@gendigital/sage-openclaw 0.10.0 → 0.12.0

package/dist/index.cjs

@@ -49,13 +49,31 @@ function getProcEnv() {
 function getHomeDir() {
   return getProcEnv().HOME || (0, import_node_os.homedir)();
 }
+async function renameWithRetry(from, to, attempts = 5) {
+  if (process.platform !== "win32") {
+    await fsPromises.rename(from, to);
+    return;
+  }
+  for (let i = 0; i < attempts; i++) {
+    try {
+      await fsPromises.rename(from, to);
+      return;
+    } catch (err) {
+      const code = err.code;
+      const transient = code === "EPERM" || code === "EACCES" || code === "EBUSY";
+      if (!transient || i === attempts - 1)
+        throw err;
+      await new Promise((resolve10) => setTimeout(resolve10, 10 * 2 ** i));
+    }
+  }
+}
 async function atomicWriteJson(path, data) {
   await fsPromises.mkdir((0, import_node_path.dirname)(path), { recursive: true });
   const tmp = `${path}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}.tmp`;
   try {
     await fsPromises.writeFile(tmp, `${JSON.stringify(data, null, 2)}
 `, { mode: 384 });
-    await fsPromises.rename(tmp, path);
+    await renameWithRetry(tmp, path);
   } catch (err) {
     try {
       await fsPromises.unlink(tmp);
@@ -112,7 +130,47 @@ async function pruneOrphanedModelDownloads(stagingDir, maxAgeMs = 60 * 60 * 1e3)
     }
   }
 }
-var import_node_crypto, fs, fsPromises, import_node_os, import_node_path, name1, name2;
+async function removeStaleFileLock(lockPath, staleAgeMs) {
+  try {
+    const s = await fsPromises.stat(lockPath);
+    if (Date.now() - s.mtimeMs < staleAgeMs)
+      return;
+    await fsPromises.rmdir(lockPath);
+  } catch {
+  }
+}
+async function acquireFileLock(filePath, timeoutMs = 250, staleAgeMs = 3e4) {
+  const lockPath = `${filePath}.lock`;
+  const deadline = Date.now() + timeoutMs;
+  while (true) {
+    try {
+      await fsPromises.mkdir(lockPath);
+      return async () => {
+        try {
+          await fsPromises.rmdir(lockPath);
+        } catch {
+        }
+      };
+    } catch {
+      await removeStaleFileLock(lockPath, staleAgeMs);
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0)
+        return void 0;
+      await (0, import_promises.setTimeout)(Math.min(50, remainingMs));
+    }
+  }
+}
+async function withFileLock(filePath, callback) {
+  const release = await acquireFileLock(filePath);
+  if (!release)
+    return;
+  try {
+    return await callback();
+  } finally {
+    await release();
+  }
+}
+var import_node_crypto, fs, fsPromises, import_node_os, import_node_path, import_promises, name1, name2;
 var init_file_utils = __esm({
   "../core/dist/file-utils.js"() {
     "use strict";
@@ -121,6 +179,7 @@ var init_file_utils = __esm({
     fsPromises = __toESM(require("node:fs/promises"), 1);
     import_node_os = require("node:os");
     import_node_path = require("node:path");
+    import_promises = require("node:timers/promises");
     name1 = "read";
     name2 = "File";
   }
@@ -4233,7 +4292,7 @@ var init_zod = __esm({
 });
 
 // ../core/dist/types.js
-var nullLogger, ArtifactTypeSchema, ArtifactSchema, SeveritySchema, ActionSchema, ThreatSchema, DecisionSchema, VerdictSeveritySchema, SensitivitySchema, UrlCheckConfigSchema, CacheConfigSchema, AllowlistConfigSchema, LoggingConfigSchema, OperationalLogLevelSchema, OperationalLoggingConfigSchema, FileCheckConfigSchema, PackageCheckConfigSchema, AmsiCheckConfigSchema, DEFAULT_PI_HIGH_RISK_THRESHOLD, DEFAULT_PI_MEDIUM_RISK_THRESHOLD, PiCheckConfigSchema, ExceptionDecisionSchema, ExceptionMatchSchema, ExceptionRuleSchema, ExceptionsFileSchema, ExceptionsConfigSchema, ConfigSchema, HookTypeSchema;
+var nullLogger, ArtifactTypeSchema, ArtifactSchema, VerdictSeveritySchema, ThreatSchema, DecisionSchema, SensitivitySchema, UrlCheckConfigSchema, CacheConfigSchema, LoggingConfigSchema, OperationalLogLevelSchema, OperationalLoggingConfigSchema, FileCheckConfigSchema, PackageCheckConfigSchema, AmsiCheckConfigSchema, SkillCheckConfigSchema, DEFAULT_PI_HIGH_RISK_THRESHOLD, DEFAULT_PI_MEDIUM_RISK_THRESHOLD, DEFAULT_PI_TELEMETRY_THRESHOLD, PiCheckConfigSchema, ExceptionDecisionSchema, ExceptionMatchSchema, ExceptionRuleSchema, ExceptionsFileSchema, ExceptionsConfigSchema, ConfigSchema, HookTypeSchema;
 var init_types2 = __esm({
   "../core/dist/types.js"() {
     "use strict";
@@ -4254,23 +4313,21 @@ var init_types2 = __esm({
       value: external_exports.string(),
       context: external_exports.string().optional()
     });
-    SeveritySchema = external_exports.enum(["critical", "high", "medium", "low"]);
-    ActionSchema = external_exports.enum(["block", "require_approval", "log"]);
+    VerdictSeveritySchema = external_exports.enum(["info", "warning", "critical"]);
     ThreatSchema = external_exports.object({
       id: external_exports.string(),
       version: external_exports.number().int().optional(),
       category: external_exports.string(),
-      severity: SeveritySchema,
+      severity: VerdictSeveritySchema,
       confidence: external_exports.number(),
-      action: ActionSchema,
       pattern: external_exports.string(),
       match_on: external_exports.union([external_exports.string(), external_exports.array(external_exports.string())]),
       title: external_exports.string(),
       expires_at: external_exports.string().nullable().optional(),
-      revoked: external_exports.boolean().optional().default(false)
+      revoked: external_exports.boolean().optional().default(false),
+      flags: external_exports.array(external_exports.string()).optional().default([])
     });
     DecisionSchema = external_exports.enum(["allow", "deny", "ask"]);
-    VerdictSeveritySchema = external_exports.enum(["info", "warning", "critical"]);
     SensitivitySchema = external_exports.enum(["paranoid", "balanced", "relaxed"]);
     UrlCheckConfigSchema = external_exports.object({
       endpoint: external_exports.string().optional(),
@@ -4283,9 +4340,6 @@ var init_types2 = __esm({
       ttl_clean_seconds: external_exports.number().default(86400),
       path: external_exports.string().default("~/.sage/cache.json")
     });
-    AllowlistConfigSchema = external_exports.object({
-      path: external_exports.string().default("~/.sage/allowlist.json")
-    });
     LoggingConfigSchema = external_exports.object({
       enabled: external_exports.boolean().default(true),
       log_clean: external_exports.boolean().default(false),
@@ -4315,14 +4369,24 @@ var init_types2 = __esm({
     AmsiCheckConfigSchema = external_exports.object({
       enabled: external_exports.boolean().default(true)
     });
+    SkillCheckConfigSchema = external_exports.object({
+      enabled: external_exports.boolean().default(true),
+      cache_ttl_days: external_exports.number().min(0).default(1),
+      /**
+       * Upload unknown skills (never seen by the analyzer) for deep content
+       * analysis. When false, the scan still looks skills up by content hash and
+       * still flags known-risky ones — but no skill content ever leaves the
+       * machine and the upload worker never runs (lookup-only mode).
+       */
+      upload_enabled: external_exports.boolean().default(true)
+    });
     DEFAULT_PI_HIGH_RISK_THRESHOLD = 0.99;
     DEFAULT_PI_MEDIUM_RISK_THRESHOLD = 0.5;
+    DEFAULT_PI_TELEMETRY_THRESHOLD = 0.95;
     PiCheckConfigSchema = external_exports.object({
       enabled: external_exports.boolean().default(false),
       max_content_length: external_exports.number().default(16384),
-      model_path: external_exports.string().optional(),
-      high_risk_threshold: external_exports.number().default(DEFAULT_PI_HIGH_RISK_THRESHOLD),
-      medium_risk_threshold: external_exports.number().default(DEFAULT_PI_MEDIUM_RISK_THRESHOLD)
+      model_path: external_exports.string().optional()
     });
     ExceptionDecisionSchema = external_exports.enum(["allow", "deny"]);
     ExceptionMatchSchema = external_exports.enum(["executable", "domain", "path", "plugin", "regex"]);
@@ -4344,15 +4408,16 @@ var init_types2 = __esm({
       file_check: FileCheckConfigSchema.default({}),
       package_check: PackageCheckConfigSchema.default({}),
       amsi_check: AmsiCheckConfigSchema.default({}),
+      skill_check: SkillCheckConfigSchema.default({}),
       pi_check: PiCheckConfigSchema.default({}),
       heuristics_enabled: external_exports.boolean().default(true),
       cache: CacheConfigSchema.default({}),
-      allowlist: AllowlistConfigSchema.default({}),
       exceptions: ExceptionsConfigSchema.default({}),
       logging: LoggingConfigSchema.default({}),
       operational_logging: OperationalLoggingConfigSchema.default({}),
       sensitivity: SensitivitySchema.default("balanced"),
       disabled_threats: external_exports.array(external_exports.string()).default([]),
+      announce_clean_scans: external_exports.boolean().default(true),
       brand_key: external_exports.string().min(1).max(32).regex(/^[a-z0-9_-]+$/u).optional(),
       community_iq: external_exports.boolean().default(true)
     });
@@ -4371,12 +4436,27 @@ var init_types2 = __esm({
 var config_exports = {};
 __export(config_exports, {
   HOOK_TIMEOUT_SECONDS: () => HOOK_TIMEOUT_SECONDS,
+  MS_PER_DAY: () => MS_PER_DAY,
   SAGE_DIR: () => SAGE_DIR,
   defaultConfigPath: () => defaultConfigPath,
+  getClaudeConfigDir: () => getClaudeConfigDir,
+  isFreshTimestamp: () => isFreshTimestamp,
   loadConfig: () => loadConfig,
   loadConfigSync: () => loadConfigSync,
-  resolvePath: () => resolvePath
+  readExplicitSkillUploadEnabled: () => readExplicitSkillUploadEnabled,
+  resolvePath: () => resolvePath,
+  skillCacheTtlMs: () => skillCacheTtlMs
 });
+function skillCacheTtlMs(config2) {
+  return Math.max(1, config2.skill_check.cache_ttl_days) * MS_PER_DAY;
+}
+function isFreshTimestamp(ts, ttlMs, now = Date.now()) {
+  if (Number.isNaN(ts))
+    return false;
+  if (ts - now > CLOCK_SKEW_TOLERANCE_MS)
+    return false;
+  return now - ts < ttlMs;
+}
 function resolvedSageDir() {
   return resolvePath(SAGE_DIR);
 }
@@ -4386,9 +4466,6 @@ function defaultConfigPath() {
 function defaultCachePath() {
   return (0, import_node_path2.join)(resolvedSageDir(), "cache.json");
 }
-function defaultAllowlistPath() {
-  return (0, import_node_path2.join)(resolvedSageDir(), "allowlist.json");
-}
 function defaultExceptionsPath() {
   return (0, import_node_path2.join)(resolvedSageDir(), "exceptions.json");
 }
@@ -4405,6 +4482,12 @@ function resolvePath(pathStr) {
   }
   return pathStr;
 }
+function getClaudeConfigDir() {
+  const envDir = process.env.CLAUDE_CONFIG_DIR;
+  if (envDir)
+    return resolvePath(envDir);
+  return resolvePath("~/.claude");
+}
 function isWithinDirectory(baseDir, targetPath) {
   const rel = (0, import_node_path2.relative)(baseDir, targetPath);
   if (rel === "")
@@ -4448,13 +4531,12 @@ function sanitizeBrandKey(data, logger) {
   if (typeof brandKey === "string" && brandKey.length >= 1 && brandKey.length <= 32 && BRAND_KEY_RE.test(brandKey)) {
     return data;
   }
-  logger.warn(`Invalid brand_key in config \u2014 ignoring`, { brand_key: brandKey });
+  logger.warn(`Invalid brand_key in config - ignoring`, { brand_key: brandKey });
   const { brand_key: _, ...rest } = data;
   return rest;
 }
 function sanitizeConfigPaths(config2, logger) {
   const cachePath = defaultCachePath();
-  const allowlistPath = defaultAllowlistPath();
   const exceptionsPath = defaultExceptionsPath();
   const auditPath = defaultAuditPath();
   const operationalLogPath = defaultOperationalLogPath();
@@ -4464,10 +4546,6 @@ function sanitizeConfigPaths(config2, logger) {
       ...config2.cache,
       path: normalizeStateFilePath(config2.cache.path, cachePath, "cache", logger)
     },
-    allowlist: {
-      ...config2.allowlist,
-      path: normalizeStateFilePath(config2.allowlist.path, allowlistPath, "allowlist", logger)
-    },
     exceptions: {
       ...config2.exceptions,
       path: normalizeStateFilePath(config2.exceptions.path, exceptionsPath, "exceptions", logger)
@@ -4505,6 +4583,21 @@ function parseConfig(raw, path, logger) {
     return defaultConfig(logger);
   }
 }
+async function readExplicitSkillUploadEnabled(configPath, logger = nullLogger) {
+  const path = configPath ? resolvePath(configPath) : defaultConfigPath();
+  try {
+    const data = JSON.parse(await getFileContent(path));
+    const skillCheck = data.skill_check;
+    if (skillCheck && typeof skillCheck === "object" && !Array.isArray(skillCheck) && "upload_enabled" in skillCheck) {
+      const value = skillCheck.upload_enabled;
+      if (typeof value === "boolean")
+        return { present: true, value };
+      logger.warn("Config skill_check.upload_enabled is not a boolean; ignoring", { value });
+    }
+  } catch {
+  }
+  return { present: false, value: false };
+}
 async function loadConfig(configPath, logger = nullLogger) {
   const path = configPath ? resolvePath(configPath) : defaultConfigPath();
   try {
@@ -4521,7 +4614,7 @@ function loadConfigSync(configPath, logger = nullLogger) {
     return defaultConfig(logger);
   }
 }
-var import_node_path2, SAGE_DIR, HOOK_TIMEOUT_SECONDS, BRAND_KEY_RE;
+var import_node_path2, SAGE_DIR, HOOK_TIMEOUT_SECONDS, MS_PER_DAY, CLOCK_SKEW_TOLERANCE_MS, BRAND_KEY_RE;
 var init_config = __esm({
   "../core/dist/config.js"() {
     "use strict";
@@ -4530,6 +4623,8 @@ var init_config = __esm({
     init_types2();
     SAGE_DIR = "~/.sage";
     HOOK_TIMEOUT_SECONDS = 8;
+    MS_PER_DAY = 24 * 60 * 60 * 1e3;
+    CLOCK_SKEW_TOLERANCE_MS = 5 * 60 * 1e3;
     BRAND_KEY_RE = /^[a-z0-9_-]+$/u;
   }
 });
@@ -6794,7 +6889,7 @@ async function ensurePiDeps(modelPath, logger = nullLogger) {
   }
 }
 function runNpm(cwd, args, logger) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const isWindows = process.platform === "win32";
     const npmCmd = isWindows ? "npm.cmd" : "npm";
     const child = (0, import_node_child_process.execFile)(npmCmd, args, { cwd, timeout: 3e4, shell: isWindows }, (error, _stdout, stderr) => {
@@ -6802,7 +6897,7 @@ function runNpm(cwd, args, logger) {
         logger.warn(`npm install error: ${stderr || error.message}`);
         reject(error);
       } else {
-        resolve9();
+        resolve10();
       }
     });
     child.unref();
@@ -14115,124 +14210,66 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// ../core/dist/allowlist.js
-init_config();
-init_file_utils();
-init_types2();
-
-// ../core/dist/url-utils.js
-var import_node_crypto2 = require("node:crypto");
+// ../core/dist/allowlist-migration.js
 var import_node_path3 = require("node:path");
-init_file_utils();
-function normalizeUrl(raw) {
-  try {
-    const u = new URL(raw);
-    u.hash = "";
-    u.searchParams.sort();
-    return u.toString();
-  } catch {
-    return raw.toLowerCase();
+
+// ../core/dist/brands.js
+var defaultBranding = { name: "Sage", short_name: "Sage" };
+var BRANDS = {
+  norton: { name: "Norton AI Agent Protection", short_name: "Norton" }
+};
+function resolveBranding(brandKey, logger) {
+  if (!brandKey)
+    return defaultBranding;
+  const entry = BRANDS[brandKey];
+  if (!entry) {
+    logger?.warn(`Unknown brand_key "${brandKey}" in config - using default branding`);
+    return defaultBranding;
   }
-}
-function hashCommand(command) {
-  return (0, import_node_crypto2.createHash)("sha256").update(command).digest("hex");
-}
-function normalizeFilePath(raw) {
-  const home = getHomeDir();
-  const expanded = raw.startsWith("~/") || raw === "~" ? `${home}${raw.slice(1)}` : raw;
-  return (0, import_node_path3.normalize)(expanded);
+  return { ...entry, brand_key: brandKey };
 }
 
-// ../core/dist/allowlist.js
-function emptyAllowlist() {
-  return { urls: {}, commands: {}, filePaths: {} };
-}
-function parseEntries(raw) {
-  const entries = {};
-  for (const [key, entryData] of Object.entries(raw)) {
-    if (typeof entryData !== "object" || entryData === null)
-      continue;
-    const data = entryData;
-    if (typeof data.added_at === "string" && typeof data.reason === "string" && typeof data.original_verdict === "string") {
-      entries[key] = {
-        addedAt: data.added_at,
-        reason: data.reason,
-        originalVerdict: data.original_verdict
-      };
-    }
-  }
-  return entries;
+// ../core/dist/allowlist-migration.js
+init_config();
+init_file_utils();
+function defaultAllowlistPath() {
+  return (0, import_node_path3.join)(resolvePath("~/.sage"), "allowlist.json");
 }
-async function loadAllowlist(config2, logger = nullLogger) {
-  const path = resolvePath(config2.path);
-  let raw;
+async function checkAllowlistMigration() {
   try {
-    raw = await getFileContent(path);
+    const raw = await getFileContent(defaultAllowlistPath());
+    const data = JSON.parse(raw);
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+      return { needed: false, entryTypes: [] };
+    }
+    const record = data;
+    const found = ["urls", "commands", "file_paths"].filter((key) => typeof record[key] === "object" && record[key] !== null && Object.keys(record[key]).length > 0);
+    return { needed: found.length > 0, entryTypes: found };
   } catch {
-    return emptyAllowlist();
-  }
-  let data;
-  try {
-    data = JSON.parse(raw);
-  } catch (e) {
-    logger.warn(`Failed to load allowlist from ${path}`, { error: String(e) });
-    return emptyAllowlist();
+    return { needed: false, entryTypes: [] };
   }
-  if (typeof data !== "object" || data === null || Array.isArray(data)) {
-    logger.warn(`Allowlist file ${path} does not contain a JSON object`);
-    return emptyAllowlist();
-  }
-  const record = data;
-  const rawUrls = parseEntries(record.urls ?? {});
-  const urls = {};
-  for (const [key, entry] of Object.entries(rawUrls)) {
-    urls[normalizeUrl(key)] = entry;
-  }
-  const rawFilePaths = parseEntries(record.file_paths ?? {});
-  const filePaths = {};
-  for (const [key, entry] of Object.entries(rawFilePaths)) {
-    filePaths[normalizeFilePath(key)] = entry;
-  }
-  return {
-    urls,
-    commands: parseEntries(record.commands ?? {}),
-    filePaths
-  };
 }
-function isAllowlisted(allowlist, artifacts) {
-  for (const artifact of artifacts) {
-    if (artifact.type !== "command") {
-      continue;
-    }
-    const cmdHash = hashCommand(artifact.value);
-    if (cmdHash in allowlist.commands) {
-      return true;
-    }
-  }
-  for (const artifact of artifacts) {
-    if (artifact.type !== "file_path") {
-      continue;
-    }
-    if (normalizeFilePath(artifact.value) in allowlist.filePaths) {
-      return true;
-    }
-  }
-  if (artifacts.length > 0 && artifacts.every((artifact) => artifact.type === "url")) {
-    return artifacts.every((artifact) => normalizeUrl(artifact.value) in allowlist.urls);
-  }
-  return false;
+function formatAllowlistMigrationWarning(entryTypes, branding2 = defaultBranding) {
+  const typeList = entryTypes.join(", ");
+  const lines = [
+    `${branding2.name}: legacy allowlist.json detected with ${typeList} entries.`,
+    "  - URL and file_path entries can be migrated manually to ~/.sage/exceptions.json",
+    "  - Command entries are stored as SHA-256 hashes and cannot be recovered",
+    "  - See https://github.com/gendigitalinc/sage for migration instructions"
+  ];
+  return lines.join("\n");
 }
 
 // ../core/dist/approval-store.js
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto2 = require("node:crypto");
 var PENDING_STALE_MS = 60 * 60 * 1e3;
 var APPROVED_TTL_MS = 10 * 60 * 1e3;
-var ApprovalStore = class _ApprovalStore {
+var ApprovalStore = class {
   pending = /* @__PURE__ */ new Map();
   approved = /* @__PURE__ */ new Map();
   static actionId(toolName, params, sessionId) {
     const payload = JSON.stringify({ toolName, params, sessionId });
-    return (0, import_node_crypto3.createHash)("sha256").update(payload).digest("hex").slice(0, 32);
+    return (0, import_node_crypto2.createHash)("sha256").update(payload).digest("hex").slice(0, 32);
   }
   static artifactId(type, value) {
     return `${type}:${value}`;
@@ -14269,40 +14306,6 @@ var ApprovalStore = class _ApprovalStore {
     }
     return true;
   }
-  hasApprovedArtifact(type, value) {
-    return this.findApprovedAction(type, value) !== null;
-  }
-  consumeApprovedArtifact(type, value) {
-    const id = _ApprovalStore.artifactId(type, value);
-    for (const [actionId, entry] of this.approved.entries()) {
-      if (Date.now() >= entry.expiresAt) {
-        this.approved.delete(actionId);
-        continue;
-      }
-      const idx = entry.artifacts.findIndex((a) => _ApprovalStore.artifactId(a.type, a.value) === id);
-      if (idx !== -1) {
-        entry.artifacts.splice(idx, 1);
-        if (entry.artifacts.length === 0) {
-          this.approved.delete(actionId);
-        }
-        return true;
-      }
-    }
-    return false;
-  }
-  findApprovedAction(type, value) {
-    const id = _ApprovalStore.artifactId(type, value);
-    for (const [actionId, entry] of this.approved.entries()) {
-      if (Date.now() >= entry.expiresAt) {
-        this.approved.delete(actionId);
-        continue;
-      }
-      if (entry.artifacts.some((artifact) => _ApprovalStore.artifactId(artifact.type, artifact.value) === id)) {
-        return actionId;
-      }
-    }
-    return null;
-  }
   cleanup(now = Date.now()) {
     for (const [actionId, entry] of this.pending.entries()) {
       if (now - entry.createdAt >= PENDING_STALE_MS) {
@@ -14318,99 +14321,237 @@ var ApprovalStore = class _ApprovalStore {
 };
 
 // ../core/dist/audit-log.js
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 init_config();
-init_file_utils();
 
-// ../core/dist/jsonl-log-writer.js
-var import_promises = require("node:fs/promises");
-var import_node_path4 = require("node:path");
-var import_promises2 = require("node:timers/promises");
-init_config();
-var writeQueues = /* @__PURE__ */ new Map();
-var ROTATE_LOCK_TIMEOUT_MS = 250;
-var ROTATE_LOCK_STALE_MS = 3e4;
-var ROTATE_LOCK_POLL_MS = 50;
-async function shouldRotate(filePath, maxBytes, maxFiles) {
-  if (maxBytes <= 0 || maxFiles <= 0)
-    return false;
-  try {
-    const s = await (0, import_promises.stat)(filePath);
-    return s.size >= maxBytes;
-  } catch {
-    return false;
+// ../core/dist/content-snapshot.js
+var import_node_os2 = require("node:os");
+var CONTENT_FIELD_LIMITS = Object.freeze({
+  command: 512,
+  url: 512,
+  file_path: 512,
+  package_name: 256,
+  package_version: 128,
+  package_registry: 128
+});
+function safeTruncate(value, maxLen) {
+  if (maxLen <= 0)
+    return "";
+  if (value.length <= maxLen)
+    return value;
+  const cutIndex = maxLen;
+  const codeUnit = value.charCodeAt(cutIndex - 1);
+  if (codeUnit >= 55296 && codeUnit <= 56319) {
+    return value.slice(0, cutIndex - 1);
   }
+  return value.slice(0, cutIndex);
 }
-async function removeStaleRotateLock(lockPath) {
-  try {
-    const s = await (0, import_promises.stat)(lockPath);
-    if (Date.now() - s.mtimeMs < ROTATE_LOCK_STALE_MS)
-      return;
-    await (0, import_promises.rmdir)(lockPath);
-  } catch {
+function scrubHomePath(value) {
+  const home = (0, import_node_os2.homedir)();
+  if (!home)
+    return value;
+  const normalizedHome = home.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!normalizedHome)
+    return value;
+  const normalizedValue = value.replace(/\\/g, "/");
+  if (normalizedValue === normalizedHome)
+    return "~";
+  if (normalizedValue.startsWith(`${normalizedHome}/`)) {
+    return `~/${normalizedValue.slice(normalizedHome.length + 1)}`;
   }
+  return value;
 }
-async function acquireRotateLock(filePath) {
-  const lockPath = `${filePath}.lock`;
-  const deadline = Date.now() + ROTATE_LOCK_TIMEOUT_MS;
-  while (true) {
-    try {
-      await (0, import_promises.mkdir)(lockPath);
-      return async () => {
-        try {
-          await (0, import_promises.rmdir)(lockPath);
-        } catch {
-        }
-      };
-    } catch {
-      await removeStaleRotateLock(lockPath);
-      const remainingMs = deadline - Date.now();
-      if (remainingMs <= 0)
-        return void 0;
-      await (0, import_promises2.setTimeout)(Math.min(ROTATE_LOCK_POLL_MS, remainingMs));
-    }
-  }
+function asString(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-async function rotateIfNeeded(filePath, maxBytes, maxFiles) {
-  if (!await shouldRotate(filePath, maxBytes, maxFiles))
-    return;
-  const releaseLock = await acquireRotateLock(filePath);
-  if (!releaseLock)
-    return;
-  try {
-    if (!await shouldRotate(filePath, maxBytes, maxFiles))
-      return;
-    try {
-      await (0, import_promises.unlink)(`${filePath}.${maxFiles}`);
-    } catch {
-    }
-    for (let i = maxFiles - 1; i >= 1; i--) {
-      try {
-        await (0, import_promises.rename)(`${filePath}.${i}`, `${filePath}.${i + 1}`);
-      } catch {
-      }
-    }
-    try {
-      await (0, import_promises.rename)(filePath, `${filePath}.1`);
-    } catch {
+function resolveFilePath(toolInput) {
+  return asString(toolInput.file_path) ?? asString(toolInput.filePath) ?? asString(toolInput.path);
+}
+function resolveWebFetchUrl(toolInput) {
+  const single = asString(toolInput.url);
+  if (single)
+    return single;
+  const urls = toolInput.urls;
+  if (Array.isArray(urls)) {
+    for (const u of urls) {
+      if (typeof u === "string" && u.length > 0)
+        return u;
     }
-  } finally {
-    await releaseLock();
   }
+  return void 0;
 }
-async function appendJsonlEntryNow(path, config2, entry) {
-  await (0, import_promises.mkdir)((0, import_node_path4.dirname)(path), { recursive: true });
-  await rotateIfNeeded(path, config2.max_bytes, config2.max_files);
-  await (0, import_promises.appendFile)(path, `${JSON.stringify(entry)}
-`);
-}
-async function appendJsonlEntry(config2, entry) {
-  const path = resolvePath(config2.path);
-  const previousWrite = writeQueues.get(path) ?? Promise.resolve();
-  const nextWrite = previousWrite.catch(() => {
-  }).then(() => appendJsonlEntryNow(path, config2, entry));
-  writeQueues.set(path, nextWrite);
-  try {
+function extractFirstApplyPatchPath(patchText) {
+  if (!patchText)
+    return void 0;
+  const headerMatch = /\*{3}\s+(?:Add|Update|Delete)\s+File:\s*(.+)/.exec(patchText);
+  if (headerMatch?.[1]) {
+    const trimmed = headerMatch[1].trim();
+    if (trimmed)
+      return trimmed;
+  }
+  const renameMatch = /\*{3}\s+(?:Move\s+to|Rename\s+File):\s*(.+)/i.exec(patchText);
+  if (renameMatch?.[1]) {
+    const raw = renameMatch[1].trim();
+    const arrow = raw.indexOf(" -> ");
+    if (arrow !== -1) {
+      const src = raw.slice(0, arrow).trim();
+      if (src)
+        return src;
+      const dst = raw.slice(arrow + 4).trim();
+      if (dst)
+        return dst;
+    } else if (raw) {
+      return raw;
+    }
+  }
+  return void 0;
+}
+function extractMcpContent(toolInput) {
+  const nestedRaw = toolInput.tool_input ?? toolInput.toolInput;
+  const candidate = nestedRaw && typeof nestedRaw === "object" && !Array.isArray(nestedRaw) ? nestedRaw : toolInput;
+  return {
+    command: asString(candidate.command),
+    url: asString(candidate.url) ?? resolveWebFetchUrl(candidate),
+    file_path: resolveFilePath(candidate)
+  };
+}
+function firstUrlArtifact(artifacts) {
+  for (const a of artifacts) {
+    if (a.type === "url" && typeof a.value === "string" && a.value.length > 0) {
+      return a.value;
+    }
+  }
+  return void 0;
+}
+function applyFieldLimits(content) {
+  for (const [key, value] of Object.entries(content)) {
+    if (typeof value !== "string")
+      continue;
+    let sanitized = value;
+    if (key === "file_path" || key === "command") {
+      sanitized = scrubHomePath(sanitized);
+    }
+    const limit = CONTENT_FIELD_LIMITS[key];
+    if (limit && sanitized.length > limit) {
+      sanitized = safeTruncate(sanitized, limit);
+    }
+    content[key] = sanitized;
+  }
+}
+function buildContentSnapshot(toolType, toolInput, artifacts = [], signals = {}) {
+  const content = {};
+  switch (toolType) {
+    case "Bash": {
+      const command = asString(toolInput.command);
+      if (command)
+        content.command = command;
+      break;
+    }
+    case "WebFetch": {
+      const url = resolveWebFetchUrl(toolInput) ?? firstUrlArtifact(artifacts);
+      if (url)
+        content.url = url;
+      break;
+    }
+    case "Write":
+    case "Edit":
+    case "Read":
+    case "Delete": {
+      const filePath = resolveFilePath(toolInput);
+      if (filePath)
+        content.file_path = filePath;
+      break;
+    }
+    case "ApplyPatch": {
+      const patchText = asString(toolInput.input) ?? asString(toolInput.patch) ?? "";
+      const filePath = extractFirstApplyPatchPath(patchText);
+      if (filePath)
+        content.file_path = filePath;
+      break;
+    }
+    case "MCP": {
+      const mcp = extractMcpContent(toolInput);
+      if (mcp.command)
+        content.command = mcp.command;
+      if (mcp.url)
+        content.url = mcp.url;
+      if (mcp.file_path)
+        content.file_path = mcp.file_path;
+      break;
+    }
+  }
+  if (!content.url && signals.url_checks && signals.url_checks.length > 0) {
+    const firstUrl = signals.url_checks[0]?.url;
+    if (firstUrl)
+      content.url = firstUrl;
+  }
+  if (signals.package_checks && signals.package_checks.length > 0) {
+    const p = signals.package_checks[0];
+    if (p?.package_name)
+      content.package_name = p.package_name;
+    if (p?.package_version)
+      content.package_version = p.package_version;
+    if (p?.package_registry)
+      content.package_registry = p.package_registry;
+  }
+  applyFieldLimits(content);
+  return content;
+}
+
+// ../core/dist/audit-log.js
+init_file_utils();
+
+// ../core/dist/jsonl-log-writer.js
+var import_promises2 = require("node:fs/promises");
+var import_node_path4 = require("node:path");
+init_config();
+init_file_utils();
+var writeQueues = /* @__PURE__ */ new Map();
+async function shouldRotate(filePath, maxBytes, maxFiles) {
+  if (maxBytes <= 0 || maxFiles <= 0)
+    return false;
+  try {
+    const s = await (0, import_promises2.stat)(filePath);
+    return s.size >= maxBytes;
+  } catch {
+    return false;
+  }
+}
+async function rotateIfNeeded(filePath, maxBytes, maxFiles) {
+  if (!await shouldRotate(filePath, maxBytes, maxFiles))
+    return;
+  await withFileLock(filePath, async () => {
+    if (!await shouldRotate(filePath, maxBytes, maxFiles))
+      return;
+    try {
+      await (0, import_promises2.unlink)(`${filePath}.${maxFiles}`);
+    } catch {
+    }
+    for (let i = maxFiles - 1; i >= 1; i--) {
+      try {
+        await (0, import_promises2.rename)(`${filePath}.${i}`, `${filePath}.${i + 1}`);
+      } catch {
+      }
+    }
+    try {
+      await (0, import_promises2.rename)(filePath, `${filePath}.1`);
+    } catch {
+    }
+  });
+}
+async function appendJsonlEntryNow(path, config2, entry) {
+  await (0, import_promises2.mkdir)((0, import_node_path4.dirname)(path), { recursive: true });
+  await rotateIfNeeded(path, config2.max_bytes, config2.max_files);
+  await (0, import_promises2.appendFile)(path, `${JSON.stringify(entry)}
+`);
+}
+async function appendJsonlEntry(config2, entry) {
+  const path = resolvePath(config2.path);
+  const previousWrite = writeQueues.get(path) ?? Promise.resolve();
+  const nextWrite = previousWrite.catch(() => {
+  }).then(() => appendJsonlEntryNow(path, config2, entry));
+  writeQueues.set(path, nextWrite);
+  try {
     await nextWrite;
   } finally {
     if (writeQueues.get(path) === nextWrite)
@@ -14419,6 +14560,7 @@ async function appendJsonlEntry(config2, entry) {
 }
 
 // ../core/dist/audit-log.js
+init_types2();
 var MAX_SUMMARY_LEN = 200;
 var AUDIT_LOG_SCHEMA_VERSION = 1;
 function toolInputSummary(toolName, toolInput) {
@@ -14446,7 +14588,7 @@ async function logVerdict(config2, input) {
     return;
   const entry = {
     type: "runtime_verdict",
-    entry_id: input.eventId ?? (0, import_node_crypto4.randomUUID)(),
+    entry_id: input.eventId ?? (0, import_node_crypto3.randomUUID)(),
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     session_id: input.sessionId,
     conversation_id: input.conversationId ?? input.sessionId,
@@ -14487,32 +14629,46 @@ async function logPluginScan(config2, pluginKey, pluginVersion, findings) {
   } catch {
   }
 }
-
-// ../core/dist/brands.js
-var defaultBranding = { name: "Sage", short_name: "Sage" };
-var BRANDS = {
-  norton: { name: "Norton AI Agent Protection", short_name: "Norton" }
-};
-function resolveBranding(brandKey, logger) {
-  if (!brandKey)
-    return defaultBranding;
-  const entry = BRANDS[brandKey];
-  if (!entry) {
-    logger?.warn(`Unknown brand_key "${brandKey}" in config \u2014 using default branding`);
-    return defaultBranding;
+async function logSkillQueued(config2, skillId, pluginKey, skillFolder) {
+  if (!config2.enabled)
+    return;
+  try {
+    await appendEntry(config2, {
+      type: "skill_queued",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      skill_id: skillId,
+      plugin_key: pluginKey,
+      // Home-scrubbed folder path: aids forensics when the same skill id shows
+      // up under multiple plugins. Omitted when the caller has no path.
+      ...skillFolder ? { skill_folder: scrubHomePath(skillFolder) } : {}
+    });
+  } catch {
   }
-  return { ...entry, brand_key: brandKey };
 }
 
 // ../core/dist/cache.js
 init_config();
 init_file_utils();
 init_types2();
+
+// ../core/dist/url-utils.js
+init_file_utils();
+function normalizeUrl(raw) {
+  try {
+    const u = new URL(raw);
+    u.hash = "";
+    u.searchParams.sort();
+    return u.toString();
+  } catch {
+    return raw.toLowerCase();
+  }
+}
+
+// ../core/dist/cache.js
 var ONE_HOUR = 3600;
 var TWENTY_FOUR_HOURS = 86400;
-var FAR_FUTURE = "9999-12-31T23:59:59+00:00";
 var VerdictCache = class {
-  store = { urls: {}, commands: {}, packages: {} };
+  store = { urls: {}, packages: {} };
   path;
   config;
   logger;
@@ -14531,11 +14687,10 @@ var VerdictCache = class {
       const data = JSON.parse(raw);
       this.store = {
         urls: data.urls ?? {},
-        commands: data.commands ?? {},
         packages: data.packages ?? {}
       };
     } catch {
-      this.store = { urls: {}, commands: {}, packages: {} };
+      this.store = { urls: {}, packages: {} };
     }
   }
   getUrl(url) {
@@ -14567,31 +14722,6 @@ var VerdictCache = class {
       sageVersion: this.version
     };
   }
-  getCommand(commandHash) {
-    if (!this.config.enabled)
-      return null;
-    const entry = this.store.commands[commandHash];
-    if (!entry || this.isStale(entry))
-      return null;
-    return {
-      verdict: entry.verdict,
-      severity: entry.severity,
-      reasons: entry.reasons,
-      source: entry.source
-    };
-  }
-  putCommand(commandHash, verdict) {
-    if (!this.config.enabled)
-      return;
-    const { urlSignalLabels: _ignoredUrlLabels, ...rest } = verdict;
-    const now = /* @__PURE__ */ new Date();
-    this.store.commands[commandHash] = {
-      ...rest,
-      checkedAt: now.toISOString(),
-      expiresAt: FAR_FUTURE,
-      sageVersion: this.version
-    };
-  }
   getPackage(key) {
     if (!this.config.enabled)
       return null;
@@ -14602,7 +14732,9 @@ var VerdictCache = class {
       verdict: entry.verdict,
       severity: entry.severity,
       reasons: entry.reasons,
-      source: entry.source
+      source: entry.source,
+      ...entry.packageVerdict !== void 0 ? { packageVerdict: entry.packageVerdict } : {},
+      ...entry.packageConfidence !== void 0 ? { packageConfidence: entry.packageConfidence } : {}
     };
   }
   putPackage(key, verdict, packageAgeDays) {
@@ -14652,10 +14784,6 @@ var VerdictCache = class {
       if (this.isStale(entry))
         delete this.store.urls[key];
     }
-    for (const [key, entry] of Object.entries(this.store.commands)) {
-      if (this.isStale(entry))
-        delete this.store.commands[key];
-    }
     for (const [key, entry] of Object.entries(this.store.packages)) {
       if (this.isStale(entry))
         delete this.store.packages[key];
@@ -14947,6 +15075,7 @@ var PersistentPowershellAmsiBackend = class {
   invalidResultLogged = false;
   stdoutBuffer = "";
   pendingResponse = null;
+  scanQueue = Promise.resolve();
   constructor(logger) {
     this.logger = logger;
   }
@@ -14954,13 +15083,26 @@ var PersistentPowershellAmsiBackend = class {
     return this.available;
   }
   waitForLine(timeout) {
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       const timer = setTimeout(() => {
         this.pendingResponse = null;
         reject(new Error("timeout"));
       }, timeout);
-      this.pendingResponse = { resolve: resolve9, reject, timer };
+      this.pendingResponse = { resolve: resolve10, reject, timer };
+    });
+  }
+  async enqueueScan(operation) {
+    const previous = this.scanQueue;
+    let release;
+    this.scanQueue = new Promise((resolve10) => {
+      release = resolve10;
     });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
   }
   async init() {
     try {
@@ -15001,10 +15143,10 @@ var PersistentPowershellAmsiBackend = class {
           const line = this.stdoutBuffer.slice(0, idx).trim();
           this.stdoutBuffer = this.stdoutBuffer.slice(idx + 1);
           if (this.pendingResponse) {
-            const { resolve: resolve9, timer } = this.pendingResponse;
+            const { resolve: resolve10, timer } = this.pendingResponse;
             this.pendingResponse = null;
             clearTimeout(timer);
-            resolve9(line);
+            resolve10(line);
           }
           idx = this.stdoutBuffer.indexOf("\n");
         }
@@ -15034,29 +15176,35 @@ var PersistentPowershellAmsiBackend = class {
   async scanString(content, contentName) {
     if (!this.available || !this.process)
       return null;
-    const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
-    try {
-      const req = JSON.stringify({ content: truncated, contentName });
-      this.process.stdin?.write(`${req}
+    return this.enqueueScan(async () => {
+      const process2 = this.process;
+      if (!this.available || !process2)
+        return null;
+      const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
+      try {
+        const req = JSON.stringify({ content: truncated, contentName });
+        process2.stdin?.write(`${req}
 `);
-      const line = await this.waitForLine(PS_TIMEOUT);
-      const amsiResult = parseInt(line, 10);
-      if (Number.isNaN(amsiResult) || amsiResult < 0) {
-        if (!this.invalidResultLogged) {
-          this.invalidResultLogged = true;
-          this.logger.warn("AMSI: PowerShell scan returned invalid result", {
-            stdout: line.slice(0, 100),
-            contentName
-          });
+        const line = await this.waitForLine(PS_TIMEOUT);
+        const amsiResult = parseInt(line, 10);
+        if (Number.isNaN(amsiResult) || amsiResult < 0) {
+          if (!this.invalidResultLogged) {
+            this.invalidResultLogged = true;
+            this.logger.warn("AMSI: PowerShell scan returned invalid result", {
+              stdout: line.slice(0, 100),
+              contentName
+            });
+          }
+          return null;
         }
+        this.logger.debug("AMSI: PowerShell scan result", { contentName, amsiResult });
+        return interpretAmsiResult(amsiResult, content, contentName);
+      } catch (e) {
+        this.logger.warn("AMSI: PowerShell scan failed", { error: String(e), contentName });
+        this.close();
         return null;
       }
-      this.logger.debug("AMSI: PowerShell scan result", { contentName, amsiResult });
-      return interpretAmsiResult(amsiResult, content, contentName);
-    } catch (e) {
-      this.logger.warn("AMSI: PowerShell scan failed", { error: String(e), contentName });
-      return null;
-    }
+    });
   }
   close() {
     if (this.process) {
@@ -15097,7 +15245,7 @@ var WslPowershellAmsiBackend = class {
     if (!this.available)
       return null;
     const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
-    return new Promise((resolve9) => {
+    return new Promise((resolve10) => {
       try {
         const ps = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", PS_ONESHOT_SCRIPT], { stdio: ["pipe", "pipe", "pipe"] });
         let stdout = "";
@@ -15107,7 +15255,7 @@ var WslPowershellAmsiBackend = class {
             ps.kill();
           } catch {
           }
-          resolve9(null);
+          resolve10(null);
         }, PS_TIMEOUT);
         ps.stdout?.on("data", (chunk) => {
           stdout += chunk.toString();
@@ -15120,7 +15268,7 @@ var WslPowershellAmsiBackend = class {
         ps.on("error", (err) => {
           clearTimeout(timer);
           this.logger.debug("AMSI: PowerShell one-shot error", { error: String(err) });
-          resolve9(null);
+          resolve10(null);
         });
         ps.on("exit", () => {
           clearTimeout(timer);
@@ -15133,11 +15281,11 @@ var WslPowershellAmsiBackend = class {
                 contentName
               });
             }
-            resolve9(null);
+            resolve10(null);
             return;
           }
           this.logger.debug("AMSI: PowerShell one-shot result", { contentName, amsiResult });
-          resolve9(interpretAmsiResult(amsiResult, content, contentName));
+          resolve10(interpretAmsiResult(amsiResult, content, contentName));
         });
         const req = JSON.stringify({ content: truncated, contentName });
         ps.stdin?.write(`${req}
@@ -15145,7 +15293,7 @@ var WslPowershellAmsiBackend = class {
         ps.stdin?.end();
       } catch (e) {
         this.logger.warn("AMSI: PowerShell one-shot failed", { error: String(e), contentName });
-        resolve9(null);
+        resolve10(null);
       }
     });
   }
@@ -15291,7 +15439,7 @@ init_file_utils();
 var import_meta = {};
 function resolveVersion() {
   if (true)
-    return "0.10.0";
+    return "0.12.0";
   try {
     const pkgPath = (0, import_node_path5.join)((0, import_node_path5.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "..", "package.json");
     const pkg = JSON.parse(getFileContentSync(pkgPath));
@@ -15440,9 +15588,10 @@ var FileCheckClient = class {
 var import_node_fs = require("node:fs");
 var import_node_path6 = require("node:path");
 init_config();
-var MODEL_SCHEMA_VERSION = "v1";
+var MODEL_SCHEMA_VERSION = "v2";
 var REQUIRED_MODELS_BY_SCHEMA = {
-  v1: ["pi-model"]
+  v1: ["pi-model"],
+  v2: ["pi-model"]
 };
 var REQUIRED_MODEL_FILES = {
   "pi-model": [
@@ -15476,8 +15625,11 @@ function missingRequiredModels(schema = MODEL_SCHEMA_VERSION, sageDir) {
 init_types2();
 var STALE_LOCK_MS = 60 * 60 * 1e3;
 
+// ../core/dist/clients/model-manifest.js
+init_config();
+
 // ../core/dist/sage-proxy.js
-function mapSageProxyOs(platform) {
+function mapSageHostOs(platform) {
   switch (platform) {
     case "win32":
       return "WINDOWS";
@@ -15489,21 +15641,37 @@ function mapSageProxyOs(platform) {
       return platform;
   }
 }
-function mapSageProxyArchitecture(arch) {
+function mapSageHostArchitecture(arch) {
   return arch.toUpperCase();
 }
+function buildSageUserConfig(config2) {
+  return {
+    sensitivity: config2.sensitivity,
+    url_check_enabled: config2.url_check.enabled,
+    file_check_enabled: config2.file_check.enabled,
+    package_check_enabled: config2.package_check.enabled,
+    heuristics_enabled: config2.heuristics_enabled,
+    pi_check_enabled: config2.pi_check.enabled,
+    community_iq_enabled: config2.community_iq,
+    // Optional-chained + defaulted: real callers pass a loadConfig result (skill_check
+    // always present via the schema default), but this feeds fail-open telemetry, so a
+    // partial config must never crash the envelope build.
+    skill_check_upload_enabled: config2.skill_check?.upload_enabled ?? true
+  };
+}
 function buildSageProxyEnvelope(args) {
   return {
     identity: { uuid: args.iid },
     product: { version_app: args.versionApp },
     platform: {
-      os: args.platformOs ?? mapSageProxyOs(process.platform),
-      architecture: args.platformArchitecture ?? mapSageProxyArchitecture(process.arch)
+      os: args.platformOs ?? mapSageHostOs(process.platform),
+      architecture: args.platformArchitecture ?? mapSageHostArchitecture(process.arch)
     },
     agent: {
       agent_runtime: args.agentRuntime,
       agent_runtime_version: args.agentRuntimeVersion
-    }
+    },
+    ...args.config ? { config: buildSageUserConfig(args.config) } : {}
   };
 }
 
@@ -15937,6 +16105,8 @@ ${err.stack}` : String(err);
    */
   async classifyChunk(text) {
     const tok = this.tokenizer;
+    if (!tok)
+      throw new Error("PI tokenizer is not loaded");
     const encoded = tok.call(text, {
       truncation: true,
       max_length: MAX_TOKENS,
@@ -15969,6 +16139,8 @@ ${err.stack}` : String(err);
    */
   chunkText(text) {
     const tok = this.tokenizer;
+    if (!tok)
+      throw new Error("PI tokenizer is not loaded");
     const encoded = tok.tokenize(text, {
       addSpecialTokens: false,
       returnOffsetMapping: true,
@@ -15976,6 +16148,8 @@ ${err.stack}` : String(err);
     });
     const tokenIds = encoded.input_ids;
     const offsets = encoded.offset_mapping;
+    if (!offsets)
+      return [text];
     if (tokenIds.length <= MAX_TOKENS)
       return [text];
     const chunks = [];
@@ -16005,6 +16179,9 @@ ${content.slice(-tailLen)}`;
 // ../core/dist/index.js
 init_pi_deps_installer();
 
+// ../core/dist/clients/skill-analyze.js
+init_types2();
+
 // ../core/dist/clients/skill-check.js
 init_types2();
 var DEFAULT_TIMEOUT4 = 5;
@@ -16027,9 +16204,13 @@ var SkillCheckClient = class {
   /**
    * Check a list of skill IDs against the proxy.
    *
-   * Returns a Map keyed by skill id. A `null` value means the proxy had
-   * no opinion on that skill (analogous to a clean verdict). Skill ids
-   * not found in the response are simply absent from the map.
+   * Returns a Map keyed by skill id:
+   * - `null` — proxy had no opinion (explicit null in response, or skill absent
+   *   from an otherwise-successful response). Callers should treat this as
+   *   "unknown, queue for upload".
+   * - absent — the entire batch failed (HTTP error or network error). Callers
+   *   should fail open and skip the skill rather than enqueue it.
+   * - object — a verdict from the analyzer.
    *
    * Fails-open: on any error returns an empty Map. Per-batch errors do
    * not poison results from successful batches.
@@ -16073,8 +16254,10 @@ var SkillCheckClient = class {
       const data = await response.json();
       const results = data.results ?? {};
       for (const id of skillIds) {
-        if (!(id in results))
+        if (!(id in results)) {
+          out.set(id, null);
           continue;
+        }
         const raw = results[id];
         if (raw === null || raw === void 0) {
           out.set(id, null);
@@ -16089,17 +16272,10 @@ var SkillCheckClient = class {
     return out;
   }
   parseResult(skillId, raw) {
-    const recommendationsRaw = raw.recommendations ?? [];
-    const recommendations = recommendationsRaw.filter((r) => typeof r === "string");
-    const categoriesRaw = raw.threat_categories ?? [];
-    const threatCategories = categoriesRaw.filter((c) => typeof c === "string");
     return {
       skillId,
       verdict: typeof raw.verdict === "string" ? raw.verdict : void 0,
-      overallRiskLevel: typeof raw.overall_risk_level === "string" ? raw.overall_risk_level : void 0,
-      summary: typeof raw.summary === "string" ? raw.summary : void 0,
-      recommendations,
-      threatCategories
+      summary: typeof raw.summary === "string" ? raw.summary : void 0
     };
   }
 };
@@ -16107,6 +16283,70 @@ var SkillCheckClient = class {
 // ../core/dist/index.js
 init_config();
 
+// ../core/dist/config-defaults.js
+var import_promises3 = require("node:fs/promises");
+var import_node_path10 = require("node:path");
+init_file_utils();
+init_types2();
+var CONFIG_DEFAULTS_FILENAME = "config.default.json";
+var CONFIG_DEFAULTS_SCHEMA_VERSION = 1;
+function buildConfigDefaults() {
+  return {
+    schema_version: CONFIG_DEFAULTS_SCHEMA_VERSION,
+    ...ConfigSchema.parse({})
+  };
+}
+function serializeConfigDefaults() {
+  return `${JSON.stringify(buildConfigDefaults(), null, 2)}
+`;
+}
+function readSchemaVersion(raw) {
+  try {
+    const data = JSON.parse(raw);
+    if (typeof data !== "object" || data === null || Array.isArray(data))
+      return null;
+    const version = data.schema_version;
+    return typeof version === "number" && Number.isInteger(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+async function deployConfigDefaults(sageDirPath, logger = nullLogger) {
+  const targetPath = (0, import_node_path10.join)(sageDirPath, CONFIG_DEFAULTS_FILENAME);
+  const defaults = serializeConfigDefaults();
+  try {
+    await (0, import_promises3.mkdir)(sageDirPath, { recursive: true, mode: 448 });
+    await (0, import_promises3.chmod)(sageDirPath, 448);
+    let existing = null;
+    try {
+      existing = await (0, import_promises3.readFile)(targetPath, "utf-8");
+    } catch {
+    }
+    if (existing) {
+      const existingVersion = readSchemaVersion(existing);
+      if (existingVersion !== null && existingVersion > CONFIG_DEFAULTS_SCHEMA_VERSION) {
+        logger.warn("Deployed config defaults are newer, update your installation", {
+          path: targetPath,
+          existingVersion,
+          supportedVersion: CONFIG_DEFAULTS_SCHEMA_VERSION
+        });
+        return;
+      }
+      if (existing === defaults)
+        return;
+    }
+    await withFileLock(targetPath, async () => {
+      await (0, import_promises3.writeFile)(targetPath, defaults, { encoding: "utf-8", mode: 384 });
+      logger.debug("Deployed config defaults", {
+        path: targetPath,
+        schemaVersion: CONFIG_DEFAULTS_SCHEMA_VERSION
+      });
+    });
+  } catch (err) {
+    logger.debug("Failed to deploy config defaults", { path: targetPath, error: String(err) });
+  }
+}
+
 // ../core/dist/config-diagnostics.js
 init_config();
 init_file_utils();
@@ -16243,184 +16483,10 @@ function isScannableContent(content) {
   return SNIFF_HTML.test(head) || SNIFF_HTML_TAGS.test(head) || SNIFF_JSON.test(head) || SNIFF_XML.test(head) || SNIFF_YAML.test(head) || SNIFF_SHEBANG_SHELL.test(head) || SNIFF_SHEBANG_PYTHON.test(head) || SNIFF_PYTHON.test(head) || SNIFF_JS_TS.test(head) || SNIFF_C_CPP.test(head) || SNIFF_KOTLIN.test(head) || SNIFF_CSV.test(head);
 }
 
-// ../core/dist/content-snapshot.js
-var import_node_os2 = require("node:os");
-var CONTENT_FIELD_LIMITS = Object.freeze({
-  command: 512,
-  url: 512,
-  file_path: 512,
-  package_name: 256,
-  package_version: 128,
-  package_registry: 128
-});
-function safeTruncate(value, maxLen) {
-  if (maxLen <= 0)
-    return "";
-  if (value.length <= maxLen)
-    return value;
-  const cutIndex = maxLen;
-  const codeUnit = value.charCodeAt(cutIndex - 1);
-  if (codeUnit >= 55296 && codeUnit <= 56319) {
-    return value.slice(0, cutIndex - 1);
-  }
-  return value.slice(0, cutIndex);
-}
-function scrubHomePath(value) {
-  const home = (0, import_node_os2.homedir)();
-  if (!home)
-    return value;
-  const normalizedHome = home.replace(/\\/g, "/").replace(/\/+$/, "");
-  if (!normalizedHome)
-    return value;
-  const normalizedValue = value.replace(/\\/g, "/");
-  if (normalizedValue === normalizedHome)
-    return "~";
-  if (normalizedValue.startsWith(`${normalizedHome}/`)) {
-    return `~/${normalizedValue.slice(normalizedHome.length + 1)}`;
-  }
-  return value;
-}
-function asString(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function resolveFilePath(toolInput) {
-  return asString(toolInput.file_path) ?? asString(toolInput.filePath) ?? asString(toolInput.path);
-}
-function resolveWebFetchUrl(toolInput) {
-  const single = asString(toolInput.url);
-  if (single)
-    return single;
-  const urls = toolInput.urls;
-  if (Array.isArray(urls)) {
-    for (const u of urls) {
-      if (typeof u === "string" && u.length > 0)
-        return u;
-    }
-  }
-  return void 0;
-}
-function extractFirstApplyPatchPath(patchText) {
-  if (!patchText)
-    return void 0;
-  const headerMatch = /\*{3}\s+(?:Add|Update|Delete)\s+File:\s*(.+)/.exec(patchText);
-  if (headerMatch?.[1]) {
-    const trimmed = headerMatch[1].trim();
-    if (trimmed)
-      return trimmed;
-  }
-  const renameMatch = /\*{3}\s+(?:Move\s+to|Rename\s+File):\s*(.+)/i.exec(patchText);
-  if (renameMatch?.[1]) {
-    const raw = renameMatch[1].trim();
-    const arrow = raw.indexOf(" -> ");
-    if (arrow !== -1) {
-      const src = raw.slice(0, arrow).trim();
-      if (src)
-        return src;
-      const dst = raw.slice(arrow + 4).trim();
-      if (dst)
-        return dst;
-    } else if (raw) {
-      return raw;
-    }
-  }
-  return void 0;
-}
-function extractMcpContent(toolInput) {
-  const nestedRaw = toolInput.tool_input ?? toolInput.toolInput;
-  const candidate = nestedRaw && typeof nestedRaw === "object" && !Array.isArray(nestedRaw) ? nestedRaw : toolInput;
-  return {
-    command: asString(candidate.command),
-    url: asString(candidate.url) ?? resolveWebFetchUrl(candidate),
-    file_path: resolveFilePath(candidate)
-  };
-}
-function firstUrlArtifact(artifacts) {
-  for (const a of artifacts) {
-    if (a.type === "url" && typeof a.value === "string" && a.value.length > 0) {
-      return a.value;
-    }
-  }
-  return void 0;
-}
-function applyFieldLimits(content) {
-  for (const [key, value] of Object.entries(content)) {
-    if (typeof value !== "string")
-      continue;
-    let sanitized = value;
-    if (key === "file_path" || key === "command") {
-      sanitized = scrubHomePath(sanitized);
-    }
-    const limit = CONTENT_FIELD_LIMITS[key];
-    if (limit && sanitized.length > limit) {
-      sanitized = safeTruncate(sanitized, limit);
-    }
-    content[key] = sanitized;
-  }
-}
-function buildContentSnapshot(toolType, toolInput, artifacts = [], signals = {}) {
-  const content = {};
-  switch (toolType) {
-    case "Bash": {
-      const command = asString(toolInput.command);
-      if (command)
-        content.command = command;
-      break;
-    }
-    case "WebFetch": {
-      const url = resolveWebFetchUrl(toolInput) ?? firstUrlArtifact(artifacts);
-      if (url)
-        content.url = url;
-      break;
-    }
-    case "Write":
-    case "Edit":
-    case "Read":
-    case "Delete": {
-      const filePath = resolveFilePath(toolInput);
-      if (filePath)
-        content.file_path = filePath;
-      break;
-    }
-    case "ApplyPatch": {
-      const patchText = asString(toolInput.input) ?? asString(toolInput.patch) ?? "";
-      const filePath = extractFirstApplyPatchPath(patchText);
-      if (filePath)
-        content.file_path = filePath;
-      break;
-    }
-    case "MCP": {
-      const mcp = extractMcpContent(toolInput);
-      if (mcp.command)
-        content.command = mcp.command;
-      if (mcp.url)
-        content.url = mcp.url;
-      if (mcp.file_path)
-        content.file_path = mcp.file_path;
-      break;
-    }
-  }
-  if (!content.url && signals.url_checks && signals.url_checks.length > 0) {
-    const firstUrl = signals.url_checks[0]?.url;
-    if (firstUrl)
-      content.url = firstUrl;
-  }
-  if (signals.package_checks && signals.package_checks.length > 0) {
-    const p = signals.package_checks[0];
-    if (p?.package_name)
-      content.package_name = p.package_name;
-    if (p?.package_version)
-      content.package_version = p.package_version;
-    if (p?.package_registry)
-      content.package_registry = p.package_registry;
-  }
-  applyFieldLimits(content);
-  return content;
-}
-
 // ../core/dist/extended-info.js
-var import_promises3 = require("node:fs/promises");
+var import_promises4 = require("node:fs/promises");
 var import_node_os3 = require("node:os");
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 init_file_utils();
 init_types2();
 var EXTENDED_INFO_FILE_MAX_BYTES = 1024;
@@ -16486,8 +16552,8 @@ function sanitizeDocument(parsed, logger) {
   return out;
 }
 async function loadExtendedInfo(sageDirPath, logger = nullLogger) {
-  const sageDir = sageDirPath ?? (0, import_node_path10.join)((0, import_node_os3.homedir)(), ".sage");
-  const filePath = (0, import_node_path10.join)(sageDir, EXTENDED_INFO_FILENAME);
+  const sageDir = sageDirPath ?? (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".sage");
+  const filePath = (0, import_node_path11.join)(sageDir, EXTENDED_INFO_FILENAME);
   const cached = cache.get(filePath);
   if (cached)
     return cached.value;
@@ -16498,7 +16564,7 @@ async function loadExtendedInfo(sageDirPath, logger = nullLogger) {
 async function loadExtendedInfoUncached(filePath, logger) {
   let size;
   try {
-    const info = await (0, import_promises3.stat)(filePath);
+    const info = await (0, import_promises4.stat)(filePath);
     if (!info.isFile()) {
       logger.debug(`extended-info: not a regular file at ${filePath}`);
       return null;
@@ -16585,14 +16651,14 @@ function mergeExtendedInfo(envelope, extendedInfo) {
 }
 
 // ../core/dist/installation-id.js
-var import_node_crypto5 = require("node:crypto");
-var import_promises4 = require("node:fs/promises");
-var import_node_path11 = require("node:path");
+var import_node_crypto4 = require("node:crypto");
+var import_promises5 = require("node:fs/promises");
+var import_node_path12 = require("node:path");
 init_config();
 init_file_utils();
 async function getInstallationId(sageDirPath) {
   const sageDir = sageDirPath ?? resolvePath("~/.sage");
-  const idPath = (0, import_node_path11.join)(sageDir, "installation-id");
+  const idPath = (0, import_node_path12.join)(sageDir, "installation-id");
   let fileExists = false;
   try {
     const existing = await getFileContent(idPath, "utf-8");
@@ -16603,9 +16669,9 @@ async function getInstallationId(sageDirPath) {
   } catch {
   }
   try {
-    const id = (0, import_node_crypto5.randomUUID)();
-    await (0, import_promises4.mkdir)(sageDir, { recursive: true, mode: 448 });
-    await (0, import_promises4.writeFile)(idPath, id, { encoding: "utf-8", mode: 384, flag: fileExists ? "w" : "wx" });
+    const id = (0, import_node_crypto4.randomUUID)();
+    await (0, import_promises5.mkdir)(sageDir, { recursive: true, mode: 448 });
+    await (0, import_promises5.writeFile)(idPath, id, { encoding: "utf-8", mode: 384, flag: fileExists ? "w" : "wx" });
     return id;
   } catch (err) {
     if (err.code === "EEXIST") {
@@ -16634,10 +16700,10 @@ function resolveTimeoutMs() {
   const ms = Math.floor(parsed * 1e3);
   return Math.min(ms, MAX_EFFECTIVE_TIMEOUT_MS);
 }
-async function sendCommunityIqDetection(args) {
+async function sendCommunityIqTelemetry(args) {
   const logger = args.logger ?? nullLogger;
   if (!args.communityIqEnabled) {
-    logger.debug("Community IQ disabled, skipping detection telemetry");
+    logger.debug("Community IQ disabled, skipping telemetry");
     return;
   }
   let iid;
@@ -16646,15 +16712,17 @@ async function sendCommunityIqDetection(args) {
   } catch {
   }
   if (!iid) {
-    logger.debug("Skipping detection telemetry: missing installation id");
+    logger.debug("Skipping telemetry: missing installation id");
     return;
   }
   const envelope = buildSageProxyEnvelope({
     iid,
     versionApp: VERSION,
     agentRuntime: args.agentRuntime ?? "unknown",
-    agentRuntimeVersion: args.agentRuntimeVersion ?? process.env.SAGE_AGENT_RUNTIME_VERSION ?? "unknown"
+    agentRuntimeVersion: args.agentRuntimeVersion ?? process.env.SAGE_AGENT_RUNTIME_VERSION ?? "unknown",
+    config: args.config
   });
+  const blocking = args.blocking ?? true;
   const payload = {
     ...envelope,
     block_event: {
@@ -16663,8 +16731,8 @@ async function sendCommunityIqDetection(args) {
       // canonicalize before calling `evaluateToolCall`, so no further
       // mapping is needed here.
       tool_type: args.toolName,
-      verdict: "deny",
-      user_action: "blocked",
+      verdict: blocking ? "deny" : "suspicious",
+      ...blocking ? { user_action: "blocked" } : {},
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       ...args.signals && Object.keys(args.signals).length > 0 ? { signals: args.signals } : {},
       content: args.content ?? {}
@@ -16675,20 +16743,21 @@ async function sendCommunityIqDetection(args) {
   const extendedInfo = await loadExtendedInfo(void 0, logger).catch(() => null);
   const enriched = mergeExtendedInfo(payload, extendedInfo);
   const timeoutMs = resolveTimeoutMs();
+  const endpoint = blocking ? "/v2/detection" : "/v2/heuristic";
   try {
-    const response = await fetch(resolveEndpoint("/v2/detection"), {
+    const response = await fetch(resolveEndpoint(endpoint), {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(enriched),
       signal: AbortSignal.timeout(timeoutMs)
     });
     if (!response.ok) {
-      logger.warn("Detection telemetry send failed", {
+      logger.warn("Community IQ telemetry send failed", {
         eventId: args.eventId,
         status: response.status
       });
     } else {
-      logger.debug("Detection telemetry sent", {
+      logger.debug("Community IQ telemetry sent", {
         eventId: args.eventId,
         toolName: args.toolName,
         hookType: args.hookType ?? "PreToolUse"
@@ -16702,30 +16771,50 @@ async function sendCommunityIqDetection(args) {
   }
 }
 
-// ../core/dist/engine.js
+// ../core/dist/e2e-capture.js
+var import_node_path13 = require("node:path");
+var CAPTURE_MAX_BYTES = 10 * 1024 * 1024;
+var CAPTURE_MAX_FILES = 2;
+function captureEnabled() {
+  return !!process.env.SAGE_E2E_CAPTURE_DIR;
+}
+async function captureHookInput(event, raw, normalized, options = {}) {
+  const dir = process.env.SAGE_E2E_CAPTURE_DIR;
+  if (!dir)
+    return;
+  try {
+    const prefix = options.filePrefix ?? "";
+    const base = event === "PreToolUse" ? "pre-tool-use.jsonl" : "post-tool-use.jsonl";
+    await appendJsonlEntry({
+      path: (0, import_node_path13.join)(dir, `${prefix}${base}`),
+      max_bytes: CAPTURE_MAX_BYTES,
+      max_files: CAPTURE_MAX_FILES
+    }, { event, raw, normalized });
+  } catch {
+  }
+}
+
+// ../core/dist/policy.js
 init_types2();
-var CONFIDENCE_THRESHOLD = 0.85;
-var SENSITIVITY_THRESHOLDS = {
-  paranoid: 0.7,
-  balanced: 0.85,
-  relaxed: 0.95
-};
-var SEVERITY_MAP = {
-  critical: "critical",
-  high: "warning",
-  medium: "warning",
-  low: "info"
-};
-var ACTION_MAP = {
-  block: "deny",
-  require_approval: "ask",
-  log: "allow"
-};
-var DECISION_PRIORITY = {
-  allow: 0,
-  ask: 1,
-  deny: 2
+var SENSITIVITY_POLICY = {
+  paranoid: { denyThreshold: 0.7, askThreshold: 0.3 },
+  balanced: { denyThreshold: 0.85, askThreshold: 0.5 },
+  relaxed: { denyThreshold: 0.95, askThreshold: 0.7 }
 };
+function applyPolicy(confidence, denyThreshold, askThreshold, logger = nullLogger) {
+  if (!Number.isFinite(confidence) || confidence <= 0 || confidence > 1) {
+    logger.warn("Invalid confidence; treating as allow", { confidence });
+    return "allow";
+  }
+  if (confidence >= denyThreshold)
+    return "deny";
+  if (confidence >= askThreshold)
+    return "ask";
+  return "allow";
+}
+
+// ../core/dist/engine.js
+init_types2();
 var PI_LABEL_ONLY_SUFFIXES = /* @__PURE__ */ new Set([
   "command",
   "stdout",
@@ -16756,29 +16845,25 @@ function formatPiFinding(result) {
   return `${where} (${score})`;
 }
 var DecisionEngine = class {
-  threshold;
-  sensitivity;
-  constructor(sensitivity = "balanced") {
-    this.threshold = SENSITIVITY_THRESHOLDS[sensitivity] ?? CONFIDENCE_THRESHOLD;
-    this.sensitivity = sensitivity;
+  denyThreshold;
+  askThreshold;
+  logger;
+  constructor(sensitivity = "balanced", logger = nullLogger) {
+    const policy = SENSITIVITY_POLICY[sensitivity] ?? SENSITIVITY_POLICY.balanced;
+    this.denyThreshold = policy.denyThreshold;
+    this.askThreshold = policy.askThreshold;
+    this.logger = logger;
   }
   async decide(sources) {
     const signals = this.collectSignals(sources.heuristicMatches, sources.urlCheckResults, sources.packageCheckResults, sources.amsiCheckResults, sources.piCheckResults, sources.piThresholds);
     if (signals.length === 0) {
       return this.allowVerdict();
     }
-    signals.sort((a, b) => (DECISION_PRIORITY[b.decision] ?? 0) - (DECISION_PRIORITY[a.decision] ?? 0));
-    const top = signals[0];
-    if (!top) {
-      return this.allowVerdict();
-    }
+    const top = signals.reduce((best, s) => s.confidence > best.confidence ? s : best);
+    const maxConfidence = top.confidence;
+    const decision = applyPolicy(maxConfidence, this.denyThreshold, this.askThreshold, this.logger);
     const allArtifacts = [...new Map(signals.map((s) => [s.artifact, s.artifact])).values()];
     const allReasons = [...new Map(signals.map((s) => [s.reason, s.reason])).values()];
-    const maxConfidence = Math.max(...signals.map((s) => s.confidence));
-    let decision = top.decision;
-    if (decision === "deny" && maxConfidence < this.threshold && top.source !== "pi_check") {
-      decision = "ask";
-    }
     return {
       decision,
       category: top.category,
@@ -16793,24 +16878,26 @@ var DecisionEngine = class {
   collectSignals(heuristicMatches, urlCheckResults, packageCheckResults, amsiCheckResults, piCheckResults, piThresholds) {
     const signals = [];
     for (const match of heuristicMatches) {
+      const { confidence, category, severity, id, title } = match.threat;
+      if (applyPolicy(confidence, this.denyThreshold, this.askThreshold, this.logger) === "allow")
+        continue;
       signals.push({
-        decision: ACTION_MAP[match.threat.action] ?? "ask",
-        category: match.threat.category,
-        confidence: match.threat.confidence,
-        severity: SEVERITY_MAP[match.threat.severity] ?? "warning",
+        category,
+        confidence,
+        severity,
         source: "heuristic",
-        threatId: match.threat.id,
-        reason: match.threat.title,
+        threatId: id,
+        reason: title,
         artifact: match.artifact
       });
     }
     for (const result of urlCheckResults) {
       if (result.isMalicious) {
+        const confidence = 1;
         const findingDetails = result.findings.map((f) => `${f.severityName}/${f.typeName}`).join(", ");
         signals.push({
-          decision: "deny",
           category: "network_egress",
-          confidence: 1,
+          confidence,
           severity: "critical",
           source: "url_check",
           threatId: null,
@@ -16832,7 +16919,6 @@ var DecisionEngine = class {
       for (const result of amsiCheckResults) {
         if (result.isDetected) {
           signals.push({
-            decision: "deny",
             category: "malware",
             confidence: 1,
             severity: "critical",
@@ -16843,7 +16929,6 @@ var DecisionEngine = class {
           });
         } else if (result.isBlockedByAdmin) {
           signals.push({
-            decision: "deny",
             category: "malware",
             confidence: 0.9,
             severity: "critical",
@@ -16858,24 +16943,21 @@ var DecisionEngine = class {
     if (piCheckResults) {
       const highRisk = piThresholds?.highRisk ?? DEFAULT_PI_HIGH_RISK_THRESHOLD;
       const mediumRisk = piThresholds?.mediumRisk ?? DEFAULT_PI_MEDIUM_RISK_THRESHOLD;
-      const suppressMediumPi = this.sensitivity === "relaxed";
       for (const result of piCheckResults) {
         if (result.risk >= highRisk) {
           signals.push({
-            decision: "deny",
             category: "prompt_injection",
-            confidence: result.risk,
+            confidence: 1,
             severity: "critical",
             source: "pi_check",
             threatId: "PROMPT_INJECTION",
             reason: buildPiReason("Prompt injection detected", result),
             artifact: result.contentName
           });
-        } else if (!suppressMediumPi && result.risk >= mediumRisk) {
+        } else if (result.risk >= mediumRisk) {
           signals.push({
-            decision: "ask",
             category: "prompt_injection",
-            confidence: result.risk,
+            confidence: 0.6,
             severity: "warning",
             source: "pi_check",
             threatId: "PROMPT_INJECTION",
@@ -16890,21 +16972,10 @@ var DecisionEngine = class {
   packageVerdictToSignal(pkg) {
     switch (pkg.verdict) {
       case "not_found":
-        return {
-          decision: "deny",
-          category: "supply_chain",
-          confidence: 0.95,
-          severity: "critical",
-          source: "package_check",
-          threatId: null,
-          reason: pkg.details,
-          artifact: pkg.packageName
-        };
       case "malicious":
         return {
-          decision: "deny",
           category: "supply_chain",
-          confidence: 1,
+          confidence: pkg.confidence,
           severity: "critical",
           source: "package_check",
           threatId: null,
@@ -16912,21 +16983,10 @@ var DecisionEngine = class {
           artifact: pkg.packageName
         };
       case "suspicious_age":
-        return {
-          decision: "ask",
-          category: "supply_chain",
-          confidence: 0.75,
-          severity: "warning",
-          source: "package_check",
-          threatId: null,
-          reason: pkg.details,
-          artifact: pkg.packageName
-        };
       case "unknown":
         return {
-          decision: "ask",
           category: "supply_chain",
-          confidence: 0.6,
+          confidence: pkg.confidence,
           severity: "warning",
           source: "package_check",
           threatId: null,
@@ -16941,7 +17001,7 @@ var DecisionEngine = class {
     return {
       decision: "allow",
       category: "none",
-      confidence: 1,
+      confidence: 0,
       severity: "info",
       source: "none",
       artifacts: [],
@@ -16952,32 +17012,32 @@ var DecisionEngine = class {
 };
 
 // ../core/dist/evaluator.js
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 init_config();
 
 // ../core/dist/exceptions.js
-var import_node_crypto6 = require("node:crypto");
-var import_node_path13 = require("node:path");
+var import_node_crypto5 = require("node:crypto");
+var import_node_path15 = require("node:path");
 init_config();
 init_file_utils();
 
 // ../core/dist/trusted-domains.js
-var import_promises5 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
+var import_promises6 = require("node:fs/promises");
+var import_node_path14 = require("node:path");
 var import_yaml = __toESM(require_dist(), 1);
 init_file_utils();
 init_types2();
-async function loadTrustedDomains(allowlistsDir, logger = nullLogger) {
+async function loadTrustedDomains(trustedDomainsDir, logger = nullLogger) {
   let files;
   try {
-    files = (await (0, import_promises5.readdir)(allowlistsDir)).filter((f) => f.endsWith(".yaml")).sort();
+    files = (await (0, import_promises6.readdir)(trustedDomainsDir)).filter((f) => f.endsWith(".yaml")).sort();
   } catch {
-    logger.debug("Allowlists directory does not exist", { path: allowlistsDir });
+    logger.debug("Trusted domains directory does not exist", { path: trustedDomainsDir });
     return [];
   }
   const domains = [];
   for (const filename of files) {
-    const filePath = (0, import_node_path12.join)(allowlistsDir, filename);
+    const filePath = (0, import_node_path14.join)(trustedDomainsDir, filename);
     let content;
     try {
       content = await getFileContent(filePath);
@@ -17015,7 +17075,7 @@ async function loadTrustedDomains(allowlistsDir, logger = nullLogger) {
       domains.push({ domain: domain.toLowerCase(), reason });
     }
   }
-  logger.debug(`Loaded ${domains.length} trusted domains from ${allowlistsDir}`);
+  logger.debug(`Loaded ${domains.length} trusted domains from ${trustedDomainsDir}`);
   return domains;
 }
 function extractDomain(url) {
@@ -17042,7 +17102,7 @@ init_types2();
 var MAX_RULES_WARNING = 100;
 var REGEX_TIMEOUT_MS = 50;
 function computeRuleId(decision, match, pattern) {
-  const hash = (0, import_node_crypto6.createHash)("sha256").update(`${decision}:${match}:${pattern}`).digest("hex");
+  const hash = (0, import_node_crypto5.createHash)("sha256").update(`${decision}:${match}:${pattern}`).digest("hex");
   return hash.slice(0, 8);
 }
 async function loadExceptions(config2, logger = nullLogger) {
@@ -17253,7 +17313,7 @@ function matchesDomain(pattern, url) {
 function normalizePatternPath(pattern) {
   const home = getHomeDir();
   const expanded = pattern.startsWith("~/") || pattern === "~" ? `${home}${pattern.slice(1)}` : pattern;
-  return (0, import_node_path13.normalize)(expanded);
+  return (0, import_node_path15.normalize)(expanded);
 }
 function matchesPath(pattern, filePath) {
   const hasWildcard = pattern.includes("*");
@@ -17264,7 +17324,7 @@ function matchesPath(pattern, filePath) {
   const normalizedPath = normalizePatternPath(filePath);
   if (normalizedPath === normalizedPattern)
     return true;
-  if (normalizedPath.startsWith(normalizedPattern + import_node_path13.sep))
+  if (normalizedPath.startsWith(normalizedPattern + import_node_path15.sep))
     return true;
   return false;
 }
@@ -17620,7 +17680,7 @@ var PackageChecker = class {
         packageName: pkg.name,
         registry: pkg.registry,
         verdict: "not_found",
-        confidence: 0.9,
+        confidence: 0.95,
         details: `Package '${pkg.name}@${pkg.version}' version not found on ${pkg.registry} (hallucinated or unpublished)`
       };
     }
@@ -17653,7 +17713,7 @@ var PackageChecker = class {
         packageName: pkg.name,
         registry: pkg.registry,
         verdict: "suspicious_age",
-        confidence: 0.75,
+        confidence: 0.6,
         details: `Package '${pkg.name}' first published ${Math.floor(ageDays)} days ago (suspicious age)`,
         ageDays
       };
@@ -18044,7 +18104,7 @@ function extractFromRequirementsTxt(content) {
 }
 
 // ../core/dist/statusline.js
-var import_node_path14 = require("node:path");
+var import_node_path16 = require("node:path");
 init_config();
 init_file_utils();
 var STATUS_PREFIX = "statusline-";
@@ -18053,15 +18113,17 @@ function sanitizeSessionId(sessionId) {
   return sessionId.replace(/[^a-zA-Z0-9-]/g, "_");
 }
 function statusFilePath(sessionId) {
-  return (0, import_node_path14.join)(resolvePath(SAGE_DIR), `${STATUS_PREFIX}${sanitizeSessionId(sessionId)}${STATUS_SUFFIX}`);
+  return (0, import_node_path16.join)(resolvePath(SAGE_DIR), `${STATUS_PREFIX}${sanitizeSessionId(sessionId)}${STATUS_SUFFIX}`);
 }
 function emptyStatus() {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
   return {
     denied: 0,
     flagged: 0,
     lastCategory: null,
     lastReason: null,
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    updatedAt: now,
+    startedAt: now
   };
 }
 async function readStatus(sessionId) {
@@ -18086,8 +18148,8 @@ async function updateSessionStatus(sessionId, verdict) {
 }
 
 // ../core/dist/threat-loader.js
-var import_promises6 = require("node:fs/promises");
-var import_node_path15 = require("node:path");
+var import_promises7 = require("node:fs/promises");
+var import_node_path17 = require("node:path");
 var import_yaml2 = __toESM(require_dist(), 1);
 init_file_utils();
 init_types2();
@@ -18096,7 +18158,6 @@ var REQUIRED_FIELDS = /* @__PURE__ */ new Set([
   "category",
   "severity",
   "confidence",
-  "action",
   "pattern",
   "match_on",
   "title"
@@ -18121,13 +18182,13 @@ async function loadThreats(threatDir, logger = nullLogger) {
   const threats = [];
   let files;
   try {
-    files = (await (0, import_promises6.readdir)(threatDir)).filter((f) => f.endsWith(".yaml")).sort();
+    files = (await (0, import_promises7.readdir)(threatDir)).filter((f) => f.endsWith(".yaml")).sort();
   } catch {
     logger.warn("Threat directory does not exist or is unreadable", { path: threatDir });
     return threats;
   }
   for (const filename of files) {
-    const filePath = (0, import_node_path15.join)(threatDir, filename);
+    const filePath = (0, import_node_path17.join)(threatDir, filename);
     let content;
     try {
       content = await getFileContent(filePath);
@@ -18164,8 +18225,8 @@ async function loadThreats(threatDir, logger = nullLogger) {
         continue;
       let compiledPattern;
       try {
-        const flags = record.case_insensitive === true ? "i" : "";
-        compiledPattern = new RegExp(record.pattern, flags);
+        const flags2 = record.case_insensitive === true ? "i" : "";
+        compiledPattern = new RegExp(record.pattern, flags2);
       } catch (e) {
         logger.warn(`Skipping threat ${record.id}: invalid regex pattern`, {
           error: String(e)
@@ -18174,19 +18235,28 @@ async function loadThreats(threatDir, logger = nullLogger) {
       }
       const rawMatchOn = record.match_on;
       const matchOn = new Set(Array.isArray(rawMatchOn) ? rawMatchOn : [rawMatchOn]);
+      const rawFlags = record.flags;
+      const flags = Array.isArray(rawFlags) ? rawFlags : [];
+      const confidence = Number(record.confidence);
+      if (!Number.isFinite(confidence) || confidence <= 0 || confidence > 1) {
+        logger.warn(`Skipping threat ${record.id}: invalid confidence value`, {
+          confidence: record.confidence
+        });
+        continue;
+      }
       threats.push({
         id: record.id,
         version: typeof record.version === "number" ? record.version : void 0,
         category: record.category,
         severity: record.severity,
-        confidence: Number(record.confidence),
-        action: record.action,
+        confidence,
         pattern: record.pattern,
         compiledPattern,
         matchOn,
         title: record.title,
         expiresAt: parseExpiresAt(record.expires_at),
-        revoked: false
+        revoked: false,
+        flags
       });
     }
   }
@@ -18226,7 +18296,7 @@ function allowVerdict(source = "none") {
   return {
     decision: "allow",
     category: "none",
-    confidence: 1,
+    confidence: 0,
     severity: "info",
     source,
     artifacts: [],
@@ -18234,6 +18304,11 @@ function allowVerdict(source = "none") {
     reasons: []
   };
 }
+async function resolveEvaluationConfig(context, logger) {
+  if (context.config)
+    return context.config;
+  return loadConfig(context.configPath, logger).catch(() => ConfigSchema.parse({}));
+}
 function shouldSkipPromptInjectionForLocalMarkdown(request) {
   if (request.toolName !== "Write" && request.toolName !== "Edit")
     return false;
@@ -18243,8 +18318,8 @@ function shouldSkipPromptInjectionForLocalMarkdown(request) {
 }
 async function evaluateToolCall(request, context) {
   const logger = context.logger ?? nullLogger;
-  const config2 = await loadConfig(context.configPath, logger).catch(() => ConfigSchema.parse({}));
-  const eventId = (0, import_node_crypto7.randomUUID)();
+  const config2 = await resolveEvaluationConfig(context, logger);
+  const eventId = (0, import_node_crypto6.randomUUID)();
   logger.debug("Tool call evaluation started", {
     eventId,
     toolUseId: request.toolUseId,
@@ -18305,27 +18380,6 @@ async function evaluateToolCall(request, context) {
       logEvaluationCompleted(verdict2);
       return verdict2;
     }
-    try {
-      const allowlist = await loadAllowlist(config2.allowlist, logger);
-      if (isAllowlisted(allowlist, request.artifacts)) {
-        const allowV = allowVerdict("allowlisted");
-        await logVerdict(config2.logging, {
-          sessionId: request.sessionId,
-          toolName: request.toolName,
-          toolInput: request.toolInput,
-          verdict: allowV,
-          userOverride: true,
-          conversationId: request.conversationId,
-          agentRuntime: request.agentRuntime,
-          hookType: request.hookType,
-          eventId,
-          toolUseId: request.toolUseId
-        });
-        logEvaluationCompleted(allowV);
-        return allowV;
-      }
-    } catch {
-    }
     const allowMatch = findAllowException(exceptions, request.artifacts);
     if (allowMatch) {
       const allowV = allowVerdict("exception");
@@ -18348,7 +18402,7 @@ async function evaluateToolCall(request, context) {
       return allowV;
     }
   } catch (error) {
-    logger.debug("Exception/allowlist checks failed open", { error: String(error) });
+    logger.debug("Exception checks failed open", { error: String(error) });
   }
   let cache2 = null;
   try {
@@ -18370,7 +18424,7 @@ async function evaluateToolCall(request, context) {
     if (shouldSkipPromptInjectionForLocalMarkdown(request)) {
       threats = threats.filter((t) => t.category !== "prompt_injection");
     }
-    const trustedDomains = await loadTrustedDomains(context.allowlistsDir, logger);
+    const trustedDomains = await loadTrustedDomains(context.trustedDomainsDir, logger);
     const heuristics = new HeuristicsEngine(threats, trustedDomains);
     heuristicMatches = heuristics.match(request.artifacts);
   }
@@ -18387,10 +18441,19 @@ async function evaluateToolCall(request, context) {
   const amsiCheckResults = [];
   if (config2.amsi_check.enabled && isAmsiSupported()) {
     let amsiClient = null;
+    let amsiLease = null;
+    let ownsAmsiClient = false;
     try {
-      amsiClient = new AmsiClient(logger);
-      await amsiClient.init();
-      if (amsiClient.isAvailable) {
+      if (context.acquireAmsiClientLease) {
+        amsiLease = await context.acquireAmsiClientLease(logger);
+        amsiClient = amsiLease?.client ?? null;
+      } else {
+        amsiClient = new AmsiClient(logger);
+        ownsAmsiClient = true;
+        await amsiClient.init();
+      }
+      if (amsiClient?.isAvailable) {
+        const activeAmsiClient = amsiClient;
         const scans = [];
         if (request.toolName === "Bash") {
           const command = request.toolInput.command ?? "";
@@ -18421,7 +18484,7 @@ async function evaluateToolCall(request, context) {
           }
         }
         for (const scan of scans) {
-          const result = await amsiClient.scanString(scan.scanType, scan.name, scan.content);
+          const result = await activeAmsiClient.scanString(scan.scanType, scan.name, scan.content);
           if (result) {
             amsiCheckResults.push(result);
           }
@@ -18429,16 +18492,26 @@ async function evaluateToolCall(request, context) {
       }
     } catch {
     } finally {
-      amsiClient?.close();
+      try {
+        if (amsiLease) {
+          await amsiLease.release();
+        } else if (ownsAmsiClient) {
+          amsiClient?.close();
+        }
+      } catch {
+      }
     }
   }
+  const engine = new DecisionEngine(config2.sensitivity, logger);
+  const preliminaryVerdict = await engine.decide({
+    heuristicMatches,
+    urlCheckResults,
+    packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
+    amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0
+  });
   const allPiResults = [];
-  const piDenySignals = [];
-  const heuristicPiDeny = heuristicMatches.some((m) => m.threat.action === "block" && m.threat.category === "prompt_injection");
-  const heuristicDeny = heuristicMatches.some((m) => m.threat.action === "block");
-  const urlAlreadyDenied = cachedUrlVerdicts.size > 0 && [...cachedUrlVerdicts.values()].some((v) => v.verdict !== "allow");
-  const urlCheckDenied = urlCheckResults.some((r) => r.isMalicious);
-  if (config2.pi_check.enabled && !heuristicPiDeny && !heuristicDeny && !urlAlreadyDenied && !urlCheckDenied && request.toolName === "WebFetch") {
+  const alreadyDenied = preliminaryVerdict.decision === "deny" || cachedUrlVerdicts.size > 0 && [...cachedUrlVerdicts.values()].some((v) => v.verdict === "deny");
+  if (config2.pi_check.enabled && !alreadyDenied && request.toolName === "WebFetch") {
     try {
       const url = extractWebFetchUrl(request.toolInput);
       if (url) {
@@ -18454,9 +18527,6 @@ async function evaluateToolCall(request, context) {
               const result = await provider.checkContent(fetched.content, `WebFetch:${url}`);
               if (result) {
                 allPiResults.push(result);
-                if (result.risk >= config2.pi_check.high_risk_threshold) {
-                  piDenySignals.push(result);
-                }
               }
             }
           }
@@ -18465,34 +18535,41 @@ async function evaluateToolCall(request, context) {
     } catch {
     }
   }
-  const engine = new DecisionEngine(config2.sensitivity);
-  let verdict = await engine.decide({
-    heuristicMatches,
-    urlCheckResults,
-    packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
-    amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0,
-    piCheckResults: piDenySignals.length > 0 ? piDenySignals : void 0,
-    piThresholds: {
-      highRisk: config2.pi_check.high_risk_threshold,
-      mediumRisk: config2.pi_check.medium_risk_threshold
-    }
-  });
-  if (cachedUrlVerdicts.size > 0 && verdict.decision === "allow") {
+  let verdict;
+  if (allPiResults.length > 0) {
+    verdict = await engine.decide({
+      heuristicMatches,
+      urlCheckResults,
+      packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
+      amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0,
+      piCheckResults: allPiResults,
+      piThresholds: {
+        highRisk: DEFAULT_PI_HIGH_RISK_THRESHOLD,
+        mediumRisk: DEFAULT_PI_MEDIUM_RISK_THRESHOLD
+      }
+    });
+  } else {
+    verdict = preliminaryVerdict;
+  }
+  if (cachedUrlVerdicts.size > 0 && verdict.decision !== "deny") {
     for (const [url, cachedVerdict] of cachedUrlVerdicts) {
       if (cachedVerdict.verdict === "allow") {
         continue;
       }
-      verdict = {
-        decision: cachedVerdict.verdict,
-        category: "network_egress",
-        confidence: 1,
-        severity: cachedVerdict.severity,
-        source: `cache(${cachedVerdict.source})`,
-        artifacts: [url],
-        matchedThreatId: null,
-        reasons: cachedVerdict.reasons
-      };
-      break;
+      if (cachedVerdict.verdict === "deny" || verdict.decision === "allow") {
+        verdict = {
+          decision: cachedVerdict.verdict,
+          category: "network_egress",
+          confidence: 1,
+          severity: cachedVerdict.severity,
+          source: `cache(${cachedVerdict.source})`,
+          artifacts: [url],
+          matchedThreatId: null,
+          reasons: cachedVerdict.reasons
+        };
+        if (verdict.decision === "deny")
+          break;
+      }
     }
   }
   await cacheUrlResults(urlCheckResults, cache2);
@@ -18559,7 +18636,7 @@ async function evaluateToolCall(request, context) {
     }
   }
   if (allPiResults.length > 0) {
-    const piSnippetFloor = config2.pi_check.medium_risk_threshold;
+    const piSnippetFloor = DEFAULT_PI_MEDIUM_RISK_THRESHOLD;
     auditSignals.pi_checks = allPiResults.map((r) => ({
       risk: r.risk,
       model_id: r.modelId,
@@ -18593,9 +18670,9 @@ async function evaluateToolCall(request, context) {
   } catch (error) {
     logger.debug("Audit verdict logging failed open", { error: String(error) });
   }
-  if (verdict.decision === "deny") {
+  const submitTelemetry = async (blocking) => {
     try {
-      await sendCommunityIqDetection({
+      await sendCommunityIqTelemetry({
         eventId,
         agentRuntime: request.agentRuntime,
         agentRuntimeVersion: request.agentRuntimeVersion,
@@ -18604,11 +18681,18 @@ async function evaluateToolCall(request, context) {
         content: resolvedContent,
         signals: resolvedSignals,
         communityIqEnabled: config2.community_iq,
+        config: config2,
+        blocking,
         logger
       });
     } catch (error) {
-      logger.debug("Detection telemetry failed open", { error: String(error) });
+      logger.debug("Community IQ telemetry failed open", { error: String(error) });
     }
+  };
+  if (verdict.decision === "deny") {
+    await submitTelemetry(true);
+  } else if (allPiResults.some((r) => r.risk >= DEFAULT_PI_TELEMETRY_THRESHOLD && r.risk < DEFAULT_PI_HIGH_RISK_THRESHOLD)) {
+    await submitTelemetry(false);
   }
   if (verdict.decision !== "allow") {
     try {
@@ -18617,7 +18701,7 @@ async function evaluateToolCall(request, context) {
       logger.debug("Session status update failed open", { error: String(error) });
     }
   }
-  const piWarnings = allPiResults.filter((r) => r.risk >= config2.pi_check.medium_risk_threshold && r.risk < config2.pi_check.high_risk_threshold);
+  const piWarnings = allPiResults.filter((r) => r.risk >= DEFAULT_PI_MEDIUM_RISK_THRESHOLD && r.risk < DEFAULT_PI_HIGH_RISK_THRESHOLD);
   if (piWarnings.length > 0 && config2.sensitivity !== "relaxed")
     verdict.piWarnings = piWarnings;
   logEvaluationCompleted(verdict);
@@ -18690,21 +18774,41 @@ async function checkPackages(request, config2, cache2, logger) {
     }
     if (!parsedPackages || parsedPackages.length === 0)
       return results;
+    const DENY_CLASS_PKG_VERDICTS = /* @__PURE__ */ new Set(["malicious", "not_found"]);
+    const ASK_CLASS_PKG_VERDICTS = /* @__PURE__ */ new Set(["suspicious_age", "unknown"]);
+    const VALID_PKG_VERDICTS = /* @__PURE__ */ new Set([...DENY_CLASS_PKG_VERDICTS, ...ASK_CLASS_PKG_VERDICTS]);
     const uncached = [];
     for (const pkg of parsedPackages) {
       const cacheKey2 = `${pkg.registry}:${pkg.name}${pkg.version ? `@${pkg.version}` : ""}`;
       const cached = cache2?.getPackage(cacheKey2);
-      if (cached && cached.verdict !== "allow") {
-        results.push({
-          packageName: pkg.name,
-          registry: pkg.registry,
-          verdict: cached.verdict === "deny" ? "malicious" : "suspicious_age",
-          confidence: 1,
-          details: cached.reasons.join("; ")
+      if (!cached) {
+        uncached.push(pkg);
+        continue;
+      }
+      if (cached.verdict === "allow")
+        continue;
+      const rawVerdict = cached.packageVerdict;
+      const rawConf = cached.packageConfidence;
+      const verdictValid = rawVerdict !== void 0 && VALID_PKG_VERDICTS.has(rawVerdict);
+      const confValid = rawConf !== void 0 && Number.isFinite(rawConf) && rawConf > 0 && rawConf <= 1;
+      const consistent = rawVerdict === void 0 || !verdictValid || cached.verdict === "deny" && DENY_CLASS_PKG_VERDICTS.has(rawVerdict) || cached.verdict === "ask" && ASK_CLASS_PKG_VERDICTS.has(rawVerdict);
+      if (!verdictValid || !confValid || !consistent) {
+        logger.warn("Package cache entry has invalid metadata; re-querying live", {
+          cacheKey: cacheKey2,
+          packageVerdict: rawVerdict,
+          packageConfidence: rawConf,
+          cachedVerdict: cached.verdict
         });
-      } else if (!cached) {
         uncached.push(pkg);
+        continue;
       }
+      results.push({
+        packageName: pkg.name,
+        registry: pkg.registry,
+        verdict: rawVerdict,
+        confidence: rawConf,
+        details: cached.reasons.join("; ")
+      });
     }
     if (uncached.length > 0) {
       const checker = new PackageChecker({
@@ -18724,7 +18828,9 @@ async function checkPackages(request, config2, cache2, logger) {
             verdict: result.verdict === "clean" ? "allow" : isCritical ? "deny" : "ask",
             severity: isCritical ? "critical" : "warning",
             reasons: [result.details],
-            source: "package_check"
+            source: "package_check",
+            packageVerdict: result.verdict,
+            packageConfidence: result.confidence
           }, result.ageDays ?? null);
         }
       }
@@ -18737,7 +18843,7 @@ function createPiProvider(config2, _context, logger) {
   return new BundledPiProvider({
     modelPath: config2.pi_check.model_path,
     maxContentLength: config2.pi_check.max_content_length,
-    mediumRiskThreshold: config2.pi_check.medium_risk_threshold,
+    mediumRiskThreshold: DEFAULT_PI_MEDIUM_RISK_THRESHOLD,
     logger
   });
 }
@@ -18750,9 +18856,9 @@ var PAD = 12;
 var SEPARATOR_WIDTH = 48;
 function severityEmoji(severity) {
   const s = severity.toLowerCase();
-  if (s === "critical" || s === "high")
+  if (s === "critical")
     return "\u{1F6A8}";
-  if (s === "medium" || s === "warn" || s === "warning")
+  if (s === "warning")
     return "\u26A0\uFE0F";
   return "\u2139\uFE0F";
 }
@@ -18773,20 +18879,20 @@ ${formatUpdateNotice(versionCheck)}`;
   }
   return base;
 }
-function totalHighCrit(results) {
+function totalNonInfo(results) {
   let n = 0;
   for (const r of results) {
     for (const f of r.findings) {
-      if (f.severity === "critical" || f.severity === "high")
+      if (f.severity !== "info")
         n++;
     }
   }
   return n;
 }
-function findFirstHighCrit(results) {
+function findFirstNonInfo(results) {
   for (const r of results) {
     for (const f of r.findings) {
-      if (f.severity === "critical" || f.severity === "high") {
+      if (f.severity !== "info") {
         return { plugin: r.plugin, finding: f };
       }
     }
@@ -18799,10 +18905,10 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
   const MAX_FINDINGS = 5;
   let first = true;
   for (const result of results) {
-    const highCrit = result.findings.filter((f) => f.severity === "critical" || f.severity === "high");
-    if (highCrit.length === 0)
+    const nonInfo = result.findings.filter((f) => f.severity !== "info");
+    if (nonInfo.length === 0)
       continue;
-    for (const f of highCrit.slice(0, MAX_FINDINGS)) {
+    for (const f of nonInfo.slice(0, MAX_FINDINGS)) {
       if (!first)
         lines.push("");
       first = false;
@@ -18814,8 +18920,6 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
         lines.push(kv("Artifact", f.artifact));
       }
       lines.push(kv("Source", f.sourceFile));
-      const actionLabel = f.action === "block" ? "Blocked" : "Flagged";
-      lines.push(kv("Action", actionLabel));
       if (f.recommendations && f.recommendations.length > 0) {
         lines.push(kv("Recommendations", ""));
         for (const rec of f.recommendations) {
@@ -18823,7 +18927,7 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
         }
       }
     }
-    const overflow = highCrit.length - MAX_FINDINGS;
+    const overflow = nonInfo.length - MAX_FINDINGS;
     if (overflow > 0) {
       lines.push("");
       lines.push(`   ... and ${overflow} more findings`);
@@ -18836,8 +18940,8 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
   return lines.join("\n");
 }
 function formatThreatBannerCompact(version, results, versionCheck, branding2) {
-  const total = totalHighCrit(results);
-  const first = findFirstHighCrit(results);
+  const total = totalNonInfo(results);
+  const first = findFirstNonInfo(results);
   if (!first || total === 0) {
     return formatStartupClean(version, versionCheck, branding2);
   }
@@ -18902,20 +19006,230 @@ function truncateValue(value) {
 function summarizeArtifacts(artifacts) {
   if (artifacts.length === 0)
     return "none";
-  return artifacts.slice(0, 3).map((artifact) => `${artifact.type} '${truncateValue(artifact.value)}'`).join(", ");
+  const maxArtifacts = 3;
+  const summary = artifacts.slice(0, maxArtifacts).map((artifact) => `${artifact.type} '${truncateValue(artifact.value)}'`).join(", ");
+  const overflow = artifacts.length - maxArtifacts;
+  return overflow > 0 ? `${summary}, ... and ${overflow} more` : summary;
 }
 function formatDenyMessage(verdict, branding2 = defaultBranding) {
-  const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 5).join("; ") : verdict.category;
+  const maxReasons = 5;
+  const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, maxReasons).join("; ") + (verdict.reasons.length > maxReasons ? `; ... and ${verdict.reasons.length - maxReasons} more` : "") : verdict.category;
   return [
     `${branding2.name} blocked this action.`,
     `Severity: ${verdict.severity}`,
     `Category: ${verdict.category}`,
-    `Reason: ${reasons}`
+    `Reason: ${reasons}`,
+    `If this is a false positive, use the sage_report_false_positive MCP tool to report it.`
   ].join("\n");
 }
 
-// ../core/dist/marketplace-migration.js
+// ../core/dist/install-state.js
+var import_node_path18 = require("node:path");
+init_config();
+init_file_utils();
+
+// ../core/dist/notices.js
 init_config();
+var SKILL_UPLOAD_NOTICE = {
+  id: "skill_upload_v1",
+  body: () => [
+    "unknown skills \u2014 each skill's SKILL.md and every supporting file in its",
+    "folder \u2014 will be uploaded and checked against potential malicious artifacts",
+    "starting next session. To keep skill content on this machine, set",
+    '"skill_check": { "upload_enabled": false } in ~/.sage/config.json.'
+  ],
+  // Suppressed once the user has explicitly set upload_enabled either way: an
+  // explicit choice needs no consent prompt (the rollout obeys it directly).
+  isEligible: async ({ configPath, logger }) => !(await readExplicitSkillUploadEnabled(configPath, logger)).present
+};
+var NOTICES = {
+  [SKILL_UPLOAD_NOTICE.id]: SKILL_UPLOAD_NOTICE
+};
+var INFO_ICON = "\u2139\uFE0F";
+var CONTINUATION_INDENT = "   ";
+function formatNotice(notice, branding2 = defaultBranding) {
+  const [first = "", ...rest] = notice.body(branding2);
+  const head = `${INFO_ICON}  ${branding2.name}: ${first}`;
+  return [head, ...rest.map((line) => `${CONTINUATION_INDENT}${line}`)].join("\n");
+}
+function formatNoticeById(id, branding2 = defaultBranding) {
+  const notice = NOTICES[id];
+  return notice ? formatNotice(notice, branding2) : "";
+}
+
+// ../core/dist/install-state.js
+init_types2();
+var INSTALL_STATE_SCHEMA_VERSION = 1;
+var SKILL_UPLOAD_NOTICE_ID = SKILL_UPLOAD_NOTICE.id;
+function defaultStatePath(sageDirPath) {
+  return (0, import_node_path18.join)(sageDirPath ?? resolvePath(SAGE_DIR), "install-state.json");
+}
+function emptyState() {
+  return { schemaVersion: INSTALL_STATE_SCHEMA_VERSION, notices: {} };
+}
+async function loadInstallState(sageDirPath, logger = nullLogger) {
+  let raw;
+  try {
+    raw = await getFileContent(defaultStatePath(sageDirPath));
+  } catch {
+    return emptyState();
+  }
+  try {
+    const data = JSON.parse(raw);
+    const rawNotices = data.notices ?? {};
+    const notices = {};
+    for (const [id, rec] of Object.entries(rawNotices)) {
+      notices[id] = {
+        noticed: rec.noticed === true,
+        version: typeof rec.version === "string" ? rec.version : void 0
+      };
+    }
+    return {
+      schemaVersion: typeof data.schema_version === "number" ? data.schema_version : INSTALL_STATE_SCHEMA_VERSION,
+      lastRunVersion: typeof data.last_run_version === "string" ? data.last_run_version : void 0,
+      notices
+    };
+  } catch (e) {
+    logger.warn("Failed to parse install state; treating as fresh", { error: String(e) });
+    return emptyState();
+  }
+}
+async function saveInstallState(state, sageDirPath, logger = nullLogger) {
+  try {
+    const data = {
+      schema_version: state.schemaVersion,
+      last_run_version: state.lastRunVersion,
+      notices: Object.fromEntries(Object.entries(state.notices).map(([id, rec]) => [
+        id,
+        { noticed: rec.noticed, version: rec.version }
+      ]))
+    };
+    await atomicWriteJson(defaultStatePath(sageDirPath), data);
+  } catch (e) {
+    logger.warn("Failed to save install state", { error: String(e) });
+  }
+}
+function decideSkillUploadRollout(state, opts = {}) {
+  const versionChanged = opts.version !== void 0 && state.lastRunVersion !== opts.version;
+  const withVersion = () => ({ ...state, lastRunVersion: opts.version });
+  if (opts.explicitConfig) {
+    return {
+      uploadActive: opts.explicitValue === true,
+      showNotice: false,
+      nextState: versionChanged ? withVersion() : null
+    };
+  }
+  const notice = state.notices[SKILL_UPLOAD_NOTICE_ID];
+  if (notice?.noticed === true) {
+    return {
+      uploadActive: true,
+      showNotice: false,
+      nextState: versionChanged ? withVersion() : null
+    };
+  }
+  const nextState = {
+    ...state,
+    lastRunVersion: opts.version ?? state.lastRunVersion,
+    notices: {
+      ...state.notices,
+      [SKILL_UPLOAD_NOTICE_ID]: { noticed: true, version: opts.version }
+    }
+  };
+  return { uploadActive: false, showNotice: true, nextState };
+}
+var processRollout;
+async function resolveSkillUploadRollout(args) {
+  const commitNotice = args.commitNotice ?? true;
+  const logger = args.logger ?? nullLogger;
+  let explicit;
+  try {
+    explicit = await readExplicitSkillUploadEnabled(args.configPath, logger);
+  } catch {
+    explicit = { present: false, value: false };
+  }
+  if (explicit.present) {
+    const resolved = {
+      uploadActive: explicit.value === true,
+      showNotice: false,
+      deferUnknownSkills: false
+    };
+    logger.debug("Skill-upload rollout resolved", {
+      explicitConfig: true,
+      explicitValue: explicit.value,
+      uploadActive: resolved.uploadActive,
+      showNotice: false,
+      deferUnknownSkills: false,
+      commitNotice,
+      statePersisted: false,
+      version: args.version
+    });
+    return resolved;
+  }
+  if (processRollout)
+    return processRollout;
+  try {
+    const state = await loadInstallState(args.sageDirPath, logger);
+    const decision = decideSkillUploadRollout(state, { version: args.version });
+    if (commitNotice) {
+      if (decision.nextState) {
+        await saveInstallState(decision.nextState, args.sageDirPath, logger);
+      }
+      processRollout = {
+        uploadActive: decision.uploadActive,
+        showNotice: decision.showNotice,
+        deferUnknownSkills: decision.showNotice
+      };
+    } else {
+      processRollout = {
+        uploadActive: decision.uploadActive,
+        showNotice: false,
+        deferUnknownSkills: decision.showNotice
+      };
+    }
+    logger.debug("Skill-upload rollout resolved", {
+      explicitConfig: false,
+      uploadActive: processRollout.uploadActive,
+      showNotice: processRollout.showNotice,
+      deferUnknownSkills: processRollout.deferUnknownSkills,
+      commitNotice,
+      statePersisted: commitNotice && decision.nextState !== null,
+      version: args.version
+    });
+  } catch (e) {
+    logger.warn("Skill-upload rollout resolution failed; suppressing upload", {
+      error: String(e)
+    });
+    processRollout = { uploadActive: false, showNotice: commitNotice, deferUnknownSkills: true };
+  }
+  return processRollout;
+}
+async function takePendingNotices(args) {
+  const logger = args.logger ?? nullLogger;
+  try {
+    const state = await loadInstallState(args.sageDirPath, logger);
+    const toShow = [];
+    for (const notice of Object.values(NOTICES)) {
+      if (state.notices[notice.id]?.noticed === true)
+        continue;
+      const eligible = notice.isEligible ? await notice.isEligible({ configPath: args.configPath, logger }) : true;
+      if (eligible)
+        toShow.push(notice.id);
+    }
+    if (toShow.length === 0)
+      return [];
+    const nextNotices = { ...state.notices };
+    for (const id of toShow)
+      nextNotices[id] = { noticed: true };
+    await saveInstallState({ ...state, notices: nextNotices }, args.sageDirPath, logger);
+    logger.debug("Pending notices taken for delivery", { noticeIds: toShow });
+    return toShow;
+  } catch (e) {
+    logger.warn("takePendingNotices failed; showing no notices this turn", {
+      error: String(e)
+    });
+    return [];
+  }
+}
 
 // ../core/dist/model-download.js
 init_types2();
@@ -18988,8 +19302,8 @@ function createOperationalLogger(config2, runtime) {
       try {
         const result = await Promise.race([
           Promise.allSettled([...pendingWrites]).then(() => "drained"),
-          new Promise((resolve9) => {
-            timeout = setTimeout(() => resolve9("timeout"), remainingMs);
+          new Promise((resolve10) => {
+            timeout = setTimeout(() => resolve10("timeout"), remainingMs);
             timeout.unref?.();
           })
         ]);
@@ -19037,30 +19351,32 @@ function createOperationalLogger(config2, runtime) {
 }
 
 // ../core/dist/plugin-scan-cache.js
-var import_node_crypto8 = require("node:crypto");
-var import_promises7 = require("node:fs/promises");
-var import_node_path16 = require("node:path");
+var import_node_crypto7 = require("node:crypto");
+var import_promises8 = require("node:fs/promises");
+var import_node_path19 = require("node:path");
+init_config();
 init_file_utils();
 init_types2();
-var DEFAULT_CACHE_PATH = (0, import_node_path16.join)(getHomeDir(), ".sage", "plugin_scan_cache.json");
-var CACHE_TTL_DAYS = 7;
+var DEFAULT_CACHE_PATH = (0, import_node_path19.join)(getHomeDir(), ".sage", "plugin_scan_cache.json");
+var DEFAULT_CACHE_TTL_MS = MS_PER_DAY;
+var SCHEMA_VERSION = 5;
 function cacheKey(pluginKey, version, lastUpdated) {
   return `${pluginKey}:${version}:${lastUpdated}`;
 }
 async function computeConfigHash(sageVersion, ...dirs) {
-  const h = (0, import_node_crypto8.createHash)("sha256");
+  const h = (0, import_node_crypto7.createHash)("sha256");
   if (sageVersion)
     h.update(sageVersion);
   for (const dir of dirs) {
     let files;
     try {
-      files = (await (0, import_promises7.readdir)(dir)).filter((f) => f.endsWith(".yaml")).sort();
+      files = (await (0, import_promises8.readdir)(dir)).filter((f) => f.endsWith(".yaml")).sort();
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const content = await getFileContent((0, import_node_path16.join)(dir, file));
+        const content = await getFileContent((0, import_node_path19.join)(dir, file));
         h.update(content);
       } catch {
       }
@@ -19077,6 +19393,14 @@ async function loadScanCache(configHash = "", cachePath = DEFAULT_CACHE_PATH, lo
   }
   try {
     const data = JSON.parse(raw);
+    const storedVersion = data.schema_version ?? 1;
+    if (storedVersion !== SCHEMA_VERSION) {
+      logger.debug("Schema version changed, invalidating plugin scan cache", {
+        from: storedVersion,
+        to: SCHEMA_VERSION
+      });
+      return { configHash, entries: {} };
+    }
     const storedHash = data.config_hash ?? "";
     if (configHash && storedHash !== configHash) {
       logger.debug("Config hash changed, invalidating plugin scan cache", {
@@ -19104,6 +19428,7 @@ async function loadScanCache(configHash = "", cachePath = DEFAULT_CACHE_PATH, lo
 async function saveScanCache(cache2, cachePath = DEFAULT_CACHE_PATH, logger = nullLogger) {
   try {
     const data = {
+      schema_version: SCHEMA_VERSION,
       config_hash: cache2.configHash,
       entries: Object.fromEntries(Object.entries(cache2.entries).map(([key, entry]) => [
         key,
@@ -19120,7 +19445,7 @@ async function saveScanCache(cache2, cachePath = DEFAULT_CACHE_PATH, logger = nu
     logger.warn(`Failed to save scan cache to ${cachePath}`, { error: String(e) });
   }
 }
-function isCached(cache2, pluginKey, version, lastUpdated) {
+function isCached(cache2, pluginKey, version, lastUpdated, ttlMs = DEFAULT_CACHE_TTL_MS) {
   const key = cacheKey(pluginKey, version, lastUpdated);
   const entry = cache2.entries[key];
   if (!entry)
@@ -19128,13 +19453,13 @@ function isCached(cache2, pluginKey, version, lastUpdated) {
   try {
     const scannedAt = new Date(entry.scannedAt);
     const age = Date.now() - scannedAt.getTime();
-    return age < CACHE_TTL_DAYS * 24 * 60 * 60 * 1e3;
+    return age < ttlMs;
   } catch {
     return false;
   }
 }
-function getCached(cache2, pluginKey, version, lastUpdated) {
-  if (!isCached(cache2, pluginKey, version, lastUpdated))
+function getCached(cache2, pluginKey, version, lastUpdated, ttlMs = DEFAULT_CACHE_TTL_MS) {
+  if (!isCached(cache2, pluginKey, version, lastUpdated, ttlMs))
     return null;
   const key = cacheKey(pluginKey, version, lastUpdated);
   return cache2.entries[key] ?? null;
@@ -19150,18 +19475,22 @@ function storeResult(cache2, pluginKey, version, lastUpdated, findings) {
 }
 
 // ../core/dist/plugin-scanner.js
-var import_node_crypto10 = require("node:crypto");
-var import_promises9 = require("node:fs/promises");
-var import_node_path18 = require("node:path");
+var import_node_crypto9 = require("node:crypto");
+var import_promises11 = require("node:fs/promises");
+var import_node_path23 = require("node:path");
+init_config();
 init_file_utils();
 
 // ../core/dist/skill-id.js
-var import_node_crypto9 = require("node:crypto");
-var import_promises8 = require("node:fs/promises");
-var import_node_path17 = require("node:path");
+var import_node_crypto8 = require("node:crypto");
+var import_promises9 = require("node:fs/promises");
+var import_node_path20 = require("node:path");
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "__pycache__"]);
+var MAX_SKILL_BYTES = 50 * 1024 * 1024;
+var SkillTooLargeError = class extends Error {
+};
 function isContained(childReal, rootReal) {
-  return childReal === rootReal || childReal.startsWith(`${rootReal}${import_node_path17.sep}`);
+  return childReal === rootReal || childReal.startsWith(`${rootReal}${import_node_path20.sep}`);
 }
 function normalizePath(p) {
   let out = p.replace(/\\/g, "/").normalize("NFC");
@@ -19171,47 +19500,51 @@ function normalizePath(p) {
   }
   return out;
 }
-async function entriesFromDirectory(dirPath) {
-  const absDir = (0, import_node_path17.resolve)(dirPath);
-  const rootReal = await (0, import_promises8.realpath)(absDir);
+async function entriesFromDirectory(dirPath, maxBytes = Number.POSITIVE_INFINITY) {
+  const absDir = (0, import_node_path20.resolve)(dirPath);
+  const rootReal = await (0, import_promises9.realpath)(absDir);
   const entries = [];
   const visited = /* @__PURE__ */ new Set();
+  let total = 0;
   async function walk(currentPath) {
-    const real = await (0, import_promises8.realpath)(currentPath);
+    const real = await (0, import_promises9.realpath)(currentPath);
     if (visited.has(real))
       return;
     if (!isContained(real, rootReal))
       return;
     visited.add(real);
-    const items = await (0, import_promises8.readdir)(currentPath);
+    const items = await (0, import_promises9.readdir)(currentPath);
     const dirs = [];
     const files = [];
     for (const item of items) {
-      const fullPath = (0, import_node_path17.join)(currentPath, item);
-      const st = await (0, import_promises8.stat)(fullPath);
+      const fullPath = (0, import_node_path20.join)(currentPath, item);
+      const st = await (0, import_promises9.stat)(fullPath);
       if (st.isDirectory())
         dirs.push(item);
       else if (st.isFile())
-        files.push(item);
+        files.push({ name: item, size: st.size });
     }
     dirs.sort();
-    files.sort();
+    files.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const d of dirs) {
-      const fullPath = (0, import_node_path17.join)(currentPath, d);
-      const relPath = (0, import_node_path17.relative)(absDir, fullPath).replace(/\\/g, "/");
+      const fullPath = (0, import_node_path20.join)(currentPath, d);
+      const relPath = (0, import_node_path20.relative)(absDir, fullPath).replace(/\\/g, "/");
       entries.push({ entryPath: relPath, isDir: true, content: Buffer.alloc(0) });
       await walk(fullPath);
     }
     for (const f of files) {
-      const fullPath = (0, import_node_path17.join)(currentPath, f);
-      const fileReal = await (0, import_promises8.realpath)(fullPath);
+      const fullPath = (0, import_node_path20.join)(currentPath, f.name);
+      const fileReal = await (0, import_promises9.realpath)(fullPath);
       if (!isContained(fileReal, rootReal))
         continue;
-      const relPath = (0, import_node_path17.relative)(absDir, fullPath).replace(/\\/g, "/");
+      total += f.size;
+      if (total > maxBytes)
+        throw new SkillTooLargeError();
+      const relPath = (0, import_node_path20.relative)(absDir, fullPath).replace(/\\/g, "/");
       entries.push({
         entryPath: relPath,
         isDir: false,
-        content: await (0, import_promises8.readFile)(fullPath)
+        content: await (0, import_promises9.readFile)(fullPath)
       });
     }
   }
@@ -19230,98 +19563,363 @@ function computeSkillId(entries) {
       })).filter((e) => e.entryPath !== "");
     }
   }
-  normalized = normalized.filter((e) => e.entryPath !== "skill.sig");
-  const fileHashes = {};
-  const treeEntries = [];
-  for (const e of normalized) {
-    const contentHash = (0, import_node_crypto9.createHash)("sha256").update(e.isDir ? Buffer.alloc(0) : e.content).digest("hex");
-    const entryType = e.isDir ? "dir" : "file";
-    treeEntries.push({ type: entryType, entryPath: e.entryPath, hash: contentHash });
-    if (!e.isDir)
-      fileHashes[e.entryPath] = contentHash;
+  normalized = normalized.filter((e) => e.entryPath !== "skill.sig");
+  const fileHashes = {};
+  const treeEntries = [];
+  for (const e of normalized) {
+    const contentHash = (0, import_node_crypto8.createHash)("sha256").update(e.isDir ? Buffer.alloc(0) : e.content).digest("hex");
+    const entryType = e.isDir ? "dir" : "file";
+    treeEntries.push({ type: entryType, entryPath: e.entryPath, hash: contentHash });
+    if (!e.isDir)
+      fileHashes[e.entryPath] = contentHash;
+  }
+  treeEntries.sort((a, b) => a.entryPath < b.entryPath ? -1 : a.entryPath > b.entryPath ? 1 : 0);
+  const skillHasher = (0, import_node_crypto8.createHash)("sha256");
+  for (const e of treeEntries) {
+    skillHasher.update(Buffer.from(`${e.type}\0${e.entryPath}\0${e.hash}
+`, "utf8"));
+  }
+  return { skillId: skillHasher.digest("hex"), fileHashes };
+}
+async function findSkillPackagesWithMtime(rootDir) {
+  const found = [];
+  let rootReal;
+  try {
+    rootReal = await (0, import_promises9.realpath)((0, import_node_path20.resolve)(rootDir));
+  } catch {
+    return found;
+  }
+  const visited = /* @__PURE__ */ new Set();
+  async function walk(currentPath) {
+    let real;
+    try {
+      real = await (0, import_promises9.realpath)(currentPath);
+    } catch {
+      return 0;
+    }
+    if (visited.has(real))
+      return 0;
+    if (!isContained(real, rootReal))
+      return 0;
+    visited.add(real);
+    let st;
+    try {
+      st = await (0, import_promises9.stat)(currentPath);
+    } catch {
+      return 0;
+    }
+    let subtreeMax = st.mtimeMs;
+    if (!st.isDirectory())
+      return subtreeMax;
+    let items;
+    try {
+      items = await (0, import_promises9.readdir)(currentPath);
+    } catch {
+      return subtreeMax;
+    }
+    items.sort();
+    let entry;
+    if (items.includes("SKILL.md")) {
+      try {
+        if ((await (0, import_promises9.stat)((0, import_node_path20.join)(currentPath, "SKILL.md"))).isFile()) {
+          entry = { folder: currentPath, newestMtimeMs: 0 };
+          found.push(entry);
+        }
+      } catch {
+      }
+    }
+    for (const item of items) {
+      if (SKIP_DIRS.has(item))
+        continue;
+      const childMax = await walk((0, import_node_path20.join)(currentPath, item));
+      if (childMax > subtreeMax)
+        subtreeMax = childMax;
+    }
+    if (entry)
+      entry.newestMtimeMs = subtreeMax;
+    return subtreeMax;
+  }
+  await walk((0, import_node_path20.resolve)(rootDir));
+  return found;
+}
+function looseSkillKey(skillsRoot, folder, tag, scope) {
+  const rel = (0, import_node_path20.relative)((0, import_node_path20.resolve)(skillsRoot), (0, import_node_path20.resolve)(folder)).split(import_node_path20.sep).join("/") || (0, import_node_path20.basename)(folder);
+  return `skill:${tag}/${rel}@${scope}`;
+}
+async function discoverLooseSkills(skillsDir, tag, scope) {
+  const resolvedRoot = (0, import_node_path20.resolve)(skillsDir);
+  const packages = (await findSkillPackagesWithMtime(skillsDir)).filter((p) => (0, import_node_path20.resolve)(p.folder) !== resolvedRoot);
+  return packages.map(({ folder, newestMtimeMs }) => ({
+    key: looseSkillKey(resolvedRoot, folder, tag, scope),
+    installPath: folder,
+    version: scope,
+    lastUpdated: new Date(newestMtimeMs).toISOString()
+  }));
+}
+async function dedupeSkillsByResolvedPath(skills) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const skill of skills) {
+    let canonical = skill.installPath;
+    try {
+      canonical = await (0, import_promises9.realpath)(skill.installPath);
+    } catch {
+    }
+    if (seen.has(canonical))
+      continue;
+    seen.add(canonical);
+    out.push(skill);
+  }
+  return out;
+}
+async function discoverLooseSkillsAcrossRoots(roots) {
+  const lists = await Promise.all(roots.map(async ({ dir, tag, scope }) => {
+    try {
+      return await discoverLooseSkills(dir, tag, scope);
+    } catch {
+      return [];
+    }
+  }));
+  return lists.length <= 1 ? lists[0] ?? [] : dedupeSkillsByResolvedPath(lists.flat());
+}
+async function computeSkillIdsForRoot(rootDir, logger) {
+  const folders = (await findSkillPackagesWithMtime(rootDir)).map((p) => p.folder);
+  const out = [];
+  for (const folder of folders) {
+    try {
+      const entries = await entriesFromDirectory(folder, MAX_SKILL_BYTES);
+      const { skillId } = computeSkillId(entries);
+      out.push({ folder, skillId });
+    } catch (e) {
+      if (e instanceof SkillTooLargeError) {
+        logger?.warn("Skill directory exceeds 50 MB limit; skipping", { folder });
+      }
+    }
+  }
+  return out;
+}
+
+// ../core/dist/skill-pending.js
+var import_promises10 = require("node:fs/promises");
+var import_node_path21 = require("node:path");
+init_config();
+init_file_utils();
+init_types2();
+var SCHEMA_VERSION2 = 1;
+var PENDING_TTL_MS = 60 * 60 * 1e3;
+function defaultPendingPath() {
+  return (0, import_node_path21.join)(resolvePath(SAGE_DIR), "skill_pending.json");
+}
+async function loadPendingMarker(pendingPath = defaultPendingPath(), logger = nullLogger) {
+  let raw;
+  try {
+    raw = await getFileContent(pendingPath);
+  } catch {
+    return { entries: {} };
+  }
+  try {
+    const data = JSON.parse(raw);
+    const rawEntries = data.entries ?? {};
+    const now = Date.now();
+    const entries = {};
+    for (const [skillId, entry] of Object.entries(rawEntries)) {
+      const folder = entry.folder;
+      const submittedAt = entry.submitted_at;
+      if (!folder || !submittedAt)
+        continue;
+      const ts = Date.parse(submittedAt);
+      if (!isFreshTimestamp(ts, PENDING_TTL_MS, now))
+        continue;
+      entries[skillId] = {
+        folder,
+        submittedAt,
+        agentRuntime: typeof entry.agent_runtime === "string" ? entry.agent_runtime : void 0,
+        containerKey: typeof entry.container_key === "string" ? entry.container_key : void 0
+      };
+    }
+    return { entries };
+  } catch (e) {
+    logger.warn(`Failed to load pending marker from ${pendingPath}`, { error: String(e) });
+    return { entries: {} };
+  }
+}
+async function savePendingMarker(marker, pendingPath = defaultPendingPath(), logger = nullLogger) {
+  if (Object.keys(marker.entries).length === 0) {
+    try {
+      await (0, import_promises10.unlink)(pendingPath);
+    } catch (e) {
+      if (!e || typeof e !== "object" || e.code !== "ENOENT") {
+        logger.warn(`Failed to delete empty pending marker at ${pendingPath}`, {
+          error: String(e)
+        });
+      }
+    }
+    return;
+  }
+  try {
+    const data = {
+      schema_version: SCHEMA_VERSION2,
+      entries: Object.fromEntries(Object.entries(marker.entries).map(([skillId, entry]) => [
+        skillId,
+        {
+          folder: entry.folder,
+          submitted_at: entry.submittedAt,
+          agent_runtime: entry.agentRuntime,
+          container_key: entry.containerKey
+        }
+      ]))
+    };
+    await atomicWriteJson(pendingPath, data);
+  } catch (e) {
+    logger.warn(`Failed to save pending marker to ${pendingPath}`, { error: String(e) });
+  }
+}
+function isPending(marker, skillId) {
+  return skillId in marker.entries;
+}
+function addPending(marker, skillId, folder, origin = {}) {
+  marker.entries[skillId] = {
+    folder,
+    submittedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    agentRuntime: origin.agentRuntime,
+    containerKey: origin.containerKey
+  };
+}
+function removePending(marker, skillId) {
+  delete marker.entries[skillId];
+}
+function listPending(marker) {
+  return Object.entries(marker.entries).map(([skillId, entry]) => ({
+    skillId,
+    folder: entry.folder,
+    agentRuntime: entry.agentRuntime,
+    containerKey: entry.containerKey
+  }));
+}
+
+// ../core/dist/skill-verdict-cache.js
+var import_node_path22 = require("node:path");
+init_config();
+init_file_utils();
+init_types2();
+var SCHEMA_VERSION3 = 1;
+var DEFAULT_VERDICT_TTL_MS = MS_PER_DAY;
+function parseSources(raw) {
+  if (!Array.isArray(raw))
+    return void 0;
+  const sources = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object")
+      continue;
+    const entry = item;
+    const source = {
+      agentRuntime: typeof entry.agent_runtime === "string" ? entry.agent_runtime : void 0,
+      containerKey: typeof entry.container_key === "string" ? entry.container_key : void 0
+    };
+    if (source.agentRuntime || source.containerKey)
+      sources.push(source);
   }
-  treeEntries.sort((a, b) => a.entryPath < b.entryPath ? -1 : a.entryPath > b.entryPath ? 1 : 0);
-  const skillHasher = (0, import_node_crypto9.createHash)("sha256");
-  for (const e of treeEntries) {
-    skillHasher.update(Buffer.from(`${e.type}\0${e.entryPath}\0${e.hash}
-`, "utf8"));
+  return sources.length > 0 ? sources : void 0;
+}
+function mergeSources(existing, incoming) {
+  const merged = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const source of [...existing ?? [], ...incoming ?? []]) {
+    const key = source.agentRuntime ?? "";
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    merged.push(source);
   }
-  return { skillId: skillHasher.digest("hex"), fileHashes };
+  return merged.length > 0 ? merged : void 0;
 }
-async function findSkillPackages(rootDir) {
-  const found = [];
-  let rootReal;
+function defaultCachePath2() {
+  return (0, import_node_path22.join)(resolvePath(SAGE_DIR), "skill_verdict_cache.json");
+}
+async function loadSkillVerdictCache(cachePath = defaultCachePath2(), ttlMs = DEFAULT_VERDICT_TTL_MS, logger = nullLogger) {
+  let raw;
   try {
-    const rootStat = await (0, import_promises8.stat)(rootDir);
-    if (!rootStat.isDirectory())
-      return found;
-    rootReal = await (0, import_promises8.realpath)((0, import_node_path17.resolve)(rootDir));
+    raw = await getFileContent(cachePath);
   } catch {
-    return found;
+    return { entries: {} };
   }
-  const visited = /* @__PURE__ */ new Set();
-  async function walk(dir) {
-    let real;
-    try {
-      real = await (0, import_promises8.realpath)(dir);
-    } catch {
-      return;
-    }
-    if (visited.has(real))
-      return;
-    if (!isContained(real, rootReal))
-      return;
-    visited.add(real);
-    let items;
-    try {
-      items = await (0, import_promises8.readdir)(dir);
-    } catch {
-      return;
-    }
-    items.sort();
-    if (items.includes("SKILL.md")) {
-      try {
-        const st = await (0, import_promises8.stat)((0, import_node_path17.join)(dir, "SKILL.md"));
-        if (st.isFile())
-          found.push(dir);
-      } catch {
-      }
-    }
-    for (const item of items) {
-      if (SKIP_DIRS.has(item))
+  try {
+    const data = JSON.parse(raw);
+    const rawEntries = data.entries ?? {};
+    const now = Date.now();
+    const entries = {};
+    let pruned = 0;
+    for (const [skillId, entry] of Object.entries(rawEntries)) {
+      const analyzedAt = entry.analyzed_at;
+      if (!analyzedAt)
         continue;
-      const fullPath = (0, import_node_path17.join)(dir, item);
-      let st;
-      try {
-        st = await (0, import_promises8.stat)(fullPath);
-      } catch {
+      const ts = Date.parse(analyzedAt);
+      if (!isFreshTimestamp(ts, ttlMs, now)) {
+        pruned++;
         continue;
       }
-      if (st.isDirectory()) {
-        await walk(fullPath);
-      }
+      entries[skillId] = {
+        verdict: typeof entry.verdict === "string" ? entry.verdict : void 0,
+        summary: typeof entry.summary === "string" ? entry.summary : void 0,
+        skillName: typeof entry.skill_name === "string" ? entry.skill_name : void 0,
+        sources: parseSources(entry.sources),
+        analyzedAt
+      };
     }
+    const cache2 = { entries };
+    if (pruned > 0) {
+      logger.debug(`Pruned ${pruned} stale verdict(s) from cache`, { cachePath });
+      await saveSkillVerdictCache(cache2, cachePath, logger);
+    }
+    return cache2;
+  } catch (e) {
+    logger.warn(`Failed to load verdict cache from ${cachePath}`, { error: String(e) });
+    return { entries: {} };
   }
-  await walk((0, import_node_path17.resolve)(rootDir));
-  return found;
 }
-async function computeSkillIdsForRoot(rootDir) {
-  const folders = await findSkillPackages(rootDir);
-  const out = [];
-  for (const folder of folders) {
-    try {
-      const entries = await entriesFromDirectory(folder);
-      const { skillId } = computeSkillId(entries);
-      out.push({ folder, skillId });
-    } catch {
-    }
+async function saveSkillVerdictCache(cache2, cachePath = defaultCachePath2(), logger = nullLogger) {
+  try {
+    const data = {
+      schema_version: SCHEMA_VERSION3,
+      entries: Object.fromEntries(Object.entries(cache2.entries).map(([skillId, v]) => [
+        skillId,
+        {
+          verdict: v.verdict,
+          summary: v.summary,
+          skill_name: v.skillName,
+          sources: v.sources?.map((s) => ({
+            agent_runtime: s.agentRuntime,
+            container_key: s.containerKey
+          })),
+          analyzed_at: v.analyzedAt
+        }
+      ]))
+    };
+    await atomicWriteJson(cachePath, data);
+  } catch (e) {
+    logger.warn(`Failed to save verdict cache to ${cachePath}`, { error: String(e) });
   }
-  return out;
+}
+function getVerdict(cache2, skillId, ttlMs = DEFAULT_VERDICT_TTL_MS) {
+  const entry = cache2.entries[skillId];
+  if (!entry)
+    return null;
+  const ts = Date.parse(entry.analyzedAt);
+  if (!isFreshTimestamp(ts, ttlMs))
+    return null;
+  return entry;
+}
+function putVerdict(cache2, skillId, verdict) {
+  const existing = cache2.entries[skillId];
+  cache2.entries[skillId] = {
+    ...verdict,
+    sources: mergeSources(existing?.sources, verdict.sources),
+    analyzedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
 }
 
 // ../core/dist/plugin-scanner.js
 init_types2();
-var DEFAULT_PLUGINS_REGISTRY = (0, import_node_path18.join)(getHomeDir(), ".claude", "plugins", "installed_plugins.json");
 var SCANNABLE_EXTENSIONS2 = /* @__PURE__ */ new Set([
   ".py",
   ".js",
@@ -19344,15 +19942,34 @@ var SCANNABLE_EXTENSIONS2 = /* @__PURE__ */ new Set([
 var MAX_FILE_SIZE = 512 * 1024;
 async function walkPluginFiles(installPath, logger) {
   const files = [];
+  const visited = /* @__PURE__ */ new Set();
+  let rootReal;
+  try {
+    rootReal = await (0, import_promises11.realpath)((0, import_node_path23.resolve)(installPath));
+  } catch (e) {
+    logger.warn(`Error walking plugin path ${installPath}`, { error: String(e) });
+    return files;
+  }
   async function walk(dirOrFile) {
+    let real;
+    try {
+      real = await (0, import_promises11.realpath)(dirOrFile);
+    } catch {
+      return;
+    }
+    if (visited.has(real))
+      return;
+    if (!isContained(real, rootReal))
+      return;
+    visited.add(real);
     let stats;
     try {
-      stats = await (0, import_promises9.stat)(dirOrFile);
+      stats = await (0, import_promises11.stat)(dirOrFile);
     } catch {
       return;
     }
     if (stats.isFile()) {
-      if (SCANNABLE_EXTENSIONS2.has((0, import_node_path18.extname)(dirOrFile).toLowerCase()) && stats.size <= MAX_FILE_SIZE) {
+      if (SCANNABLE_EXTENSIONS2.has((0, import_node_path23.extname)(dirOrFile).toLowerCase()) && stats.size <= MAX_FILE_SIZE) {
         files.push(dirOrFile);
       }
       return;
@@ -19360,32 +19977,41 @@ async function walkPluginFiles(installPath, logger) {
     if (stats.isDirectory()) {
       let entries;
       try {
-        entries = await (0, import_promises9.readdir)(dirOrFile);
+        entries = await (0, import_promises11.readdir)(dirOrFile);
       } catch {
         return;
       }
       for (const entry of entries) {
         if (SKIP_DIRS.has(entry))
           continue;
-        const fullPath = (0, import_node_path18.join)(dirOrFile, entry);
+        const fullPath = (0, import_node_path23.join)(dirOrFile, entry);
         await walk(fullPath);
       }
     }
   }
   try {
-    await walk(installPath);
+    await walk((0, import_node_path23.resolve)(installPath));
   } catch (e) {
     logger.warn(`Error walking plugin path ${installPath}`, { error: String(e) });
   }
   return files;
 }
 async function scanPlugin(plugin, options = {}) {
-  const { checkUrls = true, checkFileHashes = true, checkSkills = true, amsiClient = null, logger = nullLogger } = options;
+  const { checkUrls = true, checkFileHashes = true, checkSkills = true, amsiClient = null, logger = nullLogger, skillVerdictCachePath, skillPendingPath, loggingConfig, skillVerdictTtlMs, uploadEnabled = true, deferUnknownSkills = false, agentRuntime } = options;
   const result = { plugin, findings: [] };
-  const skillCheckPromise = checkSkills ? runSkillCheck(plugin, result.findings, logger) : Promise.resolve();
+  const skillCheckPromise = checkSkills ? runSkillCheck(plugin, result.findings, logger, {
+    verdictCachePath: skillVerdictCachePath,
+    pendingPath: skillPendingPath,
+    loggingConfig,
+    verdictTtlMs: skillVerdictTtlMs,
+    uploadEnabled,
+    deferUnknownSkills,
+    agentRuntime
+  }) : Promise.resolve(false);
   const files = await walkPluginFiles(plugin.installPath, logger);
   if (files.length === 0) {
-    await skillCheckPromise;
+    if (await skillCheckPromise)
+      result.deferCache = true;
     return result;
   }
   const allUrls = [];
@@ -19401,17 +20027,15 @@ async function scanPlugin(plugin, options = {}) {
     }
     if (amsiClient) {
       try {
-        const scanName = `${plugin.key}/${(0, import_node_path18.relative)(plugin.installPath, filePath)}`;
+        const scanName = `${plugin.key}/${(0, import_node_path23.relative)(plugin.installPath, filePath)}`;
         const amsiResult = await amsiClient.scanString("Plugin", scanName, content);
         if (amsiResult && (amsiResult.isDetected || amsiResult.isBlockedByAdmin)) {
           result.findings.push({
             threatId: "AMSI_SCAN",
             title: `AMSI detection (result=${amsiResult.amsiResult})`,
             severity: "critical",
-            confidence: 1,
-            action: "block",
             artifact: content.slice(0, 200),
-            sourceFile: (0, import_node_path18.relative)(plugin.installPath, filePath)
+            sourceFile: (0, import_node_path23.relative)(plugin.installPath, filePath)
           });
         }
       } catch {
@@ -19421,7 +20045,7 @@ async function scanPlugin(plugin, options = {}) {
       allUrls.push(...extractUrls(content));
     }
     if (checkFileHashes) {
-      const sha256 = (0, import_node_crypto10.createHash)("sha256").update(rawBytes).digest("hex");
+      const sha256 = (0, import_node_crypto9.createHash)("sha256").update(rawBytes).digest("hex");
       const existing = hashToFiles.get(sha256);
       if (existing) {
         existing.push(filePath);
@@ -19442,8 +20066,6 @@ async function scanPlugin(plugin, options = {}) {
             threatId: "URL_CHECK",
             title: `Malicious URL (${findingDetails})`,
             severity: "critical",
-            confidence: 1,
-            action: "block",
             artifact: ur.url.slice(0, 200),
             sourceFile: "URL check"
           });
@@ -19465,10 +20087,8 @@ async function scanPlugin(plugin, options = {}) {
               threatId: "FILE_CHECK",
               title: `Malicious file (${fr.detectionNames.join(", ") || "unknown"})`,
               severity: "critical",
-              confidence: 1,
-              action: "block",
               artifact: fr.sha256,
-              sourceFile: (0, import_node_path18.relative)(plugin.installPath, filePath)
+              sourceFile: (0, import_node_path23.relative)(plugin.installPath, filePath)
             });
           }
         }
@@ -19476,48 +20096,109 @@ async function scanPlugin(plugin, options = {}) {
     } catch {
     }
   })() : Promise.resolve();
-  await Promise.all([urlCheckPromise, fileCheckPromise, skillCheckPromise]);
+  const [, , skillDeferCache] = await Promise.all([
+    urlCheckPromise,
+    fileCheckPromise,
+    skillCheckPromise
+  ]);
+  if (skillDeferCache)
+    result.deferCache = true;
   return result;
 }
-async function runSkillCheck(plugin, findings, logger) {
+function pushSkillFindingIfRisky(findings, plugin, skillId, folder, verdict) {
+  const risk = (verdict.verdict ?? "").toUpperCase();
+  if (risk !== "HIGH" && risk !== "CRITICAL")
+    return;
+  const severity = risk === "CRITICAL" ? "critical" : "warning";
+  findings.push({
+    threatId: "SKILL_CHECK",
+    title: verdict.summary?.trim() || (risk === "CRITICAL" ? "Malicious skill detected" : "Suspicious skill detected"),
+    severity,
+    artifact: skillId.slice(0, 16),
+    sourceFile: (0, import_node_path23.relative)(plugin.installPath, folder) || "."
+  });
+}
+async function runSkillCheck(plugin, findings, logger, paths = {}) {
   try {
-    const skills = await computeSkillIdsForRoot(plugin.installPath);
+    const skills = await computeSkillIdsForRoot(plugin.installPath, logger);
     if (skills.length === 0)
-      return;
-    const ids = skills.map((s) => s.skillId);
+      return false;
+    const verdictCache = await loadSkillVerdictCache(paths.verdictCachePath, paths.verdictTtlMs, logger);
+    const uncached = [];
+    for (const skill of skills) {
+      const cached = getVerdict(verdictCache, skill.skillId, paths.verdictTtlMs);
+      if (cached) {
+        pushSkillFindingIfRisky(findings, plugin, skill.skillId, skill.folder, cached);
+      } else {
+        uncached.push(skill);
+      }
+    }
+    if (uncached.length === 0)
+      return false;
     const client = new SkillCheckClient(void 0, logger);
-    const verdicts = await client.checkSkills(ids);
-    for (const { folder, skillId } of skills) {
-      const verdict = verdicts.get(skillId);
-      if (!verdict)
-        continue;
-      const risk = (verdict.overallRiskLevel ?? "").toUpperCase();
-      if (risk !== "HIGH" && risk !== "CRITICAL")
+    const verdicts = await client.checkSkills(uncached.map((s) => s.skillId));
+    const marker = await loadPendingMarker(paths.pendingPath, logger);
+    let cacheModified = false;
+    let markerModified = false;
+    let lookupFailed = false;
+    let graceDeferred = false;
+    for (const { folder, skillId } of uncached) {
+      if (!verdicts.has(skillId)) {
+        lookupFailed = true;
         continue;
-      const severity = risk === "CRITICAL" ? "critical" : "high";
-      findings.push({
-        threatId: "SKILL_CHECK",
-        title: verdict.summary?.trim() || `Risky skill detected (${risk})`,
-        severity,
-        confidence: 1,
-        action: "log",
-        artifact: skillId.slice(0, 16),
-        sourceFile: (0, import_node_path18.relative)(plugin.installPath, folder) || ".",
-        recommendations: verdict.recommendations.length > 0 ? verdict.recommendations : void 0
-      });
+      }
+      const verdict = verdicts.get(skillId) ?? null;
+      if (verdict) {
+        putVerdict(verdictCache, skillId, {
+          verdict: verdict.verdict,
+          summary: verdict.summary,
+          skillName: (0, import_node_path23.basename)(folder),
+          sources: [{ agentRuntime: paths.agentRuntime, containerKey: plugin.key }]
+        });
+        cacheModified = true;
+        pushSkillFindingIfRisky(findings, plugin, skillId, folder, verdict);
+        if (isPending(marker, skillId)) {
+          removePending(marker, skillId);
+          markerModified = true;
+        }
+      } else if (!isPending(marker, skillId)) {
+        if (paths.uploadEnabled === false) {
+          if (paths.deferUnknownSkills)
+            graceDeferred = true;
+        } else {
+          addPending(marker, skillId, folder, {
+            agentRuntime: paths.agentRuntime,
+            containerKey: plugin.key
+          });
+          markerModified = true;
+          if (paths.loggingConfig) {
+            logSkillQueued(paths.loggingConfig, skillId, plugin.key, folder).catch(() => {
+            });
+          }
+        }
+      }
     }
+    if (cacheModified)
+      await saveSkillVerdictCache(verdictCache, paths.verdictCachePath, logger);
+    if (markerModified)
+      await savePendingMarker(marker, paths.pendingPath, logger);
+    const anyStillPending = uncached.some(({ skillId }) => isPending(marker, skillId));
+    return markerModified || anyStillPending || lookupFailed || graceDeferred;
   } catch (e) {
     logger.debug("Skill check failed", { error: String(e) });
+    return false;
   }
 }
 
 // ../core/dist/session-start.js
 var import_node_child_process2 = require("node:child_process");
 var import_node_fs4 = require("node:fs");
+var import_node_path25 = require("node:path");
 init_config();
 init_file_utils();
 
 // ../core/dist/session-start-scan.js
+var import_node_path24 = require("node:path");
 init_config();
 init_types2();
 function fromCachedFinding(finding) {
@@ -19525,8 +20206,6 @@ function fromCachedFinding(finding) {
     threatId: finding.threat_id,
     title: finding.title,
     severity: finding.severity,
-    confidence: finding.confidence,
-    action: finding.action,
     artifact: finding.artifact,
     sourceFile: finding.source_file,
     recommendations: finding.recommendations
@@ -19537,16 +20216,13 @@ function toFindingData(finding) {
     threat_id: finding.threatId,
     title: finding.title,
     severity: finding.severity,
-    confidence: finding.confidence,
-    action: finding.action,
     artifact: finding.artifact,
     source_file: finding.sourceFile,
     recommendations: finding.recommendations
   };
 }
 function toAuditFindingData(finding) {
-  const { action: _, ...rest } = toFindingData(finding);
-  return rest;
+  return { ...toFindingData(finding) };
 }
 async function runSessionStartScan(context) {
   const logger = context.logger ?? nullLogger;
@@ -19591,7 +20267,7 @@ async function runSessionStartScan(context) {
   }
 }
 async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient, logger) {
-  const configHash = await computeConfigHash(context.sageVersion ?? "", context.threatsDir, context.allowlistsDir);
+  const configHash = await computeConfigHash(context.sageVersion ?? "", context.threatsDir, context.trustedDomainsDir);
   const cache2 = await loadScanCache(configHash, context.scanCachePath, logger);
   const resultsWithFindings = [];
   let cacheModified = false;
@@ -19605,6 +20281,9 @@ async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient,
     deniedByException: 0,
     findingsCount: 0
   };
+  const skillPendingPath = context.sageDirPath ? (0, import_node_path24.join)(context.sageDirPath, "skill_pending.json") : void 0;
+  const skillVerdictCachePath = context.sageDirPath ? (0, import_node_path24.join)(context.sageDirPath, "skill_verdict_cache.json") : void 0;
+  const cacheTtlMs = skillCacheTtlMs(config2);
   for (const plugin of plugins) {
     const denyMatch = findPluginDenyException(exceptions, plugin.key);
     if (denyMatch) {
@@ -19617,8 +20296,6 @@ async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient,
             threatId: "EXCEPTION-DENY",
             title: `Denied by exception: ${denyMatch.pattern}${denyMatch.reason ? ` \u2014 ${denyMatch.reason}` : ""}`,
             severity: "critical",
-            confidence: 1,
-            action: "block",
             artifact: plugin.key,
             sourceFile: "~/.sage/exceptions.json"
           }
@@ -19631,7 +20308,7 @@ async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient,
       stats.allowedByException += 1;
       continue;
     }
-    const cached = getCached(cache2, plugin.key, plugin.version, plugin.lastUpdated);
+    const cached = getCached(cache2, plugin.key, plugin.version, plugin.lastUpdated, cacheTtlMs);
     if (cached && cached.findings.length === 0) {
       stats.cacheHitsClean += 1;
       continue;
@@ -19650,11 +20327,23 @@ async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient,
     const result = await scanPlugin(plugin, {
       checkUrls: context.checkUrls ?? true,
       checkFileHashes: context.checkFileHashes ?? true,
+      checkSkills: config2.skill_check.enabled,
+      uploadEnabled: context.uploadUnknownSkills ?? config2.skill_check.upload_enabled,
+      deferUnknownSkills: context.deferUnknownSkills,
       amsiClient,
-      logger
+      logger,
+      skillPendingPath,
+      skillVerdictCachePath,
+      skillVerdictTtlMs: cacheTtlMs,
+      loggingConfig: config2.logging,
+      agentRuntime: context.agentRuntime
     });
-    storeResult(cache2, plugin.key, plugin.version, plugin.lastUpdated, result.findings.map(toFindingData));
-    cacheModified = true;
+    if (result.deferCache) {
+      logger.debug("Plugin cache deferred (skill verdict pending)", { plugin: plugin.key });
+    } else {
+      storeResult(cache2, plugin.key, plugin.version, plugin.lastUpdated, result.findings.map(toFindingData));
+      cacheModified = true;
+    }
     if (result.findings.length > 0) {
       stats.findingsCount += result.findings.length;
       resultsWithFindings.push(result);
@@ -19681,6 +20370,7 @@ async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient,
 init_types2();
 
 // ../core/dist/version-check.js
+init_config();
 init_types2();
 var DEFAULT_TIMEOUT_MS3 = 5e3;
 function isNewerVersion(current, latest) {
@@ -19707,11 +20397,20 @@ async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = D
       logger.debug("Skipping version check: missing installation id");
       return null;
     }
+    let config2 = context.config;
+    if (!config2) {
+      try {
+        config2 = await loadConfig(context.configPath, logger);
+      } catch (err) {
+        logger.debug(`Version check config load failed: ${err}`);
+      }
+    }
     const envelope = buildSageProxyEnvelope({
       iid: context.iid,
       versionApp: currentVersion,
       agentRuntime: context.agentRuntime,
-      agentRuntimeVersion: context.agentRuntimeVersion ?? "unknown"
+      agentRuntimeVersion: context.agentRuntimeVersion ?? "unknown",
+      config: config2
     });
     const extendedInfo = await loadExtendedInfo(void 0, logger).catch(() => null);
     const enriched = mergeExtendedInfo(envelope, extendedInfo);
@@ -19751,6 +20450,8 @@ async function runSessionStart(ctx) {
   const sageDirPath = resolvePath(ctx.sageDirPath ?? "~/.sage");
   pruneOrphanedTmpFiles(sageDirPath).catch(() => {
   });
+  deployConfigDefaults(sageDirPath, logger).catch(() => {
+  });
   maybeSpawnModelDownloadWorker({
     sageDirPath,
     workerPath: ctx.modelDownloadWorkerPath,
@@ -19761,18 +20462,29 @@ async function runSessionStart(ctx) {
     logger
   }).catch(() => {
   });
+  const rollout = await resolveSkillUploadRollout({
+    sageDirPath,
+    configPath: ctx.configPath,
+    version: ctx.version,
+    logger,
+    commitNotice: ctx.commitUploadNotice ?? true
+  });
   const iidPromise = getInstallationId(sageDirPath).catch(() => void 0);
   const [scanResults, versionCheck] = await Promise.all([
     runSessionStartScan({
       plugins: ctx.plugins,
       threatsDir: ctx.threatsDir,
-      allowlistsDir: ctx.allowlistsDir,
+      trustedDomainsDir: ctx.trustedDomainsDir,
       sageVersion: ctx.version,
       logger,
       configPath: ctx.configPath,
       scanCachePath: ctx.scanCachePath,
       checkUrls: ctx.checkUrls,
-      checkFileHashes: ctx.checkFileHashes
+      checkFileHashes: ctx.checkFileHashes,
+      sageDirPath,
+      agentRuntime: ctx.agentRuntime,
+      uploadUnknownSkills: rollout.uploadActive,
+      deferUnknownSkills: rollout.deferUnknownSkills
     }),
     iidPromise.then((iid) => {
       if (!iid) {
@@ -19781,11 +20493,25 @@ async function runSessionStart(ctx) {
       return checkForUpdate(ctx.version, logger, void 0, {
         agentRuntime: ctx.agentRuntime,
         agentRuntimeVersion: ctx.agentRuntimeVersion,
-        iid
+        iid,
+        configPath: ctx.configPath
       });
     }).catch(() => null)
   ]);
-  return { scanResults, versionCheck };
+  maybeSpawnSkillUploadWorker({
+    sageDirPath,
+    workerPath: ctx.skillUploadWorkerPath,
+    configPath: ctx.configPath,
+    agentRuntime: ctx.agentRuntime,
+    uploadActive: rollout.uploadActive,
+    logger
+  }).catch(() => {
+  });
+  return {
+    scanResults,
+    versionCheck,
+    notices: rollout.showNotice ? [SKILL_UPLOAD_NOTICE.id] : []
+  };
 }
 async function maybeSpawnModelDownloadWorker(args) {
   if (!args.workerPath) {
@@ -19831,6 +20557,7 @@ async function maybeSpawnModelDownloadWorker(args) {
   const spawned = spawnModelDownloadWorker({
     sageDirPath: args.sageDirPath,
     workerPath: args.workerPath,
+    configPath: args.configPath,
     agentRuntime: args.agentRuntime,
     agentRuntimeVersion: args.agentRuntimeVersion,
     versionApp: args.versionApp,
@@ -19842,6 +20569,9 @@ async function maybeSpawnModelDownloadWorker(args) {
     missingModels
   });
 }
+function bunRuntimeEnv() {
+  return process.versions.bun ? { BUN_BE_BUN: "1" } : {};
+}
 function spawnModelDownloadWorker(args) {
   const logger = args.logger ?? nullLogger;
   try {
@@ -19850,7 +20580,9 @@ function spawnModelDownloadWorker(args) {
       stdio: "ignore",
       env: {
         ...process.env,
+        ...bunRuntimeEnv(),
         SAGE_DIR: args.sageDirPath,
+        SAGE_CONFIG_PATH: args.configPath ?? "",
         SAGE_AGENT_RUNTIME: String(args.agentRuntime ?? "unknown"),
         SAGE_AGENT_RUNTIME_VERSION: args.agentRuntimeVersion ?? "",
         SAGE_VERSION_APP: args.versionApp ?? "",
@@ -19864,24 +20596,111 @@ function spawnModelDownloadWorker(args) {
     return false;
   }
 }
+async function maybeSpawnSkillUploadWorker(args) {
+  if (!args.uploadActive) {
+    args.logger.debug("Skill upload worker skipped", {
+      result: "skipped",
+      skippedReason: "upload_inactive"
+    });
+    return;
+  }
+  try {
+    const config2 = await loadConfig(args.configPath, args.logger);
+    if (!config2.skill_check.enabled) {
+      args.logger.debug("Skill upload worker skipped", {
+        result: "skipped",
+        skippedReason: "skill_check_disabled"
+      });
+      return;
+    }
+  } catch {
+  }
+  if (!args.workerPath) {
+    args.logger.debug("Skill upload worker skipped", {
+      result: "skipped",
+      skippedReason: "missing_worker_path"
+    });
+    return;
+  }
+  if (!(0, import_node_fs4.existsSync)(args.workerPath)) {
+    args.logger.debug("Skill upload worker skipped", {
+      result: "skipped",
+      skippedReason: "worker_script_not_found",
+      workerPath: args.workerPath
+    });
+    return;
+  }
+  const marker = await loadPendingMarker((0, import_node_path25.join)(args.sageDirPath, "skill_pending.json"), args.logger);
+  const pendingCount = listPending(marker).length;
+  if (pendingCount === 0) {
+    args.logger.debug("Skill upload worker skipped", {
+      result: "skipped",
+      skippedReason: "no_pending_skills"
+    });
+    return;
+  }
+  const spawned = spawnSkillUploadWorker({
+    sageDirPath: args.sageDirPath,
+    workerPath: args.workerPath,
+    agentRuntime: args.agentRuntime,
+    logger: args.logger
+  });
+  args.logger.debug("Skill upload worker spawn completed", {
+    result: spawned ? "spawned" : "failed",
+    pendingCount
+  });
+}
+function spawnSkillUploadWorker(args) {
+  const logger = args.logger ?? nullLogger;
+  try {
+    const child = (0, import_node_child_process2.spawn)(process.execPath, [args.workerPath], {
+      detached: true,
+      stdio: "ignore",
+      env: {
+        ...process.env,
+        ...bunRuntimeEnv(),
+        SAGE_DIR: args.sageDirPath,
+        SAGE_AGENT_RUNTIME: String(args.agentRuntime ?? "unknown")
+      }
+    });
+    child.unref();
+    return true;
+  } catch (err) {
+    logger.warn("Failed to spawn skill upload worker", { error: String(err) });
+    return false;
+  }
+}
 
 // ../core/dist/scan-handler.js
-async function runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime, branding2 = defaultBranding, modelDownloadWorkerPath, style = "verbose") {
+async function runPluginScan(logger, context, plugins, threatsDir, trustedDomainsDir, version, agentRuntime, branding2 = defaultBranding, modelDownloadWorkerPath, style = "verbose", agentRuntimeVersion, skillUploadWorkerPath, onNotices, commitUploadNotice, announceCleanScans = true) {
   logger.debug(`${branding2.name} plugin scan started (${context})`, {
     agentRuntime,
     pluginsCount: plugins.length,
     threatsDir,
-    allowlistsDir
+    trustedDomainsDir
   });
   const result = await runSessionStart({
     plugins,
     threatsDir,
-    allowlistsDir,
+    trustedDomainsDir,
     version,
     logger,
     agentRuntime,
-    modelDownloadWorkerPath
+    agentRuntimeVersion,
+    modelDownloadWorkerPath,
+    skillUploadWorkerPath,
+    commitUploadNotice
   });
+  if (result.notices && result.notices.length > 0) {
+    logger.debug(`${branding2.name} session-start produced notices`, {
+      context,
+      noticeIds: result.notices,
+      forwarded: Boolean(onNotices)
+    });
+    onNotices?.(result.notices);
+  } else {
+    logger.debug(`${branding2.name} session-start produced no notices`, { context });
+  }
   const findingsCount = result.scanResults.reduce((total, scanResult) => total + scanResult.findings.length, 0);
   const completionData = {
     agentRuntime,
@@ -19895,10 +20714,13 @@ async function runPluginScan(logger, context, plugins, threatsDir, allowlistsDir
   } else {
     logger.debug(`${branding2.name} plugin scan (${context}) complete`, completionData);
   }
+  if (findingsCount === 0 && !announceCleanScans) {
+    return "";
+  }
   return formatSessionStartMessage(version, result, branding2, style);
 }
 function createScanHandler(options) {
-  const { logger, context, discoverPlugins: discoverPlugins2, selfPrefix, threatsDir, allowlistsDir, version, agentRuntime, branding: branding2 = defaultBranding, onResult, modelDownloadWorkerPath, style = "verbose" } = options;
+  const { logger, context, discoverPlugins: discoverPlugins2, selfPrefix, threatsDir, trustedDomainsDir, version, agentRuntime, agentRuntimeVersion, branding: branding2 = defaultBranding, onResult, onNotices, modelDownloadWorkerPath, skillUploadWorkerPath, style = "verbose", commitUploadNotice, announceCleanScans = true } = options;
   return async () => {
     try {
       let plugins = await discoverPlugins2();
@@ -19906,8 +20728,10 @@ function createScanHandler(options) {
       if (plugins.length === 0) {
         logger.debug(`${branding2.name} plugin scan (${context}): no plugins to scan after filtering`);
       }
-      const msg = await runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime, branding2, modelDownloadWorkerPath, style);
-      onResult?.(msg);
+      const msg = await runPluginScan(logger, context, plugins, threatsDir, trustedDomainsDir, version, agentRuntime, branding2, modelDownloadWorkerPath, style, agentRuntimeVersion, skillUploadWorkerPath, onNotices, commitUploadNotice, announceCleanScans);
+      if (msg !== "") {
+        onResult?.(msg);
+      }
     } catch (e) {
       logger.error(`${branding2.name} ${context} scan failed`, { error: String(e) });
     }
@@ -19945,19 +20769,19 @@ function canonicalizeToolName(map, rawName) {
 init_types2();
 
 // src/bundled-dirs.ts
-var import_node_path19 = require("node:path");
-var packageRoot = (0, import_node_path19.resolve)(__dirname, "..");
+var import_node_path26 = require("node:path");
+var packageRoot = (0, import_node_path26.resolve)(__dirname, "..");
 function getBundledDataDirs() {
   return {
-    threatsDir: (0, import_node_path19.join)(packageRoot, "resources", "threats"),
-    allowlistsDir: (0, import_node_path19.join)(packageRoot, "resources", "allowlists")
+    threatsDir: (0, import_node_path26.join)(packageRoot, "resources", "threats"),
+    trustedDomainsDir: (0, import_node_path26.join)(packageRoot, "resources", "trusted-domains")
   };
 }
 var cachedVersion;
 function getSageVersion() {
   if (cachedVersion) return cachedVersion;
   try {
-    const pkg = JSON.parse(getFileContentSync((0, import_node_path19.join)(packageRoot, "package.json"), "utf-8"));
+    const pkg = JSON.parse(getFileContentSync((0, import_node_path26.join)(packageRoot, "package.json"), "utf-8"));
     cachedVersion = pkg.version ?? "0.0.0";
   } catch {
     cachedVersion = "0.0.0";
@@ -19966,37 +20790,41 @@ function getSageVersion() {
 }
 
 // src/startup-scan.ts
-var import_node_path21 = require("node:path");
+var import_node_path28 = require("node:path");
 
 // src/plugin-discovery.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises12 = require("node:fs/promises");
 var import_node_os4 = require("node:os");
-var import_node_path20 = require("node:path");
-var DEFAULT_EXTENSIONS_DIR = (0, import_node_path20.join)((0, import_node_os4.homedir)(), ".openclaw", "extensions");
-async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSIONS_DIR, branding2 = defaultBranding) {
+var import_node_path27 = require("node:path");
+var DEFAULT_EXTENSIONS_DIR = (0, import_node_path27.join)((0, import_node_os4.homedir)(), ".openclaw", "extensions");
+var SKILL_ROOTS = [
+  { dir: (0, import_node_path27.join)(getHomeDir(), ".agents", "skills"), tag: "agents", scope: "personal" },
+  { dir: (0, import_node_path27.join)(getHomeDir(), ".openclaw", "skills"), tag: "openclaw", scope: "personal" }
+];
+async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSIONS_DIR, branding2 = defaultBranding, skillRoots = SKILL_ROOTS) {
   logger.debug(`${branding2.name} plugin discovery: scanning extensions directory`, {
     path: extensionsDir
   });
+  const plugins = [];
   let entries;
   try {
-    entries = await (0, import_promises10.readdir)(extensionsDir);
+    entries = await (0, import_promises12.readdir)(extensionsDir);
   } catch {
     logger.debug("OpenClaw extensions directory not found", { path: extensionsDir });
-    return [];
+    entries = [];
   }
-  const plugins = [];
   for (const entry of entries) {
-    const extDir = (0, import_node_path20.join)(extensionsDir, entry);
+    const extDir = (0, import_node_path27.join)(extensionsDir, entry);
     let stats;
     try {
-      stats = await (0, import_promises10.stat)(extDir);
+      stats = await (0, import_promises12.stat)(extDir);
       if (!stats.isDirectory()) continue;
     } catch {
       continue;
     }
     let pkg;
     try {
-      const pkgPath = (0, import_node_path20.join)(extDir, "package.json");
+      const pkgPath = (0, import_node_path27.join)(extDir, "package.json");
       const raw = await getFileContent(pkgPath);
       pkg = JSON.parse(raw);
     } catch {
@@ -20018,12 +20846,15 @@ async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSION
     });
   }
   logger.debug(`${branding2.name} plugin discovery: found ${plugins.length} extension(s)`);
+  const skills = await discoverLooseSkillsAcrossRoots(skillRoots);
+  logger.debug(`${branding2.name} skill discovery: found ${skills.length} loose skill(s)`);
+  plugins.push(...skills);
   return plugins;
 }
 
 // src/startup-scan.ts
-function createOpenClawScanHandler(logger, context, branding2 = defaultBranding, onResult) {
-  const { threatsDir, allowlistsDir } = getBundledDataDirs();
+function createOpenClawScanHandler(logger, context, branding2 = defaultBranding, onResult, announceCleanScans = true) {
+  const { threatsDir, trustedDomainsDir } = getBundledDataDirs();
   const version = getSageVersion();
   return createScanHandler({
     logger,
@@ -20031,34 +20862,64 @@ function createOpenClawScanHandler(logger, context, branding2 = defaultBranding,
     discoverPlugins: () => discoverOpenClawPlugins(logger, void 0, branding2),
     selfPrefix: "@gendigital/sage-openclaw@",
     threatsDir,
-    allowlistsDir,
+    trustedDomainsDir,
     version,
     agentRuntime: "openclaw",
+    // No agentRuntimeVersion: the OpenClaw plugin API exposes no host version.
     branding: branding2,
     onResult,
-    modelDownloadWorkerPath: (0, import_node_path21.resolve)(__dirname, "model-download-worker.cjs")
+    // No onNotices: OpenClaw delivers the one-time notice from
+    // `before_agent_start` (a different process/turn than this scan) via
+    // takePendingNotices, so the scan-time callback would never fire.
+    modelDownloadWorkerPath: (0, import_node_path28.resolve)(__dirname, "model-download-worker.cjs"),
+    skillUploadWorkerPath: (0, import_node_path28.resolve)(__dirname, "skill-upload-worker.cjs"),
+    // Don't commit the "shown" flag here — commit happens at delivery.
+    commitUploadNotice: false,
+    announceCleanScans
   });
 }
-function createStartupScanHandler(logger, branding2 = defaultBranding, onResult) {
-  return createOpenClawScanHandler(logger, "startup", branding2, onResult);
-}
-function createSessionScanHandler(logger, branding2 = defaultBranding, onResult) {
-  return createOpenClawScanHandler(logger, "session", branding2, onResult);
-}
-function createBeforeAgentStartHandler(getFindings, clearFindings, logger, branding2 = defaultBranding) {
-  return () => {
-    const findings = getFindings();
-    if (!findings) return void 0;
-    clearFindings();
-    logger.debug(`${branding2.name}: surfacing plugin scan findings via before_agent_start`);
-    const prependContext = [
-      '<security-alert source="sage-plugin-scan">',
-      findings,
-      "",
-      "Inform the user about these security findings.",
-      "</security-alert>"
-    ].join("\n");
-    return { prependContext };
+function createStartupScanHandler(logger, branding2 = defaultBranding, onResult, announceCleanScans = true) {
+  return createOpenClawScanHandler(logger, "startup", branding2, onResult, announceCleanScans);
+}
+function createSessionScanHandler(logger, branding2 = defaultBranding, onResult, announceCleanScans = true) {
+  return createOpenClawScanHandler(logger, "session", branding2, onResult, announceCleanScans);
+}
+function createBeforeAgentStartHandler(getSecurityFindings, clearFindings, logger, branding2 = defaultBranding) {
+  return (notices) => {
+    const findings = getSecurityFindings();
+    if (!notices && !findings) {
+      logger.debug(`${branding2.name}: before_agent_start - nothing pending to surface`);
+      return void 0;
+    }
+    if (findings) clearFindings();
+    logger.debug(`${branding2.name}: surfacing context via before_agent_start`, {
+      hasNotices: Boolean(notices),
+      hasFindings: Boolean(findings)
+    });
+    const blocks = [];
+    if (notices) {
+      blocks.push(
+        [
+          '<sage-notice source="sage-session-start">',
+          notices,
+          "",
+          "Relay this notice to the user. It is informational, not a security finding.",
+          "</sage-notice>"
+        ].join("\n")
+      );
+    }
+    if (findings) {
+      blocks.push(
+        [
+          '<security-alert source="sage-plugin-scan">',
+          findings,
+          "",
+          "Inform the user about these security findings.",
+          "</security-alert>"
+        ].join("\n")
+      );
+    }
+    return { prependContext: blocks.join("\n\n") };
   };
 }
 
@@ -20124,7 +20985,7 @@ function mapToolToArtifacts(toolName, params) {
       return null;
   }
 }
-function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir, branding2 = defaultBranding) {
+function createToolCallHandler(approvalStore, logger, threatsDir, trustedDomainsDir, branding2 = defaultBranding) {
   async function handleToolCall(event, ctx) {
     const sessionId = ctx?.sessionKey ?? "unknown";
     const completeHook = (result, data = {}) => {
@@ -20145,6 +21006,17 @@ function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir,
     });
     try {
       const { toolName, params } = event;
+      if (captureEnabled()) {
+        await captureHookInput(
+          "PreToolUse",
+          { toolName, params, sessionKey: ctx?.sessionKey },
+          {
+            toolName: canonicalizeToolName(OPENCLAW_TOOL_MAP, toolName),
+            toolInput: normalizeToolInput(toolName, params)
+          },
+          { filePrefix: "openclaw-" }
+        );
+      }
       const artifacts = mapToolToArtifacts(toolName, params);
       if (!artifacts || artifacts.length === 0) {
         completeHook("skipped", { skippedReason: "no_artifacts" });
@@ -20160,7 +21032,7 @@ function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir,
           toolInput: normalizeToolInput(toolName, params),
           artifacts
         },
-        { threatsDir, allowlistsDir, logger },
+        { threatsDir, trustedDomainsDir, logger },
         approvalStore
       );
       if (verdict.decision === "allow") {
@@ -20183,7 +21055,8 @@ function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir,
         });
         return { block: true, blockReason: formatDenyMessage(verdict, branding2) };
       }
-      const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 3).join("; ") : verdict.category;
+      const maxReasons = 3;
+      const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, maxReasons).join("; ") + (verdict.reasons.length > maxReasons ? `; ... and ${verdict.reasons.length - maxReasons} more` : "") : verdict.category;
       const intersected = artifacts.filter((a) => verdict.artifacts.includes(a.value));
       const flaggedArtifacts = intersected.length > 0 ? intersected : artifacts;
       completeHook("evaluated", {
@@ -20251,35 +21124,66 @@ var index_default = {
     const toolLogger = operationalLogger.forComponent("tool-handler");
     const scanLogger = operationalLogger.forComponent("startup-scan");
     const approvalStore = new ApprovalStore();
-    const { threatsDir, allowlistsDir } = getBundledDataDirs();
+    const { threatsDir, trustedDomainsDir } = getBundledDataDirs();
     const CLEANUP_INTERVAL_MS = 5 * 60 * 1e3;
     const interval = setInterval(() => approvalStore.cleanup(), CLEANUP_INTERVAL_MS);
     if (typeof interval.unref === "function") interval.unref();
     let pendingConfigurationWarnings = formatConfigurationWarnings(getConfigurationWarningsSync(void 0, logger), branding) ?? null;
+    const migrationCheckPromise = checkAllowlistMigration().then((result) => {
+      if (result.needed) {
+        const notice = formatAllowlistMigrationWarning(result.entryTypes, branding);
+        pendingConfigurationWarnings = pendingConfigurationWarnings ? `${pendingConfigurationWarnings}
+
+${notice}` : notice;
+      }
+    }).catch(() => {
+    });
     let pendingScanFindings = null;
     const onFindings = (msg) => {
       pendingScanFindings = msg;
     };
-    const getPendingFindings = () => [pendingConfigurationWarnings, pendingScanFindings].filter(Boolean).join("\n\n") || null;
+    const getPendingSecurityFindings = () => [pendingConfigurationWarnings, pendingScanFindings].filter(Boolean).join("\n\n") || null;
+    const beforeAgentStartHandler = createBeforeAgentStartHandler(
+      getPendingSecurityFindings,
+      () => {
+        pendingConfigurationWarnings = null;
+        pendingScanFindings = null;
+      },
+      logger,
+      branding
+    );
+    const resolveNoticeText = async () => {
+      try {
+        const ids = await takePendingNotices({ logger });
+        const text = ids.map((id) => formatNoticeById(id, branding)).filter(Boolean).join("\n\n");
+        logger.debug(`${branding.name}: notices resolved for delivery`, {
+          noticeIds: ids,
+          willShow: text.length > 0
+        });
+        return text.length > 0 ? text : null;
+      } catch (e) {
+        logger.warn(`${branding.name}: notice resolution failed`, { error: String(e) });
+        return null;
+      }
+    };
     api.on(
       "before_tool_call",
-      createToolCallHandler(approvalStore, toolLogger, threatsDir, allowlistsDir, branding),
+      createToolCallHandler(approvalStore, toolLogger, threatsDir, trustedDomainsDir, branding),
       { priority: 100 }
     );
-    api.on("gateway_start", createStartupScanHandler(scanLogger, branding, onFindings));
-    api.on("session_start", createSessionScanHandler(scanLogger, branding, onFindings));
     api.on(
-      "before_agent_start",
-      createBeforeAgentStartHandler(
-        getPendingFindings,
-        () => {
-          pendingConfigurationWarnings = null;
-          pendingScanFindings = null;
-        },
-        logger,
-        branding
-      )
+      "gateway_start",
+      createStartupScanHandler(scanLogger, branding, onFindings, config.announce_clean_scans)
+    );
+    api.on(
+      "session_start",
+      createSessionScanHandler(scanLogger, branding, onFindings, config.announce_clean_scans)
     );
+    api.on("before_agent_start", async () => {
+      await migrationCheckPromise;
+      const notices = await resolveNoticeText();
+      return beforeAgentStartHandler(notices);
+    });
   }
 };
 //# sourceMappingURL=index.cjs.map