@cybedefend/vibedefend 1.2.4 → 1.3.0

package/dist/hook-runner.js

@@ -4850,18 +4850,20 @@ function resolveTokenLinux(mcpName) {
     return null;
   }
 }
-async function resolveTokenWithRefresh(mcpName) {
+async function resolveTokenWithRefresh(mcpName, deps = {}) {
+  const getValidAccessTokenFn = deps.getValidAccessToken ?? getValidAccessToken;
+  const resolveTokenFn = deps.resolveTokenFn ?? resolveToken;
   const envToken = process.env.CYBEDEFEND_TOKEN;
   if (envToken && envToken.length > 0) return envToken;
   try {
-    const token = await getValidAccessToken(mcpName);
+    const token = await getValidAccessTokenFn(mcpName);
     if (token) return token;
   } catch (e) {
     if (e instanceof LoginRequiredError) {
-      return null;
+      return resolveTokenFn(mcpName);
     }
   }
-  return resolveToken(mcpName);
+  return resolveTokenFn(mcpName);
 }
 
 // src/hooks/runtime/api.ts
@@ -4990,6 +4992,19 @@ function emitContext(body, client) {
   }
   emit(body, client);
 }
+function emitStop(body, client, reason) {
+  if (!body) return;
+  if (client === "claude-code") {
+    process.stdout.write(
+      JSON.stringify({
+        decision: "block",
+        reason: reason && reason.trim() ? reason : body
+      })
+    );
+    return;
+  }
+  emit(body, client);
+}
 
 // src/hooks/runtime/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
@@ -5469,7 +5484,7 @@ function readPackageMeta(opts = {}) {
   }
 }
 var pkg = readPackageMeta({
-  bakedVersion: true ? "1.2.4" : void 0
+  bakedVersion: true ? "1.3.0" : void 0
 });
 
 // src/hooks/runtime/session-start.ts
@@ -5579,17 +5594,29 @@ var COUNTED_TOOLS = /* @__PURE__ */ new Set([
   "apply_patch",
   "pre_write_code"
 ]);
+var REVIEW_SENTINEL = "CybeDefend gap analysis (Stop hook";
+function transcriptHasReviewSentinel(transcript) {
+  try {
+    return JSON.stringify(transcript).includes(REVIEW_SENTINEL);
+  } catch {
+    return false;
+  }
+}
 async function sessionReviewHook(deps = {}) {
   const readStdin = deps.readStdin ?? readStdinJson;
   const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
-  const emitFn = deps.emitFn ?? emit;
+  const emitFn = deps.emitFn ?? emitStop;
   const readTranscriptFile = deps.readTranscriptFile ?? defaultReadTranscript;
   const stdin = await readStdin();
   const event = sniff(stdin);
+  if (stdin.stop_hook_active === true || stdin.stop_hook_active === "true") {
+    return;
+  }
   const config = loadConfig();
   if (!config) return;
   if (!config.hooks.enableSessionReview) return;
   const transcript = loadTranscript(stdin, readTranscriptFile);
+  if (transcriptHasReviewSentinel(transcript)) return;
   let editCount = countEdits(transcript);
   if (process.env.CYBEDEFEND_DRY_RUN === "1") {
     editCount = parseInt(process.env.CYBEDEFEND_DRY_RUN_EDITS ?? "5", 10);
@@ -5597,13 +5624,18 @@ async function sessionReviewHook(deps = {}) {
   if (editCount === 0) return;
   if (editCount < config.hooks.reviewThreshold) return;
   const userPrompt = extractFirstUserPrompt(transcript);
-  const body = composeReviewBody(
+  let body = composeReviewBody(
     editCount,
     event.client,
     userPrompt,
     config.hooks.autoProposeMode
   );
-  emitFn(body, event.client);
+  const withDiffScan = config.hooks.enableDiffScan !== false;
+  if (withDiffScan) {
+    const cwd = typeof stdin.cwd === "string" && stdin.cwd ? stdin.cwd : process.cwd();
+    body += "\n" + composeDiffScanBody(extractChangedFiles(transcript, void 0, cwd));
+  }
+  emitFn(body, event.client, composeStopReason(withDiffScan));
 }
 function loadTranscript(stdin, readFile) {
   if (Array.isArray(stdin.transcript)) return stdin.transcript;
@@ -5666,6 +5698,53 @@ function countEdits(transcript) {
   }
   return n;
 }
+var CHANGED_FILES_MAX = 300;
+var CHANGED_FILES_DISPLAY = 50;
+function toolInputOf(obj) {
+  const input = obj.input ?? obj.tool_input;
+  return input && typeof input === "object" ? input : {};
+}
+function filePathOfToolUse(obj) {
+  const input = toolInputOf(obj);
+  if (typeof input.file_path === "string" && input.file_path) {
+    return input.file_path;
+  }
+  if (typeof input.path === "string" && input.path) return input.path;
+  if (typeof input.patch === "string" && input.patch) {
+    return filePathFromPatch(input.patch);
+  }
+  return "";
+}
+function collectChangedFilesDeep(node, depth, out) {
+  if (depth > 8 || node === null || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const item of node) collectChangedFilesDeep(item, depth + 1, out);
+    return;
+  }
+  const obj = node;
+  if (COUNTED_TOOLS.has(toolNameOf(obj))) {
+    const p = filePathOfToolUse(obj);
+    if (p) out.add(p);
+    return;
+  }
+  for (const value of Object.values(obj)) {
+    if (value && typeof value === "object") {
+      collectChangedFilesDeep(value, depth + 1, out);
+    }
+  }
+}
+function relativizePath(p, cwd) {
+  if (cwd && p.startsWith(cwd.endsWith("/") ? cwd : cwd + "/")) {
+    return p.slice(cwd.endsWith("/") ? cwd.length : cwd.length + 1);
+  }
+  return p;
+}
+function extractChangedFiles(transcript, cap = CHANGED_FILES_MAX, cwd) {
+  const out = /* @__PURE__ */ new Set();
+  for (const event of transcript) collectChangedFilesDeep(event, 0, out);
+  const arr = cwd ? Array.from(out).map((p) => relativizePath(p, cwd)) : Array.from(out);
+  return arr.slice(0, cap);
+}
 var COMMAND_WRAPPER_PREFIXES = [
   "<local-command-",
   "<command-name>",
@@ -5719,43 +5798,96 @@ function extractFirstUserPrompt(transcript) {
 function composeReviewBody(editCount, client, userPrompt, autoPropose) {
   const safePrompt = userPrompt || "(could not extract \u2014 re-read transcript)";
   const proposalLine = autoPropose ? [
-    "   **Auto-propose mode is ON** (configured at install). Without asking the user,",
-    "   call `cybe_rules_report_missing(projectId, { rule_text, evidence_files,",
-    '   rationale: "<quote user prompt>", confirmed_by_user: true })` for each',
-    "   selected concern (1\u20132 max). The user will validate them at the next",
-    "   session start via the Accept/Reject picker."
+    "   **Auto-propose mode is ON** (configured at install). If \u2014 and ONLY",
+    "   if \u2014 one gap clears the bar above, call WITHOUT asking the user:",
+    "   `cybe_rules_report_missing(projectId, { rule_text, evidence_files,",
+    '   rationale: "<quote user prompt>", confirmed_by_user: true })` for',
+    "   that single rule. The user validates it at the next session start",
+    "   via the Accept/Reject picker. If nothing clears the bar, propose",
+    "   nothing."
   ].join("\n") : [
     "   Ask the user via AskUserQuestion:",
-    '   > "Your prompt mentioned <concern>, but no business rule covers it.',
-    '   >  Propose this rule for the project?" \u2014 Yes / No / Edit before proposing.',
-    '   ONLY on explicit "yes": call `cybe_rules_report_missing(projectId,',
+    '   > "Your prompt implied <concern>, but no business rule covers it.',
+    '   >  Propose it as a standing rule for the project?" \u2014 Yes / No / Edit.',
+    '   ONLY on an explicit "yes": call `cybe_rules_report_missing(projectId,',
     '   { rule_text, evidence_files, rationale: "<quote user prompt>",',
     "   confirmed_by_user: true })`."
   ].join("\n");
   return [
     `## \u{1F6E1}\uFE0F CybeDefend gap analysis (Stop hook \u2014 ${editCount} edits this session, client=${client})`,
     "",
-    "Do a **gap analysis** between the original user request and the",
-    "business rules that were applied during this session.",
+    "Check whether this session revealed a MISSING standing rule \u2014 a durable,",
+    "reusable security/business invariant the project should enforce on FUTURE",
+    "changes. Proposing is the exception, not a reflex: **most sessions \u2014",
+    "especially small edits \u2014 end with no proposal, and that is the expected",
+    "outcome.**",
     "",
     "**Original user prompt (first 600 chars):**",
     `> ${safePrompt}`,
     "",
-    "### Required next-turn action",
-    "1. Extract security/business concerns the prompt mentions.",
-    "2. List CybeDefend rules returned during the session.",
-    "3. Identify concerns WITHOUT a matching rule, then select **AT MOST the",
-    "   1\u20132 most important** (prefer security-critical / data-handling). Ignore",
-    "   the rest \u2014 over-proposing causes proposal fatigue and users end up",
-    "   rejecting everything. Propose nothing if no gap is worth a standing rule.",
-    "4. For each selected concern (1\u20132 max):",
+    "### How to decide",
+    "1. List the security/business concerns the prompt mentions or implies.",
+    "2. List the CybeDefend rules that were returned during this session.",
+    "3. Find concerns with NO matching rule, then propose **at most 1** \u2014 the",
+    "   single most valuable \u2014 and ONLY if it is a durable, reusable invariant:",
+    "   it must apply to future changes (not a one-off), not be stylistic, and",
+    "   not already be covered. Over-proposing causes proposal fatigue and",
+    "   users end up rejecting everything \u2014 when in doubt, propose nothing.",
+    "4. If (and only if) one gap clears that bar:",
     proposalLine,
-    "5. If every concern is covered (or none warrants a rule), say so:",
-    '   "\u{1F6E1}\uFE0F CybeDefend gap analysis: every concern in your request was covered',
-    '    by an existing rule. No new proposals."',
+    "5. Otherwise \u2014 the normal case \u2014 propose nothing and say so:",
+    '   "\u{1F6E1}\uFE0F CybeDefend gap analysis: nothing this session warrants a new',
+    '    standing rule. No proposals."',
+    ""
+  ].join("\n");
+}
+function composeDiffScanBody(changedFiles) {
+  const total = changedFiles.length;
+  const shown = changedFiles.slice(0, CHANGED_FILES_DISPLAY);
+  const heading = total > CHANGED_FILES_DISPLAY ? `**Changed files this session (showing first ${CHANGED_FILES_DISPLAY} of ${total}):**` : `**Changed files this session (${total}):**`;
+  const fileLines = total > 0 ? [
+    heading,
+    ...shown.map((f) => `- \`${f}\``),
+    "(If you changed other files not listed above, include them too.)"
+  ] : [
+    "Use the repo-relative paths of every file you created or edited this",
+    "session as the `paths`."
+  ];
+  return [
+    "## \u{1F50D} CybeDefend pre-commit diff scan",
+    "",
+    "Before the user commits, run a best-effort security scan (SAST / IaC /",
+    "secrets) limited to the files you changed this session.",
+    "",
+    ...fileLines,
+    "",
+    "### Required next-turn action",
+    "1. Call `cybe_scan_diff(projectId, { paths })` with those repo-relative",
+    "   PATHS (paths only \u2014 NOT the file contents). It returns",
+    "   `{ scanId, uploadUrl, expiresAt }`.",
+    "2. Build a ZIP of those exact files (full current content, repo-relative",
+    "   entry names \u2014 e.g. `zip -q diff.zip <paths>`) and upload it with an HTTP",
+    "   PUT to `uploadUrl` (header `Content-Type: application/zip`) BEFORE",
+    '   `expiresAt` (e.g. `curl -X PUT -H "Content-Type: application/zip"',
+    '   --data-binary @diff.zip "<uploadUrl>"`). The contents go straight to the',
+    "   bucket, never through the MCP tool.",
+    "3. Poll `cybe_scan_status(projectId, scanId)` until it is completed, then",
+    "   read `cybe_scan_findings(projectId, scanId)`.",
+    "4. Fix or justify every finding. For a confident false positive, add a",
+    "   `// cybedefend-ignore: <reason>` comment on the offending line so it",
+    "   stays silenced on the full scan too.",
+    "",
+    "This diff scan is best-effort \u2014 it COMPLEMENTS, never replaces, the full",
+    "scan (secrets are head-only; cross-file SAST context may be missing). Caps:",
+    "300 files / 1 MB per file / 3 MB total \u2014 over the cap the scan fails, so run",
+    "a full scan instead.",
     ""
   ].join("\n");
 }
+function composeStopReason(withDiffScan) {
+  const scan = withDiffScan ? ", then run a pre-commit `cybe_scan_diff` on the files you changed (poll `cybe_scan_status`, read `cybe_scan_findings`) and fix or justify each finding" : "";
+  return "\u{1F6E1}\uFE0F CybeDefend \u2014 before wrapping up, run the end-of-session review: gap-analyse the request against this session's business rules and, for any uncovered security/data concern, offer to propose a rule via AskUserQuestion (`cybe_rules_report_missing` only on an explicit yes)" + scan + ".";
+}
 
 // src/hooks/runtime/pre-compact.ts
 async function preCompactHook(deps = {}) {
@@ -6382,6 +6514,31 @@ var PATTERNS = [
     re: /AKIA[0-9A-Z]{16}/g,
     captureIndex: null
   },
+  // 4b. Anthropic API key (matched before the generic sk- pattern below)
+  {
+    re: /sk-ant-[0-9A-Za-z_-]{16,}/g,
+    captureIndex: null
+  },
+  // 4c. OpenAI API key
+  {
+    re: /sk-[0-9A-Za-z]{20,}/g,
+    captureIndex: null
+  },
+  // 4d. Google API key
+  {
+    re: /AIza[0-9A-Za-z_-]{35,}/g,
+    captureIndex: null
+  },
+  // 4e. Slack token (bot/user/app/refresh/legacy)
+  {
+    re: /xox[baprs]-[0-9A-Za-z-]{10,}/g,
+    captureIndex: null
+  },
+  // 4f. Credentials embedded in a URL: scheme://user:pass@host — redact user:pass
+  {
+    re: /(?<=:\/\/)[^/\s:@]+:[^/\s:@]+(?=@)/g,
+    captureIndex: null
+  },
   // 5. Bearer token — preserve the "Bearer " keyword, replace only the token.
   //    Group 1 = the prefix ("Bearer "), group 2 = the token value.
   {
@@ -6439,6 +6596,280 @@ function hashTarget(text) {
   return createHash("sha256").update(text, "utf8").digest("hex");
 }
 
+// src/hooks/runtime/near-miss.ts
+var RE_CLASS_ESCAPES = /* @__PURE__ */ new Set([
+  "s",
+  "S",
+  "d",
+  "D",
+  "w",
+  "W",
+  "b",
+  "B",
+  "n",
+  "r",
+  "t",
+  "f",
+  "v",
+  "A",
+  "Z",
+  "z",
+  "G"
+]);
+var TOKEN_CHARS = /[A-Za-z0-9_\-/=:.@]/;
+function dedupe(xs) {
+  return [...new Set(xs.filter((x) => x.length > 0))];
+}
+function basename(p) {
+  const parts = p.split("/");
+  return parts[parts.length - 1] ?? p;
+}
+function expandTilde(p, homeDir) {
+  if (p === "~") return homeDir;
+  if (p.startsWith("~/")) return `${homeDir}/${p.slice(2)}`;
+  return p;
+}
+function extractCommandAnchors(src) {
+  const tokens = [];
+  const opLiterals = [];
+  let buf = "";
+  const flush = () => {
+    if (buf) tokens.push(buf);
+    buf = "";
+  };
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i];
+    if (c === "\\") {
+      const nxt = src[i + 1] ?? "";
+      i++;
+      if ("|><&".includes(nxt)) {
+        flush();
+        opLiterals.push(nxt);
+      } else if (RE_CLASS_ESCAPES.has(nxt)) {
+        flush();
+      } else {
+        buf += nxt;
+      }
+      continue;
+    }
+    if (c === "[") {
+      flush();
+      while (i < src.length && src[i] !== "]") i++;
+      continue;
+    }
+    if (c === ".") {
+      flush();
+      continue;
+    }
+    if (TOKEN_CHARS.test(c)) {
+      buf += c;
+      continue;
+    }
+    flush();
+  }
+  flush();
+  const commands = [];
+  const flags = [];
+  const literals = [];
+  for (const raw of tokens) {
+    const t = raw;
+    if (/^--?[A-Za-z][A-Za-z0-9-]*$/.test(t)) {
+      flags.push(t);
+    } else if (/[/=:@]/.test(t) || /\d{1,3}(\.\d{1,3}){2,}/.test(t)) {
+      literals.push(t);
+    } else if (/^[A-Za-z][A-Za-z0-9_-]{1,}$/.test(t)) {
+      commands.push(t);
+    } else if (t.length >= 3) {
+      literals.push(t);
+    }
+  }
+  const subLiterals = [];
+  for (const lit of literals) {
+    const m = lit.match(/\/[A-Za-z]{2,}\//g);
+    if (m) subLiterals.push(...m);
+  }
+  return {
+    commands: dedupe(commands),
+    flags: dedupe(flags),
+    literals: dedupe([...literals, ...subLiterals, ...opLiterals])
+  };
+}
+var GENERIC_SEGMENTS = /* @__PURE__ */ new Set([
+  "config",
+  "conf",
+  "configs",
+  "settings",
+  "data",
+  "home",
+  "user",
+  "users",
+  "usr",
+  "var",
+  "tmp",
+  "opt",
+  "etc",
+  "app",
+  "apps",
+  "src",
+  "lib",
+  "bin",
+  "dist",
+  "build",
+  "out",
+  "target",
+  "public",
+  "static",
+  "assets",
+  "main",
+  "index",
+  "test",
+  "tests",
+  "docs",
+  "node_modules",
+  "vendor",
+  "project"
+]);
+function extractGlobAnchors(glob) {
+  const segs = glob.split("/");
+  const literals = [];
+  let ext = null;
+  for (const seg of segs) {
+    if (!seg || seg === "**" || seg === "*") continue;
+    const bare = seg.replace(/[*?]/g, "");
+    if (!bare) continue;
+    if (bare.startsWith(".") && !bare.slice(1).includes(".")) {
+      literals.push(bare);
+      if (bare.length <= 6) ext = bare;
+    } else if (bare.includes(".")) {
+      literals.push(bare);
+    } else if (bare.length >= 3 && !GENERIC_SEGMENTS.has(bare.toLowerCase())) {
+      literals.push(bare);
+    }
+  }
+  return { ext, literals: dedupe(literals) };
+}
+function nearMissCommand(target, rule) {
+  if (!rule.commandRegex) return false;
+  const { commands, flags, literals } = extractCommandAnchors(
+    rule.commandRegex
+  );
+  if (commands.length === 0 && flags.length === 0 && literals.length === 0)
+    return false;
+  const cmd = target.command;
+  const base = basename(cmd);
+  const joined = [cmd, ...target.argv].join(" ");
+  const flagHits = (fl) => {
+    if (fl.startsWith("--")) return joined.includes(fl);
+    const letters = fl.replace(/^-+/, "").split("");
+    if (letters.length === 0) return false;
+    return target.argv.some(
+      (t) => t.startsWith("-") && letters.every((ch) => t.includes(ch))
+    );
+  };
+  const cmdHitCount = commands.filter(
+    (a) => cmd === a || base === a || target.argv.includes(a)
+  ).length;
+  const flagHitCount = flags.filter(flagHits).length;
+  const litHitCount = literals.filter((l) => joined.includes(l)).length;
+  const core = cmdHitCount > 0 || litHitCount > 0;
+  const totalAnchors = commands.length + flags.length + literals.length;
+  const signalCount = cmdHitCount + flagHitCount + litHitCount;
+  const threshold = totalAnchors >= 2 ? 2 : 1;
+  return core && signalCount >= threshold;
+}
+function nearMissFile(target, rule, homeDir) {
+  const globs = rule.filePathGlobs;
+  if (!globs || globs.length === 0) return false;
+  const path = expandTilde(target.path, homeDir);
+  const base = basename(path);
+  const segs = path.split("/");
+  for (const g of globs) {
+    const { ext, literals } = extractGlobAnchors(g);
+    if (ext && path.endsWith(ext)) return true;
+    for (const l of literals) {
+      if (l.startsWith(".")) {
+        if (base.includes(l) || path.includes(`/${l}`) || path.endsWith(l))
+          return true;
+      } else if (segs.includes(l) || base.includes(l)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function literalsFromGlobList(globs) {
+  const out = [];
+  for (const g of globs) {
+    for (const part of g.split(/[*?]/)) {
+      const p = part.replace(/^[._-]+|[._-]+$/g, "");
+      if (p.length >= 3) out.push(part.length >= 3 ? part : p);
+    }
+  }
+  return dedupe(out);
+}
+function nearMissEnv(target, rule) {
+  const globs = rule.envNameGlobs;
+  if (!globs || globs.length === 0) return false;
+  const name = target.name;
+  for (const g of globs) {
+    const lead = g.startsWith("*");
+    const trail = g.endsWith("*");
+    const core = g.replace(/[*?]/g, "");
+    if (core.length < 3) continue;
+    if (lead && trail) {
+      if (name.includes(core)) return true;
+    } else if (trail) {
+      if (name.startsWith(core)) return true;
+    } else if (lead) {
+      if (name.endsWith(core)) return true;
+    } else if (name === core) {
+      return true;
+    }
+  }
+  return false;
+}
+function nearMissHttp(target, rule) {
+  const globs = rule.httpHostGlobs;
+  if (!globs || globs.length === 0) return false;
+  let hostname;
+  try {
+    hostname = new URL(target.url).hostname;
+  } catch {
+    hostname = target.url;
+  }
+  const literals = literalsFromGlobList(globs);
+  const prefixes = [];
+  for (const l of literals) {
+    const m = l.match(/^(\d{1,3}\.\d{1,3})\.\d/);
+    if (m) prefixes.push(`${m[1]}.`);
+  }
+  return [...literals, ...prefixes].some((l) => hostname.includes(l));
+}
+function nearMissGit(target, rule) {
+  if (rule.gitSubcommand && rule.gitSubcommand.length > 0) {
+    return rule.gitSubcommand.includes(target.subcommand);
+  }
+  return false;
+}
+function nearMiss(req, rule) {
+  if (rule.toolMatch && rule.toolMatch.length > 0 && !rule.toolMatch.includes(req.tool)) {
+    return false;
+  }
+  const { target, homeDir } = req;
+  switch (target.type) {
+    case "command":
+      return nearMissCommand(target, rule);
+    case "file":
+      return nearMissFile(target, rule, homeDir);
+    case "env":
+      return nearMissEnv(target, rule);
+    case "http":
+      return nearMissHttp(target, rule);
+    case "git":
+      return nearMissGit(target, rule);
+  }
+}
+
 // src/hooks/runtime/guard-rules-cache.ts
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
@@ -6489,7 +6920,9 @@ function snakeToCamelRule(raw) {
     gitSubcommand: raw["git_subcommand"] ?? raw["gitSubcommand"],
     denyMessage: raw["deny_message"] ?? raw["denyMessage"],
     warnMessage: raw["warn_message"] ?? raw["warnMessage"],
-    defaultAction: raw["default_action"] ?? raw["defaultAction"]
+    defaultAction: raw["default_action"] ?? raw["defaultAction"],
+    llmJudgeEnabled: raw["llm_judge_enabled"] ?? raw["llmJudgeEnabled"],
+    catchEligible: raw["catch_eligible"] ?? raw["catchEligible"]
   };
 }
 function makeGuardRulesCache(opts) {
@@ -6500,7 +6933,7 @@ function makeGuardRulesCache(opts) {
     const entry = readCache(ctx.projectId);
     const ageSec = entry ? (Date.now() - entry.fetchedAt) / 1e3 : Infinity;
     if (entry && ageSec < staleSec) {
-      return { kind: "rules", rules: entry.rules };
+      return { kind: "rules", rules: entry.rules, llmJudge: entry.llmJudge };
     }
     try {
       const result = await fetchFn({
@@ -6512,19 +6945,18 @@ function makeGuardRulesCache(opts) {
           ...entry,
           fetchedAt: Date.now()
         });
-        return { kind: "rules", rules: entry.rules };
+        return { kind: "rules", rules: entry.rules, llmJudge: entry.llmJudge };
       }
-      const transformedRules = result.rules.map(
-        (r) => snakeToCamelRule(r)
-      );
+      const transformedRules = result.rules.map((r) => snakeToCamelRule(r));
       const fresh = {
         projectId: ctx.projectId,
         rules: transformedRules,
         etag: result.etag,
-        fetchedAt: Date.now()
+        fetchedAt: Date.now(),
+        llmJudge: result.llmJudge ?? null
       };
       writeCache(fresh);
-      return { kind: "rules", rules: fresh.rules };
+      return { kind: "rules", rules: fresh.rules, llmJudge: fresh.llmJudge };
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       if (entry?.rules?.length) {
@@ -6533,7 +6965,7 @@ function makeGuardRulesCache(opts) {
           `[VibeDefend] Action Guards: rule refresh failed (${msg}). Using cached rules (age=${ageSec2}s).
 `
         );
-        return { kind: "rules", rules: entry.rules };
+        return { kind: "rules", rules: entry.rules, llmJudge: entry.llmJudge };
       }
       return {
         kind: "unavailable",
@@ -6593,22 +7025,127 @@ async function fetchEffectiveRulesFromGateway(ctx, opts = {}) {
   const data = body.data ?? body;
   const rules = Array.isArray(data.rules) ? data.rules : [];
   const etag = res.headers.get("ETag");
-  return { rules, etag, notModified: false };
+  const llmJudge = parseLlmJudgeHint(data["llm_judge"]);
+  return { rules, etag, notModified: false, llmJudge };
+}
+function parseLlmJudgeHint(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  return {
+    enabled: Boolean(o["enabled"]),
+    quotaRemaining: typeof o["quota_remaining"] === "number" ? o["quota_remaining"] : -1,
+    quotaExhausted: Boolean(o["quota_exhausted"])
+  };
+}
+
+// src/hooks/runtime/judge.ts
+var DEFAULT_TIMEOUT_MS3 = 1500;
+async function callJudge(input, opts = {}) {
+  const f = opts.fetchImpl ?? globalThis.fetch;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
+  const url = `${input.apiBaseResolved}/project/${encodeURIComponent(input.projectId)}/action-guards/judge`;
+  try {
+    const res = await f(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${input.token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        tool: input.tool,
+        agent: input.agent,
+        session_id: input.sessionId,
+        phase: input.phase ?? "confirm",
+        action_summary: input.actionSummary,
+        action_hash: input.actionHash,
+        rules: input.rules
+      }),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    const data = body.data ?? body;
+    const decision = data["decision"];
+    if (decision !== "block" && decision !== "allow") return null;
+    return {
+      decision,
+      reason: typeof data["reason"] === "string" ? data["reason"] : "",
+      model: typeof data["model"] === "string" ? data["model"] : "",
+      quotaRemaining: typeof data["quota_remaining"] === "number" ? data["quota_remaining"] : -1,
+      quotaExceeded: Boolean(data["quota_exceeded"])
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/hooks/runtime/judge-cache.ts
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync10, mkdirSync as mkdirSync5 } from "node:fs";
+import { dirname as dirname4, join as join8 } from "node:path";
+import { homedir as homedir6 } from "node:os";
+var DEFAULT_JUDGE_CACHE_FILE = join8(
+  homedir6(),
+  ".cybedefend",
+  "guards-judge-cache.json"
+);
+var DEFAULT_JUDGE_TTL_MS = 12e4;
+function makeJudgeCache(opts = {}) {
+  const cacheFile = opts.cacheFile ?? DEFAULT_JUDGE_CACHE_FILE;
+  const ttlMs = opts.ttlMs ?? DEFAULT_JUDGE_TTL_MS;
+  const now = opts.now ?? (() => Date.now());
+  function readAll() {
+    if (!existsSync10(cacheFile)) return {};
+    try {
+      return JSON.parse(readFileSync10(cacheFile, "utf8"));
+    } catch {
+      return {};
+    }
+  }
+  function get(key) {
+    const entry = readAll()[key];
+    if (!entry) return null;
+    if (now() - entry.at > ttlMs) return null;
+    return entry.res;
+  }
+  function set(key, res) {
+    try {
+      const all = readAll();
+      const t = now();
+      for (const k of Object.keys(all)) {
+        if (t - all[k].at > ttlMs) delete all[k];
+      }
+      all[key] = { res, at: t };
+      ensureDirFor3(cacheFile);
+      writeFileSync6(cacheFile, JSON.stringify(all), "utf8");
+    } catch {
+    }
+  }
+  return { get, set };
+}
+function ensureDirFor3(filePath) {
+  const dir = dirname4(filePath);
+  if (!existsSync10(dir)) {
+    mkdirSync5(dir, { recursive: true });
+  }
 }
 
+// src/hooks/runtime/guard-check.ts
+import { homedir as homedir8 } from "node:os";
+import { join as join10 } from "node:path";
+
 // src/hooks/runtime/guard-violations-buffer.ts
 import {
   appendFileSync,
-  existsSync as existsSync10,
-  readFileSync as readFileSync10,
-  writeFileSync as writeFileSync6,
-  mkdirSync as mkdirSync5
+  existsSync as existsSync11,
+  readFileSync as readFileSync11,
+  writeFileSync as writeFileSync7,
+  mkdirSync as mkdirSync6
 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
-import { homedir as homedir6 } from "node:os";
-import { join as join8 } from "node:path";
-var DEFAULT_BUFFER_FILE = join8(
-  homedir6(),
+import { dirname as dirname5 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join9 } from "node:path";
+var DEFAULT_BUFFER_FILE = join9(
+  homedir7(),
   ".cybedefend",
   "guards-violations-buffer.jsonl"
 );
@@ -6621,16 +7158,16 @@ function makeViolationsBuffer(opts = {}) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     };
     try {
-      ensureDirFor3(bufferFile);
+      ensureDirFor4(bufferFile);
       appendFileSync(bufferFile, JSON.stringify(record) + "\n", "utf8");
     } catch {
     }
   }
   async function flushViolations2(ctx, postFn) {
-    if (!existsSync10(bufferFile)) return;
+    if (!existsSync11(bufferFile)) return;
     let content;
     try {
-      content = readFileSync10(bufferFile, "utf8").trim();
+      content = readFileSync11(bufferFile, "utf8").trim();
     } catch {
       return;
     }
@@ -6649,7 +7186,7 @@ function makeViolationsBuffer(opts = {}) {
     }
     if (records.length === 0) {
       try {
-        writeFileSync6(bufferFile, "", "utf8");
+        writeFileSync7(bufferFile, "", "utf8");
       } catch {
       }
       return;
@@ -6679,20 +7216,20 @@ function makeViolationsBuffer(opts = {}) {
     }
     try {
       if (failed.length === 0) {
-        writeFileSync6(bufferFile, "", "utf8");
+        writeFileSync7(bufferFile, "", "utf8");
       } else {
         const serialised = failed.map((r) => JSON.stringify(r)).join("\n") + "\n";
-        writeFileSync6(bufferFile, serialised, "utf8");
+        writeFileSync7(bufferFile, serialised, "utf8");
       }
     } catch {
     }
   }
   return { bufferViolation: bufferViolation2, flushViolations: flushViolations2 };
 }
-function ensureDirFor3(filePath) {
-  const dir = dirname4(filePath);
-  if (!existsSync10(dir)) {
-    mkdirSync5(dir, { recursive: true });
+function ensureDirFor4(filePath) {
+  const dir = dirname5(filePath);
+  if (!existsSync11(dir)) {
+    mkdirSync6(dir, { recursive: true });
   }
 }
 var _defaultBuffer = makeViolationsBuffer();
@@ -6718,11 +7255,11 @@ function appendDebugLog(entry) {
   try {
     const homeDir = process.env.HOME ?? process.env.USERPROFILE ?? "";
     if (!homeDir) return;
-    const { mkdirSync: mkdirSync6, appendFileSync: appendFileSync2 } = __require("node:fs");
-    const { join: join9 } = __require("node:path");
-    const dir = join9(homeDir, ".cybedefend");
-    mkdirSync6(dir, { recursive: true });
-    appendFileSync2(join9(dir, "hook-debug.log"), entry + "\n", "utf8");
+    const { mkdirSync: mkdirSync7, appendFileSync: appendFileSync2 } = __require("node:fs");
+    const { join: join11 } = __require("node:path");
+    const dir = join11(homeDir, ".cybedefend");
+    mkdirSync7(dir, { recursive: true });
+    appendFileSync2(join11(dir, "hook-debug.log"), entry + "\n", "utf8");
   } catch {
   }
 }
@@ -6893,36 +7430,171 @@ function stringifyTarget(t) {
       return `git ${t.subcommand}`;
   }
 }
+async function runJudgeStep(args) {
+  const {
+    judge,
+    llmJudgeHint,
+    rules,
+    decision,
+    projectContext,
+    request,
+    sessionId
+  } = args;
+  const matched = decision.matchedRuleIds.map((id) => rules.find((r) => r.id === id)).filter((r) => r !== void 0);
+  const llmRules = matched.filter(
+    (r) => r.action === "deny" && r.llmJudgeEnabled
+  );
+  if (llmRules.length === 0) return void 0;
+  if (decision.maxSeverity === "critical") return void 0;
+  if (llmJudgeHint?.enabled === false) return void 0;
+  const targetStr = stringifyTarget(request.target);
+  const actionHash = hashTarget(targetStr);
+  const ruleIds = llmRules.map((r) => r.id).sort().join(",");
+  const cacheKey = `${actionHash}|${ruleIds}|confirm`;
+  let res = judge.cacheGet(cacheKey);
+  if (!res) {
+    res = await judge.callJudge({
+      apiBaseResolved: projectContext.apiBaseResolved,
+      token: projectContext.token,
+      projectId: request.projectId,
+      tool: request.tool,
+      agent: "claude-code",
+      sessionId,
+      phase: "confirm",
+      // Judge over the FULL (schema-bounded 2048) redacted action — the default
+      // redactTarget cap of 256 (right for the DB-stored violation summary) would
+      // truncate a long dangerous action and risk an overturn on a partial view.
+      actionSummary: redactTarget(targetStr, 2048),
+      actionHash,
+      rules: llmRules.map((r) => ({
+        id: r.id,
+        name: r.name ?? r.id,
+        description: r.description ?? "",
+        severity: r.severity
+      }))
+    });
+    if (res) judge.cacheSet(cacheKey, res);
+  }
+  if (!res) {
+    return {
+      engine: "llm",
+      outcome: "fallback",
+      fallback_reason: "unavailable"
+    };
+  }
+  if (res.quotaExceeded) {
+    judge.warnOnce(
+      sessionId,
+      "VibeDefend judge quota exhausted \u2014 regex-only enforcement for this session."
+    );
+    return { engine: "llm", outcome: "quota_exceeded", model: res.model };
+  }
+  if (res.decision === "allow") {
+    return { engine: "llm", outcome: "overturned", model: res.model };
+  }
+  return { engine: "llm", outcome: "confirmed", model: res.model };
+}
+async function runCatchJudgeStep(args) {
+  const {
+    judge,
+    llmJudgeHint,
+    rules,
+    decision,
+    projectContext,
+    request,
+    sessionId
+  } = args;
+  if (llmJudgeHint?.enabled === false) return void 0;
+  const matchedIds = new Set(decision.matchedRuleIds);
+  const candidates = rules.filter(
+    (r) => r.action === "deny" && r.llmJudgeEnabled && r.catchEligible && r.severity !== "critical" && !matchedIds.has(r.id)
+  );
+  if (candidates.length === 0) return void 0;
+  const near = candidates.filter((r) => nearMiss(request, r));
+  if (near.length === 0) return void 0;
+  const targetStr = stringifyTarget(request.target);
+  const actionHash = hashTarget(targetStr);
+  const ruleIds = near.map((r) => r.id).sort();
+  const cacheKey = `${actionHash}|${ruleIds.join(",")}|catch`;
+  let res = judge.cacheGet(cacheKey);
+  if (!res) {
+    res = await judge.callJudge({
+      apiBaseResolved: projectContext.apiBaseResolved,
+      token: projectContext.token,
+      projectId: request.projectId,
+      tool: request.tool,
+      agent: "claude-code",
+      sessionId,
+      phase: "catch",
+      actionSummary: redactTarget(targetStr, 2048),
+      actionHash,
+      rules: near.map((r) => ({
+        id: r.id,
+        name: r.name ?? r.id,
+        description: r.description ?? "",
+        severity: r.severity
+      }))
+    });
+    if (res) judge.cacheSet(cacheKey, res);
+  }
+  if (!res) return void 0;
+  if (res.quotaExceeded) {
+    judge.warnOnce(
+      sessionId,
+      "VibeDefend judge quota exhausted \u2014 regex-only enforcement for this session."
+    );
+    return void 0;
+  }
+  if (res.decision !== "block") return void 0;
+  const top = near[0];
+  const message = `Blocked by the VibeDefend judge: this action resembles a dangerous pattern (${top.name ?? top.id}) the rules did not catch.`;
+  return {
+    audit: { engine: "llm", outcome: "caught", model: res.model },
+    ruleIds,
+    message
+  };
+}
+function emitUnverifiedBanner(reason) {
+  const banner = [
+    "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
+    "\u2588 VibeDefend Action Guards \u2014 UNVERIFIED                                        \u2588",
+    "\u2588\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2588",
+    "\u2588 Action Guards could NOT be enforced:                                         \u2588",
+    `\u2588   ${reason.slice(0, 76).padEnd(76)}\u2588`,
+    "\u2588                                                                              \u2588",
+    "\u2588 Your tool call is going through WITHOUT enforcement. This means:             \u2588",
+    "\u2588   \u2022 sensitive files / commands / URLs are NOT being blocked                 \u2588",
+    "\u2588   \u2022 Action Guards rules are NOT being applied                               \u2588",
+    "\u2588                                                                              \u2588",
+    "\u2588 Fix this immediately:                                                        \u2588",
+    "\u2588   vibedefend login                                                           \u2588",
+    "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"
+  ].join("\n") + "\n";
+  process.stderr.write(banner);
+  const isCodex = typeof process.env.CODEX_SANDBOX !== "undefined" || typeof process.env.CODEX_AGENT !== "undefined";
+  if (isCodex) {
+    try {
+      const ctx = JSON.stringify({
+        additionalContext: `VibeDefend Action Guards UNVERIFIED \u2014 ${reason} Tool call allowed WITHOUT enforcement. Run \`vibedefend login\` to restore protection.`
+      });
+      process.stdout.write(ctx + "\n");
+    } catch {
+    }
+  }
+}
 async function runPreToolUseGuardWith(opts) {
-  const { stdinEnvelope, projectContext, rulesOutcome, evaluateFn, bufferViolationFn } = opts;
+  const {
+    stdinEnvelope,
+    projectContext,
+    rulesOutcome,
+    evaluateFn,
+    bufferViolationFn
+  } = opts;
   if (!projectContext) return 0;
   if (rulesOutcome.kind === "unavailable") {
-    const banner = [
-      "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-      "\u2588 VibeDefend Action Guards \u2014 UNVERIFIED                                        \u2588",
-      "\u2588\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2588",
-      "\u2588 The policy engine could not be reached:                                      \u2588",
-      `\u2588   ${rulesOutcome.reason.slice(0, 76).padEnd(76)}\u2588`,
-      "\u2588                                                                              \u2588",
-      "\u2588 Your tool call is going through WITHOUT enforcement. This means:             \u2588",
-      "\u2588   \u2022 sensitive files / commands / URLs are NOT being blocked                 \u2588",
-      "\u2588   \u2022 Action Guards rules are NOT being applied                               \u2588",
-      "\u2588                                                                              \u2588",
-      "\u2588 Fix this immediately:                                                        \u2588",
-      "\u2588   vibedefend login                                                           \u2588",
-      "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"
-    ].join("\n") + "\n";
-    process.stderr.write(banner);
-    const isCodex = typeof process.env.CODEX_SANDBOX !== "undefined" || typeof process.env.CODEX_AGENT !== "undefined";
-    if (isCodex) {
-      try {
-        const ctx = JSON.stringify({
-          additionalContext: `VibeDefend Action Guards UNVERIFIED \u2014 policy engine unreachable (${rulesOutcome.reason}). Tool call allowed WITHOUT enforcement. Run \`vibedefend login\` to restore protection.`
-        });
-        process.stdout.write(ctx + "\n");
-      } catch {
-      }
-    }
+    emitUnverifiedBanner(
+      `Policy engine unreachable: ${rulesOutcome.reason}`
+    );
     return 0;
   }
   const rules = rulesOutcome.rules;
@@ -6934,17 +7606,54 @@ async function runPreToolUseGuardWith(opts) {
     projectId: projectContext.projectId,
     sessionId
   };
-  const decision = evaluateFn(rules, guardRequest);
-  if (decision.verdict !== "allow" && decision.matchedRuleIds.length > 0) {
+  let decision = evaluateFn(rules, guardRequest);
+  let judgeAudit;
+  if (opts.judge && decision.verdict === "deny" && decision.matchedRuleIds.length > 0) {
+    judgeAudit = await runJudgeStep({
+      judge: opts.judge,
+      llmJudgeHint: rulesOutcome.llmJudge,
+      rules,
+      decision,
+      projectContext,
+      request: guardRequest,
+      sessionId
+    });
+    if (judgeAudit?.outcome === "overturned") {
+      decision = { ...decision, verdict: "allow", message: void 0 };
+    }
+  }
+  if (opts.judge && opts.judgeCatch && decision.verdict === "allow") {
+    const caught = await runCatchJudgeStep({
+      judge: opts.judge,
+      llmJudgeHint: rulesOutcome.llmJudge,
+      rules,
+      decision,
+      projectContext,
+      request: guardRequest,
+      sessionId
+    });
+    if (caught) {
+      decision = {
+        ...decision,
+        verdict: "deny",
+        matchedRuleIds: caught.ruleIds,
+        message: caught.message
+      };
+      judgeAudit = caught.audit;
+    }
+  }
+  const isOverturn = judgeAudit?.outcome === "overturned";
+  if (decision.verdict !== "allow" && decision.matchedRuleIds.length > 0 || isOverturn) {
     const targetStr = stringifyTarget(guardRequest.target);
     const violation = {
       ruleId: decision.matchedRuleIds[0],
       agent: "claude-code",
       sessionId: sessionId ?? null,
       tool: guardRequest.tool,
-      outcome: decision.verdict === "deny" ? "denied" : "warned",
+      outcome: decision.verdict === "deny" || isOverturn ? "denied" : "warned",
       targetSummary: redactTarget(targetStr),
-      targetHash: hashTarget(targetStr)
+      targetHash: hashTarget(targetStr),
+      ...judgeAudit ? { extra: { judge: judgeAudit } } : {}
     };
     try {
       bufferViolationFn(projectContext, violation);
@@ -7005,6 +7714,27 @@ function emitAgentMessage(verdict, message) {
   } catch {
   }
 }
+function makeProductionJudgeDeps() {
+  const cache = makeJudgeCache();
+  const warnDir = process.env.CYBEDEFEND_BASELINE_DIR ?? join10(homedir8(), ".cybedefend");
+  const warnTracker = defaultSessionTracker(
+    join10(warnDir, "guards-judge-warned-sessions.json")
+  );
+  return {
+    callJudge,
+    cacheGet: (k) => cache.get(k),
+    cacheSet: (k, r) => cache.set(k, r),
+    warnOnce: (sessionId, message) => {
+      if (sessionId && warnTracker.hasSeen(sessionId)) return;
+      try {
+        process.stderr.write(`[VibeDefend Action Guards] ${message}
+`);
+      } catch {
+      }
+      if (sessionId) void warnTracker.markSeen(sessionId);
+    }
+  };
+}
 async function runPreToolUseGuard() {
   try {
     const envelope = await readStdinJson();
@@ -7014,7 +7744,12 @@ async function runPreToolUseGuard() {
     if (!projectId) return 0;
     const apiBaseResolved = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
     const token = await resolveTokenWithRefresh(config.region.mcpName);
-    if (!token) return 0;
+    if (!token) {
+      emitUnverifiedBanner(
+        "Not authenticated \u2014 run `vibedefend login` to restore Action Guards."
+      );
+      return 0;
+    }
     const projectContext = {
       projectId,
       apiBase: configApiBase,
@@ -7035,7 +7770,11 @@ async function runPreToolUseGuard() {
       projectContext,
       rulesOutcome,
       evaluateFn: evaluate,
-      bufferViolationFn: buffer.bufferViolation.bind(buffer)
+      bufferViolationFn: buffer.bufferViolation.bind(buffer),
+      judge: makeProductionJudgeDeps(),
+      // v1.1 catch — OFF by default; opt in with CYBEDEFEND_JUDGE_CATCH=1 once
+      // the call-rate gate is validated in the field.
+      judgeCatch: process.env.CYBEDEFEND_JUDGE_CATCH === "1"
     });
     try {
       await buffer.flushViolations(
@@ -7082,6 +7821,9 @@ function toApiViolation(r) {
   if (r.sessionId) {
     out.session_id = r.sessionId;
   }
+  if (r.extra && Object.keys(r.extra).length > 0) {
+    out.extra = r.extra;
+  }
   return out;
 }