [];
@@ -8595,6 +8816,262 @@ function isWriteTool(toolName) {
 	if (n.includes("apply_patch") || n.includes("multi_replace")) return true;
 	return !NON_WRITE_HINTS.some((h) => n.includes(h));
 }
+const SHELL_TOOL_HINTS = [
+	"bash",
+	"shell",
+	"run_in_terminal",
+	"terminal",
+	"execute_command",
+	"exec_command",
+	"run_command",
+	"powershell",
+	"cmd"
+];
+const SHELL_COMMAND_KEYS = [
+	"command",
+	"cmd",
+	"script",
+	"commandLine",
+	"command_line"
+];
+function isShellTool(toolName) {
+	const n = toolName.toLowerCase();
+	return SHELL_TOOL_HINTS.some((h) => n.includes(h));
+}
+function classifyTool(toolName) {
+	if (isWriteTool(toolName)) return "write";
+	if (isShellTool(toolName)) return "shell";
+	return "other";
+}
+const REDIRECT_RE = /(?:^|[\s;&|])(?:\d?>{1,2}|&>)\s*("([^"]+)"|'([^']+)'|([^\s;&|<>]+))/g;
+const SHELL_SPLIT_RE = /(?:^|[;&|]+|\|\||&&)\s*/;
+const WRITE_CMDS = {
+	tee: {
+		skipFlags: true,
+		operands: "all"
+	},
+	rm: {
+		skipFlags: true,
+		operands: "all"
+	},
+	rmdir: {
+		skipFlags: true,
+		operands: "all"
+	},
+	mv: {
+		skipFlags: true,
+		operands: "last"
+	},
+	cp: {
+		skipFlags: true,
+		operands: "last"
+	},
+	touch: {
+		skipFlags: true,
+		operands: "all"
+	},
+	truncate: {
+		skipFlags: true,
+		operands: "all"
+	},
+	mkdir: {
+		skipFlags: true,
+		operands: "all"
+	},
+	ln: {
+		skipFlags: true,
+		operands: "last"
+	},
+	chmod: {
+		skipFlags: true,
+		operands: "all"
+	},
+	unlink: {
+		skipFlags: true,
+		operands: "all"
+	},
+	install: {
+		skipFlags: true,
+		operands: "last"
+	},
+	dd: {
+		skipFlags: false,
+		operands: "all"
+	},
+	sed: {
+		skipFlags: true,
+		operands: "afterI"
+	},
+	"remove-item": {
+		skipFlags: true,
+		operands: "all"
+	},
+	"set-content": {
+		skipFlags: true,
+		operands: "all"
+	},
+	"add-content": {
+		skipFlags: true,
+		operands: "all"
+	},
+	"out-file": {
+		skipFlags: true,
+		operands: "all"
+	},
+	"move-item": {
+		skipFlags: true,
+		operands: "all"
+	},
+	"copy-item": {
+		skipFlags: true,
+		operands: "all"
+	},
+	"new-item": {
+		skipFlags: true,
+		operands: "all"
+	},
+	del: {
+		skipFlags: true,
+		operands: "all"
+	},
+	erase: {
+		skipFlags: true,
+		operands: "all"
+	},
+	move: {
+		skipFlags: true,
+		operands: "all"
+	},
+	copy: {
+		skipFlags: true,
+		operands: "all"
+	}
+};
+const GIT_WRITE_SUBCMDS = /* @__PURE__ */ new Set([
+	"checkout",
+	"reset",
+	"clean",
+	"restore",
+	"rm",
+	"mv",
+	"stash"
+]);
+function shellWords(segment) {
+	const out = [];
+	const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+	for (let m = re.exec(segment); m !== null; m = re.exec(segment)) out.push(m[1] ?? m[2] ?? m[3] ?? "");
+	return out;
+}
+function looksLikePath(word) {
+	if (word === "" || word === "-" || word === "--") return false;
+	if (word.startsWith("-") && !word.startsWith("./") && !word.startsWith("../")) return false;
+	if (/^\$\(|^`|^\$[A-Za-z_{]/.test(word)) return false;
+	return true;
+}
+function extractShellWriteTargets(command) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (rawPath, op) => {
+		if (!looksLikePath(rawPath) || seen.has(rawPath)) return;
+		seen.add(rawPath);
+		out.push({
+			rawPath,
+			op,
+			content: void 0
+		});
+	};
+	for (let m = REDIRECT_RE.exec(command); m !== null; m = REDIRECT_RE.exec(command)) {
+		const target = m[2] ?? m[3] ?? m[4] ?? "";
+		if (target !== "" && !/^&\d$/.test(target) && !/^\/dev\//.test(target)) push(target, "write");
+	}
+	REDIRECT_RE.lastIndex = 0;
+	for (const seg of command.split(SHELL_SPLIT_RE)) {
+		const words = shellWords(seg);
+		let i = 0;
+		while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i] ?? "")) i++;
+		while (i < words.length && [
+			"sudo",
+			"exec",
+			"command",
+			"nohup",
+			"time"
+		].includes(words[i] ?? "")) i++;
+		const cmd = (words[i] ?? "").toLowerCase().replace(/^.*[\\/]/, "");
+		const rest = words.slice(i + 1);
+		if (cmd === "git") {
+			const sub = rest.find((w) => !w.startsWith("-"));
+			if (sub !== void 0 && GIT_WRITE_SUBCMDS.has(sub)) {
+				const afterSub = rest.slice(rest.indexOf(sub) + 1);
+				const dd = afterSub.indexOf("--");
+				const operands = dd === -1 ? afterSub.filter((w) => !w.startsWith("-")) : afterSub.slice(dd + 1);
+				if (sub === "clean" || sub === "reset" && afterSub.includes("--hard")) push(".", "delete");
+				for (const p of operands) push(p, sub === "rm" || sub === "clean" ? "delete" : "write");
+			}
+			continue;
+		}
+		const rule = WRITE_CMDS[cmd];
+		if (rule === void 0) continue;
+		if (cmd === "sed") {
+			if (!rest.some((w) => /^-[a-zA-Z]*i/.test(w) || w === "--in-place" || w.startsWith("--in-place="))) continue;
+			const hasScriptFlag = rest.some((w) => /^-[a-zA-Z]*[ef]/.test(w) || /^--(expression|file)/.test(w));
+			const nonFlags = [];
+			for (let k = 0; k < rest.length; k++) {
+				const w = rest[k] ?? "";
+				if (w.startsWith("-")) {
+					if (/^-[a-zA-Z]*[ef]$/.test(w) || w === "--expression" || w === "--file") k++;
+					continue;
+				}
+				nonFlags.push(w);
+			}
+			const files = hasScriptFlag ? nonFlags : nonFlags.slice(1);
+			for (const w of files) push(w, "write");
+			continue;
+		}
+		if (cmd === "dd") {
+			for (const w of rest) if (w.startsWith("of=")) push(w.slice(3), "write");
+			continue;
+		}
+		let operands;
+		if (cmd.includes("-")) {
+			operands = [];
+			const PATH_PARAMS = [
+				"path",
+				"literalpath",
+				"filepath",
+				"destination",
+				"newname",
+				"target"
+			];
+			const VALUE_PARAMS = /* @__PURE__ */ new Set([
+				...PATH_PARAMS,
+				"value",
+				"encoding",
+				"filter",
+				"include",
+				"exclude",
+				"itemtype",
+				"name"
+			]);
+			for (let k = 0; k < rest.length; k++) {
+				const w = rest[k] ?? "";
+				if (w.startsWith("-")) {
+					const name = w.slice(1).toLowerCase();
+					const val = rest[k + 1];
+					if (PATH_PARAMS.includes(name) && val !== void 0) operands.push(val);
+					if (VALUE_PARAMS.has(name) && val !== void 0 && !val.startsWith("-")) k++;
+					continue;
+				}
+				operands.push(w);
+			}
+		} else operands = rule.skipFlags ? rest.filter((w) => !w.startsWith("-") || w === "-") : rest;
+		const op = cmd === "rm" || cmd === "rmdir" || cmd === "unlink" || cmd === "del" || cmd === "erase" || cmd === "remove-item" ? "delete" : "write";
+		if (rule.operands === "last") {
+			const last = operands[operands.length - 1];
+			if (last !== void 0) push(last, op);
+		} else for (const w of operands) push(w, op);
+	}
+	return out;
+}
 const PATCH_HEADER = /^\*\*\* (Update|Add|Delete) File: (.+?)\s*$/;
 const PATCH_MOVE = /^\*\*\* Move to: (.+?)\s*$/;
 function parseApplyPatch(patch) {
@@ -8639,7 +9116,33 @@ function joinContent(parts) {
 	return present.length === 0 ? void 0 : present.join("\n");
 }
 function extractTargets(p) {
-	if (!isWriteTool(p.toolName)) return [];
+	const cls = classifyTool(p.toolName);
+	if (cls === "other") return {
+		cls,
+		targets: [],
+		undetermined: false
+	};
+	if (cls === "shell") {
+		const command = firstString(p.input, SHELL_COMMAND_KEYS);
+		if (command === void 0) return {
+			cls,
+			targets: [],
+			undetermined: false
+		};
+		return {
+			cls,
+			targets: extractShellWriteTargets(command),
+			undetermined: false
+		};
+	}
+	const targets = extractWriteTargets(p);
+	return {
+		cls,
+		targets,
+		undetermined: targets.length === 0
+	};
+}
+function extractWriteTargets(p) {
 	const n = p.toolName.toLowerCase();
 	const input = p.input;
 	if (n.includes("apply_patch")) {
@@ -8697,9 +9200,9 @@ const PATH_CODES = /* @__PURE__ */ new Set([
 	"ERR_PATH_RESERVED_NAME",
 	"ERR_PATH_INVALID_CHAR"
 ]);
-async function resolveGateTarget(rootReal, target) {
+async function resolveGateTarget(rootReal, target, cwdReal = rootReal) {
 	const supplied = target.rawPath.replace(/\\/g, "/");
-	let abs = path.isAbsolute(supplied) ? path.resolve(supplied) : path.resolve(rootReal, supplied);
+	let abs = path.isAbsolute(supplied) ? path.resolve(supplied) : path.resolve(cwdReal, supplied);
 	if (path.isAbsolute(supplied)) abs = await canonicalizeExisting(abs);
 	const rel = path.relative(rootReal, abs);
 	if (rel === "" || rel === "." || rel.startsWith("..") || path.isAbsolute(rel)) throw new GateDeny("ERR_CONTAINMENT", "target escapes root", supplied);
@@ -8789,7 +9292,8 @@ async function runGatePredicates(targets, profile) {
 	const hasContent = targets.some((t) => t.target.content !== void 0);
 	if (hasContent && profile.noSecrets) findings.push(...await contentNoSecrets.run(ctx, {
 		disable: [],
-		allowPaths: []
+		allowPaths: [],
+		pii: profile.pii
 	}));
 	if (hasContent && profile.maxBytes !== void 0) findings.push(...await contentMaxBytes.run(ctx, { max: profile.maxBytes }));
 	const f = findings[0];
@@ -8808,29 +9312,84 @@ const RANK = {
 	info: 2,
 	debug: 3
 };
-function denyResult(d, stderr, t0) {
+function denyDocument(d, reason, extra) {
+	return {
+		hookSpecificOutput: {
+			hookEventName: "PreToolUse",
+			permissionDecision: "deny",
+			permissionDecisionReason: reason
+		},
+		permissionDecision: "deny",
+		permissionDecisionReason: reason,
+		axiom: {
+			verdict: "deny",
+			code: d.code,
+			...d.relPath === void 0 ? {} : { path: d.relPath },
+			...extra.toolClass === void 0 ? {} : { toolClass: extra.toolClass },
+			standard: "owasp-acs/0.1"
+		}
+	};
+}
+function denyResult(d, stderr, t0, extra = {}) {
 	const where = d.relPath === void 0 ? "" : ` (${d.relPath})`;
 	const reason = `AXIOM GATE DENY ${d.code}: ${d.message}${where}`;
 	stderr.push(reason);
 	return {
 		decision: "deny",
+		verdict: "deny",
 		exitCode: 2,
 		code: d.code,
 		reason: d.message,
 		...d.relPath === void 0 ? {} : { path: d.relPath },
-		stdout: JSON.stringify({ hookSpecificOutput: {
-			hookEventName: "PreToolUse",
-			permissionDecision: "deny",
-			permissionDecisionReason: reason
-		} }),
+		stdout: JSON.stringify(denyDocument(d, reason, extra)),
 		stderr,
-		durationMs: performance.now() - t0
-	};
+		durationMs: performance.now() - t0,
+		...extra.toolClass === void 0 ? {} : { toolClass: extra.toolClass },
+		...extra.root === void 0 ? {} : { root: extra.root }
+	};
+}
+const AXIOM_REPO_MARKERS = [
+	"journal",
+	"cas",
+	"applied",
+	"profiles",
+	"trust",
+	"lock",
+	"backup"
+];
+async function discoverRoot(start, home = homedir()) {
+	const homeReal = path.resolve(home);
+	const isHomeOrAbove = (p) => {
+		const a = IS_WIN32 ? p.toLowerCase() : p;
+		const h = IS_WIN32 ? homeReal.toLowerCase() : homeReal;
+		return a === h || h.startsWith(a.endsWith(path.sep) ? a : a + path.sep);
+	};
+	let cur = start;
+	for (let depth = 0; depth < 64; depth++) {
+		if (isHomeOrAbove(cur)) break;
+		try {
+			const st = await lstat(path.join(cur, ".git"));
+			if (st.isDirectory() || st.isFile()) return cur;
+		} catch {}
+		try {
+			const ax = path.join(cur, ".axiom");
+			if ((await lstat(ax)).isDirectory()) for (const m of AXIOM_REPO_MARKERS) try {
+				await lstat(path.join(ax, m));
+				return cur;
+			} catch {}
+		} catch {}
+		const parent = path.dirname(cur);
+		if (parent === cur) break;
+		cur = parent;
+	}
+	return start;
 }
 async function runGate(payloadText, opts = {}) {
 	const t0 = performance.now();
 	const level = opts.logLevel ?? "warn";
 	const stderr = [];
+	let toolClass;
+	let rootUsed;
 	const log = (lvl, msg) => {
 		if (RANK[lvl] <= RANK[level]) stderr.push(`AXIOM GATE ${lvl.toUpperCase()}: ${msg}`);
 	};
@@ -8838,15 +9397,24 @@ async function runGate(payloadText, opts = {}) {
 		log("debug", `allow: ${why}`);
 		return {
 			decision: "allow",
+			verdict: "allow",
 			exitCode: 0,
 			stderr,
-			durationMs: performance.now() - t0
+			durationMs: performance.now() - t0,
+			...toolClass === void 0 ? {} : { toolClass },
+			...rootUsed === void 0 ? {} : { root: rootUsed }
 		};
 	};
+	const deny = (d) => denyResult(d, stderr, t0, {
+		...toolClass === void 0 ? {} : { toolClass },
+		...rootUsed === void 0 ? {} : { root: rootUsed }
+	});
 	const internal = (why) => {
-		if (opts.strict === true) return denyResult(new GateDeny("ERR_INTERNAL", `${why} (--strict)`), stderr, t0);
-		log("warn", `${why} — failing open`);
-		return allow("internal error");
+		if (opts.failOpen === true) {
+			log("warn", `${why} — failing open (--fail-open)`);
+			return allow("internal error");
+		}
+		return deny(new GateDeny("ERR_INTERNAL", `${why} (fail-closed; pass --fail-open to allow)`));
 	};
 	if (payloadText === void 0) return internal("no payload on stdin (timeout or empty)");
 	let raw;
@@ -8856,26 +9424,61 @@ async function runGate(payloadText, opts = {}) {
 		return internal(`payload is not JSON: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	const payload = normalizePayload(raw);
-	if (payload === void 0) return allow("payload carries no tool name");
-	const targets = extractTargets(payload);
-	if (targets.length === 0) return allow(`tool ${payload.toolName} has no write target`);
+	if (payload === void 0) {
+		log("info", "payload carries no tool name");
+		return allow("payload carries no tool name");
+	}
+	const extracted = extractTargets(payload);
+	toolClass = extracted.cls;
+	if (extracted.cls === "other") return allow(`tool ${payload.toolName} is not a write/shell tool`);
+	if (extracted.cls === "shell" && opts.noShellScan === true) return allow(`tool ${payload.toolName} is a shell tool and --no-shell-scan is set`);
+	if (extracted.undetermined) {
+		if (opts.failOpen === true) {
+			log("warn", `write tool ${payload.toolName} has no recognised path key — allowing (--fail-open)`);
+			return allow("undetermined write target");
+		}
+		return deny(new GateDeny("ERR_UNSUPPORTED_OP", `write tool "${payload.toolName}" carries no recognised path key (${PATH_KEYS.join(", ")}); add it to the gate or pass --fail-open`));
+	}
+	const targets = extracted.targets;
+	if (targets.length === 0) return allow(`tool ${payload.toolName} writes nothing recognisable`);
 	try {
 		const rootArg = payload.cwd ?? opts.root ?? (opts.cwdFallback ?? (() => process.cwd()))();
 		let rootReal = await realpathNative(path.resolve(rootArg));
 		if (IS_WIN32 && rootReal.startsWith("\\\\?\\")) rootReal = rootReal.slice(4);
+		const cwdReal = rootReal;
+		if (opts.noRootDiscovery !== true) {
+			const discovered = await discoverRoot(rootReal, opts.home);
+			if (discovered !== rootReal) {
+				log("debug", `root discovered ${rootReal} → ${discovered}`);
+				rootReal = discovered;
+			}
+		}
+		rootUsed = rootReal;
 		const { profile, source } = await loadGateProfile({
 			root: rootReal,
 			...opts.profilePath === void 0 ? {} : { profilePath: opts.profilePath },
 			...opts.home === void 0 ? {} : { home: opts.home }
 		});
-		log("debug", `root=${rootReal} profile=${source} targets=${targets.length}`);
+		log("debug", `root=${rootReal} profile=${source} class=${extracted.cls} targets=${targets.length}`);
 		const resolved = [];
-		for (const t of targets) resolved.push(await resolveGateTarget(rootReal, t));
-		const deny = await runGatePredicates(resolved, profile);
-		if (deny !== void 0) return denyResult(deny, stderr, t0);
-		return allow(`${resolved.length} target(s) passed`);
+		for (const t of targets) try {
+			resolved.push(await resolveGateTarget(rootReal, t, cwdReal));
+		} catch (err) {
+			if (extracted.cls === "shell" && err instanceof GateDeny && err.code !== "ERR_CONTAINMENT") {
+				log("debug", `shell operand ${JSON.stringify(t.rawPath)} skipped: ${err.code}`);
+				continue;
+			}
+			if (extracted.cls === "shell" && err instanceof GateDeny && t.rawPath === ".") {
+				if (profile.deny.length > 0) throw new GateDeny("path.deny", "destructive git command on the whole tree", ".");
+				continue;
+			}
+			throw err;
+		}
+		const verdict = await runGatePredicates(resolved, profile);
+		if (verdict !== void 0) return deny(verdict);
+		return allow(`${resolved.length} target(s) passed (${extracted.cls})`);
 	} catch (err) {
-		if (err instanceof GateDeny) return denyResult(err, stderr, t0);
+		if (err instanceof GateDeny) return deny(err);
 		return internal(err instanceof Error ? err.message : String(err));
 	}
 }
@@ -8925,7 +9528,7 @@ function readStdin(stream, { timeoutMs = GATE_STDIN_TIMEOUT_MS, maxBytes = GATE_
 		stream.resume();
 	});
 }
-const GATE_USAGE = "usage: axiom gate --stdin [--root <dir>] [--profile <file>] [--strict] [--log-level error|warn|info|debug]";
+const GATE_USAGE = "usage: axiom gate --stdin [--root <dir>] [--profile <file>] [--fail-open] [--no-shell-scan] [--no-root-discovery] [--log-level error|warn|info|debug]";
 async function gateMain(argv, io = {}) {
 	const t0 = performance.now();
 	let values;
@@ -8937,6 +9540,9 @@ async function gateMain(argv, io = {}) {
 				root: { type: "string" },
 				profile: { type: "string" },
 				strict: { type: "boolean" },
+				"fail-open": { type: "boolean" },
+				"no-shell-scan": { type: "boolean" },
+				"no-root-discovery": { type: "boolean" },
 				"log-level": { type: "string" }
 			},
 			strict: true,
@@ -8945,6 +9551,7 @@ async function gateMain(argv, io = {}) {
 	} catch (err) {
 		return {
 			decision: "deny",
+			verdict: "deny",
 			exitCode: 2,
 			reason: err instanceof Error ? err.message : String(err),
 			stderr: [`AXIOM GATE ERROR: ${err instanceof Error ? err.message : String(err)}`, GATE_USAGE],
@@ -8953,6 +9560,7 @@ async function gateMain(argv, io = {}) {
 	}
 	if (values.stdin !== true) return {
 		decision: "deny",
+		verdict: "deny",
 		exitCode: 2,
 		reason: "--stdin is required",
 		stderr: ["AXIOM GATE ERROR: --stdin is required", GATE_USAGE],
@@ -8965,6 +9573,9 @@ async function gateMain(argv, io = {}) {
 	if (values.root !== void 0) opts.root = values.root;
 	if (values.profile !== void 0) opts.profilePath = values.profile;
 	if (values.strict === true) opts.strict = true;
+	if (values["fail-open"] === true) opts.failOpen = true;
+	if (values["no-shell-scan"] === true) opts.noShellScan = true;
+	if (values["no-root-discovery"] === true) opts.noRootDiscovery = true;
 	if (io.cwdFallback !== void 0) opts.cwdFallback = io.cwdFallback;
 	if (io.home !== void 0) opts.home = io.home;
 	if (read.tooLarge) {