@gendigital/sage-openclaw 0.10.0 → 0.11.0

package/dist/index.cjs

@@ -49,13 +49,31 @@ function getProcEnv() {
 function getHomeDir() {
   return getProcEnv().HOME || (0, import_node_os.homedir)();
 }
+async function renameWithRetry(from, to, attempts = 5) {
+  if (process.platform !== "win32") {
+    await fsPromises.rename(from, to);
+    return;
+  }
+  for (let i = 0; i < attempts; i++) {
+    try {
+      await fsPromises.rename(from, to);
+      return;
+    } catch (err) {
+      const code = err.code;
+      const transient = code === "EPERM" || code === "EACCES" || code === "EBUSY";
+      if (!transient || i === attempts - 1)
+        throw err;
+      await new Promise((resolve9) => setTimeout(resolve9, 10 * 2 ** i));
+    }
+  }
+}
 async function atomicWriteJson(path, data) {
   await fsPromises.mkdir((0, import_node_path.dirname)(path), { recursive: true });
   const tmp = `${path}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}.tmp`;
   try {
     await fsPromises.writeFile(tmp, `${JSON.stringify(data, null, 2)}
 `, { mode: 384 });
-    await fsPromises.rename(tmp, path);
+    await renameWithRetry(tmp, path);
   } catch (err) {
     try {
       await fsPromises.unlink(tmp);
@@ -4233,7 +4251,7 @@ var init_zod = __esm({
 });
 
 // ../core/dist/types.js
-var nullLogger, ArtifactTypeSchema, ArtifactSchema, SeveritySchema, ActionSchema, ThreatSchema, DecisionSchema, VerdictSeveritySchema, SensitivitySchema, UrlCheckConfigSchema, CacheConfigSchema, AllowlistConfigSchema, LoggingConfigSchema, OperationalLogLevelSchema, OperationalLoggingConfigSchema, FileCheckConfigSchema, PackageCheckConfigSchema, AmsiCheckConfigSchema, DEFAULT_PI_HIGH_RISK_THRESHOLD, DEFAULT_PI_MEDIUM_RISK_THRESHOLD, PiCheckConfigSchema, ExceptionDecisionSchema, ExceptionMatchSchema, ExceptionRuleSchema, ExceptionsFileSchema, ExceptionsConfigSchema, ConfigSchema, HookTypeSchema;
+var nullLogger, ArtifactTypeSchema, ArtifactSchema, VerdictSeveritySchema, ThreatSchema, DecisionSchema, SensitivitySchema, UrlCheckConfigSchema, CacheConfigSchema, LoggingConfigSchema, OperationalLogLevelSchema, OperationalLoggingConfigSchema, FileCheckConfigSchema, PackageCheckConfigSchema, AmsiCheckConfigSchema, DEFAULT_PI_HIGH_RISK_THRESHOLD, DEFAULT_PI_MEDIUM_RISK_THRESHOLD, PiCheckConfigSchema, ExceptionDecisionSchema, ExceptionMatchSchema, ExceptionRuleSchema, ExceptionsFileSchema, ExceptionsConfigSchema, ConfigSchema, HookTypeSchema;
 var init_types2 = __esm({
   "../core/dist/types.js"() {
     "use strict";
@@ -4254,23 +4272,21 @@ var init_types2 = __esm({
       value: external_exports.string(),
       context: external_exports.string().optional()
     });
-    SeveritySchema = external_exports.enum(["critical", "high", "medium", "low"]);
-    ActionSchema = external_exports.enum(["block", "require_approval", "log"]);
+    VerdictSeveritySchema = external_exports.enum(["info", "warning", "critical"]);
     ThreatSchema = external_exports.object({
       id: external_exports.string(),
       version: external_exports.number().int().optional(),
       category: external_exports.string(),
-      severity: SeveritySchema,
+      severity: VerdictSeveritySchema,
       confidence: external_exports.number(),
-      action: ActionSchema,
       pattern: external_exports.string(),
       match_on: external_exports.union([external_exports.string(), external_exports.array(external_exports.string())]),
       title: external_exports.string(),
       expires_at: external_exports.string().nullable().optional(),
-      revoked: external_exports.boolean().optional().default(false)
+      revoked: external_exports.boolean().optional().default(false),
+      flags: external_exports.array(external_exports.string()).optional().default([])
     });
     DecisionSchema = external_exports.enum(["allow", "deny", "ask"]);
-    VerdictSeveritySchema = external_exports.enum(["info", "warning", "critical"]);
     SensitivitySchema = external_exports.enum(["paranoid", "balanced", "relaxed"]);
     UrlCheckConfigSchema = external_exports.object({
       endpoint: external_exports.string().optional(),
@@ -4283,9 +4299,6 @@ var init_types2 = __esm({
       ttl_clean_seconds: external_exports.number().default(86400),
       path: external_exports.string().default("~/.sage/cache.json")
     });
-    AllowlistConfigSchema = external_exports.object({
-      path: external_exports.string().default("~/.sage/allowlist.json")
-    });
     LoggingConfigSchema = external_exports.object({
       enabled: external_exports.boolean().default(true),
       log_clean: external_exports.boolean().default(false),
@@ -4347,7 +4360,6 @@ var init_types2 = __esm({
       pi_check: PiCheckConfigSchema.default({}),
       heuristics_enabled: external_exports.boolean().default(true),
       cache: CacheConfigSchema.default({}),
-      allowlist: AllowlistConfigSchema.default({}),
       exceptions: ExceptionsConfigSchema.default({}),
       logging: LoggingConfigSchema.default({}),
       operational_logging: OperationalLoggingConfigSchema.default({}),
@@ -4373,6 +4385,7 @@ __export(config_exports, {
   HOOK_TIMEOUT_SECONDS: () => HOOK_TIMEOUT_SECONDS,
   SAGE_DIR: () => SAGE_DIR,
   defaultConfigPath: () => defaultConfigPath,
+  getClaudeConfigDir: () => getClaudeConfigDir,
   loadConfig: () => loadConfig,
   loadConfigSync: () => loadConfigSync,
   resolvePath: () => resolvePath
@@ -4386,9 +4399,6 @@ function defaultConfigPath() {
 function defaultCachePath() {
   return (0, import_node_path2.join)(resolvedSageDir(), "cache.json");
 }
-function defaultAllowlistPath() {
-  return (0, import_node_path2.join)(resolvedSageDir(), "allowlist.json");
-}
 function defaultExceptionsPath() {
   return (0, import_node_path2.join)(resolvedSageDir(), "exceptions.json");
 }
@@ -4405,6 +4415,12 @@ function resolvePath(pathStr) {
   }
   return pathStr;
 }
+function getClaudeConfigDir() {
+  const envDir = process.env.CLAUDE_CONFIG_DIR;
+  if (envDir)
+    return resolvePath(envDir);
+  return resolvePath("~/.claude");
+}
 function isWithinDirectory(baseDir, targetPath) {
   const rel = (0, import_node_path2.relative)(baseDir, targetPath);
   if (rel === "")
@@ -4454,7 +4470,6 @@ function sanitizeBrandKey(data, logger) {
 }
 function sanitizeConfigPaths(config2, logger) {
   const cachePath = defaultCachePath();
-  const allowlistPath = defaultAllowlistPath();
   const exceptionsPath = defaultExceptionsPath();
   const auditPath = defaultAuditPath();
   const operationalLogPath = defaultOperationalLogPath();
@@ -4464,10 +4479,6 @@ function sanitizeConfigPaths(config2, logger) {
       ...config2.cache,
       path: normalizeStateFilePath(config2.cache.path, cachePath, "cache", logger)
     },
-    allowlist: {
-      ...config2.allowlist,
-      path: normalizeStateFilePath(config2.allowlist.path, allowlistPath, "allowlist", logger)
-    },
     exceptions: {
       ...config2.exceptions,
       path: normalizeStateFilePath(config2.exceptions.path, exceptionsPath, "exceptions", logger)
@@ -14115,124 +14126,66 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// ../core/dist/allowlist.js
-init_config();
-init_file_utils();
-init_types2();
-
-// ../core/dist/url-utils.js
-var import_node_crypto2 = require("node:crypto");
+// ../core/dist/allowlist-migration.js
 var import_node_path3 = require("node:path");
-init_file_utils();
-function normalizeUrl(raw) {
-  try {
-    const u = new URL(raw);
-    u.hash = "";
-    u.searchParams.sort();
-    return u.toString();
-  } catch {
-    return raw.toLowerCase();
+
+// ../core/dist/brands.js
+var defaultBranding = { name: "Sage", short_name: "Sage" };
+var BRANDS = {
+  norton: { name: "Norton AI Agent Protection", short_name: "Norton" }
+};
+function resolveBranding(brandKey, logger) {
+  if (!brandKey)
+    return defaultBranding;
+  const entry = BRANDS[brandKey];
+  if (!entry) {
+    logger?.warn(`Unknown brand_key "${brandKey}" in config \u2014 using default branding`);
+    return defaultBranding;
   }
-}
-function hashCommand(command) {
-  return (0, import_node_crypto2.createHash)("sha256").update(command).digest("hex");
-}
-function normalizeFilePath(raw) {
-  const home = getHomeDir();
-  const expanded = raw.startsWith("~/") || raw === "~" ? `${home}${raw.slice(1)}` : raw;
-  return (0, import_node_path3.normalize)(expanded);
+  return { ...entry, brand_key: brandKey };
 }
 
-// ../core/dist/allowlist.js
-function emptyAllowlist() {
-  return { urls: {}, commands: {}, filePaths: {} };
-}
-function parseEntries(raw) {
-  const entries = {};
-  for (const [key, entryData] of Object.entries(raw)) {
-    if (typeof entryData !== "object" || entryData === null)
-      continue;
-    const data = entryData;
-    if (typeof data.added_at === "string" && typeof data.reason === "string" && typeof data.original_verdict === "string") {
-      entries[key] = {
-        addedAt: data.added_at,
-        reason: data.reason,
-        originalVerdict: data.original_verdict
-      };
-    }
-  }
-  return entries;
+// ../core/dist/allowlist-migration.js
+init_config();
+init_file_utils();
+function defaultAllowlistPath() {
+  return (0, import_node_path3.join)(resolvePath("~/.sage"), "allowlist.json");
 }
-async function loadAllowlist(config2, logger = nullLogger) {
-  const path = resolvePath(config2.path);
-  let raw;
+async function checkAllowlistMigration() {
   try {
-    raw = await getFileContent(path);
+    const raw = await getFileContent(defaultAllowlistPath());
+    const data = JSON.parse(raw);
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+      return { needed: false, entryTypes: [] };
+    }
+    const record = data;
+    const found = ["urls", "commands", "file_paths"].filter((key) => typeof record[key] === "object" && record[key] !== null && Object.keys(record[key]).length > 0);
+    return { needed: found.length > 0, entryTypes: found };
   } catch {
-    return emptyAllowlist();
-  }
-  let data;
-  try {
-    data = JSON.parse(raw);
-  } catch (e) {
-    logger.warn(`Failed to load allowlist from ${path}`, { error: String(e) });
-    return emptyAllowlist();
-  }
-  if (typeof data !== "object" || data === null || Array.isArray(data)) {
-    logger.warn(`Allowlist file ${path} does not contain a JSON object`);
-    return emptyAllowlist();
-  }
-  const record = data;
-  const rawUrls = parseEntries(record.urls ?? {});
-  const urls = {};
-  for (const [key, entry] of Object.entries(rawUrls)) {
-    urls[normalizeUrl(key)] = entry;
-  }
-  const rawFilePaths = parseEntries(record.file_paths ?? {});
-  const filePaths = {};
-  for (const [key, entry] of Object.entries(rawFilePaths)) {
-    filePaths[normalizeFilePath(key)] = entry;
+    return { needed: false, entryTypes: [] };
   }
-  return {
-    urls,
-    commands: parseEntries(record.commands ?? {}),
-    filePaths
-  };
 }
-function isAllowlisted(allowlist, artifacts) {
-  for (const artifact of artifacts) {
-    if (artifact.type !== "command") {
-      continue;
-    }
-    const cmdHash = hashCommand(artifact.value);
-    if (cmdHash in allowlist.commands) {
-      return true;
-    }
-  }
-  for (const artifact of artifacts) {
-    if (artifact.type !== "file_path") {
-      continue;
-    }
-    if (normalizeFilePath(artifact.value) in allowlist.filePaths) {
-      return true;
-    }
-  }
-  if (artifacts.length > 0 && artifacts.every((artifact) => artifact.type === "url")) {
-    return artifacts.every((artifact) => normalizeUrl(artifact.value) in allowlist.urls);
-  }
-  return false;
+function formatAllowlistMigrationWarning(entryTypes, branding2 = defaultBranding) {
+  const typeList = entryTypes.join(", ");
+  const lines = [
+    `${branding2.name}: legacy allowlist.json detected with ${typeList} entries.`,
+    "  - URL and file_path entries can be migrated manually to ~/.sage/exceptions.json",
+    "  - Command entries are stored as SHA-256 hashes and cannot be recovered",
+    "  - See https://github.com/gendigitalinc/sage for migration instructions"
+  ];
+  return lines.join("\n");
 }
 
 // ../core/dist/approval-store.js
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto2 = require("node:crypto");
 var PENDING_STALE_MS = 60 * 60 * 1e3;
 var APPROVED_TTL_MS = 10 * 60 * 1e3;
-var ApprovalStore = class _ApprovalStore {
+var ApprovalStore = class {
   pending = /* @__PURE__ */ new Map();
   approved = /* @__PURE__ */ new Map();
   static actionId(toolName, params, sessionId) {
     const payload = JSON.stringify({ toolName, params, sessionId });
-    return (0, import_node_crypto3.createHash)("sha256").update(payload).digest("hex").slice(0, 32);
+    return (0, import_node_crypto2.createHash)("sha256").update(payload).digest("hex").slice(0, 32);
   }
   static artifactId(type, value) {
     return `${type}:${value}`;
@@ -14269,40 +14222,6 @@ var ApprovalStore = class _ApprovalStore {
     }
     return true;
   }
-  hasApprovedArtifact(type, value) {
-    return this.findApprovedAction(type, value) !== null;
-  }
-  consumeApprovedArtifact(type, value) {
-    const id = _ApprovalStore.artifactId(type, value);
-    for (const [actionId, entry] of this.approved.entries()) {
-      if (Date.now() >= entry.expiresAt) {
-        this.approved.delete(actionId);
-        continue;
-      }
-      const idx = entry.artifacts.findIndex((a) => _ApprovalStore.artifactId(a.type, a.value) === id);
-      if (idx !== -1) {
-        entry.artifacts.splice(idx, 1);
-        if (entry.artifacts.length === 0) {
-          this.approved.delete(actionId);
-        }
-        return true;
-      }
-    }
-    return false;
-  }
-  findApprovedAction(type, value) {
-    const id = _ApprovalStore.artifactId(type, value);
-    for (const [actionId, entry] of this.approved.entries()) {
-      if (Date.now() >= entry.expiresAt) {
-        this.approved.delete(actionId);
-        continue;
-      }
-      if (entry.artifacts.some((artifact) => _ApprovalStore.artifactId(artifact.type, artifact.value) === id)) {
-        return actionId;
-      }
-    }
-    return null;
-  }
   cleanup(now = Date.now()) {
     for (const [actionId, entry] of this.pending.entries()) {
       if (now - entry.createdAt >= PENDING_STALE_MS) {
@@ -14318,7 +14237,7 @@ var ApprovalStore = class _ApprovalStore {
 };
 
 // ../core/dist/audit-log.js
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 init_config();
 init_file_utils();
 
@@ -14446,7 +14365,7 @@ async function logVerdict(config2, input) {
     return;
   const entry = {
     type: "runtime_verdict",
-    entry_id: input.eventId ?? (0, import_node_crypto4.randomUUID)(),
+    entry_id: input.eventId ?? (0, import_node_crypto3.randomUUID)(),
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     session_id: input.sessionId,
     conversation_id: input.conversationId ?? input.sessionId,
@@ -14488,31 +14407,29 @@ async function logPluginScan(config2, pluginKey, pluginVersion, findings) {
   }
 }
 
-// ../core/dist/brands.js
-var defaultBranding = { name: "Sage", short_name: "Sage" };
-var BRANDS = {
-  norton: { name: "Norton AI Agent Protection", short_name: "Norton" }
-};
-function resolveBranding(brandKey, logger) {
-  if (!brandKey)
-    return defaultBranding;
-  const entry = BRANDS[brandKey];
-  if (!entry) {
-    logger?.warn(`Unknown brand_key "${brandKey}" in config \u2014 using default branding`);
-    return defaultBranding;
-  }
-  return { ...entry, brand_key: brandKey };
-}
-
 // ../core/dist/cache.js
 init_config();
 init_file_utils();
 init_types2();
+
+// ../core/dist/url-utils.js
+init_file_utils();
+function normalizeUrl(raw) {
+  try {
+    const u = new URL(raw);
+    u.hash = "";
+    u.searchParams.sort();
+    return u.toString();
+  } catch {
+    return raw.toLowerCase();
+  }
+}
+
+// ../core/dist/cache.js
 var ONE_HOUR = 3600;
 var TWENTY_FOUR_HOURS = 86400;
-var FAR_FUTURE = "9999-12-31T23:59:59+00:00";
 var VerdictCache = class {
-  store = { urls: {}, commands: {}, packages: {} };
+  store = { urls: {}, packages: {} };
   path;
   config;
   logger;
@@ -14531,11 +14448,10 @@ var VerdictCache = class {
       const data = JSON.parse(raw);
       this.store = {
         urls: data.urls ?? {},
-        commands: data.commands ?? {},
         packages: data.packages ?? {}
       };
     } catch {
-      this.store = { urls: {}, commands: {}, packages: {} };
+      this.store = { urls: {}, packages: {} };
     }
   }
   getUrl(url) {
@@ -14567,31 +14483,6 @@ var VerdictCache = class {
       sageVersion: this.version
     };
   }
-  getCommand(commandHash) {
-    if (!this.config.enabled)
-      return null;
-    const entry = this.store.commands[commandHash];
-    if (!entry || this.isStale(entry))
-      return null;
-    return {
-      verdict: entry.verdict,
-      severity: entry.severity,
-      reasons: entry.reasons,
-      source: entry.source
-    };
-  }
-  putCommand(commandHash, verdict) {
-    if (!this.config.enabled)
-      return;
-    const { urlSignalLabels: _ignoredUrlLabels, ...rest } = verdict;
-    const now = /* @__PURE__ */ new Date();
-    this.store.commands[commandHash] = {
-      ...rest,
-      checkedAt: now.toISOString(),
-      expiresAt: FAR_FUTURE,
-      sageVersion: this.version
-    };
-  }
   getPackage(key) {
     if (!this.config.enabled)
       return null;
@@ -14602,7 +14493,9 @@ var VerdictCache = class {
       verdict: entry.verdict,
       severity: entry.severity,
       reasons: entry.reasons,
-      source: entry.source
+      source: entry.source,
+      ...entry.packageVerdict !== void 0 ? { packageVerdict: entry.packageVerdict } : {},
+      ...entry.packageConfidence !== void 0 ? { packageConfidence: entry.packageConfidence } : {}
     };
   }
   putPackage(key, verdict, packageAgeDays) {
@@ -14652,10 +14545,6 @@ var VerdictCache = class {
       if (this.isStale(entry))
         delete this.store.urls[key];
     }
-    for (const [key, entry] of Object.entries(this.store.commands)) {
-      if (this.isStale(entry))
-        delete this.store.commands[key];
-    }
     for (const [key, entry] of Object.entries(this.store.packages)) {
       if (this.isStale(entry))
         delete this.store.packages[key];
@@ -14947,6 +14836,7 @@ var PersistentPowershellAmsiBackend = class {
   invalidResultLogged = false;
   stdoutBuffer = "";
   pendingResponse = null;
+  scanQueue = Promise.resolve();
   constructor(logger) {
     this.logger = logger;
   }
@@ -14962,6 +14852,19 @@ var PersistentPowershellAmsiBackend = class {
       this.pendingResponse = { resolve: resolve9, reject, timer };
     });
   }
+  async enqueueScan(operation) {
+    const previous = this.scanQueue;
+    let release;
+    this.scanQueue = new Promise((resolve9) => {
+      release = resolve9;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
   async init() {
     try {
       this.process = spawn("powershell.exe", [
@@ -15034,29 +14937,35 @@ var PersistentPowershellAmsiBackend = class {
   async scanString(content, contentName) {
     if (!this.available || !this.process)
       return null;
-    const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
-    try {
-      const req = JSON.stringify({ content: truncated, contentName });
-      this.process.stdin?.write(`${req}
+    return this.enqueueScan(async () => {
+      const process2 = this.process;
+      if (!this.available || !process2)
+        return null;
+      const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
+      try {
+        const req = JSON.stringify({ content: truncated, contentName });
+        process2.stdin?.write(`${req}
 `);
-      const line = await this.waitForLine(PS_TIMEOUT);
-      const amsiResult = parseInt(line, 10);
-      if (Number.isNaN(amsiResult) || amsiResult < 0) {
-        if (!this.invalidResultLogged) {
-          this.invalidResultLogged = true;
-          this.logger.warn("AMSI: PowerShell scan returned invalid result", {
-            stdout: line.slice(0, 100),
-            contentName
-          });
+        const line = await this.waitForLine(PS_TIMEOUT);
+        const amsiResult = parseInt(line, 10);
+        if (Number.isNaN(amsiResult) || amsiResult < 0) {
+          if (!this.invalidResultLogged) {
+            this.invalidResultLogged = true;
+            this.logger.warn("AMSI: PowerShell scan returned invalid result", {
+              stdout: line.slice(0, 100),
+              contentName
+            });
+          }
+          return null;
         }
+        this.logger.debug("AMSI: PowerShell scan result", { contentName, amsiResult });
+        return interpretAmsiResult(amsiResult, content, contentName);
+      } catch (e) {
+        this.logger.warn("AMSI: PowerShell scan failed", { error: String(e), contentName });
+        this.close();
         return null;
       }
-      this.logger.debug("AMSI: PowerShell scan result", { contentName, amsiResult });
-      return interpretAmsiResult(amsiResult, content, contentName);
-    } catch (e) {
-      this.logger.warn("AMSI: PowerShell scan failed", { error: String(e), contentName });
-      return null;
-    }
+    });
   }
   close() {
     if (this.process) {
@@ -15291,7 +15200,7 @@ init_file_utils();
 var import_meta = {};
 function resolveVersion() {
   if (true)
-    return "0.10.0";
+    return "0.11.0";
   try {
     const pkgPath = (0, import_node_path5.join)((0, import_node_path5.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "..", "package.json");
     const pkg = JSON.parse(getFileContentSync(pkgPath));
@@ -15937,6 +15846,8 @@ ${err.stack}` : String(err);
    */
   async classifyChunk(text) {
     const tok = this.tokenizer;
+    if (!tok)
+      throw new Error("PI tokenizer is not loaded");
     const encoded = tok.call(text, {
       truncation: true,
       max_length: MAX_TOKENS,
@@ -15969,6 +15880,8 @@ ${err.stack}` : String(err);
    */
   chunkText(text) {
     const tok = this.tokenizer;
+    if (!tok)
+      throw new Error("PI tokenizer is not loaded");
     const encoded = tok.tokenize(text, {
       addSpecialTokens: false,
       returnOffsetMapping: true,
@@ -15976,6 +15889,8 @@ ${err.stack}` : String(err);
     });
     const tokenIds = encoded.input_ids;
     const offsets = encoded.offset_mapping;
+    if (!offsets)
+      return [text];
     if (tokenIds.length <= MAX_TOKENS)
       return [text];
     const chunks = [];
@@ -16585,7 +16500,7 @@ function mergeExtendedInfo(envelope, extendedInfo) {
 }
 
 // ../core/dist/installation-id.js
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var import_promises4 = require("node:fs/promises");
 var import_node_path11 = require("node:path");
 init_config();
@@ -16603,7 +16518,7 @@ async function getInstallationId(sageDirPath) {
   } catch {
   }
   try {
-    const id = (0, import_node_crypto5.randomUUID)();
+    const id = (0, import_node_crypto4.randomUUID)();
     await (0, import_promises4.mkdir)(sageDir, { recursive: true, mode: 448 });
     await (0, import_promises4.writeFile)(idPath, id, { encoding: "utf-8", mode: 384, flag: fileExists ? "w" : "wx" });
     return id;
@@ -16702,30 +16617,27 @@ async function sendCommunityIqDetection(args) {
   }
 }
 
-// ../core/dist/engine.js
+// ../core/dist/policy.js
 init_types2();
-var CONFIDENCE_THRESHOLD = 0.85;
-var SENSITIVITY_THRESHOLDS = {
-  paranoid: 0.7,
-  balanced: 0.85,
-  relaxed: 0.95
-};
-var SEVERITY_MAP = {
-  critical: "critical",
-  high: "warning",
-  medium: "warning",
-  low: "info"
-};
-var ACTION_MAP = {
-  block: "deny",
-  require_approval: "ask",
-  log: "allow"
-};
-var DECISION_PRIORITY = {
-  allow: 0,
-  ask: 1,
-  deny: 2
+var SENSITIVITY_POLICY = {
+  paranoid: { denyThreshold: 0.7, askThreshold: 0.3 },
+  balanced: { denyThreshold: 0.85, askThreshold: 0.5 },
+  relaxed: { denyThreshold: 0.95, askThreshold: 0.7 }
 };
+function applyPolicy(confidence, denyThreshold, askThreshold, logger = nullLogger) {
+  if (!Number.isFinite(confidence) || confidence <= 0 || confidence > 1) {
+    logger.warn("Invalid confidence; treating as allow", { confidence });
+    return "allow";
+  }
+  if (confidence >= denyThreshold)
+    return "deny";
+  if (confidence >= askThreshold)
+    return "ask";
+  return "allow";
+}
+
+// ../core/dist/engine.js
+init_types2();
 var PI_LABEL_ONLY_SUFFIXES = /* @__PURE__ */ new Set([
   "command",
   "stdout",
@@ -16756,29 +16668,25 @@ function formatPiFinding(result) {
   return `${where} (${score})`;
 }
 var DecisionEngine = class {
-  threshold;
-  sensitivity;
-  constructor(sensitivity = "balanced") {
-    this.threshold = SENSITIVITY_THRESHOLDS[sensitivity] ?? CONFIDENCE_THRESHOLD;
-    this.sensitivity = sensitivity;
+  denyThreshold;
+  askThreshold;
+  logger;
+  constructor(sensitivity = "balanced", logger = nullLogger) {
+    const policy = SENSITIVITY_POLICY[sensitivity] ?? SENSITIVITY_POLICY.balanced;
+    this.denyThreshold = policy.denyThreshold;
+    this.askThreshold = policy.askThreshold;
+    this.logger = logger;
   }
   async decide(sources) {
     const signals = this.collectSignals(sources.heuristicMatches, sources.urlCheckResults, sources.packageCheckResults, sources.amsiCheckResults, sources.piCheckResults, sources.piThresholds);
     if (signals.length === 0) {
       return this.allowVerdict();
     }
-    signals.sort((a, b) => (DECISION_PRIORITY[b.decision] ?? 0) - (DECISION_PRIORITY[a.decision] ?? 0));
-    const top = signals[0];
-    if (!top) {
-      return this.allowVerdict();
-    }
+    const top = signals.reduce((best, s) => s.confidence > best.confidence ? s : best);
+    const maxConfidence = top.confidence;
+    const decision = applyPolicy(maxConfidence, this.denyThreshold, this.askThreshold, this.logger);
     const allArtifacts = [...new Map(signals.map((s) => [s.artifact, s.artifact])).values()];
     const allReasons = [...new Map(signals.map((s) => [s.reason, s.reason])).values()];
-    const maxConfidence = Math.max(...signals.map((s) => s.confidence));
-    let decision = top.decision;
-    if (decision === "deny" && maxConfidence < this.threshold && top.source !== "pi_check") {
-      decision = "ask";
-    }
     return {
       decision,
       category: top.category,
@@ -16793,24 +16701,26 @@ var DecisionEngine = class {
   collectSignals(heuristicMatches, urlCheckResults, packageCheckResults, amsiCheckResults, piCheckResults, piThresholds) {
     const signals = [];
     for (const match of heuristicMatches) {
+      const { confidence, category, severity, id, title } = match.threat;
+      if (applyPolicy(confidence, this.denyThreshold, this.askThreshold, this.logger) === "allow")
+        continue;
       signals.push({
-        decision: ACTION_MAP[match.threat.action] ?? "ask",
-        category: match.threat.category,
-        confidence: match.threat.confidence,
-        severity: SEVERITY_MAP[match.threat.severity] ?? "warning",
+        category,
+        confidence,
+        severity,
         source: "heuristic",
-        threatId: match.threat.id,
-        reason: match.threat.title,
+        threatId: id,
+        reason: title,
         artifact: match.artifact
       });
     }
     for (const result of urlCheckResults) {
       if (result.isMalicious) {
+        const confidence = 1;
         const findingDetails = result.findings.map((f) => `${f.severityName}/${f.typeName}`).join(", ");
         signals.push({
-          decision: "deny",
           category: "network_egress",
-          confidence: 1,
+          confidence,
           severity: "critical",
           source: "url_check",
           threatId: null,
@@ -16832,7 +16742,6 @@ var DecisionEngine = class {
       for (const result of amsiCheckResults) {
         if (result.isDetected) {
           signals.push({
-            decision: "deny",
             category: "malware",
             confidence: 1,
             severity: "critical",
@@ -16843,7 +16752,6 @@ var DecisionEngine = class {
           });
         } else if (result.isBlockedByAdmin) {
           signals.push({
-            decision: "deny",
             category: "malware",
             confidence: 0.9,
             severity: "critical",
@@ -16858,24 +16766,21 @@ var DecisionEngine = class {
     if (piCheckResults) {
       const highRisk = piThresholds?.highRisk ?? DEFAULT_PI_HIGH_RISK_THRESHOLD;
       const mediumRisk = piThresholds?.mediumRisk ?? DEFAULT_PI_MEDIUM_RISK_THRESHOLD;
-      const suppressMediumPi = this.sensitivity === "relaxed";
       for (const result of piCheckResults) {
         if (result.risk >= highRisk) {
           signals.push({
-            decision: "deny",
             category: "prompt_injection",
-            confidence: result.risk,
+            confidence: 1,
             severity: "critical",
             source: "pi_check",
             threatId: "PROMPT_INJECTION",
             reason: buildPiReason("Prompt injection detected", result),
             artifact: result.contentName
           });
-        } else if (!suppressMediumPi && result.risk >= mediumRisk) {
+        } else if (result.risk >= mediumRisk) {
           signals.push({
-            decision: "ask",
             category: "prompt_injection",
-            confidence: result.risk,
+            confidence: 0.6,
             severity: "warning",
             source: "pi_check",
             threatId: "PROMPT_INJECTION",
@@ -16890,21 +16795,10 @@ var DecisionEngine = class {
   packageVerdictToSignal(pkg) {
     switch (pkg.verdict) {
       case "not_found":
-        return {
-          decision: "deny",
-          category: "supply_chain",
-          confidence: 0.95,
-          severity: "critical",
-          source: "package_check",
-          threatId: null,
-          reason: pkg.details,
-          artifact: pkg.packageName
-        };
       case "malicious":
         return {
-          decision: "deny",
           category: "supply_chain",
-          confidence: 1,
+          confidence: pkg.confidence,
           severity: "critical",
           source: "package_check",
           threatId: null,
@@ -16912,21 +16806,10 @@ var DecisionEngine = class {
           artifact: pkg.packageName
         };
       case "suspicious_age":
-        return {
-          decision: "ask",
-          category: "supply_chain",
-          confidence: 0.75,
-          severity: "warning",
-          source: "package_check",
-          threatId: null,
-          reason: pkg.details,
-          artifact: pkg.packageName
-        };
       case "unknown":
         return {
-          decision: "ask",
           category: "supply_chain",
-          confidence: 0.6,
+          confidence: pkg.confidence,
           severity: "warning",
           source: "package_check",
           threatId: null,
@@ -16941,7 +16824,7 @@ var DecisionEngine = class {
     return {
       decision: "allow",
       category: "none",
-      confidence: 1,
+      confidence: 0,
       severity: "info",
       source: "none",
       artifacts: [],
@@ -16952,11 +16835,11 @@ var DecisionEngine = class {
 };
 
 // ../core/dist/evaluator.js
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 init_config();
 
 // ../core/dist/exceptions.js
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var import_node_path13 = require("node:path");
 init_config();
 init_file_utils();
@@ -16967,17 +16850,17 @@ var import_node_path12 = require("node:path");
 var import_yaml = __toESM(require_dist(), 1);
 init_file_utils();
 init_types2();
-async function loadTrustedDomains(allowlistsDir, logger = nullLogger) {
+async function loadTrustedDomains(trustedDomainsDir, logger = nullLogger) {
   let files;
   try {
-    files = (await (0, import_promises5.readdir)(allowlistsDir)).filter((f) => f.endsWith(".yaml")).sort();
+    files = (await (0, import_promises5.readdir)(trustedDomainsDir)).filter((f) => f.endsWith(".yaml")).sort();
   } catch {
-    logger.debug("Allowlists directory does not exist", { path: allowlistsDir });
+    logger.debug("Trusted domains directory does not exist", { path: trustedDomainsDir });
     return [];
   }
   const domains = [];
   for (const filename of files) {
-    const filePath = (0, import_node_path12.join)(allowlistsDir, filename);
+    const filePath = (0, import_node_path12.join)(trustedDomainsDir, filename);
     let content;
     try {
       content = await getFileContent(filePath);
@@ -17015,7 +16898,7 @@ async function loadTrustedDomains(allowlistsDir, logger = nullLogger) {
       domains.push({ domain: domain.toLowerCase(), reason });
     }
   }
-  logger.debug(`Loaded ${domains.length} trusted domains from ${allowlistsDir}`);
+  logger.debug(`Loaded ${domains.length} trusted domains from ${trustedDomainsDir}`);
   return domains;
 }
 function extractDomain(url) {
@@ -17042,7 +16925,7 @@ init_types2();
 var MAX_RULES_WARNING = 100;
 var REGEX_TIMEOUT_MS = 50;
 function computeRuleId(decision, match, pattern) {
-  const hash = (0, import_node_crypto6.createHash)("sha256").update(`${decision}:${match}:${pattern}`).digest("hex");
+  const hash = (0, import_node_crypto5.createHash)("sha256").update(`${decision}:${match}:${pattern}`).digest("hex");
   return hash.slice(0, 8);
 }
 async function loadExceptions(config2, logger = nullLogger) {
@@ -17620,7 +17503,7 @@ var PackageChecker = class {
         packageName: pkg.name,
         registry: pkg.registry,
         verdict: "not_found",
-        confidence: 0.9,
+        confidence: 0.95,
         details: `Package '${pkg.name}@${pkg.version}' version not found on ${pkg.registry} (hallucinated or unpublished)`
       };
     }
@@ -17653,7 +17536,7 @@ var PackageChecker = class {
         packageName: pkg.name,
         registry: pkg.registry,
         verdict: "suspicious_age",
-        confidence: 0.75,
+        confidence: 0.6,
         details: `Package '${pkg.name}' first published ${Math.floor(ageDays)} days ago (suspicious age)`,
         ageDays
       };
@@ -18096,7 +17979,6 @@ var REQUIRED_FIELDS = /* @__PURE__ */ new Set([
   "category",
   "severity",
   "confidence",
-  "action",
   "pattern",
   "match_on",
   "title"
@@ -18164,8 +18046,8 @@ async function loadThreats(threatDir, logger = nullLogger) {
         continue;
       let compiledPattern;
       try {
-        const flags = record.case_insensitive === true ? "i" : "";
-        compiledPattern = new RegExp(record.pattern, flags);
+        const flags2 = record.case_insensitive === true ? "i" : "";
+        compiledPattern = new RegExp(record.pattern, flags2);
       } catch (e) {
         logger.warn(`Skipping threat ${record.id}: invalid regex pattern`, {
           error: String(e)
@@ -18174,19 +18056,28 @@ async function loadThreats(threatDir, logger = nullLogger) {
       }
       const rawMatchOn = record.match_on;
       const matchOn = new Set(Array.isArray(rawMatchOn) ? rawMatchOn : [rawMatchOn]);
+      const rawFlags = record.flags;
+      const flags = Array.isArray(rawFlags) ? rawFlags : [];
+      const confidence = Number(record.confidence);
+      if (!Number.isFinite(confidence) || confidence <= 0 || confidence > 1) {
+        logger.warn(`Skipping threat ${record.id}: invalid confidence value`, {
+          confidence: record.confidence
+        });
+        continue;
+      }
       threats.push({
         id: record.id,
         version: typeof record.version === "number" ? record.version : void 0,
         category: record.category,
         severity: record.severity,
-        confidence: Number(record.confidence),
-        action: record.action,
+        confidence,
         pattern: record.pattern,
         compiledPattern,
         matchOn,
         title: record.title,
         expiresAt: parseExpiresAt(record.expires_at),
-        revoked: false
+        revoked: false,
+        flags
       });
     }
   }
@@ -18226,7 +18117,7 @@ function allowVerdict(source = "none") {
   return {
     decision: "allow",
     category: "none",
-    confidence: 1,
+    confidence: 0,
     severity: "info",
     source,
     artifacts: [],
@@ -18234,6 +18125,11 @@ function allowVerdict(source = "none") {
     reasons: []
   };
 }
+async function resolveEvaluationConfig(context, logger) {
+  if (context.config)
+    return context.config;
+  return loadConfig(context.configPath, logger).catch(() => ConfigSchema.parse({}));
+}
 function shouldSkipPromptInjectionForLocalMarkdown(request) {
   if (request.toolName !== "Write" && request.toolName !== "Edit")
     return false;
@@ -18243,8 +18139,8 @@ function shouldSkipPromptInjectionForLocalMarkdown(request) {
 }
 async function evaluateToolCall(request, context) {
   const logger = context.logger ?? nullLogger;
-  const config2 = await loadConfig(context.configPath, logger).catch(() => ConfigSchema.parse({}));
-  const eventId = (0, import_node_crypto7.randomUUID)();
+  const config2 = await resolveEvaluationConfig(context, logger);
+  const eventId = (0, import_node_crypto6.randomUUID)();
   logger.debug("Tool call evaluation started", {
     eventId,
     toolUseId: request.toolUseId,
@@ -18305,27 +18201,6 @@ async function evaluateToolCall(request, context) {
       logEvaluationCompleted(verdict2);
       return verdict2;
     }
-    try {
-      const allowlist = await loadAllowlist(config2.allowlist, logger);
-      if (isAllowlisted(allowlist, request.artifacts)) {
-        const allowV = allowVerdict("allowlisted");
-        await logVerdict(config2.logging, {
-          sessionId: request.sessionId,
-          toolName: request.toolName,
-          toolInput: request.toolInput,
-          verdict: allowV,
-          userOverride: true,
-          conversationId: request.conversationId,
-          agentRuntime: request.agentRuntime,
-          hookType: request.hookType,
-          eventId,
-          toolUseId: request.toolUseId
-        });
-        logEvaluationCompleted(allowV);
-        return allowV;
-      }
-    } catch {
-    }
     const allowMatch = findAllowException(exceptions, request.artifacts);
     if (allowMatch) {
       const allowV = allowVerdict("exception");
@@ -18348,7 +18223,7 @@ async function evaluateToolCall(request, context) {
       return allowV;
     }
   } catch (error) {
-    logger.debug("Exception/allowlist checks failed open", { error: String(error) });
+    logger.debug("Exception checks failed open", { error: String(error) });
   }
   let cache2 = null;
   try {
@@ -18370,7 +18245,7 @@ async function evaluateToolCall(request, context) {
     if (shouldSkipPromptInjectionForLocalMarkdown(request)) {
       threats = threats.filter((t) => t.category !== "prompt_injection");
     }
-    const trustedDomains = await loadTrustedDomains(context.allowlistsDir, logger);
+    const trustedDomains = await loadTrustedDomains(context.trustedDomainsDir, logger);
     const heuristics = new HeuristicsEngine(threats, trustedDomains);
     heuristicMatches = heuristics.match(request.artifacts);
   }
@@ -18387,10 +18262,19 @@ async function evaluateToolCall(request, context) {
   const amsiCheckResults = [];
   if (config2.amsi_check.enabled && isAmsiSupported()) {
     let amsiClient = null;
+    let amsiLease = null;
+    let ownsAmsiClient = false;
     try {
-      amsiClient = new AmsiClient(logger);
-      await amsiClient.init();
-      if (amsiClient.isAvailable) {
+      if (context.acquireAmsiClientLease) {
+        amsiLease = await context.acquireAmsiClientLease(logger);
+        amsiClient = amsiLease?.client ?? null;
+      } else {
+        amsiClient = new AmsiClient(logger);
+        ownsAmsiClient = true;
+        await amsiClient.init();
+      }
+      if (amsiClient?.isAvailable) {
+        const activeAmsiClient = amsiClient;
         const scans = [];
         if (request.toolName === "Bash") {
           const command = request.toolInput.command ?? "";
@@ -18421,7 +18305,7 @@ async function evaluateToolCall(request, context) {
           }
         }
         for (const scan of scans) {
-          const result = await amsiClient.scanString(scan.scanType, scan.name, scan.content);
+          const result = await activeAmsiClient.scanString(scan.scanType, scan.name, scan.content);
           if (result) {
             amsiCheckResults.push(result);
           }
@@ -18429,16 +18313,26 @@ async function evaluateToolCall(request, context) {
       }
     } catch {
     } finally {
-      amsiClient?.close();
+      try {
+        if (amsiLease) {
+          await amsiLease.release();
+        } else if (ownsAmsiClient) {
+          amsiClient?.close();
+        }
+      } catch {
+      }
     }
   }
+  const engine = new DecisionEngine(config2.sensitivity, logger);
+  const preliminaryVerdict = await engine.decide({
+    heuristicMatches,
+    urlCheckResults,
+    packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
+    amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0
+  });
   const allPiResults = [];
-  const piDenySignals = [];
-  const heuristicPiDeny = heuristicMatches.some((m) => m.threat.action === "block" && m.threat.category === "prompt_injection");
-  const heuristicDeny = heuristicMatches.some((m) => m.threat.action === "block");
-  const urlAlreadyDenied = cachedUrlVerdicts.size > 0 && [...cachedUrlVerdicts.values()].some((v) => v.verdict !== "allow");
-  const urlCheckDenied = urlCheckResults.some((r) => r.isMalicious);
-  if (config2.pi_check.enabled && !heuristicPiDeny && !heuristicDeny && !urlAlreadyDenied && !urlCheckDenied && request.toolName === "WebFetch") {
+  const alreadyDenied = preliminaryVerdict.decision === "deny" || cachedUrlVerdicts.size > 0 && [...cachedUrlVerdicts.values()].some((v) => v.verdict === "deny");
+  if (config2.pi_check.enabled && !alreadyDenied && request.toolName === "WebFetch") {
     try {
       const url = extractWebFetchUrl(request.toolInput);
       if (url) {
@@ -18454,9 +18348,6 @@ async function evaluateToolCall(request, context) {
               const result = await provider.checkContent(fetched.content, `WebFetch:${url}`);
               if (result) {
                 allPiResults.push(result);
-                if (result.risk >= config2.pi_check.high_risk_threshold) {
-                  piDenySignals.push(result);
-                }
               }
             }
           }
@@ -18465,34 +18356,41 @@ async function evaluateToolCall(request, context) {
     } catch {
     }
   }
-  const engine = new DecisionEngine(config2.sensitivity);
-  let verdict = await engine.decide({
-    heuristicMatches,
-    urlCheckResults,
-    packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
-    amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0,
-    piCheckResults: piDenySignals.length > 0 ? piDenySignals : void 0,
-    piThresholds: {
-      highRisk: config2.pi_check.high_risk_threshold,
-      mediumRisk: config2.pi_check.medium_risk_threshold
-    }
-  });
-  if (cachedUrlVerdicts.size > 0 && verdict.decision === "allow") {
+  let verdict;
+  if (allPiResults.length > 0) {
+    verdict = await engine.decide({
+      heuristicMatches,
+      urlCheckResults,
+      packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
+      amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0,
+      piCheckResults: allPiResults,
+      piThresholds: {
+        highRisk: config2.pi_check.high_risk_threshold,
+        mediumRisk: config2.pi_check.medium_risk_threshold
+      }
+    });
+  } else {
+    verdict = preliminaryVerdict;
+  }
+  if (cachedUrlVerdicts.size > 0 && verdict.decision !== "deny") {
     for (const [url, cachedVerdict] of cachedUrlVerdicts) {
       if (cachedVerdict.verdict === "allow") {
         continue;
       }
-      verdict = {
-        decision: cachedVerdict.verdict,
-        category: "network_egress",
-        confidence: 1,
-        severity: cachedVerdict.severity,
-        source: `cache(${cachedVerdict.source})`,
-        artifacts: [url],
-        matchedThreatId: null,
-        reasons: cachedVerdict.reasons
-      };
-      break;
+      if (cachedVerdict.verdict === "deny" || verdict.decision === "allow") {
+        verdict = {
+          decision: cachedVerdict.verdict,
+          category: "network_egress",
+          confidence: 1,
+          severity: cachedVerdict.severity,
+          source: `cache(${cachedVerdict.source})`,
+          artifacts: [url],
+          matchedThreatId: null,
+          reasons: cachedVerdict.reasons
+        };
+        if (verdict.decision === "deny")
+          break;
+      }
     }
   }
   await cacheUrlResults(urlCheckResults, cache2);
@@ -18690,21 +18588,41 @@ async function checkPackages(request, config2, cache2, logger) {
     }
     if (!parsedPackages || parsedPackages.length === 0)
       return results;
+    const DENY_CLASS_PKG_VERDICTS = /* @__PURE__ */ new Set(["malicious", "not_found"]);
+    const ASK_CLASS_PKG_VERDICTS = /* @__PURE__ */ new Set(["suspicious_age", "unknown"]);
+    const VALID_PKG_VERDICTS = /* @__PURE__ */ new Set([...DENY_CLASS_PKG_VERDICTS, ...ASK_CLASS_PKG_VERDICTS]);
     const uncached = [];
     for (const pkg of parsedPackages) {
       const cacheKey2 = `${pkg.registry}:${pkg.name}${pkg.version ? `@${pkg.version}` : ""}`;
       const cached = cache2?.getPackage(cacheKey2);
-      if (cached && cached.verdict !== "allow") {
-        results.push({
-          packageName: pkg.name,
-          registry: pkg.registry,
-          verdict: cached.verdict === "deny" ? "malicious" : "suspicious_age",
-          confidence: 1,
-          details: cached.reasons.join("; ")
+      if (!cached) {
+        uncached.push(pkg);
+        continue;
+      }
+      if (cached.verdict === "allow")
+        continue;
+      const rawVerdict = cached.packageVerdict;
+      const rawConf = cached.packageConfidence;
+      const verdictValid = rawVerdict !== void 0 && VALID_PKG_VERDICTS.has(rawVerdict);
+      const confValid = rawConf !== void 0 && Number.isFinite(rawConf) && rawConf > 0 && rawConf <= 1;
+      const consistent = rawVerdict === void 0 || !verdictValid || cached.verdict === "deny" && DENY_CLASS_PKG_VERDICTS.has(rawVerdict) || cached.verdict === "ask" && ASK_CLASS_PKG_VERDICTS.has(rawVerdict);
+      if (!verdictValid || !confValid || !consistent) {
+        logger.warn("Package cache entry has invalid metadata; re-querying live", {
+          cacheKey: cacheKey2,
+          packageVerdict: rawVerdict,
+          packageConfidence: rawConf,
+          cachedVerdict: cached.verdict
         });
-      } else if (!cached) {
         uncached.push(pkg);
+        continue;
       }
+      results.push({
+        packageName: pkg.name,
+        registry: pkg.registry,
+        verdict: rawVerdict,
+        confidence: rawConf,
+        details: cached.reasons.join("; ")
+      });
     }
     if (uncached.length > 0) {
       const checker = new PackageChecker({
@@ -18724,7 +18642,9 @@ async function checkPackages(request, config2, cache2, logger) {
             verdict: result.verdict === "clean" ? "allow" : isCritical ? "deny" : "ask",
             severity: isCritical ? "critical" : "warning",
             reasons: [result.details],
-            source: "package_check"
+            source: "package_check",
+            packageVerdict: result.verdict,
+            packageConfidence: result.confidence
           }, result.ageDays ?? null);
         }
       }
@@ -18750,9 +18670,9 @@ var PAD = 12;
 var SEPARATOR_WIDTH = 48;
 function severityEmoji(severity) {
   const s = severity.toLowerCase();
-  if (s === "critical" || s === "high")
+  if (s === "critical")
     return "\u{1F6A8}";
-  if (s === "medium" || s === "warn" || s === "warning")
+  if (s === "warning")
     return "\u26A0\uFE0F";
   return "\u2139\uFE0F";
 }
@@ -18773,20 +18693,20 @@ ${formatUpdateNotice(versionCheck)}`;
   }
   return base;
 }
-function totalHighCrit(results) {
+function totalNonInfo(results) {
   let n = 0;
   for (const r of results) {
     for (const f of r.findings) {
-      if (f.severity === "critical" || f.severity === "high")
+      if (f.severity !== "info")
         n++;
     }
   }
   return n;
 }
-function findFirstHighCrit(results) {
+function findFirstNonInfo(results) {
   for (const r of results) {
     for (const f of r.findings) {
-      if (f.severity === "critical" || f.severity === "high") {
+      if (f.severity !== "info") {
         return { plugin: r.plugin, finding: f };
       }
     }
@@ -18799,10 +18719,10 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
   const MAX_FINDINGS = 5;
   let first = true;
   for (const result of results) {
-    const highCrit = result.findings.filter((f) => f.severity === "critical" || f.severity === "high");
-    if (highCrit.length === 0)
+    const nonInfo = result.findings.filter((f) => f.severity !== "info");
+    if (nonInfo.length === 0)
       continue;
-    for (const f of highCrit.slice(0, MAX_FINDINGS)) {
+    for (const f of nonInfo.slice(0, MAX_FINDINGS)) {
       if (!first)
         lines.push("");
       first = false;
@@ -18814,8 +18734,6 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
         lines.push(kv("Artifact", f.artifact));
       }
       lines.push(kv("Source", f.sourceFile));
-      const actionLabel = f.action === "block" ? "Blocked" : "Flagged";
-      lines.push(kv("Action", actionLabel));
       if (f.recommendations && f.recommendations.length > 0) {
         lines.push(kv("Recommendations", ""));
         for (const rec of f.recommendations) {
@@ -18823,7 +18741,7 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
         }
       }
     }
-    const overflow = highCrit.length - MAX_FINDINGS;
+    const overflow = nonInfo.length - MAX_FINDINGS;
     if (overflow > 0) {
       lines.push("");
       lines.push(`   ... and ${overflow} more findings`);
@@ -18836,8 +18754,8 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
   return lines.join("\n");
 }
 function formatThreatBannerCompact(version, results, versionCheck, branding2) {
-  const total = totalHighCrit(results);
-  const first = findFirstHighCrit(results);
+  const total = totalNonInfo(results);
+  const first = findFirstNonInfo(results);
   if (!first || total === 0) {
     return formatStartupClean(version, versionCheck, branding2);
   }
@@ -18902,21 +18820,23 @@ function truncateValue(value) {
 function summarizeArtifacts(artifacts) {
   if (artifacts.length === 0)
     return "none";
-  return artifacts.slice(0, 3).map((artifact) => `${artifact.type} '${truncateValue(artifact.value)}'`).join(", ");
+  const maxArtifacts = 3;
+  const summary = artifacts.slice(0, maxArtifacts).map((artifact) => `${artifact.type} '${truncateValue(artifact.value)}'`).join(", ");
+  const overflow = artifacts.length - maxArtifacts;
+  return overflow > 0 ? `${summary}, ... and ${overflow} more` : summary;
 }
 function formatDenyMessage(verdict, branding2 = defaultBranding) {
-  const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 5).join("; ") : verdict.category;
+  const maxReasons = 5;
+  const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, maxReasons).join("; ") + (verdict.reasons.length > maxReasons ? `; ... and ${verdict.reasons.length - maxReasons} more` : "") : verdict.category;
   return [
     `${branding2.name} blocked this action.`,
     `Severity: ${verdict.severity}`,
     `Category: ${verdict.category}`,
-    `Reason: ${reasons}`
+    `Reason: ${reasons}`,
+    `If this is a false positive, use the sage_report_false_positive MCP tool to report it.`
   ].join("\n");
 }
 
-// ../core/dist/marketplace-migration.js
-init_config();
-
 // ../core/dist/model-download.js
 init_types2();
 
@@ -19037,18 +18957,19 @@ function createOperationalLogger(config2, runtime) {
 }
 
 // ../core/dist/plugin-scan-cache.js
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var import_promises7 = require("node:fs/promises");
 var import_node_path16 = require("node:path");
 init_file_utils();
 init_types2();
 var DEFAULT_CACHE_PATH = (0, import_node_path16.join)(getHomeDir(), ".sage", "plugin_scan_cache.json");
-var CACHE_TTL_DAYS = 7;
+var CACHE_TTL_DAYS = 1;
+var SCHEMA_VERSION = 3;
 function cacheKey(pluginKey, version, lastUpdated) {
   return `${pluginKey}:${version}:${lastUpdated}`;
 }
 async function computeConfigHash(sageVersion, ...dirs) {
-  const h = (0, import_node_crypto8.createHash)("sha256");
+  const h = (0, import_node_crypto7.createHash)("sha256");
   if (sageVersion)
     h.update(sageVersion);
   for (const dir of dirs) {
@@ -19077,6 +18998,14 @@ async function loadScanCache(configHash = "", cachePath = DEFAULT_CACHE_PATH, lo
   }
   try {
     const data = JSON.parse(raw);
+    const storedVersion = data.schema_version ?? 1;
+    if (storedVersion !== SCHEMA_VERSION) {
+      logger.debug("Schema version changed, invalidating plugin scan cache", {
+        from: storedVersion,
+        to: SCHEMA_VERSION
+      });
+      return { configHash, entries: {} };
+    }
     const storedHash = data.config_hash ?? "";
     if (configHash && storedHash !== configHash) {
       logger.debug("Config hash changed, invalidating plugin scan cache", {
@@ -19104,6 +19033,7 @@ async function loadScanCache(configHash = "", cachePath = DEFAULT_CACHE_PATH, lo
 async function saveScanCache(cache2, cachePath = DEFAULT_CACHE_PATH, logger = nullLogger) {
   try {
     const data = {
+      schema_version: SCHEMA_VERSION,
       config_hash: cache2.configHash,
       entries: Object.fromEntries(Object.entries(cache2.entries).map(([key, entry]) => [
         key,
@@ -19150,13 +19080,14 @@ function storeResult(cache2, pluginKey, version, lastUpdated, findings) {
 }
 
 // ../core/dist/plugin-scanner.js
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var import_promises9 = require("node:fs/promises");
 var import_node_path18 = require("node:path");
+init_config();
 init_file_utils();
 
 // ../core/dist/skill-id.js
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var import_promises8 = require("node:fs/promises");
 var import_node_path17 = require("node:path");
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "__pycache__"]);
@@ -19234,14 +19165,14 @@ function computeSkillId(entries) {
   const fileHashes = {};
   const treeEntries = [];
   for (const e of normalized) {
-    const contentHash = (0, import_node_crypto9.createHash)("sha256").update(e.isDir ? Buffer.alloc(0) : e.content).digest("hex");
+    const contentHash = (0, import_node_crypto8.createHash)("sha256").update(e.isDir ? Buffer.alloc(0) : e.content).digest("hex");
     const entryType = e.isDir ? "dir" : "file";
     treeEntries.push({ type: entryType, entryPath: e.entryPath, hash: contentHash });
     if (!e.isDir)
       fileHashes[e.entryPath] = contentHash;
   }
   treeEntries.sort((a, b) => a.entryPath < b.entryPath ? -1 : a.entryPath > b.entryPath ? 1 : 0);
-  const skillHasher = (0, import_node_crypto9.createHash)("sha256");
+  const skillHasher = (0, import_node_crypto8.createHash)("sha256");
   for (const e of treeEntries) {
     skillHasher.update(Buffer.from(`${e.type}\0${e.entryPath}\0${e.hash}
 `, "utf8"));
@@ -19321,7 +19252,6 @@ async function computeSkillIdsForRoot(rootDir) {
 
 // ../core/dist/plugin-scanner.js
 init_types2();
-var DEFAULT_PLUGINS_REGISTRY = (0, import_node_path18.join)(getHomeDir(), ".claude", "plugins", "installed_plugins.json");
 var SCANNABLE_EXTENSIONS2 = /* @__PURE__ */ new Set([
   ".py",
   ".js",
@@ -19408,8 +19338,6 @@ async function scanPlugin(plugin, options = {}) {
             threatId: "AMSI_SCAN",
             title: `AMSI detection (result=${amsiResult.amsiResult})`,
             severity: "critical",
-            confidence: 1,
-            action: "block",
             artifact: content.slice(0, 200),
             sourceFile: (0, import_node_path18.relative)(plugin.installPath, filePath)
           });
@@ -19421,7 +19349,7 @@ async function scanPlugin(plugin, options = {}) {
       allUrls.push(...extractUrls(content));
     }
     if (checkFileHashes) {
-      const sha256 = (0, import_node_crypto10.createHash)("sha256").update(rawBytes).digest("hex");
+      const sha256 = (0, import_node_crypto9.createHash)("sha256").update(rawBytes).digest("hex");
       const existing = hashToFiles.get(sha256);
       if (existing) {
         existing.push(filePath);
@@ -19442,8 +19370,6 @@ async function scanPlugin(plugin, options = {}) {
             threatId: "URL_CHECK",
             title: `Malicious URL (${findingDetails})`,
             severity: "critical",
-            confidence: 1,
-            action: "block",
             artifact: ur.url.slice(0, 200),
             sourceFile: "URL check"
           });
@@ -19465,8 +19391,6 @@ async function scanPlugin(plugin, options = {}) {
               threatId: "FILE_CHECK",
               title: `Malicious file (${fr.detectionNames.join(", ") || "unknown"})`,
               severity: "critical",
-              confidence: 1,
-              action: "block",
               artifact: fr.sha256,
               sourceFile: (0, import_node_path18.relative)(plugin.installPath, filePath)
             });
@@ -19494,13 +19418,11 @@ async function runSkillCheck(plugin, findings, logger) {
       const risk = (verdict.overallRiskLevel ?? "").toUpperCase();
       if (risk !== "HIGH" && risk !== "CRITICAL")
         continue;
-      const severity = risk === "CRITICAL" ? "critical" : "high";
+      const severity = risk === "CRITICAL" ? "critical" : "warning";
       findings.push({
         threatId: "SKILL_CHECK",
         title: verdict.summary?.trim() || `Risky skill detected (${risk})`,
         severity,
-        confidence: 1,
-        action: "log",
         artifact: skillId.slice(0, 16),
         sourceFile: (0, import_node_path18.relative)(plugin.installPath, folder) || ".",
         recommendations: verdict.recommendations.length > 0 ? verdict.recommendations : void 0
@@ -19525,8 +19447,6 @@ function fromCachedFinding(finding) {
     threatId: finding.threat_id,
     title: finding.title,
     severity: finding.severity,
-    confidence: finding.confidence,
-    action: finding.action,
     artifact: finding.artifact,
     sourceFile: finding.source_file,
     recommendations: finding.recommendations
@@ -19537,16 +19457,13 @@ function toFindingData(finding) {
     threat_id: finding.threatId,
     title: finding.title,
     severity: finding.severity,
-    confidence: finding.confidence,
-    action: finding.action,
     artifact: finding.artifact,
     source_file: finding.sourceFile,
     recommendations: finding.recommendations
   };
 }
 function toAuditFindingData(finding) {
-  const { action: _, ...rest } = toFindingData(finding);
-  return rest;
+  return { ...toFindingData(finding) };
 }
 async function runSessionStartScan(context) {
   const logger = context.logger ?? nullLogger;
@@ -19591,7 +19508,7 @@ async function runSessionStartScan(context) {
   }
 }
 async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient, logger) {
-  const configHash = await computeConfigHash(context.sageVersion ?? "", context.threatsDir, context.allowlistsDir);
+  const configHash = await computeConfigHash(context.sageVersion ?? "", context.threatsDir, context.trustedDomainsDir);
   const cache2 = await loadScanCache(configHash, context.scanCachePath, logger);
   const resultsWithFindings = [];
   let cacheModified = false;
@@ -19617,8 +19534,6 @@ async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient,
             threatId: "EXCEPTION-DENY",
             title: `Denied by exception: ${denyMatch.pattern}${denyMatch.reason ? ` \u2014 ${denyMatch.reason}` : ""}`,
             severity: "critical",
-            confidence: 1,
-            action: "block",
             artifact: plugin.key,
             sourceFile: "~/.sage/exceptions.json"
           }
@@ -19766,7 +19681,7 @@ async function runSessionStart(ctx) {
     runSessionStartScan({
       plugins: ctx.plugins,
       threatsDir: ctx.threatsDir,
-      allowlistsDir: ctx.allowlistsDir,
+      trustedDomainsDir: ctx.trustedDomainsDir,
       sageVersion: ctx.version,
       logger,
       configPath: ctx.configPath,
@@ -19866,20 +19781,21 @@ function spawnModelDownloadWorker(args) {
 }
 
 // ../core/dist/scan-handler.js
-async function runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime, branding2 = defaultBranding, modelDownloadWorkerPath, style = "verbose") {
+async function runPluginScan(logger, context, plugins, threatsDir, trustedDomainsDir, version, agentRuntime, branding2 = defaultBranding, modelDownloadWorkerPath, style = "verbose", agentRuntimeVersion) {
   logger.debug(`${branding2.name} plugin scan started (${context})`, {
     agentRuntime,
     pluginsCount: plugins.length,
     threatsDir,
-    allowlistsDir
+    trustedDomainsDir
   });
   const result = await runSessionStart({
     plugins,
     threatsDir,
-    allowlistsDir,
+    trustedDomainsDir,
     version,
     logger,
     agentRuntime,
+    agentRuntimeVersion,
     modelDownloadWorkerPath
   });
   const findingsCount = result.scanResults.reduce((total, scanResult) => total + scanResult.findings.length, 0);
@@ -19898,7 +19814,7 @@ async function runPluginScan(logger, context, plugins, threatsDir, allowlistsDir
   return formatSessionStartMessage(version, result, branding2, style);
 }
 function createScanHandler(options) {
-  const { logger, context, discoverPlugins: discoverPlugins2, selfPrefix, threatsDir, allowlistsDir, version, agentRuntime, branding: branding2 = defaultBranding, onResult, modelDownloadWorkerPath, style = "verbose" } = options;
+  const { logger, context, discoverPlugins: discoverPlugins2, selfPrefix, threatsDir, trustedDomainsDir, version, agentRuntime, agentRuntimeVersion, branding: branding2 = defaultBranding, onResult, modelDownloadWorkerPath, style = "verbose" } = options;
   return async () => {
     try {
       let plugins = await discoverPlugins2();
@@ -19906,7 +19822,7 @@ function createScanHandler(options) {
       if (plugins.length === 0) {
         logger.debug(`${branding2.name} plugin scan (${context}): no plugins to scan after filtering`);
       }
-      const msg = await runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime, branding2, modelDownloadWorkerPath, style);
+      const msg = await runPluginScan(logger, context, plugins, threatsDir, trustedDomainsDir, version, agentRuntime, branding2, modelDownloadWorkerPath, style, agentRuntimeVersion);
       onResult?.(msg);
     } catch (e) {
       logger.error(`${branding2.name} ${context} scan failed`, { error: String(e) });
@@ -19950,7 +19866,7 @@ var packageRoot = (0, import_node_path19.resolve)(__dirname, "..");
 function getBundledDataDirs() {
   return {
     threatsDir: (0, import_node_path19.join)(packageRoot, "resources", "threats"),
-    allowlistsDir: (0, import_node_path19.join)(packageRoot, "resources", "allowlists")
+    trustedDomainsDir: (0, import_node_path19.join)(packageRoot, "resources", "trusted-domains")
   };
 }
 var cachedVersion;
@@ -20023,7 +19939,7 @@ async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSION
 
 // src/startup-scan.ts
 function createOpenClawScanHandler(logger, context, branding2 = defaultBranding, onResult) {
-  const { threatsDir, allowlistsDir } = getBundledDataDirs();
+  const { threatsDir, trustedDomainsDir } = getBundledDataDirs();
   const version = getSageVersion();
   return createScanHandler({
     logger,
@@ -20031,9 +19947,10 @@ function createOpenClawScanHandler(logger, context, branding2 = defaultBranding,
     discoverPlugins: () => discoverOpenClawPlugins(logger, void 0, branding2),
     selfPrefix: "@gendigital/sage-openclaw@",
     threatsDir,
-    allowlistsDir,
+    trustedDomainsDir,
     version,
     agentRuntime: "openclaw",
+    // No agentRuntimeVersion: the OpenClaw plugin API exposes no host version.
     branding: branding2,
     onResult,
     modelDownloadWorkerPath: (0, import_node_path21.resolve)(__dirname, "model-download-worker.cjs")
@@ -20124,7 +20041,7 @@ function mapToolToArtifacts(toolName, params) {
       return null;
   }
 }
-function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir, branding2 = defaultBranding) {
+function createToolCallHandler(approvalStore, logger, threatsDir, trustedDomainsDir, branding2 = defaultBranding) {
   async function handleToolCall(event, ctx) {
     const sessionId = ctx?.sessionKey ?? "unknown";
     const completeHook = (result, data = {}) => {
@@ -20160,7 +20077,7 @@ function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir,
           toolInput: normalizeToolInput(toolName, params),
           artifacts
         },
-        { threatsDir, allowlistsDir, logger },
+        { threatsDir, trustedDomainsDir, logger },
         approvalStore
       );
       if (verdict.decision === "allow") {
@@ -20183,7 +20100,8 @@ function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir,
         });
         return { block: true, blockReason: formatDenyMessage(verdict, branding2) };
       }
-      const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 3).join("; ") : verdict.category;
+      const maxReasons = 3;
+      const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, maxReasons).join("; ") + (verdict.reasons.length > maxReasons ? `; ... and ${verdict.reasons.length - maxReasons} more` : "") : verdict.category;
       const intersected = artifacts.filter((a) => verdict.artifacts.includes(a.value));
       const flaggedArtifacts = intersected.length > 0 ? intersected : artifacts;
       completeHook("evaluated", {
@@ -20251,35 +20169,45 @@ var index_default = {
     const toolLogger = operationalLogger.forComponent("tool-handler");
     const scanLogger = operationalLogger.forComponent("startup-scan");
     const approvalStore = new ApprovalStore();
-    const { threatsDir, allowlistsDir } = getBundledDataDirs();
+    const { threatsDir, trustedDomainsDir } = getBundledDataDirs();
     const CLEANUP_INTERVAL_MS = 5 * 60 * 1e3;
     const interval = setInterval(() => approvalStore.cleanup(), CLEANUP_INTERVAL_MS);
     if (typeof interval.unref === "function") interval.unref();
     let pendingConfigurationWarnings = formatConfigurationWarnings(getConfigurationWarningsSync(void 0, logger), branding) ?? null;
+    const migrationCheckPromise = checkAllowlistMigration().then((result) => {
+      if (result.needed) {
+        const notice = formatAllowlistMigrationWarning(result.entryTypes, branding);
+        pendingConfigurationWarnings = pendingConfigurationWarnings ? `${pendingConfigurationWarnings}
+
+${notice}` : notice;
+      }
+    }).catch(() => {
+    });
     let pendingScanFindings = null;
     const onFindings = (msg) => {
       pendingScanFindings = msg;
     };
     const getPendingFindings = () => [pendingConfigurationWarnings, pendingScanFindings].filter(Boolean).join("\n\n") || null;
+    const beforeAgentStartHandler = createBeforeAgentStartHandler(
+      getPendingFindings,
+      () => {
+        pendingConfigurationWarnings = null;
+        pendingScanFindings = null;
+      },
+      logger,
+      branding
+    );
     api.on(
       "before_tool_call",
-      createToolCallHandler(approvalStore, toolLogger, threatsDir, allowlistsDir, branding),
+      createToolCallHandler(approvalStore, toolLogger, threatsDir, trustedDomainsDir, branding),
       { priority: 100 }
     );
     api.on("gateway_start", createStartupScanHandler(scanLogger, branding, onFindings));
     api.on("session_start", createSessionScanHandler(scanLogger, branding, onFindings));
-    api.on(
-      "before_agent_start",
-      createBeforeAgentStartHandler(
-        getPendingFindings,
-        () => {
-          pendingConfigurationWarnings = null;
-          pendingScanFindings = null;
-        },
-        logger,
-        branding
-      )
-    );
+    api.on("before_agent_start", async () => {
+      await migrationCheckPromise;
+      return beforeAgentStartHandler();
+    });
   }
 };
 //# sourceMappingURL=index.cjs.map