@gendigital/sage-openclaw 0.13.1 → 0.15.0

package/dist/index.cjs

@@ -63,7 +63,7 @@ async function renameWithRetry(from, to, attempts = 5) {
       const transient = code === "EPERM" || code === "EACCES" || code === "EBUSY";
       if (!transient || i === attempts - 1)
         throw err;
-      await new Promise((resolve10) => setTimeout(resolve10, 10 * 2 ** i));
+      await new Promise((resolve11) => setTimeout(resolve11, 10 * 2 ** i));
     }
   }
 }
@@ -4292,7 +4292,10 @@ var init_zod = __esm({
 });
 
 // ../core/dist/types.js
-var nullLogger, ArtifactTypeSchema, ArtifactSchema, VerdictSeveritySchema, ThreatSchema, DecisionSchema, SensitivitySchema, UrlCheckConfigSchema, CacheConfigSchema, LoggingConfigSchema, OperationalLogLevelSchema, OperationalLoggingConfigSchema, FileCheckConfigSchema, PackageCheckConfigSchema, AmsiCheckConfigSchema, SkillCheckConfigSchema, DEFAULT_PI_HIGH_RISK_THRESHOLD, DEFAULT_PI_MEDIUM_RISK_THRESHOLD, DEFAULT_PI_TELEMETRY_THRESHOLD, PiCheckConfigSchema, ExceptionDecisionSchema, ExceptionMatchSchema, ExceptionRuleSchema, ExceptionsFileSchema, ExceptionsConfigSchema, ConfigSchema, HookTypeSchema;
+function isSubmitOnlyThreat(threat) {
+  return threat.flags?.includes(SUBMIT_ONLY_FLAG) ?? false;
+}
+var nullLogger, ArtifactTypeSchema, ArtifactSchema, VerdictSeveritySchema, ThreatSchema, SUBMIT_ONLY_FLAG, DecisionSchema, SensitivitySchema, UrlCheckConfigSchema, CacheConfigSchema, LoggingConfigSchema, OperationalLogLevelSchema, OperationalLoggingConfigSchema, FileCheckConfigSchema, PackageCheckConfigSchema, AmsiCheckConfigSchema, SkillCheckConfigSchema, DEFAULT_PI_HIGH_RISK_THRESHOLD, DEFAULT_PI_MEDIUM_RISK_THRESHOLD, DEFAULT_PI_TELEMETRY_THRESHOLD, PiCheckConfigSchema, ExceptionDecisionSchema, ExceptionMatchSchema, ExceptionRuleSchema, ExceptionsFileSchema, ExceptionsConfigSchema, ConfigSchema, HookTypeSchema;
 var init_types2 = __esm({
   "../core/dist/types.js"() {
     "use strict";
@@ -4328,6 +4331,7 @@ var init_types2 = __esm({
       revoked: external_exports.boolean().optional().default(false),
       flags: external_exports.array(external_exports.string()).optional().default([])
     });
+    SUBMIT_ONLY_FLAG = "submit_only";
     DecisionSchema = external_exports.enum(["allow", "deny", "ask"]);
     SensitivitySchema = external_exports.enum(["paranoid", "balanced", "relaxed"]);
     UrlCheckConfigSchema = external_exports.object({
@@ -6891,7 +6895,7 @@ async function ensurePiDeps(modelPath, logger = nullLogger) {
   }
 }
 function runNpm(cwd, args, logger) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const isWindows = process.platform === "win32";
     const npmCmd = isWindows ? "npm.cmd" : "npm";
     const child = (0, import_node_child_process.execFile)(npmCmd, args, { cwd, timeout: 3e4, shell: isWindows }, (error, _stdout, stderr) => {
@@ -6899,7 +6903,7 @@ function runNpm(cwd, args, logger) {
         logger.warn(`npm install error: ${stderr || error.message}`);
         reject(error);
       } else {
-        resolve10();
+        resolve11();
       }
     });
     child.unref();
@@ -14323,7 +14327,7 @@ var ApprovalStore = class {
 };
 
 // ../core/dist/audit-log.js
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 init_config();
 
 // ../core/dist/content-snapshot.js
@@ -14500,12 +14504,143 @@ function buildContentSnapshot(toolType, toolInput, artifacts = [], signals = {})
   return content;
 }
 
+// ../core/dist/detection-names.js
+var import_node_crypto3 = require("node:crypto");
+
+// ../core/dist/model-storage.js
+var import_node_fs = require("node:fs");
+var import_node_path4 = require("node:path");
+init_config();
+var MODEL_SCHEMA_VERSION = "v2";
+var REQUIRED_MODELS_BY_SCHEMA = {
+  v1: ["pi-model"],
+  v2: ["pi-model"]
+};
+var REQUIRED_MODEL_FILES = {
+  "pi-model": [
+    "model_int8.onnx",
+    "tokenizer.json",
+    "tokenizer_config.json",
+    "special_tokens_map.json",
+    "vocab.txt",
+    "config.json"
+  ]
+};
+function getModelStorageRoot(sageDir = resolvePath("~/.sage")) {
+  return (0, import_node_path4.join)(resolvePath(sageDir), "models");
+}
+function getModelDir(modelName, schema = MODEL_SCHEMA_VERSION, sageDir) {
+  return (0, import_node_path4.join)(getModelStorageRoot(sageDir), schema, modelName);
+}
+function isModelPresent(modelName, schema = MODEL_SCHEMA_VERSION, sageDir) {
+  const dir = getModelDir(modelName, schema, sageDir);
+  const files = REQUIRED_MODEL_FILES[modelName];
+  if (!files || files.length === 0)
+    return false;
+  return files.every((f) => (0, import_node_fs.existsSync)((0, import_node_path4.resolve)(dir, f)));
+}
+function missingRequiredModels(schema = MODEL_SCHEMA_VERSION, sageDir) {
+  const required = REQUIRED_MODELS_BY_SCHEMA[schema] ?? [];
+  return required.filter((name) => !isModelPresent(name, schema, sageDir));
+}
+
+// ../core/dist/detection-names.js
+init_types2();
+var PI_DETECTION_NAME = "Other:SagePromptInjectionML-A [Susp]";
+var REPORTING_ENGINE_SHORTHANDS = {
+  package: "sgpk",
+  amsi: "sgam",
+  heuristics: "sghe",
+  ml: "sgml",
+  skill: "skan"
+};
+var REPORTING_DETECTION_SUFFIX = "sage";
+function formatReportingDetectionName(canonicalName, engine, optionalData = "") {
+  const engineMetadata = optionalData ? `${REPORTING_ENGINE_SHORTHANDS[engine]}:${optionalData}` : REPORTING_ENGINE_SHORTHANDS[engine];
+  return `${canonicalName}|${engineMetadata}|${REPORTING_DETECTION_SUFFIX}`;
+}
+function sha256Hex(text) {
+  return (0, import_node_crypto3.createHash)("sha256").update(text).digest("hex");
+}
+function formatOnlineClassifierDetectionName(postfix, modelVersion, textHash) {
+  return `Text:OnlineClassifier [${postfix}]|${modelVersion}-${textHash}|sgpi`;
+}
+function piReportingDetectionName(r) {
+  if (r.risk >= DEFAULT_PI_MEDIUM_RISK_THRESHOLD && r.modelVersion && r.contentSnippet) {
+    return formatOnlineClassifierDetectionName("Misc", r.modelVersion, sha256Hex(r.contentSnippet));
+  }
+  return formatReportingDetectionName(PI_DETECTION_NAME, "ml", `${r.modelId}:${MODEL_SCHEMA_VERSION}`);
+}
+var PACKAGE_DETECTION_NAMES = {
+  not_found: "Other:SagePackageNotFound-A [Susp]",
+  suspicious_age: "Other:SagePackageNew-A [Susp]",
+  malicious: "Other:SagePackageMalicious-A [Trj]",
+  unknown: "Other:SagePackageUnknown-A [Susp]"
+};
+var AMSI_DETECTION_NAMES = {
+  detected: "Other:SageAmsiDetected-A [Heur]",
+  blocked_by_admin: "Other:SageAmsiBlockedByAdmin-A [Heur]",
+  unknown: "Other:SageAmsiUnknown-A [Susp]"
+};
+var AMSI_REPORTING_RULE_NAMES = {
+  detected: "AMSI_DETECTED",
+  blocked_by_admin: "AMSI_BLOCKED_BY_ADMIN",
+  unknown: "AMSI_UNKNOWN"
+};
+var SKILL_DETECTION_NAMES = {
+  HIGH: "Other:SageSuspiciousSkill-A [Susp]",
+  CRITICAL: "Other:SageMaliciousSkill-A [Trj]"
+};
+function isCanonicalDetectionName(name) {
+  return /^\w+:\w+-[A-Z]+ \[[^\]\r\n]+\]$/.test(name);
+}
+function packageDetectionName(verdict) {
+  return PACKAGE_DETECTION_NAMES[verdict];
+}
+function amsiDetectionClass(amsiResult) {
+  if (amsiResult >= 32768)
+    return "detected";
+  if (amsiResult >= 16384)
+    return "blocked_by_admin";
+  return "unknown";
+}
+function amsiDetectionName(amsiResult) {
+  return AMSI_DETECTION_NAMES[amsiDetectionClass(amsiResult)];
+}
+function amsiReportingData(amsiResult) {
+  const ruleName = AMSI_REPORTING_RULE_NAMES[amsiDetectionClass(amsiResult)];
+  return `${ruleName}:${Math.trunc(amsiResult).toString(16)}`;
+}
+function skillDetectionName(verdict) {
+  return SKILL_DETECTION_NAMES[verdict.toUpperCase()];
+}
+function isSkillId(value) {
+  return /^[0-9a-f]{64}$/i.test(value);
+}
+function skillReportingDetectionName(verdict, skillId) {
+  const canonicalName = skillDetectionName(verdict);
+  return canonicalName && isSkillId(skillId) ? formatReportingDetectionName(canonicalName, "skill", skillId.toLowerCase()) : void 0;
+}
+function buildSkillCheckSignal(skillId, analyzerVerdict, jobId) {
+  const normalizedSkillId = skillId.toLowerCase();
+  const normalizedVerdict = analyzerVerdict.toUpperCase();
+  const detectionName = skillReportingDetectionName(normalizedVerdict, normalizedSkillId);
+  if (!detectionName)
+    return void 0;
+  return {
+    detection_name: detectionName,
+    skill_id: normalizedSkillId,
+    ...jobId ? { job_id: jobId } : {},
+    analyzer_verdict: normalizedVerdict
+  };
+}
+
 // ../core/dist/audit-log.js
 init_file_utils();
 
 // ../core/dist/jsonl-log-writer.js
 var import_promises2 = require("node:fs/promises");
-var import_node_path4 = require("node:path");
+var import_node_path5 = require("node:path");
 init_config();
 init_file_utils();
 var writeQueues = /* @__PURE__ */ new Map();
@@ -14542,7 +14677,7 @@ async function rotateIfNeeded(filePath, maxBytes, maxFiles) {
   });
 }
 async function appendJsonlEntryNow(path, config2, entry) {
-  await (0, import_promises2.mkdir)((0, import_node_path4.dirname)(path), { recursive: true });
+  await (0, import_promises2.mkdir)((0, import_node_path5.dirname)(path), { recursive: true });
   await rotateIfNeeded(path, config2.max_bytes, config2.max_files);
   await (0, import_promises2.appendFile)(path, `${JSON.stringify(entry)}
 `);
@@ -14590,7 +14725,7 @@ async function logVerdict(config2, input) {
     return;
   const entry = {
     type: "runtime_verdict",
-    entry_id: input.eventId ?? (0, import_node_crypto3.randomUUID)(),
+    entry_id: input.eventId ?? (0, import_node_crypto4.randomUUID)(),
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     session_id: input.sessionId,
     conversation_id: input.conversationId ?? input.sessionId,
@@ -14604,6 +14739,8 @@ async function logVerdict(config2, input) {
     reasons: input.verdict.reasons,
     source: input.verdict.source,
     threat_id: input.verdict.matchedThreatId,
+    ...input.verdict.customThreatMatched ? { custom_threat_matched: true } : {},
+    ...input.nonCustomThreatMatched ? { non_custom_detection_matched: true } : {},
     user_override: userOverride,
     signals: input.signals,
     tool_use_id: input.toolUseId
@@ -14651,6 +14788,37 @@ async function logSkillQueued(config2, skillId, pluginKey, skillFolder) {
   } catch {
   }
 }
+async function logSkillVerdict(config2, skillId, status, verdict, summary, context = {}) {
+  if (!config2.enabled)
+    return false;
+  const entry = {
+    type: "skill_verdict",
+    entry_id: context.entryId ?? (0, import_node_crypto4.randomUUID)(),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    skill_id: skillId,
+    status
+  };
+  if (context.jobId !== void 0)
+    entry.job_id = context.jobId;
+  if (context.agentRuntime !== void 0)
+    entry.agent_runtime = context.agentRuntime;
+  if (verdict !== void 0)
+    entry.verdict = verdict;
+  if (summary !== void 0)
+    entry.summary = summary.slice(0, MAX_SUMMARY_LEN);
+  const skillSignal = status === "analyzed" && verdict !== void 0 ? buildSkillCheckSignal(skillId, verdict, context.jobId) : void 0;
+  if (skillSignal) {
+    entry.signals = {
+      skill_checks: [skillSignal]
+    };
+  }
+  try {
+    await appendEntry(config2, entry);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // ../core/dist/cache.js
 init_config();
@@ -15089,19 +15257,19 @@ var PersistentPowershellAmsiBackend = class {
     return this.available;
   }
   waitForLine(timeout) {
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve11, reject) => {
       const timer = setTimeout(() => {
         this.pendingResponse = null;
         reject(new Error("timeout"));
       }, timeout);
-      this.pendingResponse = { resolve: resolve10, reject, timer };
+      this.pendingResponse = { resolve: resolve11, reject, timer };
     });
   }
   async enqueueScan(operation) {
     const previous = this.scanQueue;
     let release;
-    this.scanQueue = new Promise((resolve10) => {
-      release = resolve10;
+    this.scanQueue = new Promise((resolve11) => {
+      release = resolve11;
     });
     await previous;
     try {
@@ -15149,10 +15317,10 @@ var PersistentPowershellAmsiBackend = class {
           const line = this.stdoutBuffer.slice(0, idx).trim();
           this.stdoutBuffer = this.stdoutBuffer.slice(idx + 1);
           if (this.pendingResponse) {
-            const { resolve: resolve10, timer } = this.pendingResponse;
+            const { resolve: resolve11, timer } = this.pendingResponse;
             this.pendingResponse = null;
             clearTimeout(timer);
-            resolve10(line);
+            resolve11(line);
           }
           idx = this.stdoutBuffer.indexOf("\n");
         }
@@ -15251,7 +15419,7 @@ var WslPowershellAmsiBackend = class {
     if (!this.available)
       return null;
     const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
-    return new Promise((resolve10) => {
+    return new Promise((resolve11) => {
       try {
         const ps = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", PS_ONESHOT_SCRIPT], { stdio: ["pipe", "pipe", "pipe"] });
         let stdout = "";
@@ -15261,7 +15429,7 @@ var WslPowershellAmsiBackend = class {
             ps.kill();
           } catch {
           }
-          resolve10(null);
+          resolve11(null);
         }, PS_TIMEOUT);
         ps.stdout?.on("data", (chunk) => {
           stdout += chunk.toString();
@@ -15274,7 +15442,7 @@ var WslPowershellAmsiBackend = class {
         ps.on("error", (err) => {
           clearTimeout(timer);
           this.logger.debug("AMSI: PowerShell one-shot error", { error: String(err) });
-          resolve10(null);
+          resolve11(null);
         });
         ps.on("exit", () => {
           clearTimeout(timer);
@@ -15287,11 +15455,11 @@ var WslPowershellAmsiBackend = class {
                 contentName
               });
             }
-            resolve10(null);
+            resolve11(null);
             return;
           }
           this.logger.debug("AMSI: PowerShell one-shot result", { contentName, amsiResult });
-          resolve10(interpretAmsiResult(amsiResult, content, contentName));
+          resolve11(interpretAmsiResult(amsiResult, content, contentName));
         });
         const req = JSON.stringify({ content: truncated, contentName });
         ps.stdin?.write(`${req}
@@ -15299,7 +15467,7 @@ var WslPowershellAmsiBackend = class {
         ps.stdin?.end();
       } catch (e) {
         this.logger.warn("AMSI: PowerShell one-shot failed", { error: String(e), contentName });
-        resolve10(null);
+        resolve11(null);
       }
     });
   }
@@ -15439,15 +15607,15 @@ var ContentFetchClient = class _ContentFetchClient {
 init_types2();
 
 // ../core/dist/version.js
-var import_node_path5 = require("node:path");
+var import_node_path6 = require("node:path");
 var import_node_url = require("node:url");
 init_file_utils();
 var import_meta = {};
 function resolveVersion() {
   if (true)
-    return "0.13.0";
+    return "0.15.0";
   try {
-    const pkgPath = (0, import_node_path5.join)((0, import_node_path5.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "..", "package.json");
+    const pkgPath = (0, import_node_path6.join)((0, import_node_path6.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "..", "package.json");
     const pkg = JSON.parse(getFileContentSync(pkgPath));
     if (typeof pkg.version === "string")
       return pkg.version;
@@ -15590,43 +15758,6 @@ var FileCheckClient = class {
   }
 };
 
-// ../core/dist/model-storage.js
-var import_node_fs = require("node:fs");
-var import_node_path6 = require("node:path");
-init_config();
-var MODEL_SCHEMA_VERSION = "v2";
-var REQUIRED_MODELS_BY_SCHEMA = {
-  v1: ["pi-model"],
-  v2: ["pi-model"]
-};
-var REQUIRED_MODEL_FILES = {
-  "pi-model": [
-    "model_int8.onnx",
-    "tokenizer.json",
-    "tokenizer_config.json",
-    "special_tokens_map.json",
-    "vocab.txt",
-    "config.json"
-  ]
-};
-function getModelStorageRoot(sageDir = resolvePath("~/.sage")) {
-  return (0, import_node_path6.join)(resolvePath(sageDir), "models");
-}
-function getModelDir(modelName, schema = MODEL_SCHEMA_VERSION, sageDir) {
-  return (0, import_node_path6.join)(getModelStorageRoot(sageDir), schema, modelName);
-}
-function isModelPresent(modelName, schema = MODEL_SCHEMA_VERSION, sageDir) {
-  const dir = getModelDir(modelName, schema, sageDir);
-  const files = REQUIRED_MODEL_FILES[modelName];
-  if (!files || files.length === 0)
-    return false;
-  return files.every((f) => (0, import_node_fs.existsSync)((0, import_node_path6.resolve)(dir, f)));
-}
-function missingRequiredModels(schema = MODEL_SCHEMA_VERSION, sageDir) {
-  const required = REQUIRED_MODELS_BY_SCHEMA[schema] ?? [];
-  return required.filter((name) => !isModelPresent(name, schema, sageDir));
-}
-
 // ../core/dist/clients/model-downloader.js
 init_types2();
 var STALE_LOCK_MS = 60 * 60 * 1e3;
@@ -15967,6 +16098,8 @@ var RegistryClient = class {
 };
 
 // ../core/dist/clients/pi-check.js
+var import_node_crypto5 = require("node:crypto");
+var import_promises3 = require("node:fs/promises");
 var import_node_path9 = require("node:path");
 init_types2();
 var DEFAULT_MAX_CONTENT_LENGTH2 = 16384;
@@ -15981,6 +16114,18 @@ var MODEL_METADATA_FILES = [
   "vocab.txt",
   MODEL_FILE
 ];
+async function computeModelVersion(modelPath, logger = nullLogger) {
+  try {
+    const hash = (0, import_node_crypto5.createHash)("sha256");
+    for (const name of MODEL_METADATA_FILES) {
+      hash.update(await (0, import_promises3.readFile)((0, import_node_path9.resolve)(modelPath, name)));
+    }
+    return hash.digest("hex").slice(0, 8);
+  } catch (err) {
+    logger.warn(`PI model version unavailable; hits keep the model-id detection name: ${err instanceof Error ? err.message : String(err)}`);
+    return void 0;
+  }
+}
 function softmax(logits) {
   const max = Math.max(...logits);
   const exp = logits.map((x) => Math.exp(x - max));
@@ -16005,6 +16150,7 @@ var BundledPiProvider = class _BundledPiProvider {
   logger;
   tokenizer = null;
   session = null;
+  modelVersion;
   tensorClass = null;
   inputNames = /* @__PURE__ */ new Set();
   initPromise = null;
@@ -16070,6 +16216,7 @@ var BundledPiProvider = class _BundledPiProvider {
         findings,
         contentName: context,
         modelId,
+        modelVersion: this.modelVersion,
         contentSnippet: maxChunk || void 0
       };
       this.logger.info("PI model inference completed", {
@@ -16112,6 +16259,7 @@ var BundledPiProvider = class _BundledPiProvider {
       this.session = await runtime.InferenceSession.create(modelFilePath);
       const sess = this.session;
       this.inputNames = new Set(sess.inputNames);
+      this.modelVersion = await computeModelVersion(this.modelPath, this.logger);
       _BundledPiProvider.modelRuntimeLoaded = true;
       this.logger.info("PI model loaded", { path: this.modelPath });
       return true;
@@ -16303,6 +16451,7 @@ var SkillCheckClient = class {
   parseResult(skillId, raw) {
     return {
       skillId,
+      jobId: typeof raw.job_id === "string" ? raw.job_id : void 0,
       verdict: typeof raw.verdict === "string" ? raw.verdict : void 0,
       summary: typeof raw.summary === "string" ? raw.summary : void 0
     };
@@ -16313,7 +16462,7 @@ var SkillCheckClient = class {
 init_config();
 
 // ../core/dist/config-defaults.js
-var import_promises3 = require("node:fs/promises");
+var import_promises4 = require("node:fs/promises");
 var import_node_path10 = require("node:path");
 init_file_utils();
 init_types2();
@@ -16344,11 +16493,11 @@ async function deployConfigDefaults(sageDirPath, logger = nullLogger) {
   const targetPath = (0, import_node_path10.join)(sageDirPath, CONFIG_DEFAULTS_FILENAME);
   const defaults = serializeConfigDefaults();
   try {
-    await (0, import_promises3.mkdir)(sageDirPath, { recursive: true, mode: 448 });
-    await (0, import_promises3.chmod)(sageDirPath, 448);
+    await (0, import_promises4.mkdir)(sageDirPath, { recursive: true, mode: 448 });
+    await (0, import_promises4.chmod)(sageDirPath, 448);
     let existing = null;
     try {
-      existing = await (0, import_promises3.readFile)(targetPath, "utf-8");
+      existing = await (0, import_promises4.readFile)(targetPath, "utf-8");
     } catch {
     }
     if (existing) {
@@ -16365,7 +16514,7 @@ async function deployConfigDefaults(sageDirPath, logger = nullLogger) {
         return;
     }
     await withFileLock(targetPath, async () => {
-      await (0, import_promises3.writeFile)(targetPath, defaults, { encoding: "utf-8", mode: 384 });
+      await (0, import_promises4.writeFile)(targetPath, defaults, { encoding: "utf-8", mode: 384 });
       logger.debug("Deployed config defaults", {
         path: targetPath,
         schemaVersion: CONFIG_DEFAULTS_SCHEMA_VERSION
@@ -16512,58 +16661,8 @@ function isScannableContent(content) {
   return SNIFF_HTML.test(head) || SNIFF_HTML_TAGS.test(head) || SNIFF_JSON.test(head) || SNIFF_XML.test(head) || SNIFF_YAML.test(head) || SNIFF_SHEBANG_SHELL.test(head) || SNIFF_SHEBANG_PYTHON.test(head) || SNIFF_PYTHON.test(head) || SNIFF_JS_TS.test(head) || SNIFF_C_CPP.test(head) || SNIFF_KOTLIN.test(head) || SNIFF_CSV.test(head);
 }
 
-// ../core/dist/detection-names.js
-var PI_DETECTION_NAME = "Other:SagePromptInjectionML-A [Susp]";
-var REPORTING_ENGINE_SHORTHANDS = {
-  package: "sgpk",
-  amsi: "sgam",
-  heuristics: "sghe",
-  ml: "sgml"
-};
-var REPORTING_DETECTION_SUFFIX = "sage";
-function formatReportingDetectionName(canonicalName, engine, optionalData = "") {
-  const engineMetadata = optionalData ? `${REPORTING_ENGINE_SHORTHANDS[engine]}:${optionalData}` : REPORTING_ENGINE_SHORTHANDS[engine];
-  return `${canonicalName}|${engineMetadata}|${REPORTING_DETECTION_SUFFIX}`;
-}
-var PACKAGE_DETECTION_NAMES = {
-  not_found: "Other:SagePackageNotFound-A [Susp]",
-  suspicious_age: "Other:SagePackageNew-A [Susp]",
-  malicious: "Other:SagePackageMalicious-A [Trj]",
-  unknown: "Other:SagePackageUnknown-A [Susp]"
-};
-var AMSI_DETECTION_NAMES = {
-  detected: "Other:SageAmsiDetected-A [Heur]",
-  blocked_by_admin: "Other:SageAmsiBlockedByAdmin-A [Heur]",
-  unknown: "Other:SageAmsiUnknown-A [Susp]"
-};
-var AMSI_REPORTING_RULE_NAMES = {
-  detected: "AMSI_DETECTED",
-  blocked_by_admin: "AMSI_BLOCKED_BY_ADMIN",
-  unknown: "AMSI_UNKNOWN"
-};
-function isCanonicalDetectionName(name) {
-  return /^\w+:\w+-[A-Z]+ \[[^\]\r\n]+\]$/.test(name);
-}
-function packageDetectionName(verdict) {
-  return PACKAGE_DETECTION_NAMES[verdict];
-}
-function amsiDetectionClass(amsiResult) {
-  if (amsiResult >= 32768)
-    return "detected";
-  if (amsiResult >= 16384)
-    return "blocked_by_admin";
-  return "unknown";
-}
-function amsiDetectionName(amsiResult) {
-  return AMSI_DETECTION_NAMES[amsiDetectionClass(amsiResult)];
-}
-function amsiReportingData(amsiResult) {
-  const ruleName = AMSI_REPORTING_RULE_NAMES[amsiDetectionClass(amsiResult)];
-  return `${ruleName}:${Math.trunc(amsiResult).toString(16)}`;
-}
-
 // ../core/dist/extended-info.js
-var import_promises4 = require("node:fs/promises");
+var import_promises5 = require("node:fs/promises");
 var import_node_os3 = require("node:os");
 var import_node_path11 = require("node:path");
 init_file_utils();
@@ -16643,7 +16742,7 @@ async function loadExtendedInfo(sageDirPath, logger = nullLogger) {
 async function loadExtendedInfoUncached(filePath, logger) {
   let size;
   try {
-    const info = await (0, import_promises4.stat)(filePath);
+    const info = await (0, import_promises5.stat)(filePath);
     if (!info.isFile()) {
       logger.debug(`extended-info: not a regular file at ${filePath}`);
       return null;
@@ -16730,8 +16829,8 @@ function mergeExtendedInfo(envelope, extendedInfo) {
 }
 
 // ../core/dist/installation-id.js
-var import_node_crypto4 = require("node:crypto");
-var import_promises5 = require("node:fs/promises");
+var import_node_crypto6 = require("node:crypto");
+var import_promises6 = require("node:fs/promises");
 var import_node_path12 = require("node:path");
 init_config();
 init_file_utils();
@@ -16748,9 +16847,9 @@ async function getInstallationId(sageDirPath) {
   } catch {
   }
   try {
-    const id = (0, import_node_crypto4.randomUUID)();
-    await (0, import_promises5.mkdir)(sageDir, { recursive: true, mode: 448 });
-    await (0, import_promises5.writeFile)(idPath, id, { encoding: "utf-8", mode: 384, flag: fileExists ? "w" : "wx" });
+    const id = (0, import_node_crypto6.randomUUID)();
+    await (0, import_promises6.mkdir)(sageDir, { recursive: true, mode: 448 });
+    await (0, import_promises6.writeFile)(idPath, id, { encoding: "utf-8", mode: 384, flag: fileExists ? "w" : "wx" });
     return id;
   } catch (err) {
     if (err.code === "EEXIST") {
@@ -16934,6 +17033,10 @@ var DecisionEngine = class {
     this.askThreshold = policy.askThreshold;
     this.logger = logger;
   }
+  /** Whether these sources contain a decision signal independent of custom rules. */
+  hasNonCustomDetection(sources) {
+    return this.collectSignals(sources.heuristicMatches, sources.urlCheckResults, sources.packageCheckResults, sources.amsiCheckResults, sources.piCheckResults, sources.piThresholds).some((signal) => signal.customThreat !== true);
+  }
   async decide(sources) {
     const signals = this.collectSignals(sources.heuristicMatches, sources.urlCheckResults, sources.packageCheckResults, sources.amsiCheckResults, sources.piCheckResults, sources.piThresholds);
     if (signals.length === 0) {
@@ -16952,12 +17055,15 @@ var DecisionEngine = class {
       source: top.source,
       artifacts: allArtifacts,
       matchedThreatId: top.threatId,
+      customThreat: top.customThreat,
       reasons: allReasons
     };
   }
   collectSignals(heuristicMatches, urlCheckResults, packageCheckResults, amsiCheckResults, piCheckResults, piThresholds) {
     const signals = [];
     for (const match of heuristicMatches) {
+      if (isSubmitOnlyThreat(match.threat))
+        continue;
       const { confidence, category, severity, id, title } = match.threat;
       if (applyPolicy(confidence, this.denyThreshold, this.askThreshold, this.logger) === "allow")
         continue;
@@ -16967,6 +17073,7 @@ var DecisionEngine = class {
         severity,
         source: "heuristic",
         threatId: id,
+        customThreat: match.threat.customRule === true,
         reason: title,
         artifact: match.artifact
       });
@@ -17092,43 +17199,422 @@ var DecisionEngine = class {
 };
 
 // ../core/dist/evaluator.js
-var import_node_crypto6 = require("node:crypto");
-init_config();
-
-// ../core/dist/exceptions.js
-var import_node_crypto5 = require("node:crypto");
-var import_node_path15 = require("node:path");
+var import_node_crypto8 = require("node:crypto");
 init_config();
-init_file_utils();
 
-// ../core/dist/trusted-domains.js
-var import_promises6 = require("node:fs/promises");
-var import_node_path14 = require("node:path");
-var import_yaml = __toESM(require_dist(), 1);
-init_file_utils();
-init_types2();
-async function loadTrustedDomains(trustedDomainsDir, logger = nullLogger) {
-  let files;
-  try {
-    files = (await (0, import_promises6.readdir)(trustedDomainsDir)).filter((f) => f.endsWith(".yaml")).sort();
-  } catch {
-    logger.debug("Trusted domains directory does not exist", { path: trustedDomainsDir });
-    return [];
-  }
-  const domains = [];
-  for (const filename of files) {
-    const filePath = (0, import_node_path14.join)(trustedDomainsDir, filename);
-    let content;
-    try {
-      content = await getFileContent(filePath);
-    } catch (e) {
-      logger.warn(`Failed to read ${filename}`, { error: String(e) });
-      continue;
-    }
-    let data;
-    try {
-      data = (0, import_yaml.parse)(content);
-    } catch (e) {
+// ../core/dist/extractors.js
+var URL_PATTERN = /https?:\/\/[^\s"')<>[\]{}]+/g;
+var TRAILING_PUNCT = /[.,;:!?]+$/;
+var MAX_CONTENT_SIZE = 64 * 1024;
+var BASE64_DECODE_EXEC = /\b(echo|printf|cat)\b[^|]*\|\s*base64\s+(-d|--decode)[^|]*\|\s*(bash|sh|zsh|ksh|dash|python|perl|ruby|node)\b/;
+var PRINTF_ENCODE_EXEC = /\bprintf\b\s+['"](\\x[0-9a-fA-F]{2}|\\[0-7]{3})[^|]*\|\s*(bash|sh|zsh|ksh|dash)\b/;
+var VAR_INTERPOLATION_URL = /\b(curl|wget|fetch)\b[^|;]*(\$\{?\w+\}?\.\$\{?\w+\}?|\$\{?\w+\}?:\/\/)/;
+var SHELLS = "bash|sh|zsh|ksh|dash";
+function extractUrls(text) {
+  const seen = /* @__PURE__ */ new Set();
+  const urls = [];
+  for (const match of text.matchAll(URL_PATTERN)) {
+    const url = match[0].replace(TRAILING_PUNCT, "");
+    if (!seen.has(url)) {
+      seen.add(url);
+      urls.push(url);
+    }
+  }
+  return urls;
+}
+function escapeRegExp(str) {
+  const regExpEscape = RegExp.escape;
+  if (regExpEscape) {
+    return regExpEscape(str);
+  }
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function stripHeredocs(command) {
+  return command.replace(/<<-?\s*['"]?(\w+)['"]?\n[\s\S]*?\n[ \t]*\1\b/g, "<<$1");
+}
+function extractFromBash(command) {
+  const artifacts = [];
+  const effective = stripHeredocs(command);
+  artifacts.push({ type: "command", value: effective });
+  if (BASE64_DECODE_EXEC.test(effective)) {
+    artifacts.push({ type: "command", value: effective, context: "base64_decode_exec" });
+  }
+  if (PRINTF_ENCODE_EXEC.test(effective)) {
+    artifacts.push({ type: "command", value: effective, context: "printf_encode_exec" });
+  }
+  if (VAR_INTERPOLATION_URL.test(effective)) {
+    artifacts.push({ type: "command", value: effective, context: "variable_interpolation_url" });
+  }
+  for (const url of extractUrls(command)) {
+    let context;
+    const escaped = escapeRegExp(url);
+    const directPipe = new RegExp(escaped + String.raw`[^|]*\|\s*(${SHELLS})\b`);
+    const wrappedPipe = new RegExp(escaped + String.raw`[^|]*\|\s*\S+\s+(\S+\s+)?(${SHELLS})\b`);
+    const subshellExec = new RegExp(`${String.raw`(\$\(|`}\`)${escaped}[^)\`]*${String.raw`\|\s*(${SHELLS})\b`}`);
+    if (directPipe.test(command) || wrappedPipe.test(command) || subshellExec.test(command)) {
+      context = "piped to shell";
+    }
+    artifacts.push({ type: "url", value: url, context });
+  }
+  return artifacts;
+}
+function extractFromWebFetch(toolInput) {
+  const url = toolInput.url;
+  if (url && typeof url === "string") {
+    return [{ type: "url", value: url, context: "webfetch" }];
+  }
+  return [];
+}
+function extractFileArtifacts(toolInput, filePathKey, contentKey, contextName, urlContextName) {
+  const artifacts = [];
+  const filePath = toolInput[filePathKey];
+  if (filePath && typeof filePath === "string") {
+    artifacts.push({ type: "file_path", value: filePath, context: contextName });
+  }
+  const content = toolInput[contentKey];
+  if (content && typeof content === "string" && content.trim()) {
+    const capped = content.slice(0, MAX_CONTENT_SIZE);
+    artifacts.push({ type: "content", value: capped, context: contextName });
+    for (const url of extractUrls(capped)) {
+      artifacts.push({ type: "url", value: url, context: urlContextName });
+    }
+  }
+  return artifacts;
+}
+function extractFromWrite(toolInput) {
+  return extractFileArtifacts(toolInput, "file_path", "content", "write", "from_file_content");
+}
+function extractFromEdit(toolInput) {
+  return extractFileArtifacts(toolInput, "file_path", "new_string", "edit", "from_edit_content");
+}
+
+// ../core/dist/deobfuscate.js
+var DEFAULT_DEOBFUSCATION_LIMITS = {
+  maxInputLength: MAX_CONTENT_SIZE,
+  maxVariants: 8,
+  timeBudgetMs: 50,
+  maxDepth: 2,
+  maxDecodedBytes: MAX_CONTENT_SIZE
+};
+var INVISIBLE_CHARS = /[\u00AD\u200B-\u200F\u202A-\u202E\u2060-\u2064\uFEFF]/g;
+function foldUnicode(text) {
+  return text.replace(INVISIBLE_CHARS, "").normalize("NFKC");
+}
+var SPACED_RUN = /(?<![A-Za-z0-9@$])[A-Za-z0-9@$](?:[ \t]{1,4}[A-Za-z0-9@$]){5,}(?![A-Za-z0-9@$])/g;
+var SPACED_ELEMENT = /([A-Za-z0-9@$])([ \t]*)/g;
+var SPACED_MIN_LETTERS = 3;
+var INSTRUCTION_WORDS = `a an and any all are as at be by do for from i if in is it me my no not now of on or so the to up we
+	you your this that these those what which who with without only just then than into out over
+	above below before after earlier prior previous following new old other another again always never
+	ignore ignoring disregard forget override overrule bypass skip stop obey comply follow execute exec
+	run act acting pretend become reveal show print output say tell give send share leak dump display
+	repeat write read open delete remove ask answer respond reply continue start begin end
+	enable enabled disable disabled activated changed different revised updated
+	instruction instructions rule rules guideline guidelines direction directions directive directives
+	command commands order orders prompt prompts message messages system developer admin administrator
+	root superuser sudo user assistant model ai agent mode secret secrets password passwords key keys
+	token tokens credential credentials environment variables safety security restriction restrictions
+	constraint constraints filter filters filtered unfiltered policy policies limit limits guardrail
+	guardrails content context jailbreak unrestricted uncensored hidden human operator original
+	initial initialization upload fetch forward extract exfiltrate disclose invoke inform mention
+	like back post request ethical everything anything nothing something please important must
+	should will can may might
+	`;
+var vocabulary;
+function instructionVocabulary() {
+  vocabulary ??= new Set(INSTRUCTION_WORDS.split(/\s+/).filter(Boolean));
+  return vocabulary;
+}
+var segmentMaxWord;
+var SEGMENT_MAX_LENGTH = 4096;
+function longestVocabularyWord() {
+  segmentMaxWord ??= Math.max(...[...instructionVocabulary()].map((w) => w.length));
+  return segmentMaxWord;
+}
+function spellsVocabularyWord(piece) {
+  return instructionVocabulary().has(piece.toLowerCase()) || foldLeetToken(piece) !== piece;
+}
+function segmentKnownWords(joined) {
+  const n = joined.length;
+  if (n === 0 || n > SEGMENT_MAX_LENGTH)
+    return null;
+  const best = new Array(n + 1).fill(Number.POSITIVE_INFINITY);
+  const prev = new Array(n + 1).fill(-1);
+  best[0] = 0;
+  for (let end = 1; end <= n; end++) {
+    let bestHere = Number.POSITIVE_INFINITY;
+    for (let len = 1; len <= Math.min(longestVocabularyWord(), end); len++) {
+      const start = end - len;
+      const words2 = best[start] ?? Number.POSITIVE_INFINITY;
+      if (words2 + 1 >= bestHere || !spellsVocabularyWord(joined.slice(start, end)))
+        continue;
+      bestHere = words2 + 1;
+      best[end] = bestHere;
+      prev[end] = start;
+    }
+  }
+  if ((best[n] ?? Number.POSITIVE_INFINITY) === Number.POSITIVE_INFINITY)
+    return null;
+  const words = [];
+  for (let end = n; end > 0; ) {
+    const start = prev[end] ?? 0;
+    words.push(joined.slice(start, end));
+    end = start;
+  }
+  return words.reverse().join(" ");
+}
+function collapseSpacedRun(run) {
+  const elements = [];
+  for (const m of run.matchAll(SPACED_ELEMENT)) {
+    elements.push({ ch: m[1] ?? "", gap: (m[2] ?? "").length });
+  }
+  const letters = elements.reduce((n, e) => n + (/[A-Za-z]/.test(e.ch) ? 1 : 0), 0);
+  if (letters < SPACED_MIN_LETTERS)
+    return run;
+  const gaps = elements.slice(0, -1).map((e) => e.gap);
+  const minGap = Math.min(...gaps);
+  const uniform = gaps.every((g) => g === minGap);
+  let out = "";
+  elements.forEach((e, i) => {
+    out += e.ch;
+    if (i < elements.length - 1 && e.gap > minGap)
+      out += " ";
+  });
+  return uniform ? segmentKnownWords(out) ?? out : out;
+}
+function collapseSpaced(text) {
+  return text.replace(SPACED_RUN, collapseSpacedRun);
+}
+var LEET_MAP = {
+  "0": "o",
+  "3": "e",
+  "4": "a",
+  "5": "s",
+  "7": "t",
+  "@": "a",
+  $: "s"
+};
+var WORD_TOKEN = /[A-Za-z0-9@$]+/g;
+var LETTER = /[A-Za-z]/;
+var LEET_CHARS = /[0-9@$]/;
+var LEET_MIN_TOKEN = 3;
+var NUMBER_WITH_SUFFIX = /^[0-9]+[A-Za-z]$/;
+function foldLeetToken(token) {
+  if (token.length < LEET_MIN_TOKEN || !LETTER.test(token) || !LEET_CHARS.test(token)) {
+    return token;
+  }
+  if (NUMBER_WITH_SUFFIX.test(token))
+    return token;
+  for (const one of ["i", "l"]) {
+    let folded = "";
+    for (const ch of token)
+      folded += ch === "1" ? one : LEET_MAP[ch] ?? ch;
+    if (instructionVocabulary().has(folded.toLowerCase()))
+      return folded;
+    if (!token.includes("1"))
+      break;
+  }
+  return token;
+}
+function foldLeet(text) {
+  return text.replace(WORD_TOKEN, foldLeetToken);
+}
+var BASE64_CANDIDATE = /(?<![A-Za-z0-9+/_-])[A-Za-z0-9+/_-]{16,}={0,2}(?![A-Za-z0-9+/=_-])/g;
+var BASE64_MIN_ALNUM_RATIO = 0.85;
+var HEX_CONTIGUOUS = /(?<![0-9A-Za-z])(?:[0-9A-Fa-f]{2}){8,}[0-9A-Fa-f]?(?![0-9A-Za-z])/g;
+var HEX_ESCAPES = /(?:\\x[0-9A-Fa-f]{2}){6,}/g;
+var HEX_SEPARATED = /(?<![0-9A-Za-z])[0-9A-Fa-f]{2}(?:[ :,-][0-9A-Fa-f]{2}){7,}(?![0-9A-Za-z])/g;
+var MIN_DECODED_BYTES = 8;
+var MIN_PRINTABLE_RATIO = 0.95;
+var MIN_WORDISH_RATIO = 0.6;
+var WORDISH = /[\p{L}\s]/u;
+var REPLACEMENT_CHAR = String.fromCharCode(65533);
+function decodeIfText(bytes) {
+  if (bytes.length < MIN_DECODED_BYTES)
+    return null;
+  const text = bytes.toString("utf8");
+  if (text.includes(REPLACEMENT_CHAR))
+    return null;
+  let total = 0;
+  let printable = 0;
+  let wordish = 0;
+  for (const ch of text) {
+    total++;
+    const c = ch.codePointAt(0) ?? 0;
+    if (c >= 32 && c < 127 || c === 9 || c === 10 || c === 13 || c >= 160) {
+      printable++;
+    }
+    if (WORDISH.test(ch))
+      wordish++;
+  }
+  if (total === 0)
+    return null;
+  if (printable / total < MIN_PRINTABLE_RATIO)
+    return null;
+  if (wordish / total < MIN_WORDISH_RATIO && !isHexDump(text))
+    return null;
+  return text;
+}
+function isHexDump(text) {
+  const digits = text.replace(/\\x|[\s:,-]/g, "");
+  return digits.length >= 16 && digits.length % 2 === 0 && /^[0-9A-Fa-f]+$/.test(digits);
+}
+function alnumRatio(s) {
+  let n = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c >= 48 && c <= 57 || c >= 65 && c <= 90 || c >= 97 && c <= 122)
+      n++;
+  }
+  return n / s.length;
+}
+function decodeCandidates(candidates, toBytes, budget) {
+  const decoded = [];
+  for (const candidate of candidates) {
+    if (budget.bytesLeft < MIN_DECODED_BYTES)
+      break;
+    const bytes = toBytes(candidate);
+    if (bytes === null || bytes.length > budget.bytesLeft)
+      continue;
+    const text = decodeIfText(bytes);
+    if (text === null)
+      continue;
+    budget.bytesLeft -= bytes.length;
+    decoded.push(text);
+  }
+  return decoded.length > 0 ? decoded.join("\n") : null;
+}
+function base64Bytes(candidate) {
+  const token = candidate.replace(/=+$/, "");
+  if (token.length % 4 === 1 || alnumRatio(token) < BASE64_MIN_ALNUM_RATIO)
+    return null;
+  if (!LETTER.test(token))
+    return null;
+  return Buffer.from(token.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+}
+function hexBytes(candidate) {
+  const digits = candidate.replace(/\\x|[^0-9A-Fa-f]/g, "");
+  return Buffer.from(digits.length % 2 === 1 ? digits.slice(0, -1) : digits, "hex");
+}
+function decodeBase64Snippets(text, budget) {
+  return decodeCandidates(text.matchAll(BASE64_CANDIDATE), (m) => base64Bytes(m[0]), budget);
+}
+function decodeHexSnippets(text, budget) {
+  const matches = [HEX_CONTIGUOUS, HEX_ESCAPES, HEX_SEPARATED].flatMap((p) => [
+    ...text.matchAll(p)
+  ]);
+  return decodeCandidates(matches, (m) => hexBytes(m[0]), budget);
+}
+function exhausted(run) {
+  return Date.now() > run.deadline || run.variants.length >= run.limits.maxVariants;
+}
+function addVariant(run, text, techniques) {
+  const { maxInputLength, maxVariants } = run.limits;
+  const clamped = text.length > maxInputLength ? text.slice(0, maxInputLength) : text;
+  if (run.seen.has(clamped) || run.variants.length >= maxVariants)
+    return false;
+  run.seen.add(clamped);
+  run.variants.push({ text: clamped, techniques });
+  return true;
+}
+function expand(run, text, depth, prefix) {
+  let current = text;
+  const applied = [...prefix];
+  const folded = foldUnicode(current);
+  if (folded !== current) {
+    current = folded;
+    applied.push("unicode");
+    addVariant(run, current, [...applied]);
+  }
+  const decodeSource = current;
+  if (!exhausted(run)) {
+    const collapsed = collapseSpaced(current);
+    if (collapsed !== current) {
+      current = collapsed;
+      applied.push("spaced");
+      addVariant(run, current, [...applied]);
+    }
+  }
+  if (!exhausted(run)) {
+    const leetFolded = foldLeet(current);
+    if (leetFolded !== current)
+      addVariant(run, leetFolded, [...applied, "leet"]);
+  }
+  if (depth >= run.limits.maxDepth)
+    return;
+  const decoders = [
+    ["base64", decodeBase64Snippets],
+    ["hex", decodeHexSnippets]
+  ];
+  for (const [technique, decode] of decoders) {
+    if (exhausted(run))
+      return;
+    const decoded = decode(decodeSource, run.budget);
+    if (decoded === null)
+      continue;
+    const techniques = [...prefix, technique];
+    if (addVariant(run, decoded, techniques)) {
+      expand(run, decoded, depth + 1, techniques);
+    }
+  }
+}
+function deobfuscate(input, limits = {}) {
+  const resolved = { ...DEFAULT_DEOBFUSCATION_LIMITS, ...limits };
+  const original = input.length > resolved.maxInputLength ? input.slice(0, resolved.maxInputLength) : input;
+  const run = {
+    limits: resolved,
+    deadline: Date.now() + resolved.timeBudgetMs,
+    seen: /* @__PURE__ */ new Set([original]),
+    variants: [],
+    budget: { bytesLeft: resolved.maxDecodedBytes }
+  };
+  if (!original)
+    return run.variants;
+  try {
+    expand(run, original, 0, []);
+  } catch {
+  }
+  return run.variants;
+}
+var DEOBFUSCATED_CONTEXT_PREFIX = "deobfuscated:";
+function deobfuscationContext(techniques) {
+  return `${DEOBFUSCATED_CONTEXT_PREFIX}${techniques.join("+")}`;
+}
+
+// ../core/dist/exceptions.js
+var import_node_crypto7 = require("node:crypto");
+var import_node_path15 = require("node:path");
+init_config();
+init_file_utils();
+
+// ../core/dist/trusted-domains.js
+var import_promises7 = require("node:fs/promises");
+var import_node_path14 = require("node:path");
+var import_yaml = __toESM(require_dist(), 1);
+init_file_utils();
+init_types2();
+async function loadTrustedDomains(trustedDomainsDir, logger = nullLogger) {
+  let files;
+  try {
+    files = (await (0, import_promises7.readdir)(trustedDomainsDir)).filter((f) => f.endsWith(".yaml")).sort();
+  } catch {
+    logger.debug("Trusted domains directory does not exist", { path: trustedDomainsDir });
+    return [];
+  }
+  const domains = [];
+  for (const filename of files) {
+    const filePath = (0, import_node_path14.join)(trustedDomainsDir, filename);
+    let content;
+    try {
+      content = await getFileContent(filePath);
+    } catch (e) {
+      logger.warn(`Failed to read ${filename}`, { error: String(e) });
+      continue;
+    }
+    let data;
+    try {
+      data = (0, import_yaml.parse)(content);
+    } catch (e) {
       logger.warn(`Failed to parse ${filename}`, { error: String(e) });
       continue;
     }
@@ -17182,7 +17668,7 @@ init_types2();
 var MAX_RULES_WARNING = 100;
 var REGEX_TIMEOUT_MS = 50;
 function computeRuleId(decision, match, pattern) {
-  const hash = (0, import_node_crypto5.createHash)("sha256").update(`${decision}:${match}:${pattern}`).digest("hex");
+  const hash = (0, import_node_crypto7.createHash)("sha256").update(`${decision}:${match}:${pattern}`).digest("hex");
   return hash.slice(0, 8);
 }
 async function loadExceptions(config2, logger = nullLogger) {
@@ -17548,93 +18034,8 @@ function matchesArtifact(rule, artifact) {
   }
 }
 
-// ../core/dist/extractors.js
-var URL_PATTERN = /https?:\/\/[^\s"')<>[\]{}]+/g;
-var TRAILING_PUNCT = /[.,;:!?]+$/;
-var MAX_CONTENT_SIZE = 64 * 1024;
-var BASE64_DECODE_EXEC = /\b(echo|printf|cat)\b[^|]*\|\s*base64\s+(-d|--decode)[^|]*\|\s*(bash|sh|zsh|ksh|dash|python|perl|ruby|node)\b/;
-var PRINTF_ENCODE_EXEC = /\bprintf\b\s+['"](\\x[0-9a-fA-F]{2}|\\[0-7]{3})[^|]*\|\s*(bash|sh|zsh|ksh|dash)\b/;
-var VAR_INTERPOLATION_URL = /\b(curl|wget|fetch)\b[^|;]*(\$\{?\w+\}?\.\$\{?\w+\}?|\$\{?\w+\}?:\/\/)/;
-var SHELLS = "bash|sh|zsh|ksh|dash";
-function extractUrls(text) {
-  const seen = /* @__PURE__ */ new Set();
-  const urls = [];
-  for (const match of text.matchAll(URL_PATTERN)) {
-    const url = match[0].replace(TRAILING_PUNCT, "");
-    if (!seen.has(url)) {
-      seen.add(url);
-      urls.push(url);
-    }
-  }
-  return urls;
-}
-function escapeRegExp(str) {
-  const regExpEscape = RegExp.escape;
-  if (regExpEscape) {
-    return regExpEscape(str);
-  }
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function stripHeredocs(command) {
-  return command.replace(/<<-?\s*['"]?(\w+)['"]?\n[\s\S]*?\n[ \t]*\1\b/g, "<<$1");
-}
-function extractFromBash(command) {
-  const artifacts = [];
-  const effective = stripHeredocs(command);
-  artifacts.push({ type: "command", value: effective });
-  if (BASE64_DECODE_EXEC.test(effective)) {
-    artifacts.push({ type: "command", value: effective, context: "base64_decode_exec" });
-  }
-  if (PRINTF_ENCODE_EXEC.test(effective)) {
-    artifacts.push({ type: "command", value: effective, context: "printf_encode_exec" });
-  }
-  if (VAR_INTERPOLATION_URL.test(effective)) {
-    artifacts.push({ type: "command", value: effective, context: "variable_interpolation_url" });
-  }
-  for (const url of extractUrls(command)) {
-    let context;
-    const escaped = escapeRegExp(url);
-    const directPipe = new RegExp(escaped + String.raw`[^|]*\|\s*(${SHELLS})\b`);
-    const wrappedPipe = new RegExp(escaped + String.raw`[^|]*\|\s*\S+\s+(\S+\s+)?(${SHELLS})\b`);
-    const subshellExec = new RegExp(`${String.raw`(\$\(|`}\`)${escaped}[^)\`]*${String.raw`\|\s*(${SHELLS})\b`}`);
-    if (directPipe.test(command) || wrappedPipe.test(command) || subshellExec.test(command)) {
-      context = "piped to shell";
-    }
-    artifacts.push({ type: "url", value: url, context });
-  }
-  return artifacts;
-}
-function extractFromWebFetch(toolInput) {
-  const url = toolInput.url;
-  if (url && typeof url === "string") {
-    return [{ type: "url", value: url, context: "webfetch" }];
-  }
-  return [];
-}
-function extractFileArtifacts(toolInput, filePathKey, contentKey, contextName, urlContextName) {
-  const artifacts = [];
-  const filePath = toolInput[filePathKey];
-  if (filePath && typeof filePath === "string") {
-    artifacts.push({ type: "file_path", value: filePath, context: contextName });
-  }
-  const content = toolInput[contentKey];
-  if (content && typeof content === "string" && content.trim()) {
-    const capped = content.slice(0, MAX_CONTENT_SIZE);
-    artifacts.push({ type: "content", value: capped, context: contextName });
-    for (const url of extractUrls(capped)) {
-      artifacts.push({ type: "url", value: url, context: urlContextName });
-    }
-  }
-  return artifacts;
-}
-function extractFromWrite(toolInput) {
-  return extractFileArtifacts(toolInput, "file_path", "content", "write", "from_file_content");
-}
-function extractFromEdit(toolInput) {
-  return extractFileArtifacts(toolInput, "file_path", "new_string", "edit", "from_edit_content");
-}
-
 // ../core/dist/heuristics.js
+var MAX_VARIANTS_PER_CALL = 16;
 var TRUSTED_DOMAIN_SUPPRESSIBLE = /* @__PURE__ */ new Set([
   "CLT-CMD-001",
   "CLT-CMD-002",
@@ -17695,6 +18096,51 @@ var HeuristicsEngine = class {
     }
     return matches;
   }
+  /**
+   * Match deobfuscated variants of the `content` artifacts against this
+   * engine's prompt-injection rules only. Command, credential, URL and other
+   * rules never see decoded or folded text, so deobfuscation adds coverage for
+   * hidden instructions without widening any other rule's false-positive surface.
+   *
+   * A variant match is attributed to the *original* artifact (`artifact`), and
+   * only the short matched snippet (`matchValue`) comes from decoded text; the
+   * decoded variant itself is never stored or passed on.
+   *
+   * Each rule is reported at most once, and not at all when its ID is in
+   * `alreadyMatched` (the raw text already tripped it), so audit and telemetry
+   * signals are not duplicated.
+   */
+  matchDeobfuscated(artifacts, alreadyMatched = /* @__PURE__ */ new Set()) {
+    const piThreats = (this.threatMap.get("content") ?? []).filter((t) => t.category === "prompt_injection");
+    if (piThreats.length === 0)
+      return [];
+    const matches = [];
+    const reported = new Set(alreadyMatched);
+    let variantsLeft = MAX_VARIANTS_PER_CALL;
+    for (const artifact of artifacts) {
+      if (artifact.type !== "content")
+        continue;
+      for (const variant of deobfuscate(artifact.value)) {
+        if (variantsLeft-- <= 0)
+          return matches;
+        for (const threat of piThreats) {
+          if (reported.has(threat.id))
+            continue;
+          const m = threat.compiledPattern.exec(variant.text);
+          if (!m)
+            continue;
+          reported.add(threat.id);
+          matches.push({
+            threat,
+            artifact: artifact.value,
+            matchValue: m[0],
+            context: deobfuscationContext(variant.techniques)
+          });
+        }
+      }
+    }
+    return matches;
+  }
 };
 
 // ../core/dist/package-checker.js
@@ -18137,7 +18583,7 @@ function extractFromPackageJson(content) {
         continue;
       if (version === "" || version === "*")
         continue;
-      if (version.startsWith("file:") || version.startsWith("link:") || version.startsWith("git+") || version.startsWith("git:") || version.startsWith("http:") || version.startsWith("https:") || version.startsWith("workspace:") || version.startsWith("github:") || version.startsWith("bitbucket:") || version.startsWith("gitlab:") || version.startsWith("portal:") || version.startsWith("patch:"))
+      if (version.startsWith("catalog:") || version.startsWith("file:") || version.startsWith("link:") || version.startsWith("git+") || version.startsWith("git:") || version.startsWith("http:") || version.startsWith("https:") || version.startsWith("workspace:") || version.startsWith("github:") || version.startsWith("bitbucket:") || version.startsWith("gitlab:") || version.startsWith("portal:") || version.startsWith("patch:"))
         continue;
       if (version.startsWith("npm:")) {
         const aliasTarget = version.slice(4);
@@ -18234,12 +18680,98 @@ async function updateSessionStatus(sessionId, verdict) {
   await atomicWriteJson(statusFilePath(sessionId), status);
 }
 
-// ../core/dist/threat-loader.js
-var import_promises7 = require("node:fs/promises");
+// ../core/dist/submit-limits.js
+var import_promises8 = require("node:fs/promises");
 var import_node_path17 = require("node:path");
+init_config();
+init_file_utils();
+init_types2();
+var SUBMIT_LIMITS_SCHEMA_VERSION = 1;
+var SUBMIT_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function submitLimitsPath(sageDirPath) {
+  return (0, import_node_path17.join)(sageDirPath ?? resolvePath(SAGE_DIR), "submit-limits.json");
+}
+function isEligible(limits, ruleId, now) {
+  const last = limits[ruleId];
+  if (last === void 0)
+    return true;
+  return now - last >= SUBMIT_WINDOW_MS || last > now;
+}
+async function loadSubmitLimits(opts = {}) {
+  const logger = opts.logger ?? nullLogger;
+  let raw;
+  try {
+    raw = await getFileContent(submitLimitsPath(opts.sageDirPath));
+  } catch {
+    return {};
+  }
+  try {
+    const data = JSON.parse(raw);
+    const rules = data.rules ?? {};
+    const limits = {};
+    for (const [id, rec] of Object.entries(rules)) {
+      const last = rec?.last_submitted_ms;
+      if (typeof last === "number" && Number.isFinite(last))
+        limits[id] = last;
+    }
+    return limits;
+  } catch (e) {
+    logger.warn("Failed to parse submit limits; treating as empty", { error: String(e) });
+    return {};
+  }
+}
+async function saveSubmitLimits(limits, sageDirPath) {
+  await atomicWriteJson(submitLimitsPath(sageDirPath), {
+    schema_version: SUBMIT_LIMITS_SCHEMA_VERSION,
+    rules: Object.fromEntries(Object.entries(limits).map(([id, last]) => [id, { last_submitted_ms: last }]))
+  });
+}
+async function claimRuleSubmissions(ruleIds, opts = {}) {
+  const logger = opts.logger ?? nullLogger;
+  const unique = [...new Set(ruleIds)];
+  if (unique.length === 0)
+    return [];
+  const now = opts.now ?? Date.now();
+  const path = submitLimitsPath(opts.sageDirPath);
+  let claimed = [];
+  try {
+    await (0, import_promises8.mkdir)((0, import_node_path17.dirname)(path), { recursive: true });
+    await withFileLock(path, async () => {
+      const limits = await loadSubmitLimits(opts);
+      const eligible = opts.force ? unique : unique.filter((id) => isEligible(limits, id, now));
+      if (eligible.length === 0)
+        return;
+      const next = {};
+      for (const [id, last] of Object.entries(limits)) {
+        if (isEligible(limits, id, now))
+          continue;
+        next[id] = last;
+      }
+      for (const id of eligible)
+        next[id] = now;
+      await saveSubmitLimits(next, opts.sageDirPath);
+      claimed = eligible;
+    });
+  } catch (e) {
+    logger.warn("Failed to persist submit limits; suppressing submission", { error: String(e) });
+    return [];
+  }
+  if (claimed.length === 0)
+    logger.debug("Rule submissions capped", { ruleIds: unique });
+  return claimed;
+}
+
+// ../core/dist/threat-loader.js
+var import_promises9 = require("node:fs/promises");
+var import_node_path18 = require("node:path");
 var import_yaml2 = __toESM(require_dist(), 1);
+init_config();
 init_file_utils();
 init_types2();
+var MAX_THREAT_RULES = 1e4;
+function getUserThreatsDir(sageDirPath) {
+  return (0, import_node_path18.join)(resolvePath(sageDirPath ?? SAGE_DIR), "threats");
+}
 var REQUIRED_FIELDS = /* @__PURE__ */ new Set([
   "id",
   "version",
@@ -18298,13 +18830,21 @@ function isExpired(entry) {
     return false;
   return Date.now() > expiresAt.getTime();
 }
-async function loadThreats(threatDir, logger = nullLogger) {
+async function loadThreatDirectory(threatDir, logger, { custom: custom2 = false, customThreatIds = /* @__PURE__ */ new Set(), bundledThreatIds = /* @__PURE__ */ new Set(), maxRules = MAX_THREAT_RULES, logCustomRuleIds = false, optional = false } = {}) {
   const threats = [];
   let files;
   try {
-    files = (await (0, import_promises7.readdir)(threatDir)).filter((f) => f.endsWith(".yaml")).sort();
-  } catch {
-    logger.warn("Threat directory does not exist or is unreadable", { path: threatDir });
+    files = (await (0, import_promises9.readdir)(threatDir)).filter((f) => f.endsWith(".yaml")).sort();
+  } catch (error) {
+    const code = error.code;
+    if (optional && code === "ENOENT") {
+      logger.debug("Custom threat directory does not exist", { path: threatDir });
+      return threats;
+    }
+    logger.warn("Threat directory does not exist or is unreadable", {
+      path: threatDir,
+      error: String(error)
+    });
     return threats;
   }
   const ruleFiles = [];
@@ -18312,7 +18852,7 @@ async function loadThreats(threatDir, logger = nullLogger) {
   for (const filename of files) {
     let content;
     try {
-      content = await getFileContent((0, import_node_path17.join)(threatDir, filename));
+      content = await getFileContent((0, import_node_path18.join)(threatDir, filename));
     } catch (e) {
       logger.warn(`Failed to read ${filename}`, { error: String(e) });
       continue;
@@ -18338,8 +18878,15 @@ async function loadThreats(threatDir, logger = nullLogger) {
     }
     ruleFiles.push({ filename, data });
   }
-  for (const { filename, data } of ruleFiles) {
+  ruleFilesLoop: for (const { filename, data } of ruleFiles) {
     for (const entry of data) {
+      if (threats.length >= maxRules) {
+        logger.warn("Threat rule limit reached; ignoring remaining rules", {
+          path: threatDir,
+          maxRules: MAX_THREAT_RULES
+        });
+        break ruleFilesLoop;
+      }
       if (typeof entry !== "object" || entry === null) {
         logger.warn(`Skipping non-object entry in ${filename}`);
         continue;
@@ -18351,6 +18898,14 @@ async function loadThreats(threatDir, logger = nullLogger) {
         logger.warn(`Skipping threat in ${filename}: missing fields ${missing.join(", ")}`);
         continue;
       }
+      if (typeof record.id !== "string" || record.id.length === 0) {
+        logger.warn(`Skipping threat in ${filename}: invalid id`, { id: record.id });
+        continue;
+      }
+      if (custom2 && customThreatIds.has(record.id)) {
+        logger.warn(bundledThreatIds.has(record.id) ? `Skipping custom threat ${record.id}: id conflicts with a bundled rule` : `Skipping custom threat ${record.id}: duplicate custom rule id`, { id: record.id, path: (0, import_node_path18.join)(threatDir, filename) });
+        continue;
+      }
       if (record.revoked === true)
         continue;
       if (isExpired(record))
@@ -18392,7 +18947,7 @@ async function loadThreats(threatDir, logger = nullLogger) {
         });
         continue;
       }
-      threats.push({
+      const threat = {
         id: record.id,
         version,
         detectionName,
@@ -18405,13 +18960,41 @@ async function loadThreats(threatDir, logger = nullLogger) {
         title: record.title,
         expiresAt: parseExpiresAt(record.expires_at),
         revoked: false,
-        flags
-      });
+        flags,
+        customRule: custom2
+      };
+      threats.push(threat);
+      if (custom2) {
+        customThreatIds.add(threat.id);
+        if (logCustomRuleIds) {
+          logger.info("Loaded custom threat rule", {
+            id: threat.id,
+            path: (0, import_node_path18.join)(threatDir, filename)
+          });
+        }
+      }
     }
   }
   logger.debug(`Loaded ${threats.length} threats from ${threatDir}`);
   return threats;
 }
+async function loadThreats(threatDir, logger = nullLogger, options = {}) {
+  const bundledThreats = await loadThreatDirectory(threatDir, logger);
+  if (!options.customThreatsDir || (0, import_node_path18.resolve)(options.customThreatsDir) === (0, import_node_path18.resolve)(threatDir)) {
+    return bundledThreats;
+  }
+  const bundledThreatIds = new Set(bundledThreats.map((threat) => threat.id));
+  const customThreatIds = new Set(bundledThreatIds);
+  const customThreats = await loadThreatDirectory(options.customThreatsDir, logger, {
+    custom: true,
+    customThreatIds,
+    bundledThreatIds,
+    maxRules: Math.max(0, MAX_THREAT_RULES - bundledThreats.length),
+    logCustomRuleIds: options.logCustomRuleIds,
+    optional: true
+  });
+  return [...bundledThreats, ...customThreats];
+}
 
 // ../core/dist/evaluator.js
 init_types2();
@@ -18419,6 +19002,8 @@ var AMSI_CONTENT_SNIPPET_MAX = 200;
 var AMSI_CONTENT_NAME_MAX = 256;
 var HEURISTIC_PI_CONTENT_SNIPPET_MAX = 200;
 function buildHeuristicSignal(match) {
+  if (match.threat.customRule)
+    return void 0;
   return {
     detection_name: formatReportingDetectionName(match.threat.detectionName, "heuristics", `${match.threat.id}:${match.threat.version}`),
     rule_id: match.threat.id,
@@ -18434,7 +19019,7 @@ function resolvePiContentSnippet(piResults, heuristicMatches) {
   }
   if (highestRiskResult?.contentSnippet)
     return scrubHomePath(highestRiskResult.contentSnippet);
-  const heuristicMatch = heuristicMatches.find((match) => match.threat.category === "prompt_injection");
+  const heuristicMatch = heuristicMatches.find((match) => !match.threat.customRule && match.threat.category === "prompt_injection");
   if (!heuristicMatch)
     return void 0;
   const snippet = safeTruncate(scrubHomePath(heuristicMatch.matchValue), HEURISTIC_PI_CONTENT_SNIPPET_MAX);
@@ -18485,7 +19070,7 @@ function shouldSkipPromptInjectionForLocalMarkdown(request) {
 async function evaluateToolCall(request, context) {
   const logger = context.logger ?? nullLogger;
   const config2 = await resolveEvaluationConfig(context, logger);
-  const eventId = (0, import_node_crypto6.randomUUID)();
+  const eventId = (0, import_node_crypto8.randomUUID)();
   logger.debug("Tool call evaluation started", {
     eventId,
     toolUseId: request.toolUseId,
@@ -18582,7 +19167,9 @@ async function evaluateToolCall(request, context) {
   const { cachedUrlVerdicts, uncachedUrls } = partitionUrlsByCache(urls, cache2);
   let heuristicMatches = [];
   if (config2.heuristics_enabled) {
-    let threats = await loadThreats(context.threatsDir, logger);
+    let threats = await loadThreats(context.threatsDir, logger, {
+      customThreatsDir: getUserThreatsDir(context.sageDirPath)
+    });
     if (config2.disabled_threats.length > 0) {
       const disabledSet = new Set(config2.disabled_threats);
       threats = threats.filter((t) => !disabledSet.has(t.id));
@@ -18593,6 +19180,8 @@ async function evaluateToolCall(request, context) {
     const trustedDomains = await loadTrustedDomains(context.trustedDomainsDir, logger);
     const heuristics = new HeuristicsEngine(threats, trustedDomains);
     heuristicMatches = heuristics.match(request.artifacts);
+    const rawMatchedIds = new Set(heuristicMatches.map((m) => m.threat.id));
+    heuristicMatches.push(...heuristics.matchDeobfuscated(request.artifacts, rawMatchedIds));
   }
   let urlCheckResults = [];
   const urlsToCheck = cache2 ? uncachedUrls : urls;
@@ -18669,12 +19258,13 @@ async function evaluateToolCall(request, context) {
     }
   }
   const engine = new DecisionEngine(config2.sensitivity, logger);
-  const preliminaryVerdict = await engine.decide({
+  const preliminarySources = {
     heuristicMatches,
     urlCheckResults,
     packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
     amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0
-  });
+  };
+  const preliminaryVerdict = await engine.decide(preliminarySources);
   const allPiResults = [];
   const alreadyDenied = preliminaryVerdict.decision === "deny" || cachedUrlVerdicts.size > 0 && [...cachedUrlVerdicts.values()].some((v) => v.verdict === "deny");
   if (config2.pi_check.enabled && !alreadyDenied && request.toolName === "WebFetch") {
@@ -18708,18 +19298,17 @@ async function evaluateToolCall(request, context) {
     }
   }
   let verdict;
+  let verdictSources = preliminarySources;
   if (allPiResults.length > 0) {
-    verdict = await engine.decide({
-      heuristicMatches,
-      urlCheckResults,
-      packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
-      amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0,
+    verdictSources = {
+      ...preliminarySources,
       piCheckResults: allPiResults,
       piThresholds: {
         highRisk: DEFAULT_PI_HIGH_RISK_THRESHOLD,
         mediumRisk: DEFAULT_PI_MEDIUM_RISK_THRESHOLD
       }
-    });
+    };
+    verdict = await engine.decide(verdictSources);
   } else {
     verdict = preliminaryVerdict;
   }
@@ -18744,10 +19333,19 @@ async function evaluateToolCall(request, context) {
       }
     }
   }
+  const customThreatMatched = heuristicMatches.some((match) => match.threat.customRule === true);
+  const hasCachedUrlDetection = [...cachedUrlVerdicts.values()].some((cachedVerdict) => cachedVerdict.verdict !== "allow");
+  const nonCustomThreatMatched = customThreatMatched && (engine.hasNonCustomDetection(verdictSources) || hasCachedUrlDetection);
+  verdict.customThreatMatched = customThreatMatched;
   await cacheUrlResults(urlCheckResults, cache2);
   const auditSignals = {};
   if (heuristicMatches.length > 0) {
-    auditSignals.heuristics = heuristicMatches.map(buildHeuristicSignal);
+    const heuristicSignals = heuristicMatches.flatMap((match) => {
+      const signal = buildHeuristicSignal(match);
+      return signal ? [signal] : [];
+    });
+    if (heuristicSignals.length > 0)
+      auditSignals.heuristics = heuristicSignals;
   }
   if (urlCheckResults.length > 0) {
     const relevant = urlCheckResults.filter((r) => r.isMalicious);
@@ -18795,7 +19393,7 @@ async function evaluateToolCall(request, context) {
   if (allPiResults.length > 0) {
     const piSnippetFloor = DEFAULT_PI_MEDIUM_RISK_THRESHOLD;
     auditSignals.pi_checks = allPiResults.map((r) => ({
-      detection_name: formatReportingDetectionName(PI_DETECTION_NAME, "ml", `${r.modelId}:${MODEL_SCHEMA_VERSION}`),
+      detection_name: piReportingDetectionName(r),
       risk: r.risk,
       model_id: r.modelId,
       content_name: r.contentName,
@@ -18818,6 +19416,7 @@ async function evaluateToolCall(request, context) {
       toolName: request.toolName,
       toolInput: request.toolInput,
       verdict,
+      nonCustomThreatMatched,
       conversationId: request.conversationId,
       agentRuntime: request.agentRuntime,
       hookType: request.hookType,
@@ -18830,7 +19429,7 @@ async function evaluateToolCall(request, context) {
   } catch (error) {
     logger.debug("Audit verdict logging failed open", { error: String(error) });
   }
-  const submitTelemetry = async (blocking) => {
+  const submitTelemetry = async (blocking, signals = resolvedSignals) => {
     try {
       await sendCommunityIqTelemetry({
         eventId,
@@ -18840,7 +19439,7 @@ async function evaluateToolCall(request, context) {
         toolName: request.toolName,
         content: resolvedContent,
         contentSnippet,
-        signals: resolvedSignals,
+        signals,
         communityIqEnabled: config2.community_iq,
         config: config2,
         blocking,
@@ -18851,9 +19450,18 @@ async function evaluateToolCall(request, context) {
     }
   };
   if (verdict.decision === "deny") {
-    await submitTelemetry(true);
-  } else if (allPiResults.some((r) => r.risk >= DEFAULT_PI_TELEMETRY_THRESHOLD && r.risk < DEFAULT_PI_HIGH_RISK_THRESHOLD)) {
-    await submitTelemetry(false);
+    if (customThreatMatched && !nonCustomThreatMatched) {
+      logger.debug("Custom threat matched without non-custom detections; skipping Community IQ telemetry", { eventId });
+    } else {
+      await submitTelemetry(true);
+    }
+  } else {
+    const piSuspicious = allPiResults.some((r) => r.risk >= DEFAULT_PI_TELEMETRY_THRESHOLD && r.risk < DEFAULT_PI_HIGH_RISK_THRESHOLD);
+    const submitOnlyIds = new Set(heuristicMatches.filter((m) => !m.threat.customRule && isSubmitOnlyThreat(m.threat)).map((m) => m.threat.id));
+    const claimedRuleIds = await claimSubmitOnlySubmissions(submitOnlyIds, config2, logger);
+    if (piSuspicious || claimedRuleIds.size > 0) {
+      await submitTelemetry(false, withoutCappedSubmitOnly(resolvedSignals, submitOnlyIds, claimedRuleIds));
+    }
   }
   if (verdict.decision !== "allow") {
     try {
@@ -18868,6 +19476,26 @@ async function evaluateToolCall(request, context) {
   logEvaluationCompleted(verdict);
   return verdict;
 }
+async function claimSubmitOnlySubmissions(submitOnlyIds, config2, logger) {
+  if (!config2.community_iq || submitOnlyIds.size === 0)
+    return /* @__PURE__ */ new Set();
+  try {
+    return new Set(await claimRuleSubmissions([...submitOnlyIds], { logger }));
+  } catch (error) {
+    logger.debug("Submit-limit claim failed open", { error: String(error) });
+    return /* @__PURE__ */ new Set();
+  }
+}
+function withoutCappedSubmitOnly(signals, submitOnlyIds, claimedRuleIds) {
+  if (!signals?.heuristics)
+    return signals;
+  const heuristics = signals.heuristics.filter((h) => !submitOnlyIds.has(h.rule_id) || claimedRuleIds.has(h.rule_id));
+  if (heuristics.length === signals.heuristics.length)
+    return signals;
+  const { heuristics: _dropped, ...rest } = signals;
+  const next = heuristics.length > 0 ? { ...rest, heuristics } : rest;
+  return Object.keys(next).length > 0 ? next : void 0;
+}
 function partitionUrlsByCache(urls, cache2) {
   const cachedUrlVerdicts = /* @__PURE__ */ new Map();
   let uncachedUrls = [];
@@ -19035,14 +19663,19 @@ function ruleLabel(verdict) {
     return null;
   return verdict.source === "exception" ? `${verdict.matchedThreatId} (your exception rule)` : verdict.matchedThreatId;
 }
+var FP_REPORT_TOOL_NAME = "sage_report_false_positive";
 function remediationHint(verdict) {
   if (verdict.source === "exception") {
     const id = verdict.matchedThreatId ? ` (id ${verdict.matchedThreatId})` : "";
     return `This block comes from your own rule in ~/.sage/exceptions.json${id} \u2014 edit or remove it there.`;
   }
+  if (verdict.customThreat) {
+    return "This match comes from your custom threat rules in ~/.sage/threats/ \u2014 edit or remove the matching rule there.";
+  }
   const rule = verdict.matchedThreatId ? ` (rule ${verdict.matchedThreatId})` : "";
-  return `If this is a false positive, use the sage_report_false_positive MCP tool to report it${rule}.`;
+  return `If this is a false positive, ask your agent to report it with the ${FP_REPORT_TOOL_NAME} MCP tool${rule}.`;
 }
+var SESSION_START_FP_HINT = `If this is a false positive, ask your agent to report it with the ${FP_REPORT_TOOL_NAME} MCP tool.`;
 function formatUpdateNotice(result) {
   return `\u2B06\uFE0F  Update available: v${result.currentVersion} \u2192 v${result.latestVersion} (https://github.com/gendigitalinc/sage)`;
 }
@@ -19108,6 +19741,10 @@ function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
       lines.push(`   ... and ${overflow} more findings`);
     }
   }
+  if (!first) {
+    lines.push("");
+    lines.push(SESSION_START_FP_HINT);
+  }
   if (versionCheck?.updateAvailable) {
     lines.push("");
     lines.push(formatUpdateNotice(versionCheck));
@@ -19130,6 +19767,7 @@ function formatThreatBannerCompact(version, results, versionCheck, branding2) {
   if (remaining > 0) {
     lines.push(`\u2026and ${remaining} more finding${remaining === 1 ? "" : "s"}`);
   }
+  lines.push(SESSION_START_FP_HINT);
   if (versionCheck?.updateAvailable) {
     lines.push(formatUpdateNotice(versionCheck));
   }
@@ -19151,8 +19789,8 @@ function formatSessionStartMessage(version, result, branding2 = defaultBranding,
 // ../core/dist/guard.js
 init_config();
 init_types2();
-async function guardToolCall(request, context, approvalStore) {
-  const actionId = ApprovalStore.actionId(request.toolName, request.toolInput, request.sessionId);
+async function guardToolCall(request, context, approvalStore, actionIdOverride) {
+  const actionId = actionIdOverride ?? ApprovalStore.actionId(request.toolName, request.toolInput, request.sessionId);
   if (approvalStore.isApproved(actionId)) {
     return { verdict: allowVerdict("approved") };
   }
@@ -19201,7 +19839,7 @@ function formatDenyMessage(verdict, branding2 = defaultBranding) {
 }
 
 // ../core/dist/install-state.js
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 init_config();
 init_file_utils();
 
@@ -19239,7 +19877,7 @@ init_types2();
 var INSTALL_STATE_SCHEMA_VERSION = 1;
 var SKILL_UPLOAD_NOTICE_ID = SKILL_UPLOAD_NOTICE.id;
 function defaultStatePath(sageDirPath) {
-  return (0, import_node_path18.join)(sageDirPath ?? resolvePath(SAGE_DIR), "install-state.json");
+  return (0, import_node_path19.join)(sageDirPath ?? resolvePath(SAGE_DIR), "install-state.json");
 }
 function emptyState() {
   return { schemaVersion: INSTALL_STATE_SCHEMA_VERSION, notices: {} };
@@ -19479,8 +20117,8 @@ function createOperationalLogger(config2, runtime) {
       try {
         const result = await Promise.race([
           Promise.allSettled([...pendingWrites]).then(() => "drained"),
-          new Promise((resolve10) => {
-            timeout = setTimeout(() => resolve10("timeout"), remainingMs);
+          new Promise((resolve11) => {
+            timeout = setTimeout(() => resolve11("timeout"), remainingMs);
             timeout.unref?.();
           })
         ]);
@@ -19528,32 +20166,32 @@ function createOperationalLogger(config2, runtime) {
 }
 
 // ../core/dist/plugin-scan-cache.js
-var import_node_crypto7 = require("node:crypto");
-var import_promises8 = require("node:fs/promises");
-var import_node_path19 = require("node:path");
+var import_node_crypto9 = require("node:crypto");
+var import_promises10 = require("node:fs/promises");
+var import_node_path20 = require("node:path");
 init_config();
 init_file_utils();
 init_types2();
-var DEFAULT_CACHE_PATH = (0, import_node_path19.join)(getHomeDir(), ".sage", "plugin_scan_cache.json");
+var DEFAULT_CACHE_PATH = (0, import_node_path20.join)(getHomeDir(), ".sage", "plugin_scan_cache.json");
 var DEFAULT_CACHE_TTL_MS = MS_PER_DAY;
 var SCHEMA_VERSION = 5;
 function cacheKey(pluginKey, version, lastUpdated) {
   return `${pluginKey}:${version}:${lastUpdated}`;
 }
 async function computeConfigHash(sageVersion, ...dirs) {
-  const h = (0, import_node_crypto7.createHash)("sha256");
+  const h = (0, import_node_crypto9.createHash)("sha256");
   if (sageVersion)
     h.update(sageVersion);
   for (const dir of dirs) {
     let files;
     try {
-      files = (await (0, import_promises8.readdir)(dir)).filter((f) => f.endsWith(".yaml")).sort();
+      files = (await (0, import_promises10.readdir)(dir)).filter((f) => f.endsWith(".yaml")).sort();
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const content = await getFileContent((0, import_node_path19.join)(dir, file));
+        const content = await getFileContent((0, import_node_path20.join)(dir, file));
         h.update(content);
       } catch {
       }
@@ -19652,22 +20290,22 @@ function storeResult(cache2, pluginKey, version, lastUpdated, findings) {
 }
 
 // ../core/dist/plugin-scanner.js
-var import_node_crypto9 = require("node:crypto");
-var import_promises11 = require("node:fs/promises");
-var import_node_path23 = require("node:path");
+var import_node_crypto12 = require("node:crypto");
+var import_promises13 = require("node:fs/promises");
+var import_node_path24 = require("node:path");
 init_config();
 init_file_utils();
 
 // ../core/dist/skill-id.js
-var import_node_crypto8 = require("node:crypto");
-var import_promises9 = require("node:fs/promises");
-var import_node_path20 = require("node:path");
+var import_node_crypto10 = require("node:crypto");
+var import_promises11 = require("node:fs/promises");
+var import_node_path21 = require("node:path");
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "__pycache__"]);
 var MAX_SKILL_BYTES = 50 * 1024 * 1024;
 var SkillTooLargeError = class extends Error {
 };
 function isContained(childReal, rootReal) {
-  return childReal === rootReal || childReal.startsWith(`${rootReal}${import_node_path20.sep}`);
+  return childReal === rootReal || childReal.startsWith(`${rootReal}${import_node_path21.sep}`);
 }
 function normalizePath(p) {
   let out = p.replace(/\\/g, "/").normalize("NFC");
@@ -19678,24 +20316,24 @@ function normalizePath(p) {
   return out;
 }
 async function entriesFromDirectory(dirPath, maxBytes = Number.POSITIVE_INFINITY) {
-  const absDir = (0, import_node_path20.resolve)(dirPath);
-  const rootReal = await (0, import_promises9.realpath)(absDir);
+  const absDir = (0, import_node_path21.resolve)(dirPath);
+  const rootReal = await (0, import_promises11.realpath)(absDir);
   const entries = [];
   const visited = /* @__PURE__ */ new Set();
   let total = 0;
   async function walk(currentPath) {
-    const real = await (0, import_promises9.realpath)(currentPath);
+    const real = await (0, import_promises11.realpath)(currentPath);
     if (visited.has(real))
       return;
     if (!isContained(real, rootReal))
       return;
     visited.add(real);
-    const items = await (0, import_promises9.readdir)(currentPath);
+    const items = await (0, import_promises11.readdir)(currentPath);
     const dirs = [];
     const files = [];
     for (const item of items) {
-      const fullPath = (0, import_node_path20.join)(currentPath, item);
-      const st = await (0, import_promises9.stat)(fullPath);
+      const fullPath = (0, import_node_path21.join)(currentPath, item);
+      const st = await (0, import_promises11.stat)(fullPath);
       if (st.isDirectory())
         dirs.push(item);
       else if (st.isFile())
@@ -19704,24 +20342,24 @@ async function entriesFromDirectory(dirPath, maxBytes = Number.POSITIVE_INFINITY
     dirs.sort();
     files.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const d of dirs) {
-      const fullPath = (0, import_node_path20.join)(currentPath, d);
-      const relPath = (0, import_node_path20.relative)(absDir, fullPath).replace(/\\/g, "/");
+      const fullPath = (0, import_node_path21.join)(currentPath, d);
+      const relPath = (0, import_node_path21.relative)(absDir, fullPath).replace(/\\/g, "/");
       entries.push({ entryPath: relPath, isDir: true, content: Buffer.alloc(0) });
       await walk(fullPath);
     }
     for (const f of files) {
-      const fullPath = (0, import_node_path20.join)(currentPath, f.name);
-      const fileReal = await (0, import_promises9.realpath)(fullPath);
+      const fullPath = (0, import_node_path21.join)(currentPath, f.name);
+      const fileReal = await (0, import_promises11.realpath)(fullPath);
       if (!isContained(fileReal, rootReal))
         continue;
       total += f.size;
       if (total > maxBytes)
         throw new SkillTooLargeError();
-      const relPath = (0, import_node_path20.relative)(absDir, fullPath).replace(/\\/g, "/");
+      const relPath = (0, import_node_path21.relative)(absDir, fullPath).replace(/\\/g, "/");
       entries.push({
         entryPath: relPath,
         isDir: false,
-        content: await (0, import_promises9.readFile)(fullPath)
+        content: await (0, import_promises11.readFile)(fullPath)
       });
     }
   }
@@ -19744,14 +20382,14 @@ function computeSkillId(entries) {
   const fileHashes = {};
   const treeEntries = [];
   for (const e of normalized) {
-    const contentHash = (0, import_node_crypto8.createHash)("sha256").update(e.isDir ? Buffer.alloc(0) : e.content).digest("hex");
+    const contentHash = (0, import_node_crypto10.createHash)("sha256").update(e.isDir ? Buffer.alloc(0) : e.content).digest("hex");
     const entryType = e.isDir ? "dir" : "file";
     treeEntries.push({ type: entryType, entryPath: e.entryPath, hash: contentHash });
     if (!e.isDir)
       fileHashes[e.entryPath] = contentHash;
   }
   treeEntries.sort((a, b) => a.entryPath < b.entryPath ? -1 : a.entryPath > b.entryPath ? 1 : 0);
-  const skillHasher = (0, import_node_crypto8.createHash)("sha256");
+  const skillHasher = (0, import_node_crypto10.createHash)("sha256");
   for (const e of treeEntries) {
     skillHasher.update(Buffer.from(`${e.type}\0${e.entryPath}\0${e.hash}
 `, "utf8"));
@@ -19762,7 +20400,7 @@ async function findSkillPackagesWithMtime(rootDir) {
   const found = [];
   let rootReal;
   try {
-    rootReal = await (0, import_promises9.realpath)((0, import_node_path20.resolve)(rootDir));
+    rootReal = await (0, import_promises11.realpath)((0, import_node_path21.resolve)(rootDir));
   } catch {
     return found;
   }
@@ -19770,7 +20408,7 @@ async function findSkillPackagesWithMtime(rootDir) {
   async function walk(currentPath) {
     let real;
     try {
-      real = await (0, import_promises9.realpath)(currentPath);
+      real = await (0, import_promises11.realpath)(currentPath);
     } catch {
       return 0;
     }
@@ -19781,7 +20419,7 @@ async function findSkillPackagesWithMtime(rootDir) {
     visited.add(real);
     let st;
     try {
-      st = await (0, import_promises9.stat)(currentPath);
+      st = await (0, import_promises11.stat)(currentPath);
     } catch {
       return 0;
     }
@@ -19790,7 +20428,7 @@ async function findSkillPackagesWithMtime(rootDir) {
       return subtreeMax;
     let items;
     try {
-      items = await (0, import_promises9.readdir)(currentPath);
+      items = await (0, import_promises11.readdir)(currentPath);
     } catch {
       return subtreeMax;
     }
@@ -19798,7 +20436,7 @@ async function findSkillPackagesWithMtime(rootDir) {
     let entry;
     if (items.includes("SKILL.md")) {
       try {
-        if ((await (0, import_promises9.stat)((0, import_node_path20.join)(currentPath, "SKILL.md"))).isFile()) {
+        if ((await (0, import_promises11.stat)((0, import_node_path21.join)(currentPath, "SKILL.md"))).isFile()) {
           entry = { folder: currentPath, newestMtimeMs: 0 };
           found.push(entry);
         }
@@ -19808,7 +20446,7 @@ async function findSkillPackagesWithMtime(rootDir) {
     for (const item of items) {
       if (SKIP_DIRS.has(item))
         continue;
-      const childMax = await walk((0, import_node_path20.join)(currentPath, item));
+      const childMax = await walk((0, import_node_path21.join)(currentPath, item));
       if (childMax > subtreeMax)
         subtreeMax = childMax;
     }
@@ -19816,16 +20454,16 @@ async function findSkillPackagesWithMtime(rootDir) {
       entry.newestMtimeMs = subtreeMax;
     return subtreeMax;
   }
-  await walk((0, import_node_path20.resolve)(rootDir));
+  await walk((0, import_node_path21.resolve)(rootDir));
   return found;
 }
 function looseSkillKey(skillsRoot, folder, tag, scope) {
-  const rel = (0, import_node_path20.relative)((0, import_node_path20.resolve)(skillsRoot), (0, import_node_path20.resolve)(folder)).split(import_node_path20.sep).join("/") || (0, import_node_path20.basename)(folder);
+  const rel = (0, import_node_path21.relative)((0, import_node_path21.resolve)(skillsRoot), (0, import_node_path21.resolve)(folder)).split(import_node_path21.sep).join("/") || (0, import_node_path21.basename)(folder);
   return `skill:${tag}/${rel}@${scope}`;
 }
 async function discoverLooseSkills(skillsDir, tag, scope) {
-  const resolvedRoot = (0, import_node_path20.resolve)(skillsDir);
-  const packages = (await findSkillPackagesWithMtime(skillsDir)).filter((p) => (0, import_node_path20.resolve)(p.folder) !== resolvedRoot);
+  const resolvedRoot = (0, import_node_path21.resolve)(skillsDir);
+  const packages = (await findSkillPackagesWithMtime(skillsDir)).filter((p) => (0, import_node_path21.resolve)(p.folder) !== resolvedRoot);
   return packages.map(({ folder, newestMtimeMs }) => ({
     key: looseSkillKey(resolvedRoot, folder, tag, scope),
     installPath: folder,
@@ -19839,7 +20477,7 @@ async function dedupeSkillsByResolvedPath(skills) {
   for (const skill of skills) {
     let canonical = skill.installPath;
     try {
-      canonical = await (0, import_promises9.realpath)(skill.installPath);
+      canonical = await (0, import_promises11.realpath)(skill.installPath);
     } catch {
     }
     if (seen.has(canonical))
@@ -19881,15 +20519,15 @@ async function computeSkillIdsForRoot(rootDir, logger) {
 }
 
 // ../core/dist/skill-pending.js
-var import_promises10 = require("node:fs/promises");
-var import_node_path21 = require("node:path");
+var import_promises12 = require("node:fs/promises");
+var import_node_path22 = require("node:path");
 init_config();
 init_file_utils();
 init_types2();
 var SCHEMA_VERSION2 = 1;
 var PENDING_TTL_MS = 60 * 60 * 1e3;
 function defaultPendingPath() {
-  return (0, import_node_path21.join)(resolvePath(SAGE_DIR), "skill_pending.json");
+  return (0, import_node_path22.join)(resolvePath(SAGE_DIR), "skill_pending.json");
 }
 async function loadPendingMarker(pendingPath = defaultPendingPath(), logger = nullLogger) {
   let raw;
@@ -19927,7 +20565,7 @@ async function loadPendingMarker(pendingPath = defaultPendingPath(), logger = nu
 async function savePendingMarker(marker, pendingPath = defaultPendingPath(), logger = nullLogger) {
   if (Object.keys(marker.entries).length === 0) {
     try {
-      await (0, import_promises10.unlink)(pendingPath);
+      await (0, import_promises12.unlink)(pendingPath);
     } catch (e) {
       if (!e || typeof e !== "object" || e.code !== "ENOENT") {
         logger.warn(`Failed to delete empty pending marker at ${pendingPath}`, {
@@ -19979,7 +20617,7 @@ function listPending(marker) {
 }
 
 // ../core/dist/skill-verdict-cache.js
-var import_node_path22 = require("node:path");
+var import_node_path23 = require("node:path");
 init_config();
 init_file_utils();
 init_types2();
@@ -20015,9 +20653,9 @@ function mergeSources(existing, incoming) {
   return merged.length > 0 ? merged : void 0;
 }
 function defaultCachePath2() {
-  return (0, import_node_path22.join)(resolvePath(SAGE_DIR), "skill_verdict_cache.json");
+  return (0, import_node_path23.join)(resolvePath(SAGE_DIR), "skill_verdict_cache.json");
 }
-async function loadSkillVerdictCache(cachePath = defaultCachePath2(), ttlMs = DEFAULT_VERDICT_TTL_MS, logger = nullLogger) {
+async function loadSkillVerdictCacheInternal(cachePath, ttlMs, logger, pruneOnLoad) {
   let raw;
   try {
     raw = await getFileContent(cachePath);
@@ -20040,6 +20678,8 @@ async function loadSkillVerdictCache(cachePath = defaultCachePath2(), ttlMs = DE
         continue;
       }
       entries[skillId] = {
+        entryId: typeof entry.entry_id === "string" ? entry.entry_id : void 0,
+        jobId: typeof entry.job_id === "string" ? entry.job_id : void 0,
         verdict: typeof entry.verdict === "string" ? entry.verdict : void 0,
         summary: typeof entry.summary === "string" ? entry.summary : void 0,
         skillName: typeof entry.skill_name === "string" ? entry.skill_name : void 0,
@@ -20048,7 +20688,7 @@ async function loadSkillVerdictCache(cachePath = defaultCachePath2(), ttlMs = DE
       };
     }
     const cache2 = { entries };
-    if (pruned > 0) {
+    if (pruneOnLoad && pruned > 0) {
       logger.debug(`Pruned ${pruned} stale verdict(s) from cache`, { cachePath });
       await saveSkillVerdictCache(cache2, cachePath, logger);
     }
@@ -20058,6 +20698,9 @@ async function loadSkillVerdictCache(cachePath = defaultCachePath2(), ttlMs = DE
     return { entries: {} };
   }
 }
+async function loadSkillVerdictCache(cachePath = defaultCachePath2(), ttlMs = DEFAULT_VERDICT_TTL_MS, logger = nullLogger) {
+  return loadSkillVerdictCacheInternal(cachePath, ttlMs, logger, true);
+}
 async function saveSkillVerdictCache(cache2, cachePath = defaultCachePath2(), logger = nullLogger) {
   try {
     const data = {
@@ -20065,6 +20708,8 @@ async function saveSkillVerdictCache(cache2, cachePath = defaultCachePath2(), lo
       entries: Object.fromEntries(Object.entries(cache2.entries).map(([skillId, v]) => [
         skillId,
         {
+          entry_id: v.entryId,
+          job_id: v.jobId,
           verdict: v.verdict,
           summary: v.summary,
           skill_name: v.skillName,
@@ -20077,8 +20722,10 @@ async function saveSkillVerdictCache(cache2, cachePath = defaultCachePath2(), lo
       ]))
     };
     await atomicWriteJson(cachePath, data);
+    return true;
   } catch (e) {
     logger.warn(`Failed to save verdict cache to ${cachePath}`, { error: String(e) });
+    return false;
   }
 }
 function getVerdict(cache2, skillId, ttlMs = DEFAULT_VERDICT_TTL_MS) {
@@ -20099,6 +20746,34 @@ function putVerdict(cache2, skillId, verdict) {
   };
 }
 
+// ../core/dist/skill-verdict-record.js
+var import_node_crypto11 = require("node:crypto");
+function recordAnalyzedSkillVerdict(cache2, skillId, result, origin) {
+  const entryId = (0, import_node_crypto11.randomUUID)();
+  putVerdict(cache2, skillId, {
+    entryId,
+    jobId: result.jobId,
+    verdict: result.verdict,
+    summary: result.summary,
+    skillName: origin.skillName,
+    sources: [{ agentRuntime: origin.agentRuntime, containerKey: origin.containerKey }]
+  });
+  const { loggingConfig } = origin;
+  return {
+    entryId,
+    writeAuditEntry: async () => {
+      if (!loggingConfig)
+        return;
+      await logSkillVerdict(loggingConfig, skillId, "analyzed", result.verdict, result.summary, {
+        entryId,
+        jobId: result.jobId,
+        agentRuntime: origin.agentRuntime
+      });
+    }
+  };
+}
+var SKILL_ENTRY_ID_NAMESPACE = Buffer.from("75bba79a376142a7bacbf95d791126d3", "hex");
+
 // ../core/dist/plugin-scanner.js
 init_types2();
 var SCANNABLE_EXTENSIONS2 = /* @__PURE__ */ new Set([
@@ -20126,7 +20801,7 @@ async function walkPluginFiles(installPath, logger) {
   const visited = /* @__PURE__ */ new Set();
   let rootReal;
   try {
-    rootReal = await (0, import_promises11.realpath)((0, import_node_path23.resolve)(installPath));
+    rootReal = await (0, import_promises13.realpath)((0, import_node_path24.resolve)(installPath));
   } catch (e) {
     logger.warn(`Error walking plugin path ${installPath}`, { error: String(e) });
     return files;
@@ -20134,7 +20809,7 @@ async function walkPluginFiles(installPath, logger) {
   async function walk(dirOrFile) {
     let real;
     try {
-      real = await (0, import_promises11.realpath)(dirOrFile);
+      real = await (0, import_promises13.realpath)(dirOrFile);
     } catch {
       return;
     }
@@ -20145,12 +20820,12 @@ async function walkPluginFiles(installPath, logger) {
     visited.add(real);
     let stats;
     try {
-      stats = await (0, import_promises11.stat)(dirOrFile);
+      stats = await (0, import_promises13.stat)(dirOrFile);
     } catch {
       return;
     }
     if (stats.isFile()) {
-      if (SCANNABLE_EXTENSIONS2.has((0, import_node_path23.extname)(dirOrFile).toLowerCase()) && stats.size <= MAX_FILE_SIZE) {
+      if (SCANNABLE_EXTENSIONS2.has((0, import_node_path24.extname)(dirOrFile).toLowerCase()) && stats.size <= MAX_FILE_SIZE) {
         files.push(dirOrFile);
       }
       return;
@@ -20158,20 +20833,20 @@ async function walkPluginFiles(installPath, logger) {
     if (stats.isDirectory()) {
       let entries;
       try {
-        entries = await (0, import_promises11.readdir)(dirOrFile);
+        entries = await (0, import_promises13.readdir)(dirOrFile);
       } catch {
         return;
       }
       for (const entry of entries) {
         if (SKIP_DIRS.has(entry))
           continue;
-        const fullPath = (0, import_node_path23.join)(dirOrFile, entry);
+        const fullPath = (0, import_node_path24.join)(dirOrFile, entry);
         await walk(fullPath);
       }
     }
   }
   try {
-    await walk((0, import_node_path23.resolve)(installPath));
+    await walk((0, import_node_path24.resolve)(installPath));
   } catch (e) {
     logger.warn(`Error walking plugin path ${installPath}`, { error: String(e) });
   }
@@ -20208,7 +20883,7 @@ async function scanPlugin(plugin, options = {}) {
     }
     if (amsiClient) {
       try {
-        const scanName = `${plugin.key}/${(0, import_node_path23.relative)(plugin.installPath, filePath)}`;
+        const scanName = `${plugin.key}/${(0, import_node_path24.relative)(plugin.installPath, filePath)}`;
         const amsiResult = await amsiClient.scanString("Plugin", scanName, content);
         if (amsiResult && (amsiResult.isDetected || amsiResult.isBlockedByAdmin)) {
           result.findings.push({
@@ -20216,7 +20891,7 @@ async function scanPlugin(plugin, options = {}) {
             title: `AMSI detection (result=${amsiResult.amsiResult})`,
             severity: "critical",
             artifact: content.slice(0, 200),
-            sourceFile: (0, import_node_path23.relative)(plugin.installPath, filePath)
+            sourceFile: (0, import_node_path24.relative)(plugin.installPath, filePath)
           });
         }
       } catch {
@@ -20226,7 +20901,7 @@ async function scanPlugin(plugin, options = {}) {
       allUrls.push(...extractUrls(content));
     }
     if (checkFileHashes) {
-      const sha256 = (0, import_node_crypto9.createHash)("sha256").update(rawBytes).digest("hex");
+      const sha256 = (0, import_node_crypto12.createHash)("sha256").update(rawBytes).digest("hex");
       const existing = hashToFiles.get(sha256);
       if (existing) {
         existing.push(filePath);
@@ -20269,7 +20944,7 @@ async function scanPlugin(plugin, options = {}) {
               title: `Malicious file (${fr.detectionNames.join(", ") || "unknown"})`,
               severity: "critical",
               artifact: fr.sha256,
-              sourceFile: (0, import_node_path23.relative)(plugin.installPath, filePath)
+              sourceFile: (0, import_node_path24.relative)(plugin.installPath, filePath)
             });
           }
         }
@@ -20296,7 +20971,7 @@ function pushSkillFindingIfRisky(findings, plugin, skillId, folder, verdict) {
     title: verdict.summary?.trim() || (risk === "CRITICAL" ? "Malicious skill detected" : "Suspicious skill detected"),
     severity,
     artifact: skillId.slice(0, 16),
-    sourceFile: (0, import_node_path23.relative)(plugin.installPath, folder) || "."
+    sourceFile: (0, import_node_path24.relative)(plugin.installPath, folder) || "."
   });
 }
 async function runSkillCheck(plugin, findings, logger, paths = {}) {
@@ -20323,6 +20998,8 @@ async function runSkillCheck(plugin, findings, logger, paths = {}) {
     let markerModified = false;
     let lookupFailed = false;
     let graceDeferred = false;
+    const resolvedPendingSkillIds = /* @__PURE__ */ new Set();
+    const recordedVerdicts = /* @__PURE__ */ new Map();
     for (const { folder, skillId } of uncached) {
       if (!verdicts.has(skillId)) {
         lookupFailed = true;
@@ -20330,17 +21007,18 @@ async function runSkillCheck(plugin, findings, logger, paths = {}) {
       }
       const verdict = verdicts.get(skillId) ?? null;
       if (verdict) {
-        putVerdict(verdictCache, skillId, {
-          verdict: verdict.verdict,
-          summary: verdict.summary,
-          skillName: (0, import_node_path23.basename)(folder),
-          sources: [{ agentRuntime: paths.agentRuntime, containerKey: plugin.key }]
-        });
-        cacheModified = true;
+        if (!recordedVerdicts.has(skillId)) {
+          recordedVerdicts.set(skillId, recordAnalyzedSkillVerdict(verdictCache, skillId, verdict, {
+            skillName: (0, import_node_path24.basename)(folder),
+            agentRuntime: paths.agentRuntime,
+            containerKey: plugin.key,
+            loggingConfig: paths.loggingConfig
+          }));
+          cacheModified = true;
+        }
         pushSkillFindingIfRisky(findings, plugin, skillId, folder, verdict);
         if (isPending(marker, skillId)) {
-          removePending(marker, skillId);
-          markerModified = true;
+          resolvedPendingSkillIds.add(skillId);
         }
       } else if (!isPending(marker, skillId)) {
         if (paths.uploadEnabled === false) {
@@ -20359,8 +21037,17 @@ async function runSkillCheck(plugin, findings, logger, paths = {}) {
         }
       }
     }
-    if (cacheModified)
-      await saveSkillVerdictCache(verdictCache, paths.verdictCachePath, logger);
+    const cacheSaved = cacheModified ? await saveSkillVerdictCache(verdictCache, paths.verdictCachePath, logger) : true;
+    if (cacheSaved) {
+      await Promise.all([...recordedVerdicts.values()].map((entry) => entry.writeAuditEntry().catch(() => {
+      })));
+      for (const skillId of resolvedPendingSkillIds) {
+        removePending(marker, skillId);
+        markerModified = true;
+      }
+    } else {
+      lookupFailed = true;
+    }
     if (markerModified)
       await savePendingMarker(marker, paths.pendingPath, logger);
     const anyStillPending = uncached.some(({ skillId }) => isPending(marker, skillId));
@@ -20374,12 +21061,12 @@ async function runSkillCheck(plugin, findings, logger, paths = {}) {
 // ../core/dist/session-start.js
 var import_node_child_process2 = require("node:child_process");
 var import_node_fs4 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_path26 = require("node:path");
 init_config();
 init_file_utils();
 
 // ../core/dist/session-start-scan.js
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 init_config();
 init_types2();
 function fromCachedFinding(finding) {
@@ -20462,8 +21149,8 @@ async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient,
     deniedByException: 0,
     findingsCount: 0
   };
-  const skillPendingPath = context.sageDirPath ? (0, import_node_path24.join)(context.sageDirPath, "skill_pending.json") : void 0;
-  const skillVerdictCachePath = context.sageDirPath ? (0, import_node_path24.join)(context.sageDirPath, "skill_verdict_cache.json") : void 0;
+  const skillPendingPath = context.sageDirPath ? (0, import_node_path25.join)(context.sageDirPath, "skill_pending.json") : void 0;
+  const skillVerdictCachePath = context.sageDirPath ? (0, import_node_path25.join)(context.sageDirPath, "skill_verdict_cache.json") : void 0;
   const cacheTtlMs = skillCacheTtlMs(config2);
   for (const plugin of plugins) {
     const denyMatch = findPluginDenyException(exceptions, plugin.key);
@@ -20629,6 +21316,16 @@ async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = D
 async function runSessionStart(ctx) {
   const logger = ctx.logger ?? nullLogger;
   const sageDirPath = resolvePath(ctx.sageDirPath ?? "~/.sage");
+  try {
+    await loadThreats(ctx.threatsDir, logger, {
+      customThreatsDir: getUserThreatsDir(sageDirPath),
+      logCustomRuleIds: true
+    });
+  } catch (error) {
+    logger.warn("Threat rules failed to load at session start (fail-open)", {
+      error: String(error)
+    });
+  }
   pruneOrphanedTmpFiles(sageDirPath).catch(() => {
   });
   deployConfigDefaults(sageDirPath, logger).catch(() => {
@@ -20811,7 +21508,7 @@ async function maybeSpawnSkillUploadWorker(args) {
     });
     return;
   }
-  const marker = await loadPendingMarker((0, import_node_path25.join)(args.sageDirPath, "skill_pending.json"), args.logger);
+  const marker = await loadPendingMarker((0, import_node_path26.join)(args.sageDirPath, "skill_pending.json"), args.logger);
   const pendingCount = listPending(marker).length;
   if (pendingCount === 0) {
     args.logger.debug("Skill upload worker skipped", {
@@ -20950,19 +21647,19 @@ function canonicalizeToolName(map, rawName) {
 init_types2();
 
 // src/bundled-dirs.ts
-var import_node_path26 = require("node:path");
-var packageRoot = (0, import_node_path26.resolve)(__dirname, "..");
+var import_node_path27 = require("node:path");
+var packageRoot = (0, import_node_path27.resolve)(__dirname, "..");
 function getBundledDataDirs() {
   return {
-    threatsDir: (0, import_node_path26.join)(packageRoot, "resources", "threats"),
-    trustedDomainsDir: (0, import_node_path26.join)(packageRoot, "resources", "trusted-domains")
+    threatsDir: (0, import_node_path27.join)(packageRoot, "resources", "threats"),
+    trustedDomainsDir: (0, import_node_path27.join)(packageRoot, "resources", "trusted-domains")
   };
 }
 var cachedVersion;
 function getSageVersion() {
   if (cachedVersion) return cachedVersion;
   try {
-    const pkg = JSON.parse(getFileContentSync((0, import_node_path26.join)(packageRoot, "package.json"), "utf-8"));
+    const pkg = JSON.parse(getFileContentSync((0, import_node_path27.join)(packageRoot, "package.json"), "utf-8"));
     cachedVersion = pkg.version ?? "0.0.0";
   } catch {
     cachedVersion = "0.0.0";
@@ -20971,16 +21668,16 @@ function getSageVersion() {
 }
 
 // src/startup-scan.ts
-var import_node_path28 = require("node:path");
+var import_node_path29 = require("node:path");
 
 // src/plugin-discovery.ts
-var import_promises12 = require("node:fs/promises");
+var import_promises14 = require("node:fs/promises");
 var import_node_os4 = require("node:os");
-var import_node_path27 = require("node:path");
-var DEFAULT_EXTENSIONS_DIR = (0, import_node_path27.join)((0, import_node_os4.homedir)(), ".openclaw", "extensions");
+var import_node_path28 = require("node:path");
+var DEFAULT_EXTENSIONS_DIR = (0, import_node_path28.join)((0, import_node_os4.homedir)(), ".openclaw", "extensions");
 var SKILL_ROOTS = [
-  { dir: (0, import_node_path27.join)(getHomeDir(), ".agents", "skills"), tag: "agents", scope: "personal" },
-  { dir: (0, import_node_path27.join)(getHomeDir(), ".openclaw", "skills"), tag: "openclaw", scope: "personal" }
+  { dir: (0, import_node_path28.join)(getHomeDir(), ".agents", "skills"), tag: "agents", scope: "personal" },
+  { dir: (0, import_node_path28.join)(getHomeDir(), ".openclaw", "skills"), tag: "openclaw", scope: "personal" }
 ];
 async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSIONS_DIR, branding2 = defaultBranding, skillRoots = SKILL_ROOTS) {
   logger.debug(`${branding2.name} plugin discovery: scanning extensions directory`, {
@@ -20989,23 +21686,23 @@ async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSION
   const plugins = [];
   let entries;
   try {
-    entries = await (0, import_promises12.readdir)(extensionsDir);
+    entries = await (0, import_promises14.readdir)(extensionsDir);
   } catch {
     logger.debug("OpenClaw extensions directory not found", { path: extensionsDir });
     entries = [];
   }
   for (const entry of entries) {
-    const extDir = (0, import_node_path27.join)(extensionsDir, entry);
+    const extDir = (0, import_node_path28.join)(extensionsDir, entry);
     let stats;
     try {
-      stats = await (0, import_promises12.stat)(extDir);
+      stats = await (0, import_promises14.stat)(extDir);
       if (!stats.isDirectory()) continue;
     } catch {
       continue;
     }
     let pkg;
     try {
-      const pkgPath = (0, import_node_path27.join)(extDir, "package.json");
+      const pkgPath = (0, import_node_path28.join)(extDir, "package.json");
       const raw = await getFileContent(pkgPath);
       pkg = JSON.parse(raw);
     } catch {
@@ -21052,8 +21749,8 @@ function createOpenClawScanHandler(logger, context, branding2 = defaultBranding,
     // No onNotices: OpenClaw delivers the one-time notice from
     // `before_prompt_build` (a different process/turn than this scan) via
     // takePendingNotices, so the scan-time callback would never fire.
-    modelDownloadWorkerPath: (0, import_node_path28.resolve)(__dirname, "model-download-worker.cjs"),
-    skillUploadWorkerPath: (0, import_node_path28.resolve)(__dirname, "skill-upload-worker.cjs"),
+    modelDownloadWorkerPath: (0, import_node_path29.resolve)(__dirname, "model-download-worker.cjs"),
+    skillUploadWorkerPath: (0, import_node_path29.resolve)(__dirname, "skill-upload-worker.cjs"),
     // Don't commit the "shown" flag here — commit happens at delivery.
     commitUploadNotice: false,
     announceCleanScans