@gendigital/sage-openclaw 0.4.4 → 0.5.3

package/dist/index.cjs

@@ -3978,10 +3978,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep, value } = collItem;
+        const { start, key, sep: sep2, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep?.[0],
+          next: key ?? sep2?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -3995,7 +3995,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep) {
+          if (!keyProps.anchor && !keyProps.tag && !sep2) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -4019,7 +4019,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep ?? [], {
+        const valueProps = resolveProps.resolveProps(sep2 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -4035,7 +4035,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep2, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -4126,7 +4126,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep = "";
+        let sep2 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -4140,13 +4140,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep + cb;
-              sep = "";
+                comment += sep2 + cb;
+              sep2 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep += source;
+                sep2 += source;
               hasSpace = true;
               break;
             default:
@@ -4189,18 +4189,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep, value } = collItem;
+        const { start, key, sep: sep2, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep?.[0],
+          next: key ?? sep2?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep && !value) {
+          if (!props.anchor && !props.tag && !sep2 && !value) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -4254,8 +4254,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep, null, props, onError);
+        if (!isMap && !sep2 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep2, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -4267,7 +4267,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep ?? [], {
+          const valueProps = resolveProps.resolveProps(sep2 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -4278,8 +4278,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep)
-                for (const st of sep) {
+              if (sep2)
+                for (const st of sep2) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -4296,7 +4296,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep2, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -4476,7 +4476,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value = "";
-      let sep = "";
+      let sep2 = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value += lines[i][0].slice(trimIndent) + "\n";
@@ -4493,24 +4493,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep + indent.slice(trimIndent) + content;
-          sep = "\n";
+          value += sep2 + indent.slice(trimIndent) + content;
+          sep2 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep === " ")
-            sep = "\n";
-          else if (!prevMoreIndented && sep === "\n")
-            sep = "\n\n";
-          value += sep + indent.slice(trimIndent) + content;
-          sep = "\n";
+          if (sep2 === " ")
+            sep2 = "\n";
+          else if (!prevMoreIndented && sep2 === "\n")
+            sep2 = "\n\n";
+          value += sep2 + indent.slice(trimIndent) + content;
+          sep2 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep === "\n")
+          if (sep2 === "\n")
             value += "\n";
           else
-            sep = "\n";
+            sep2 = "\n";
         } else {
-          value += sep + content;
-          sep = " ";
+          value += sep2 + content;
+          sep2 = " ";
           prevMoreIndented = false;
         }
       }
@@ -4692,25 +4692,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep = " ";
+      let sep2 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep === "\n")
-            res += sep;
+          if (sep2 === "\n")
+            res += sep2;
           else
-            sep = "\n";
+            sep2 = "\n";
         } else {
-          res += sep + match[1];
-          sep = " ";
+          res += sep2 + match[1];
+          sep2 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep + (match?.[1] ?? "");
+      return res + sep2 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -5511,14 +5511,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep, value }) {
+    function stringifyItem({ start, key, sep: sep2, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep)
-        for (const st of sep)
+      if (sep2)
+        for (const st of sep2)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -6667,18 +6667,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep;
+          let sep2;
           if (scalar.end) {
-            sep = scalar.end;
-            sep.push(this.sourceToken);
+            sep2 = scalar.end;
+            sep2.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep = [this.sourceToken];
+            sep2 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep }]
+            items: [{ start, key: scalar, sep: sep2 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -6831,15 +6831,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep = it.sep;
-                  sep.push(this.sourceToken);
+                  const sep2 = it.sep;
+                  sep2.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep }]
+                    items: [{ start: start2, key, sep: sep2 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -7033,13 +7033,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep = fc.end.splice(1, fc.end.length);
-            sep.push(this.sourceToken);
+            const sep2 = fc.end.splice(1, fc.end.length);
+            sep2.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep }]
+              items: [{ start, key: fc, sep: sep2 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -7324,11 +7324,6 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/approval-store.ts
-var import_node_crypto5 = require("node:crypto");
-var import_node_os5 = require("node:os");
-var import_node_path9 = require("node:path");
-
 // ../core/dist/config.js
 var import_node_os = require("node:os");
 var import_node_path2 = require("node:path");
@@ -11487,10 +11482,14 @@ var PackageCheckConfigSchema = external_exports.object({
   // v1: all scoped packages (@scope/pkg) are skipped automatically.
   // Future: add private_scopes / public_scopes config for fine-grained control.
 });
+var AmsiCheckConfigSchema = external_exports.object({
+  enabled: external_exports.boolean().default(true)
+});
 var ConfigSchema = external_exports.object({
   url_check: UrlCheckConfigSchema.default({}),
   file_check: FileCheckConfigSchema.default({}),
   package_check: PackageCheckConfigSchema.default({}),
+  amsi_check: AmsiCheckConfigSchema.default({}),
   heuristics_enabled: external_exports.boolean().default(true),
   cache: CacheConfigSchema.default({}),
   allowlist: AllowlistConfigSchema.default({}),
@@ -11500,37 +11499,112 @@ var ConfigSchema = external_exports.object({
 });
 
 // ../core/dist/config.js
-var DEFAULT_CONFIG_PATH = (0, import_node_path2.join)((0, import_node_os.homedir)(), ".sage", "config.json");
+var SAGE_DIR = "~/.sage";
+function currentHomeDir() {
+  const envHome = process.env.HOME?.trim();
+  return envHome && envHome.length > 0 ? envHome : (0, import_node_os.homedir)();
+}
+function resolvedSageDir() {
+  return resolvePath(SAGE_DIR);
+}
+function defaultConfigPath() {
+  return (0, import_node_path2.join)(resolvedSageDir(), "config.json");
+}
+function defaultCachePath() {
+  return (0, import_node_path2.join)(resolvedSageDir(), "cache.json");
+}
+function defaultAllowlistPath() {
+  return (0, import_node_path2.join)(resolvedSageDir(), "allowlist.json");
+}
+function defaultAuditPath() {
+  return (0, import_node_path2.join)(resolvedSageDir(), "audit.jsonl");
+}
 function resolvePath(pathStr) {
   if (pathStr.startsWith("~/") || pathStr === "~") {
-    return (0, import_node_path2.join)((0, import_node_os.homedir)(), pathStr.slice(1));
+    return (0, import_node_path2.join)(currentHomeDir(), pathStr.slice(1));
   }
   return pathStr;
 }
+function isWithinDirectory(baseDir, targetPath) {
+  const rel = (0, import_node_path2.relative)(baseDir, targetPath);
+  if (rel === "")
+    return true;
+  if ((0, import_node_path2.isAbsolute)(rel))
+    return false;
+  return rel !== ".." && !rel.startsWith(`..${import_node_path2.sep}`);
+}
+function normalizeStateFilePath(configuredPath, fallbackPath, field, logger) {
+  const sageDir = resolvedSageDir();
+  const trimmed = configuredPath.trim();
+  if (trimmed === "") {
+    logger.warn(`Config ${field}.path is empty; using default`, {
+      configuredPath,
+      defaultPath: fallbackPath
+    });
+    return fallbackPath;
+  }
+  const expanded = resolvePath(trimmed);
+  const resolved = (0, import_node_path2.isAbsolute)(expanded) ? (0, import_node_path2.resolve)(expanded) : (0, import_node_path2.resolve)(sageDir, expanded);
+  if (isWithinDirectory(sageDir, resolved)) {
+    if (resolved === sageDir) {
+      logger.warn(`Config ${field}.path must point to a file; using default`, {
+        configuredPath,
+        defaultPath: fallbackPath
+      });
+      return fallbackPath;
+    }
+    return resolved;
+  }
+  logger.warn(`Config ${field}.path escapes ${sageDir}; using default`, {
+    configuredPath,
+    defaultPath: fallbackPath
+  });
+  return fallbackPath;
+}
+function sanitizeConfigPaths(config, logger) {
+  const cachePath = defaultCachePath();
+  const allowlistPath = defaultAllowlistPath();
+  const auditPath = defaultAuditPath();
+  return {
+    ...config,
+    cache: {
+      ...config.cache,
+      path: normalizeStateFilePath(config.cache.path, cachePath, "cache", logger)
+    },
+    allowlist: {
+      ...config.allowlist,
+      path: normalizeStateFilePath(config.allowlist.path, allowlistPath, "allowlist", logger)
+    },
+    logging: {
+      ...config.logging,
+      path: normalizeStateFilePath(config.logging.path, auditPath, "logging", logger)
+    }
+  };
+}
 async function loadConfig(configPath, logger = nullLogger) {
-  const path = configPath ?? DEFAULT_CONFIG_PATH;
+  const path = configPath ?? defaultConfigPath();
   let raw;
   try {
     raw = await getFileContent(path);
   } catch {
-    return ConfigSchema.parse({});
+    return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
   }
   let data;
   try {
     data = JSON.parse(raw);
   } catch (e) {
     logger.warn(`Failed to parse config from ${path}`, { error: String(e) });
-    return ConfigSchema.parse({});
+    return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
   }
   if (typeof data !== "object" || data === null || Array.isArray(data)) {
     logger.warn(`Config file ${path} does not contain a JSON object`);
-    return ConfigSchema.parse({});
+    return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
   }
   try {
-    return ConfigSchema.parse(data);
+    return sanitizeConfigPaths(ConfigSchema.parse(data), logger);
   } catch (e) {
     logger.warn(`Config validation failed, using defaults`, { error: String(e) });
-    return ConfigSchema.parse({});
+    return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
   }
 }
 
@@ -11560,6 +11634,16 @@ function normalizeFilePath(raw) {
 function emptyAllowlist() {
   return { urls: {}, commands: {}, filePaths: {} };
 }
+function addEntry(record, key, reason, originalVerdict) {
+  record[key] = { addedAt: (/* @__PURE__ */ new Date()).toISOString(), reason, originalVerdict };
+}
+function removeEntry(record, key) {
+  if (key in record) {
+    delete record[key];
+    return true;
+  }
+  return false;
+}
 function parseEntries(raw) {
   const entries = {};
   for (const [key, entryData] of Object.entries(raw)) {
@@ -11612,6 +11696,29 @@ async function loadAllowlist(config, logger = nullLogger) {
     filePaths
   };
 }
+async function saveAllowlist(allowlist, config, logger = nullLogger) {
+  const path = resolvePath(config.path);
+  const serializeEntries = (entries) => Object.fromEntries(Object.entries(entries).map(([key, entry]) => [
+    key,
+    {
+      added_at: entry.addedAt,
+      reason: entry.reason,
+      original_verdict: entry.originalVerdict
+    }
+  ]));
+  const data = {
+    urls: serializeEntries(allowlist.urls),
+    commands: serializeEntries(allowlist.commands),
+    file_paths: serializeEntries(allowlist.filePaths)
+  };
+  try {
+    await atomicWriteJson(path, data);
+    return true;
+  } catch (e) {
+    logger.warn(`Failed to save allowlist to ${path}`, { error: String(e) });
+    return false;
+  }
+}
 function isAllowlisted(allowlist, artifacts) {
   for (const artifact of artifacts) {
     if (artifact.type !== "command") {
@@ -11635,6 +11742,115 @@ function isAllowlisted(allowlist, artifacts) {
   }
   return false;
 }
+function addUrl(allowlist, url, reason, originalVerdict) {
+  addEntry(allowlist.urls, normalizeUrl(url), reason, originalVerdict);
+}
+function addCommand(allowlist, command, reason, originalVerdict) {
+  addEntry(allowlist.commands, hashCommand(command), reason, originalVerdict);
+}
+function addFilePath(allowlist, filePath, reason, originalVerdict) {
+  addEntry(allowlist.filePaths, normalizeFilePath(filePath), reason, originalVerdict);
+}
+function removeFilePath(allowlist, filePath) {
+  return removeEntry(allowlist.filePaths, normalizeFilePath(filePath));
+}
+function removeUrl(allowlist, url) {
+  return removeEntry(allowlist.urls, normalizeUrl(url));
+}
+function removeCommand(allowlist, commandHash) {
+  return removeEntry(allowlist.commands, commandHash);
+}
+
+// ../core/dist/approval-store.js
+var import_node_crypto3 = require("node:crypto");
+var PENDING_STALE_MS = 60 * 60 * 1e3;
+var APPROVED_TTL_MS = 10 * 60 * 1e3;
+var ApprovalStore = class _ApprovalStore {
+  pending = /* @__PURE__ */ new Map();
+  approved = /* @__PURE__ */ new Map();
+  static actionId(toolName, params, sessionId) {
+    const payload = JSON.stringify({ toolName, params, sessionId });
+    return (0, import_node_crypto3.createHash)("sha256").update(payload).digest("hex");
+  }
+  static artifactId(type, value) {
+    return `${type}:${value}`;
+  }
+  setPending(actionId, entry) {
+    this.pending.set(actionId, { ...entry, artifacts: [...entry.artifacts] });
+  }
+  deletePending(actionId) {
+    this.pending.delete(actionId);
+  }
+  approve(actionId) {
+    const entry = this.pending.get(actionId);
+    if (!entry)
+      return null;
+    const now = Date.now();
+    this.approved.set(actionId, {
+      artifacts: [...entry.artifacts],
+      approvedAt: now,
+      expiresAt: now + APPROVED_TTL_MS
+    });
+    this.pending.delete(actionId);
+    return entry;
+  }
+  isApproved(actionId) {
+    const entry = this.approved.get(actionId);
+    if (!entry)
+      return false;
+    if (Date.now() >= entry.expiresAt) {
+      this.approved.delete(actionId);
+      return false;
+    }
+    return true;
+  }
+  hasApprovedArtifact(type, value) {
+    return this.findApprovedAction(type, value) !== null;
+  }
+  consumeApprovedArtifact(type, value) {
+    const id = _ApprovalStore.artifactId(type, value);
+    for (const [actionId, entry] of this.approved.entries()) {
+      if (Date.now() >= entry.expiresAt) {
+        this.approved.delete(actionId);
+        continue;
+      }
+      const idx = entry.artifacts.findIndex((a) => _ApprovalStore.artifactId(a.type, a.value) === id);
+      if (idx !== -1) {
+        entry.artifacts.splice(idx, 1);
+        if (entry.artifacts.length === 0) {
+          this.approved.delete(actionId);
+        }
+        return true;
+      }
+    }
+    return false;
+  }
+  findApprovedAction(type, value) {
+    const id = _ApprovalStore.artifactId(type, value);
+    for (const [actionId, entry] of this.approved.entries()) {
+      if (Date.now() >= entry.expiresAt) {
+        this.approved.delete(actionId);
+        continue;
+      }
+      if (entry.artifacts.some((artifact) => _ApprovalStore.artifactId(artifact.type, artifact.value) === id)) {
+        return actionId;
+      }
+    }
+    return null;
+  }
+  cleanup(now = Date.now()) {
+    for (const [actionId, entry] of this.pending.entries()) {
+      if (now - entry.createdAt >= PENDING_STALE_MS) {
+        this.pending.delete(actionId);
+      }
+    }
+    for (const [actionId, entry] of this.approved.entries()) {
+      if (now >= entry.expiresAt) {
+        this.approved.delete(actionId);
+      }
+    }
+  }
+};
 
 // ../core/dist/audit-log.js
 var import_promises = require("node:fs/promises");
@@ -11647,7 +11863,7 @@ function toolInputSummary(toolName, toolInput) {
   if (toolName === "WebFetch") {
     return String(toolInput.url ?? "").slice(0, MAX_SUMMARY_LEN);
   }
-  if (toolName === "Write" || toolName === "Edit") {
+  if (toolName === "Write" || toolName === "Edit" || toolName === "Read" || toolName === "Delete") {
     return String(toolInput.file_path ?? "").slice(0, MAX_SUMMARY_LEN);
   }
   return JSON.stringify(toolInput).slice(0, MAX_SUMMARY_LEN);
@@ -11864,8 +12080,483 @@ var VerdictCache = class {
   }
 };
 
+// ../core/dist/clients/amsi.js
+var import_node_child_process = require("node:child_process");
+var AMSI_RESULT_DETECTED = 32768;
+var AMSI_RESULT_BLOCKED_BY_ADMIN_START = 16384;
+var MAX_SCAN_LENGTH = 1048576;
+var PS_TIMEOUT = 15e3;
+function isWSL() {
+  if (process.platform !== "linux")
+    return false;
+  return !!process.env.WSL_DISTRO_NAME;
+}
+function isAmsiSupported() {
+  return process.platform === "win32" || isWSL();
+}
+function interpretAmsiResult(amsiResult, content, contentName) {
+  return {
+    content: content.length > 200 ? `${content.slice(0, 200)}...` : content,
+    contentName,
+    amsiResult,
+    isDetected: amsiResult >= AMSI_RESULT_DETECTED,
+    isBlockedByAdmin: amsiResult >= AMSI_RESULT_BLOCKED_BY_ADMIN_START && amsiResult < AMSI_RESULT_DETECTED
+  };
+}
+var KoffiAmsiBackend = class {
+  logger;
+  context = null;
+  session = null;
+  available = false;
+  /* biome-ignore lint/suspicious/noExplicitAny: koffi FFI functions have dynamic signatures */
+  fnScanBuffer = null;
+  /* biome-ignore lint/suspicious/noExplicitAny: koffi FFI functions have dynamic signatures */
+  fnCloseSession = null;
+  /* biome-ignore lint/suspicious/noExplicitAny: koffi FFI functions have dynamic signatures */
+  fnUninitialize = null;
+  constructor(logger) {
+    this.logger = logger;
+  }
+  get isAvailable() {
+    return this.available;
+  }
+  async init() {
+    try {
+      const koffiModule = await import("koffi");
+      const koffi = koffiModule.default ?? koffiModule;
+      const lib = koffi.load("amsi.dll");
+      const _HAMSICONTEXT = koffi.pointer("HAMSICONTEXT", koffi.opaque());
+      const _HAMSISESSION = koffi.pointer("HAMSISESSION", koffi.opaque());
+      const AmsiInitialize = lib.func("int32 __stdcall AmsiInitialize(str16 appName, _Out_ HAMSICONTEXT *ctx)");
+      const AmsiOpenSession = lib.func("int32 __stdcall AmsiOpenSession(HAMSICONTEXT ctx, _Out_ HAMSISESSION *session)");
+      this.fnScanBuffer = lib.func("int32 __stdcall AmsiScanBuffer(HAMSICONTEXT ctx, void *buf, uint32 len, str16 contentName, HAMSISESSION session, _Out_ int32 *result)");
+      this.fnCloseSession = lib.func("void __stdcall AmsiCloseSession(HAMSICONTEXT ctx, HAMSISESSION session)");
+      this.fnUninitialize = lib.func("void __stdcall AmsiUninitialize(HAMSICONTEXT ctx)");
+      const ctxOut = [null];
+      const hr = AmsiInitialize("Sage", ctxOut);
+      if (hr !== 0) {
+        this.logger.warn("AMSI: koffi AmsiInitialize failed", { hr });
+        return;
+      }
+      this.context = ctxOut[0];
+      const sessOut = [null];
+      const hr2 = AmsiOpenSession(this.context, sessOut);
+      if (hr2 !== 0) {
+        this.logger.warn("AMSI: koffi AmsiOpenSession failed", { hr: hr2 });
+        try {
+          if (this.fnUninitialize) {
+            this.fnUninitialize(this.context);
+          }
+        } catch {
+        }
+        this.context = null;
+        return;
+      }
+      this.session = sessOut[0];
+      this.available = true;
+      this.logger.debug("AMSI: koffi backend initialized");
+    } catch (e) {
+      this.logger.debug("AMSI: koffi backend init failed", { error: String(e) });
+      this.available = false;
+    }
+  }
+  async scanString(content, contentName) {
+    if (!this.available || !this.fnScanBuffer || !this.context || !this.session) {
+      return null;
+    }
+    try {
+      const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
+      const buf = Buffer.from(truncated, "utf-8");
+      const resultOut = [0];
+      const hr = this.fnScanBuffer(this.context, buf, buf.length, contentName, this.session, resultOut);
+      if (hr !== 0) {
+        this.logger.warn("AMSI: koffi AmsiScanBuffer failed", { hr, contentName });
+        return null;
+      }
+      const amsiResult = resultOut[0] ?? 0;
+      this.logger.debug("AMSI: koffi scan result", { contentName, amsiResult });
+      return interpretAmsiResult(amsiResult, content, contentName);
+    } catch (e) {
+      this.logger.warn("AMSI: koffi scanBuffer failed", { error: String(e), contentName });
+      return null;
+    }
+  }
+  close() {
+    try {
+      if (this.session && this.context && this.fnCloseSession) {
+        this.fnCloseSession(this.context, this.session);
+      }
+    } catch {
+    }
+    try {
+      if (this.context && this.fnUninitialize) {
+        this.fnUninitialize(this.context);
+      }
+    } catch {
+    }
+    this.session = null;
+    this.context = null;
+    this.available = false;
+  }
+};
+var AMSI_CSHARP_TYPE = `
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public class SageAmsi {
+    [DllImport("amsi.dll", CharSet = CharSet.Unicode)]
+    static extern int AmsiInitialize(string appName, out IntPtr ctx);
+
+    [DllImport("amsi.dll")]
+    static extern int AmsiOpenSession(IntPtr ctx, out IntPtr session);
+
+    [DllImport("amsi.dll", CharSet = CharSet.Unicode)]
+    static extern int AmsiScanBuffer(
+        IntPtr ctx, byte[] buf, uint len,
+        string contentName, IntPtr session, out int result);
+
+    [DllImport("amsi.dll")]
+    static extern void AmsiCloseSession(IntPtr ctx, IntPtr session);
+
+    [DllImport("amsi.dll")]
+    static extern void AmsiUninitialize(IntPtr ctx);
+
+    private static IntPtr _ctx;
+    private static IntPtr _session;
+    private static bool _initialized;
+
+    public static bool Init() {
+        int hr = AmsiInitialize("Sage", out _ctx);
+        if (hr != 0) return false;
+        hr = AmsiOpenSession(_ctx, out _session);
+        if (hr != 0) {
+            AmsiUninitialize(_ctx);
+            return false;
+        }
+        _initialized = true;
+        return true;
+    }
+
+    public static int Scan(string content, string contentName) {
+        if (!_initialized) return -1;
+        byte[] bytes = Encoding.UTF8.GetBytes(content);
+        int result;
+        int hr = AmsiScanBuffer(_ctx, bytes, (uint)bytes.Length,
+                                contentName, _session, out result);
+        if (hr != 0) return -1;
+        return result;
+    }
+
+    public static void Shutdown() {
+        if (!_initialized) return;
+        AmsiCloseSession(_ctx, _session);
+        AmsiUninitialize(_ctx);
+        _initialized = false;
+    }
+}
+`;
+var PS_PERSISTENT_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+try {
+    Add-Type -TypeDefinition @'
+${AMSI_CSHARP_TYPE}
+'@
+
+    if (-not [SageAmsi]::Init()) {
+        [Console]::Error.Write("AMSI initialization failed")
+        exit 1
+    }
+
+    [Console]::Out.WriteLine("READY")
+    [Console]::Out.Flush()
+
+    while ($null -ne ($line = [Console]::In.ReadLine())) {
+        try {
+            $req = $line | ConvertFrom-Json
+            $content = $req.content
+            $cname = $req.contentName
+            if (-not $cname) { $cname = 'sage:test' }
+            $result = [SageAmsi]::Scan($content, $cname)
+            [Console]::Out.WriteLine($result)
+            [Console]::Out.Flush()
+        } catch {
+            [Console]::Out.WriteLine("-1")
+            [Console]::Out.Flush()
+        }
+    }
+
+    [SageAmsi]::Shutdown()
+} catch {
+    [Console]::Error.Write($_.Exception.Message)
+    exit 1
+}
+`;
+var PS_ONESHOT_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+try {
+    Add-Type -TypeDefinition @'
+${AMSI_CSHARP_TYPE}
+'@
+
+    if (-not [SageAmsi]::Init()) {
+        [Console]::Out.WriteLine("-1")
+        exit
+    }
+
+    $line = [Console]::In.ReadLine()
+    $req = $line | ConvertFrom-Json
+    $content = $req.content
+    $cname = $req.contentName
+    if (-not $cname) { $cname = 'sage:scan' }
+    $result = [SageAmsi]::Scan($content, $cname)
+    [SageAmsi]::Shutdown()
+    [Console]::Out.WriteLine($result)
+    [Console]::Out.Flush()
+} catch {
+    [Console]::Out.WriteLine("-1")
+}
+`;
+var PersistentPowershellAmsiBackend = class {
+  logger;
+  process = null;
+  available = false;
+  stdoutBuffer = "";
+  pendingResponse = null;
+  constructor(logger) {
+    this.logger = logger;
+  }
+  get isAvailable() {
+    return this.available;
+  }
+  waitForLine(timeout) {
+    return new Promise((resolve3, reject) => {
+      const timer = setTimeout(() => {
+        this.pendingResponse = null;
+        reject(new Error("timeout"));
+      }, timeout);
+      this.pendingResponse = { resolve: resolve3, reject, timer };
+    });
+  }
+  async init() {
+    try {
+      this.process = (0, import_node_child_process.spawn)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", PS_PERSISTENT_SCRIPT], {
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true
+      });
+      this.process.on("error", (err) => {
+        this.logger.debug("AMSI: PowerShell process error", { error: String(err) });
+        this.available = false;
+        if (this.pendingResponse) {
+          const { reject, timer } = this.pendingResponse;
+          this.pendingResponse = null;
+          clearTimeout(timer);
+          reject(err);
+        }
+      });
+      this.process.on("exit", () => {
+        this.available = false;
+        if (this.pendingResponse) {
+          const { reject, timer } = this.pendingResponse;
+          this.pendingResponse = null;
+          clearTimeout(timer);
+          reject(new Error("process exited"));
+        }
+      });
+      this.process.stdout?.on("data", (chunk) => {
+        this.stdoutBuffer += chunk.toString();
+        let idx = this.stdoutBuffer.indexOf("\n");
+        while (idx !== -1) {
+          const line = this.stdoutBuffer.slice(0, idx).trim();
+          this.stdoutBuffer = this.stdoutBuffer.slice(idx + 1);
+          if (this.pendingResponse) {
+            const { resolve: resolve3, timer } = this.pendingResponse;
+            this.pendingResponse = null;
+            clearTimeout(timer);
+            resolve3(line);
+          }
+          idx = this.stdoutBuffer.indexOf("\n");
+        }
+      });
+      this.process.stdin?.on("error", () => {
+      });
+      this.process.stderr?.on("data", (chunk) => {
+        this.logger.debug("AMSI: PowerShell stderr", {
+          data: chunk.toString().slice(0, 200)
+        });
+      });
+      const readyLine = await this.waitForLine(PS_TIMEOUT);
+      if (readyLine === "READY") {
+        this.available = true;
+        this.logger.debug("AMSI: PowerShell persistent backend initialized");
+      } else {
+        this.logger.debug("AMSI: PowerShell unexpected ready signal", { readyLine });
+        this.close();
+      }
+    } catch (e) {
+      this.logger.debug("AMSI: PowerShell persistent backend init failed", {
+        error: String(e)
+      });
+      this.close();
+    }
+  }
+  async scanString(content, contentName) {
+    if (!this.available || !this.process)
+      return null;
+    const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
+    try {
+      const req = JSON.stringify({ content: truncated, contentName });
+      this.process.stdin?.write(`${req}
+`);
+      const line = await this.waitForLine(PS_TIMEOUT);
+      const amsiResult = parseInt(line, 10);
+      if (Number.isNaN(amsiResult) || amsiResult < 0) {
+        this.logger.warn("AMSI: PowerShell scan returned invalid result", {
+          stdout: line.slice(0, 100),
+          contentName
+        });
+        return null;
+      }
+      this.logger.debug("AMSI: PowerShell scan result", { contentName, amsiResult });
+      return interpretAmsiResult(amsiResult, content, contentName);
+    } catch (e) {
+      this.logger.warn("AMSI: PowerShell scan failed", { error: String(e), contentName });
+      return null;
+    }
+  }
+  close() {
+    if (this.process) {
+      try {
+        this.process.stdin?.end();
+      } catch {
+      }
+      try {
+        this.process.kill();
+      } catch {
+      }
+      this.process = null;
+    }
+    if (this.pendingResponse) {
+      const { reject, timer } = this.pendingResponse;
+      this.pendingResponse = null;
+      clearTimeout(timer);
+      reject(new Error("closed"));
+    }
+    this.available = false;
+  }
+};
+var WslPowershellAmsiBackend = class {
+  logger;
+  available = false;
+  constructor(logger) {
+    this.logger = logger;
+  }
+  get isAvailable() {
+    return this.available;
+  }
+  async init() {
+    this.available = true;
+    this.logger.debug("AMSI: PowerShell one-shot backend ready (WSL)");
+  }
+  async scanString(content, contentName) {
+    if (!this.available)
+      return null;
+    const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
+    return new Promise((resolve3) => {
+      try {
+        const ps = (0, import_node_child_process.spawn)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", PS_ONESHOT_SCRIPT], { stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        const timer = setTimeout(() => {
+          this.logger.warn("AMSI: PowerShell one-shot timeout", { contentName });
+          try {
+            ps.kill();
+          } catch {
+          }
+          resolve3(null);
+        }, PS_TIMEOUT);
+        ps.stdout?.on("data", (chunk) => {
+          stdout += chunk.toString();
+        });
+        ps.stderr?.on("data", (chunk) => {
+          this.logger.debug("AMSI: PowerShell one-shot stderr", {
+            data: chunk.toString().slice(0, 200)
+          });
+        });
+        ps.on("error", (err) => {
+          clearTimeout(timer);
+          this.logger.debug("AMSI: PowerShell one-shot error", { error: String(err) });
+          resolve3(null);
+        });
+        ps.on("exit", () => {
+          clearTimeout(timer);
+          const amsiResult = parseInt(stdout.trim(), 10);
+          if (Number.isNaN(amsiResult) || amsiResult < 0) {
+            this.logger.warn("AMSI: PowerShell one-shot invalid result", {
+              stdout: stdout.slice(0, 100),
+              contentName
+            });
+            resolve3(null);
+            return;
+          }
+          this.logger.debug("AMSI: PowerShell one-shot result", { contentName, amsiResult });
+          resolve3(interpretAmsiResult(amsiResult, content, contentName));
+        });
+        const req = JSON.stringify({ content: truncated, contentName });
+        ps.stdin?.write(`${req}
+`);
+        ps.stdin?.end();
+      } catch (e) {
+        this.logger.warn("AMSI: PowerShell one-shot failed", { error: String(e), contentName });
+        resolve3(null);
+      }
+    });
+  }
+  close() {
+    this.available = false;
+  }
+};
+var AmsiClient = class {
+  logger;
+  backend = null;
+  constructor(logger = nullLogger) {
+    this.logger = logger;
+  }
+  get isAvailable() {
+    return this.backend?.isAvailable ?? false;
+  }
+  async init() {
+    const wsl = isWSL();
+    if (process.platform !== "win32" && !wsl) {
+      this.logger.debug("AMSI: skipping, not Windows");
+      return;
+    }
+    if (!wsl) {
+      const koffi = new KoffiAmsiBackend(this.logger);
+      await koffi.init();
+      if (koffi.isAvailable) {
+        this.backend = koffi;
+        return;
+      }
+    }
+    const ps = wsl ? new WslPowershellAmsiBackend(this.logger) : new PersistentPowershellAmsiBackend(this.logger);
+    await ps.init();
+    if (ps.isAvailable) {
+      this.backend = ps;
+      return;
+    }
+    this.logger.debug("AMSI: no backend available");
+  }
+  async scanString(content, contentName) {
+    return await this.backend?.scanString(content, contentName) ?? null;
+  }
+  close() {
+    this.backend?.close();
+    this.backend = null;
+  }
+};
+
 // ../core/dist/version.js
-var VERSION = true ? "0.4.4" : "dev";
+var VERSION = true ? "0.5.2" : "dev";
 
 // ../core/dist/clients/file-check.js
 var DEFAULT_TIMEOUT = 5;
@@ -12000,32 +12691,190 @@ var FileCheckClient = class {
   }
 };
 
-// ../core/dist/clients/url-check.js
+// ../core/dist/clients/package-registry.js
+var NPM_REGISTRY = "https://registry.npmjs.org";
+var PYPI_REGISTRY = "https://pypi.org/pypi";
 var DEFAULT_TIMEOUT2 = 5;
-var MAX_URLS_PER_REQUEST = 50;
-var SERVICE_NAME2 = "sage";
-function getProviderTld2() {
-  return "com";
-}
-var REQUEST_HEADERS2 = [
-  { name: "Accept", value: "application/json" },
-  { name: "Content-Type", value: "application/json" },
-  { name: "User-Agent", value: SERVICE_NAME2 }
-];
-function getProviderName2() {
-  return "avast";
-}
-var UrlCheckClient = class {
-  endpoint;
+var NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+var PYPI_NAME_RE = /^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$/;
+var RegistryClient = class {
   timeoutMs;
   logger;
   constructor(config, logger = nullLogger) {
-    this.endpoint = config?.endpoint ?? this.resolveEndpoint();
     this.timeoutMs = (config?.timeout_seconds ?? DEFAULT_TIMEOUT2) * 1e3;
     this.logger = logger;
   }
-  buildPath() {
-    return "/url-check";
+  async getPackageMetadata(name, registry, version) {
+    if (registry === "npm")
+      return this.getNpmMetadata(name, version);
+    return this.getPypiMetadata(name, version);
+  }
+  async getNpmMetadata(name, version) {
+    if (!NPM_NAME_RE.test(name)) {
+      this.logger.warn("Invalid npm package name rejected", { name });
+      return null;
+    }
+    const encodedName = name.includes("/") ? `${name.split("/")[0]}%2f${name.split("/")[1]}` : name;
+    const url = `${NPM_REGISTRY}/${encodedName}`;
+    try {
+      const response = await fetch(url, {
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+      if (response.status === 404)
+        return null;
+      if (!response.ok) {
+        this.logger.warn(`npm registry HTTP error: ${response.status}`, { name });
+        throw new Error(`npm registry HTTP ${response.status}`);
+      }
+      const data = await response.json();
+      return this.parseNpmResponse(name, data, version);
+    } catch (e) {
+      this.logger.warn("npm registry request failed", { name, error: String(e) });
+      throw e;
+    }
+  }
+  parseNpmResponse(name, data, requestedVersion) {
+    try {
+      const distTags = data["dist-tags"] ?? {};
+      const latestTag = distTags.latest;
+      if (!latestTag)
+        return null;
+      const versions = data.versions ?? {};
+      const effectiveVersion = requestedVersion && distTags[requestedVersion] ? distTags[requestedVersion] : requestedVersion;
+      const requestedVersionFound = !effectiveVersion || Boolean(versions[effectiveVersion]);
+      const resolvedVersion = effectiveVersion && versions[effectiveVersion] ? effectiveVersion : latestTag;
+      const resolvedVersionData = versions[resolvedVersion];
+      if (!resolvedVersionData)
+        return null;
+      const dist = resolvedVersionData.dist ?? {};
+      const shasum = dist.shasum ?? "";
+      const integrity = dist.integrity ?? "";
+      let latestHash = shasum;
+      let hashAlgorithm = "sha1";
+      if (integrity.startsWith("sha256-")) {
+        latestHash = Buffer.from(integrity.slice(7), "base64").toString("hex");
+        hashAlgorithm = "sha256";
+      }
+      const time = data.time ?? {};
+      let firstReleaseDate = null;
+      const created = time.created;
+      if (created) {
+        firstReleaseDate = new Date(created);
+      }
+      return {
+        name,
+        resolvedVersion,
+        latestHash,
+        hashAlgorithm,
+        firstReleaseDate,
+        requestedVersionFound
+      };
+    } catch (e) {
+      this.logger.warn("Failed to parse npm response", { name, error: String(e) });
+      return null;
+    }
+  }
+  async getPypiMetadata(name, version) {
+    if (!PYPI_NAME_RE.test(name)) {
+      this.logger.warn("Invalid PyPI package name rejected", { name });
+      return null;
+    }
+    const url = `${PYPI_REGISTRY}/${name}/json`;
+    try {
+      const response = await fetch(url, {
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+      if (response.status === 404)
+        return null;
+      if (!response.ok) {
+        this.logger.warn(`PyPI registry HTTP error: ${response.status}`, { name });
+        throw new Error(`PyPI registry HTTP ${response.status}`);
+      }
+      const data = await response.json();
+      return this.parsePypiResponse(name, data, version);
+    } catch (e) {
+      this.logger.warn("PyPI registry request failed", { name, error: String(e) });
+      throw e;
+    }
+  }
+  parsePypiResponse(name, data, requestedVersion) {
+    try {
+      const info = data.info ?? {};
+      const latestTag = info.version ?? "";
+      if (!latestTag)
+        return null;
+      const releases = data.releases ?? {};
+      const requestedVersionFound = !requestedVersion || Boolean(releases[requestedVersion]?.length);
+      const resolvedVersion = requestedVersion && releases[requestedVersion]?.length ? requestedVersion : latestTag;
+      let latestHash = "";
+      const latestFiles = releases[resolvedVersion] ?? [];
+      for (const file of latestFiles) {
+        const digests = file.digests ?? {};
+        if (digests.sha256) {
+          latestHash = digests.sha256;
+          break;
+        }
+      }
+      let firstReleaseDate = null;
+      for (const [, files] of Object.entries(releases)) {
+        for (const file of files) {
+          const uploadTime = file.upload_time_iso_8601;
+          if (uploadTime) {
+            const date = new Date(uploadTime);
+            if (!firstReleaseDate || date < firstReleaseDate) {
+              firstReleaseDate = date;
+            }
+          }
+        }
+      }
+      return {
+        name,
+        resolvedVersion,
+        latestHash,
+        hashAlgorithm: "sha256",
+        firstReleaseDate,
+        requestedVersionFound
+      };
+    } catch (e) {
+      this.logger.warn("Failed to parse PyPI response", { name, error: String(e) });
+      return null;
+    }
+  }
+};
+
+// ../core/dist/clients/url-check.js
+var DEFAULT_TIMEOUT3 = 5;
+var MAX_URLS_PER_REQUEST = 50;
+var SERVICE_NAME2 = "sage";
+function getProviderTld2() {
+  return "com";
+}
+var REQUEST_HEADERS2 = [
+  { name: "Accept", value: "application/json" },
+  { name: "Content-Type", value: "application/json" },
+  { name: "User-Agent", value: SERVICE_NAME2 }
+];
+function getProviderName2() {
+  return "avast";
+}
+function getSubdomain() {
+  return "svc";
+}
+function buildDomain() {
+  return [getSubdomain(), getProviderName2(), getProviderTld2()].join(".");
+}
+function resolveEndpoint(path) {
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  return `https://${SERVICE_NAME2}-proxy.${buildDomain()}${normalizedPath}`;
+}
+var UrlCheckClient = class {
+  endpoint;
+  timeoutMs;
+  logger;
+  constructor(config, logger = nullLogger) {
+    this.endpoint = config?.endpoint ?? resolveEndpoint("/url-check");
+    this.timeoutMs = (config?.timeout_seconds ?? DEFAULT_TIMEOUT3) * 1e3;
+    this.logger = logger;
   }
   async checkUrls(urls) {
     if (urls.length === 0)
@@ -12037,9 +12886,6 @@ var UrlCheckClient = class {
     const batchResults = await Promise.all(batches.map((batch) => this.checkBatch(batch)));
     return batchResults.flat();
   }
-  getSubdomain() {
-    return "svc";
-  }
   async checkBatch(urls) {
     const queries = urls.map((url) => ({ key: { "url-like": url } }));
     const payload = {
@@ -12075,9 +12921,6 @@ var UrlCheckClient = class {
       return [];
     }
   }
-  buildDomain() {
-    return [this.getSubdomain(), getProviderName2(), getProviderTld2()].join(".");
-  }
   parseAnswer(answer) {
     try {
       const url = answer.key ?? "";
@@ -12102,9 +12945,6 @@ var UrlCheckClient = class {
       return null;
     }
   }
-  resolveEndpoint() {
-    return `https://${SERVICE_NAME2}-proxy.${this.buildDomain()}${this.buildPath()}`;
-  }
 };
 
 // ../core/dist/engine.js
@@ -12135,17 +12975,8 @@ var DecisionEngine = class {
   constructor(sensitivity = "balanced") {
     this.threshold = SENSITIVITY_THRESHOLDS[sensitivity] ?? CONFIDENCE_THRESHOLD;
   }
-  async decide(heuristicMatchesOrSources, urlCheckResults) {
-    let sources;
-    if (Array.isArray(heuristicMatchesOrSources)) {
-      sources = {
-        heuristicMatches: heuristicMatchesOrSources,
-        urlCheckResults: urlCheckResults ?? []
-      };
-    } else {
-      sources = heuristicMatchesOrSources;
-    }
-    const signals = this.collectSignals(sources.heuristicMatches, sources.urlCheckResults, sources.packageCheckResults);
+  async decide(sources) {
+    const signals = this.collectSignals(sources.heuristicMatches, sources.urlCheckResults, sources.packageCheckResults, sources.amsiCheckResults);
     if (signals.length === 0) {
       return this.allowVerdict();
     }
@@ -12172,7 +13003,7 @@ var DecisionEngine = class {
       reasons: allReasons
     };
   }
-  collectSignals(heuristicMatches, urlCheckResults, packageCheckResults) {
+  collectSignals(heuristicMatches, urlCheckResults, packageCheckResults, amsiCheckResults) {
     const signals = [];
     for (const match of heuristicMatches) {
       signals.push({
@@ -12222,6 +13053,33 @@ var DecisionEngine = class {
           signals.push(signal);
       }
     }
+    if (amsiCheckResults) {
+      for (const result of amsiCheckResults) {
+        if (result.isDetected) {
+          signals.push({
+            decision: "deny",
+            category: "malware",
+            confidence: 1,
+            severity: "critical",
+            source: "amsi",
+            threatId: null,
+            reason: `AMSI detected malware in ${result.contentName} (result=${result.amsiResult})`,
+            artifact: result.contentName
+          });
+        } else if (result.isBlockedByAdmin) {
+          signals.push({
+            decision: "deny",
+            category: "malware",
+            confidence: 0.9,
+            severity: "critical",
+            source: "amsi",
+            threatId: null,
+            reason: `AMSI: content blocked by admin policy in ${result.contentName} (result=${result.amsiResult})`,
+            artifact: result.contentName
+          });
+        }
+      }
+    }
     return signals;
   }
   packageVerdictToSignal(pkg) {
@@ -12511,6 +13369,459 @@ var HeuristicsEngine = class {
   }
 };
 
+// ../core/dist/package-checker.js
+var SUSPICIOUS_AGE_DAYS = 7;
+var MAX_CONCURRENT = 10;
+var PackageChecker = class {
+  registryClient;
+  fileCheckClient;
+  logger;
+  constructor(config = {}, logger = nullLogger) {
+    this.logger = logger;
+    this.registryClient = new RegistryClient({ timeout_seconds: config.registryTimeoutSeconds }, logger);
+    this.fileCheckClient = config.fileCheckEnabled !== false ? new FileCheckClient({
+      endpoint: config.fileCheckEndpoint,
+      timeout_seconds: config.fileCheckTimeoutSeconds
+    }, logger) : null;
+  }
+  async checkPackages(packages) {
+    const toCheck = [];
+    const results = [];
+    for (const pkg of packages) {
+      if (pkg.name.startsWith("@")) {
+        results.push({
+          packageName: pkg.name,
+          registry: pkg.registry,
+          verdict: "clean",
+          confidence: 1,
+          details: "Scoped package \u2014 skipped (v1)"
+        });
+      } else {
+        toCheck.push(pkg);
+      }
+    }
+    const checkResults = await this.runWithConcurrencyLimit(toCheck, (pkg) => this.checkSinglePackage(pkg), MAX_CONCURRENT);
+    results.push(...checkResults);
+    return results;
+  }
+  async checkSinglePackage(pkg) {
+    let metadata;
+    try {
+      metadata = await this.registryClient.getPackageMetadata(pkg.name, pkg.registry, pkg.version);
+    } catch {
+      return {
+        packageName: pkg.name,
+        registry: pkg.registry,
+        verdict: "unknown",
+        confidence: 0.6,
+        details: `Package check for '${pkg.name}' timed out (verify manually)`
+      };
+    }
+    if (metadata === null) {
+      return {
+        packageName: pkg.name,
+        registry: pkg.registry,
+        verdict: "not_found",
+        confidence: 0.95,
+        details: `Package '${pkg.name}' not found on ${pkg.registry} (non-existent or misspelled)`
+      };
+    }
+    if (!metadata.requestedVersionFound && pkg.version) {
+      return {
+        packageName: pkg.name,
+        registry: pkg.registry,
+        verdict: "not_found",
+        confidence: 0.9,
+        details: `Package '${pkg.name}@${pkg.version}' version not found on ${pkg.registry} (hallucinated or unpublished)`
+      };
+    }
+    if (metadata.latestHash && this.fileCheckClient && metadata.hashAlgorithm === "sha256") {
+      try {
+        const fileResult = await this.fileCheckClient.checkHash(metadata.latestHash);
+        if (fileResult) {
+          const sev = fileResult.severity.toUpperCase();
+          if (sev === "SEVERITY_MALWARE") {
+            const detections = fileResult.detectionNames.length > 0 ? fileResult.detectionNames.join(", ") : sev;
+            return {
+              packageName: pkg.name,
+              registry: pkg.registry,
+              verdict: "malicious",
+              confidence: 1,
+              details: `Malicious package '${pkg.name}' (${detections})`,
+              fileCheckSeverity: sev
+            };
+          }
+        }
+      } catch {
+        this.logger.warn("File-check failed for package", { name: pkg.name });
+      }
+    }
+    const ageDays = metadata.firstReleaseDate ? (Date.now() - metadata.firstReleaseDate.getTime()) / (1e3 * 60 * 60 * 24) : void 0;
+    if (ageDays !== void 0 && ageDays < SUSPICIOUS_AGE_DAYS) {
+      return {
+        packageName: pkg.name,
+        registry: pkg.registry,
+        verdict: "suspicious_age",
+        confidence: 0.75,
+        details: `Package '${pkg.name}' first published ${Math.floor(ageDays)} days ago (suspicious age)`,
+        ageDays
+      };
+    }
+    return {
+      packageName: pkg.name,
+      registry: pkg.registry,
+      verdict: "clean",
+      confidence: 1,
+      details: `Package '${pkg.name}' verified on ${pkg.registry}`,
+      ageDays
+    };
+  }
+  async runWithConcurrencyLimit(items, fn, limit) {
+    const results = [];
+    const executing = [];
+    for (const item of items) {
+      const p = fn(item).then((r) => {
+        results.push(r);
+      });
+      executing.push(p);
+      if (executing.length >= limit) {
+        await Promise.race(executing);
+        for (let i = executing.length - 1; i >= 0; i--) {
+          const settled = await Promise.race([
+            executing[i]?.then(() => true),
+            Promise.resolve(false)
+          ]);
+          if (settled)
+            executing.splice(i, 1);
+        }
+      }
+    }
+    await Promise.allSettled(executing);
+    return results;
+  }
+};
+
+// ../core/dist/package-extractor.js
+function extractPackagesFromCommand(command) {
+  const packages = [];
+  const normalized = command.replace(/^(\s*(sudo|env\s+\S+=\S+)\s+)+/g, "").trim();
+  const commands = normalized.split(/\s*(?:&&|;|\|)\s*/);
+  for (const cmd of commands) {
+    const tokens = shellTokenize(cmd.trim());
+    if (tokens.length === 0)
+      continue;
+    const binary = tokens[0]?.replace(/^.*[/\\]/, "") ?? "";
+    if (["npm", "npx"].includes(binary)) {
+      packages.push(...extractNpmPackages(tokens));
+    } else if (binary === "yarn") {
+      packages.push(...extractYarnPackages(tokens));
+    } else if (["pnpm", "bunx"].includes(binary)) {
+      packages.push(...extractPnpmBunPackages(tokens, binary));
+    } else if (binary === "bun") {
+      packages.push(...extractBunPackages(tokens));
+    } else if (["pip", "pip3"].includes(binary)) {
+      packages.push(...extractPipPackages(tokens));
+    } else if (["python", "python3", "python.exe", "python3.exe"].includes(binary) || binary.match(/python3?\.\d+/) || binary.endsWith("/python") || binary.endsWith("/python3")) {
+      if (tokens[1] === "-m" && ["pip", "pip3"].includes(tokens[2] ?? "")) {
+        packages.push(...extractPipPackages(tokens.slice(2)));
+      }
+    }
+  }
+  return packages;
+}
+function extractPackagesFromManifest(filePath, content) {
+  const lowerPath = filePath.toLowerCase().replace(/\\/g, "/");
+  if (lowerPath.endsWith("package.json")) {
+    return extractFromPackageJson(content);
+  }
+  if (lowerPath.endsWith("requirements.txt")) {
+    return extractFromRequirementsTxt(content);
+  }
+  return [];
+}
+function shellTokenize(cmd) {
+  const tokens = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  for (const ch of cmd) {
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+    } else if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+    } else if (/\s/.test(ch) && !inSingle && !inDouble) {
+      if (current)
+        tokens.push(current);
+      current = "";
+    } else {
+      current += ch;
+    }
+  }
+  if (current)
+    tokens.push(current);
+  return tokens;
+}
+function isPackageName(token) {
+  if (token.startsWith("-"))
+    return false;
+  if (!/^[a-zA-Z@]/.test(token))
+    return false;
+  if (token.startsWith("https://") || token.startsWith("http://"))
+    return false;
+  if (token.startsWith("git+"))
+    return false;
+  if (token.startsWith("./") || token.startsWith("../") || token.startsWith("/"))
+    return false;
+  if (token.startsWith("file:"))
+    return false;
+  if (token === ".")
+    return false;
+  return true;
+}
+function splitNameVersion(token) {
+  if (token.startsWith("@")) {
+    const afterScope = token.indexOf("/");
+    if (afterScope === -1)
+      return { name: token };
+    const rest = token.slice(afterScope + 1);
+    const atIdx2 = rest.indexOf("@");
+    if (atIdx2 > 0) {
+      return {
+        name: `${token.slice(0, afterScope + 1)}${rest.slice(0, atIdx2)}`,
+        version: rest.slice(atIdx2 + 1)
+      };
+    }
+    return { name: token };
+  }
+  const atIdx = token.indexOf("@");
+  if (atIdx > 0) {
+    return { name: token.slice(0, atIdx), version: token.slice(atIdx + 1) };
+  }
+  return { name: token };
+}
+var NPM_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "--registry",
+  "--tag",
+  "--workspace",
+  "-w",
+  "--prefix",
+  "--cache",
+  "--userconfig",
+  "--globalconfig"
+]);
+function extractNpmPackages(tokens) {
+  const packages = [];
+  const binary = tokens[0]?.replace(/^.*[/\\]/, "") ?? "";
+  if (binary === "npx") {
+    for (let i = 1; i < tokens.length; i++) {
+      const t = tokens[i] ?? "";
+      if (t === "--" || t === "-y" || t === "--yes" || t === "-p" || t === "--package")
+        continue;
+      if (t.startsWith("-"))
+        continue;
+      if (!isPackageName(t))
+        break;
+      const { name, version } = splitNameVersion(t);
+      packages.push({ name, version, registry: "npm", source: "command" });
+      break;
+    }
+    return packages;
+  }
+  const subcommand = tokens[1] ?? "";
+  if (!["install", "i", "add", "ci"].includes(subcommand))
+    return packages;
+  let skipNext = false;
+  for (let i = 2; i < tokens.length; i++) {
+    const t = tokens[i] ?? "";
+    if (skipNext) {
+      skipNext = false;
+      continue;
+    }
+    if (NPM_VALUE_FLAGS.has(t)) {
+      skipNext = true;
+      continue;
+    }
+    if (t.startsWith("-"))
+      continue;
+    if (!isPackageName(t))
+      break;
+    const { name, version } = splitNameVersion(t);
+    packages.push({ name, version, registry: "npm", source: "command" });
+  }
+  return packages;
+}
+function extractYarnPackages(tokens) {
+  const packages = [];
+  const subcommand = tokens[1] ?? "";
+  if (subcommand !== "add")
+    return packages;
+  for (let i = 2; i < tokens.length; i++) {
+    const t = tokens[i] ?? "";
+    if (t.startsWith("-"))
+      continue;
+    if (!isPackageName(t))
+      break;
+    const { name, version } = splitNameVersion(t);
+    packages.push({ name, version, registry: "npm", source: "command" });
+  }
+  return packages;
+}
+function extractPnpmBunPackages(tokens, binary) {
+  const packages = [];
+  if (binary === "bunx") {
+    for (let i = 1; i < tokens.length; i++) {
+      const t = tokens[i] ?? "";
+      if (t.startsWith("-"))
+        continue;
+      if (!isPackageName(t))
+        break;
+      const { name, version } = splitNameVersion(t);
+      packages.push({ name, version, registry: "npm", source: "command" });
+      break;
+    }
+    return packages;
+  }
+  const subcommand = tokens[1] ?? "";
+  if (subcommand === "dlx") {
+    for (let i = 2; i < tokens.length; i++) {
+      const t = tokens[i] ?? "";
+      if (t.startsWith("-"))
+        continue;
+      if (!isPackageName(t))
+        break;
+      const { name, version } = splitNameVersion(t);
+      packages.push({ name, version, registry: "npm", source: "command" });
+      break;
+    }
+    return packages;
+  }
+  if (!["add", "install", "i"].includes(subcommand))
+    return packages;
+  for (let i = 2; i < tokens.length; i++) {
+    const t = tokens[i] ?? "";
+    if (t.startsWith("-"))
+      continue;
+    if (!isPackageName(t))
+      break;
+    const { name, version } = splitNameVersion(t);
+    packages.push({ name, version, registry: "npm", source: "command" });
+  }
+  return packages;
+}
+function extractBunPackages(tokens) {
+  const packages = [];
+  const subcommand = tokens[1] ?? "";
+  if (!["add", "install", "i"].includes(subcommand))
+    return packages;
+  for (let i = 2; i < tokens.length; i++) {
+    const t = tokens[i] ?? "";
+    if (t.startsWith("-"))
+      continue;
+    if (!isPackageName(t))
+      break;
+    const { name, version } = splitNameVersion(t);
+    packages.push({ name, version, registry: "npm", source: "command" });
+  }
+  return packages;
+}
+function extractPipPackages(tokens) {
+  const packages = [];
+  const subcommand = tokens[1] ?? "";
+  if (subcommand !== "install")
+    return packages;
+  let skipNext = false;
+  for (let i = 2; i < tokens.length; i++) {
+    const t = tokens[i] ?? "";
+    if (skipNext) {
+      skipNext = false;
+      continue;
+    }
+    if ([
+      "-r",
+      "--requirement",
+      "-c",
+      "--constraint",
+      "-e",
+      "--editable",
+      "-t",
+      "--target",
+      "--prefix",
+      "-i",
+      "--index-url",
+      "--extra-index-url",
+      "-f",
+      "--find-links"
+    ].includes(t)) {
+      skipNext = true;
+      continue;
+    }
+    if (t.startsWith("-"))
+      continue;
+    if (!isPackageName(t))
+      break;
+    const match = t.match(/^([a-zA-Z0-9._-]+)(?:[><=!~]+(.+))?$/);
+    if (match) {
+      packages.push({
+        name: match[1],
+        version: match[2],
+        registry: "pypi",
+        source: "command"
+      });
+    }
+  }
+  return packages;
+}
+function extractFromPackageJson(content) {
+  const packages = [];
+  try {
+    const data = JSON.parse(content);
+    const deps = data.dependencies ?? {};
+    const devDeps = data.devDependencies ?? {};
+    for (const [name, version] of Object.entries({ ...deps, ...devDeps })) {
+      if (typeof version !== "string")
+        continue;
+      if (version.startsWith("file:") || version.startsWith("link:"))
+        continue;
+      if (version.startsWith("git+") || version.startsWith("http"))
+        continue;
+      packages.push({
+        name,
+        version: version.replace(/^[\^~>=<]+/, ""),
+        registry: "npm",
+        source: "package.json"
+      });
+    }
+  } catch {
+  }
+  return packages;
+}
+function extractFromRequirementsTxt(content) {
+  const packages = [];
+  const lines = content.split("\n");
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#") || line.startsWith("-r") || line.startsWith("--requirement") || line.startsWith("-e") || line.startsWith("--editable") || line.startsWith("-i") || line.startsWith("--index-url") || line.startsWith("--extra-index-url") || line.startsWith("-f") || line.startsWith("--find-links") || line.startsWith("-c") || line.startsWith("--constraint")) {
+      continue;
+    }
+    if (line.startsWith("git+") || line.startsWith("http://") || line.startsWith("https://")) {
+      continue;
+    }
+    const cleaned = line.split("#")[0]?.split(";")[0]?.trim() ?? "";
+    if (!cleaned)
+      continue;
+    const match = cleaned.match(/^([a-zA-Z0-9._-]+)(?:\[.*\])?(?:[><=!~]+(.+))?$/);
+    if (match) {
+      packages.push({
+        name: match[1],
+        version: match[2]?.trim(),
+        registry: "pypi",
+        source: "requirements.txt"
+      });
+    }
+  }
+  return packages;
+}
+
 // ../core/dist/threat-loader.js
 var import_promises3 = require("node:fs/promises");
 var import_node_path6 = require("node:path");
@@ -12617,32 +13928,283 @@ async function loadThreats(threatDir, logger = nullLogger) {
   return threats;
 }
 
-// ../core/dist/format.js
-var PAD = 12;
-var SEPARATOR_WIDTH = 48;
-function severityEmoji(severity) {
-  const s = severity.toLowerCase();
-  if (s === "critical" || s === "high")
-    return "\u{1F6A8}";
-  if (s === "medium" || s === "warn" || s === "warning")
-    return "\u26A0\uFE0F";
-  return "\u2139\uFE0F";
-}
-function kv(key, value) {
-  return `   ${key.padEnd(PAD)}${value}`;
-}
-function separatorLine(headerLength) {
-  return "\u2501".repeat(headerLength);
-}
-function formatUpdateNotice(result) {
-  return `\u2B06\uFE0F  Update available: v${result.currentVersion} \u2192 v${result.latestVersion} (https://github.com/avast/sage)`;
+// ../core/dist/evaluator.js
+function allowVerdict(source = "none") {
+  return {
+    decision: "allow",
+    category: "none",
+    confidence: 1,
+    severity: "info",
+    source,
+    artifacts: [],
+    matchedThreatId: null,
+    reasons: []
+  };
 }
-function formatThreatBanner(version, results, versionCheck) {
-  const header = `\u{1F6E1}\uFE0F Sage v${version} by Gen Digital \u2014 Threat Detected`;
-  const lines = [" ", header, separatorLine(SEPARATOR_WIDTH)];
-  const MAX_FINDINGS = 5;
-  let first = true;
-  for (const result of results) {
+async function evaluateToolCall(request, context) {
+  const logger = context.logger ?? nullLogger;
+  const config = await loadConfig(context.configPath, logger).catch(() => ConfigSchema.parse({}));
+  if (request.artifacts.length === 0) {
+    return allowVerdict("no_artifacts");
+  }
+  try {
+    const allowlist = await loadAllowlist(config.allowlist, logger);
+    if (isAllowlisted(allowlist, request.artifacts)) {
+      const verdict2 = allowVerdict("allowlisted");
+      await logVerdict(config.logging, request.sessionId, request.toolName, request.toolInput, verdict2, true);
+      return verdict2;
+    }
+  } catch {
+  }
+  let cache = null;
+  try {
+    cache = new VerdictCache(config.cache, logger);
+    await cache.load();
+  } catch {
+    cache = null;
+  }
+  const urls = request.artifacts.filter((artifact) => artifact.type === "url").map((artifact) => artifact.value);
+  const { cachedUrlVerdicts, uncachedUrls } = partitionUrlsByCache(urls, cache);
+  let heuristicMatches = [];
+  if (config.heuristics_enabled) {
+    let threats = await loadThreats(context.threatsDir, logger);
+    if (config.disabled_threats.length > 0) {
+      const disabledSet = new Set(config.disabled_threats);
+      threats = threats.filter((t) => !disabledSet.has(t.id));
+    }
+    const trustedDomains = await loadTrustedDomains(context.allowlistsDir, logger);
+    const heuristics = new HeuristicsEngine(threats, trustedDomains);
+    heuristicMatches = heuristics.match(request.artifacts);
+  }
+  let urlCheckResults = [];
+  const urlsToCheck = cache ? uncachedUrls : urls;
+  if (urlsToCheck.length > 0 && config.url_check.enabled) {
+    try {
+      const client = new UrlCheckClient(config.url_check, logger);
+      urlCheckResults = await client.checkUrls(urlsToCheck);
+    } catch {
+    }
+  }
+  const packageCheckResults = await checkPackages(request, config, cache, logger);
+  const amsiCheckResults = [];
+  if (config.amsi_check.enabled && isAmsiSupported()) {
+    let amsiClient = null;
+    try {
+      amsiClient = new AmsiClient(logger);
+      await amsiClient.init();
+      if (amsiClient.isAvailable) {
+        const scans = [];
+        if (request.toolName === "Bash") {
+          const command = request.toolInput.command ?? "";
+          if (command) {
+            scans.push({ content: command, name: `Bash:command` });
+          }
+        } else if (request.toolName === "Write") {
+          const filePath = request.toolInput.file_path ?? "";
+          const content = request.toolInput.content ?? "";
+          if (content) {
+            scans.push({ content, name: `Write:${filePath}` });
+          }
+        } else if (request.toolName === "Edit") {
+          const filePath = request.toolInput.file_path ?? "";
+          const newString = request.toolInput.new_string ?? "";
+          if (newString) {
+            scans.push({ content: newString, name: `Edit:${filePath}` });
+          }
+        }
+        for (const scan of scans) {
+          const result = await amsiClient.scanString(scan.content, scan.name);
+          if (result) {
+            amsiCheckResults.push(result);
+          }
+        }
+      }
+    } catch {
+    } finally {
+      amsiClient?.close();
+    }
+  }
+  const engine = new DecisionEngine(config.sensitivity);
+  let verdict = await engine.decide({
+    heuristicMatches,
+    urlCheckResults,
+    packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
+    amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0
+  });
+  if (cachedUrlVerdicts.size > 0 && verdict.decision === "allow") {
+    for (const [url, cachedVerdict] of cachedUrlVerdicts) {
+      if (cachedVerdict.verdict === "allow") {
+        continue;
+      }
+      verdict = {
+        decision: cachedVerdict.verdict,
+        category: "network_egress",
+        confidence: 1,
+        severity: cachedVerdict.severity,
+        source: `cache(${cachedVerdict.source})`,
+        artifacts: [url],
+        matchedThreatId: null,
+        reasons: cachedVerdict.reasons
+      };
+      break;
+    }
+  }
+  await cacheUrlResults(urlCheckResults, cache);
+  try {
+    await logVerdict(config.logging, request.sessionId, request.toolName, request.toolInput, verdict);
+  } catch {
+  }
+  return verdict;
+}
+function partitionUrlsByCache(urls, cache) {
+  const cachedUrlVerdicts = /* @__PURE__ */ new Map();
+  let uncachedUrls = [];
+  if (cache && urls.length > 0) {
+    try {
+      for (const url of urls) {
+        const cached = cache.getUrl(url);
+        if (cached !== null) {
+          cachedUrlVerdicts.set(url, cached);
+        } else {
+          uncachedUrls.push(url);
+        }
+      }
+    } catch {
+      uncachedUrls = urls;
+    }
+  }
+  return { cachedUrlVerdicts, uncachedUrls };
+}
+async function cacheUrlResults(urlCheckResults, cache) {
+  if (!cache)
+    return;
+  try {
+    for (const result of urlCheckResults) {
+      let cachedVerdict;
+      if (result.isMalicious) {
+        cachedVerdict = {
+          verdict: "deny",
+          severity: "critical",
+          reasons: [
+            `URL check: malicious (${result.findings.map((finding) => `${finding.severityName}/${finding.typeName}`).join(", ")})`
+          ],
+          source: "url_check"
+        };
+      } else if (result.flags.length > 0) {
+        cachedVerdict = {
+          verdict: "ask",
+          severity: "warning",
+          reasons: [`URL check: suspicious (${result.flags.join(", ")})`],
+          source: "url_check"
+        };
+      } else {
+        cachedVerdict = {
+          verdict: "allow",
+          severity: "info",
+          reasons: [],
+          source: "url_check"
+        };
+      }
+      cache.putUrl(result.url, cachedVerdict, result.isMalicious);
+    }
+    await cache.save();
+  } catch {
+  }
+}
+async function checkPackages(request, config, cache, logger) {
+  const results = [];
+  if (!config.package_check.enabled)
+    return results;
+  try {
+    let parsedPackages;
+    if (request.toolName === "Bash") {
+      const command = request.toolInput.command ?? "";
+      parsedPackages = extractPackagesFromCommand(command);
+    } else if (request.toolName === "Write" || request.toolName === "Edit") {
+      const filePath = request.toolInput.file_path ?? "";
+      const content = request.toolInput.content ?? request.toolInput.new_string ?? "";
+      parsedPackages = extractPackagesFromManifest(filePath, content);
+    }
+    if (!parsedPackages || parsedPackages.length === 0)
+      return results;
+    const uncached = [];
+    for (const pkg of parsedPackages) {
+      const cacheKey2 = `${pkg.registry}:${pkg.name}${pkg.version ? `@${pkg.version}` : ""}`;
+      const cached = cache?.getPackage(cacheKey2);
+      if (cached && cached.verdict !== "allow") {
+        results.push({
+          packageName: pkg.name,
+          registry: pkg.registry,
+          verdict: cached.verdict === "deny" ? "malicious" : "suspicious_age",
+          confidence: 1,
+          details: cached.reasons.join("; ")
+        });
+      } else if (!cached) {
+        uncached.push(pkg);
+      }
+    }
+    if (uncached.length > 0) {
+      const checker = new PackageChecker({
+        registryTimeoutSeconds: config.package_check.timeout_seconds,
+        fileCheckEndpoint: config.file_check.endpoint,
+        fileCheckTimeoutSeconds: config.file_check.timeout_seconds,
+        fileCheckEnabled: config.file_check.enabled
+      }, logger);
+      const checked = await checker.checkPackages(uncached);
+      results.push(...checked);
+      if (cache) {
+        for (const result of checked) {
+          const pkg = uncached.find((p) => p.name === result.packageName);
+          const cacheKey2 = `${result.registry}:${result.packageName}${pkg?.version ? `@${pkg.version}` : ""}`;
+          const isCritical = result.verdict === "malicious" || result.verdict === "not_found";
+          cache.putPackage(cacheKey2, {
+            verdict: result.verdict === "clean" ? "allow" : isCritical ? "deny" : "ask",
+            severity: isCritical ? "critical" : "warning",
+            reasons: [result.details],
+            source: "package_check"
+          }, result.ageDays ?? null);
+        }
+      }
+    }
+  } catch {
+  }
+  return results;
+}
+
+// ../core/dist/format.js
+var PAD = 12;
+var SEPARATOR_WIDTH = 48;
+function severityEmoji(severity) {
+  const s = severity.toLowerCase();
+  if (s === "critical" || s === "high")
+    return "\u{1F6A8}";
+  if (s === "medium" || s === "warn" || s === "warning")
+    return "\u26A0\uFE0F";
+  return "\u2139\uFE0F";
+}
+function kv(key, value) {
+  return `   ${key.padEnd(PAD)}${value}`;
+}
+function separatorLine(headerLength) {
+  return "\u2501".repeat(headerLength);
+}
+function formatUpdateNotice(result) {
+  return `\u2B06\uFE0F  Update available: v${result.currentVersion} \u2192 v${result.latestVersion} (https://github.com/avast/sage)`;
+}
+function formatStartupClean(version, versionCheck) {
+  const base = `\u{1F6E1}\uFE0F Sage v${version} by Gen Digital \u2705 No threats found`;
+  if (versionCheck?.updateAvailable) {
+    return `${base}
+${formatUpdateNotice(versionCheck)}`;
+  }
+  return base;
+}
+function formatThreatBanner(version, results, versionCheck) {
+  const header = `\u{1F6E1}\uFE0F Sage v${version} by Gen Digital \u2014 Threat Detected`;
+  const lines = [" ", header, separatorLine(SEPARATOR_WIDTH)];
+  const MAX_FINDINGS = 5;
+  let first = true;
+  for (const result of results) {
     const highCrit = result.findings.filter((f) => f.severity === "critical" || f.severity === "high");
     if (highCrit.length === 0)
       continue;
@@ -12673,31 +14235,203 @@ function formatThreatBanner(version, results, versionCheck) {
   }
   return lines.join("\n");
 }
+function formatSessionStartMessage(version, result) {
+  if (result.scanResults.length > 0) {
+    return formatThreatBanner(version, result.scanResults, result.versionCheck);
+  }
+  return formatStartupClean(version, result.versionCheck);
+}
 
-// ../core/dist/plugin-scan-cache.js
-var import_node_crypto3 = require("node:crypto");
+// ../core/dist/guard.js
+async function guardToolCall(request, context, approvalStore) {
+  const actionId = ApprovalStore.actionId(request.toolName, request.toolInput, request.sessionId);
+  if (approvalStore.isApproved(actionId)) {
+    return { verdict: allowVerdict("approved") };
+  }
+  const verdict = await evaluateToolCall(request, context);
+  if (verdict.decision === "allow" || verdict.decision === "deny") {
+    return { verdict };
+  }
+  const logger = context.logger ?? nullLogger;
+  const config = await loadConfig(context.configPath, logger);
+  if (config.sensitivity === "paranoid") {
+    return { verdict: { ...verdict, decision: "deny" } };
+  }
+  approvalStore.setPending(actionId, {
+    artifacts: request.artifacts,
+    createdAt: Date.now()
+  });
+  return { verdict, actionId };
+}
+var MAX_ARTIFACT_VALUE_LEN = 120;
+function truncateValue(value) {
+  const singleLine = value.replaceAll("\n", "\\n");
+  if (singleLine.length <= MAX_ARTIFACT_VALUE_LEN)
+    return singleLine;
+  return `${singleLine.slice(0, MAX_ARTIFACT_VALUE_LEN)}\u2026`;
+}
+function summarizeArtifacts(artifacts) {
+  if (artifacts.length === 0)
+    return "none";
+  return artifacts.slice(0, 3).map((artifact) => `${artifact.type} '${truncateValue(artifact.value)}'`).join(", ");
+}
+function formatDenyMessage(verdict) {
+  const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 5).join("; ") : verdict.category;
+  return [
+    "Sage blocked this action.",
+    `Severity: ${verdict.severity}`,
+    `Category: ${verdict.category}`,
+    `Reason: ${reasons}`
+  ].join("\n");
+}
+function formatAskMessage(actionId, verdict, artifacts) {
+  const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 3).join("; ") : verdict.category;
+  return [
+    "Sage flagged this action and requires explicit user approval.",
+    `Severity: ${verdict.severity}`,
+    `Category: ${verdict.category}`,
+    `Reason: ${reasons}`,
+    `Artifacts: ${summarizeArtifacts(artifacts)}`,
+    "",
+    "Ask the user for confirmation to proceed, DO NOT auto-approve.",
+    `if the user confirms, call:`,
+    `  sage_approve({ actionId: "${actionId}", approved: true })`,
+    "If the user declines, call:",
+    `  sage_approve({ actionId: "${actionId}", approved: false })`
+  ].join("\n");
+}
+async function approveAction(store, actionId) {
+  const entry = store.approve(actionId);
+  if (!entry) {
+    return "No pending Sage approval found for this action ID.";
+  }
+  return [
+    `Approved action ${actionId}. Retry the original tool call now.`,
+    "",
+    "Inform the user that they can ask you to permanently allowlist this artifact. Do NOT add it to the allowlist unless the user explicitly requests it."
+  ].join("\n");
+}
+async function addToAllowlist(store, type, value, reason, configPath, logger = nullLogger) {
+  if (!store.hasApprovedArtifact(type, value)) {
+    return "Cannot add to allowlist: no recent user approval found for this artifact.";
+  }
+  const config = await loadConfig(configPath, logger);
+  const allowlist = await loadAllowlist(config.allowlist, logger);
+  const entryReason = reason ?? "Approved by user via sage_approve";
+  if (type === "url") {
+    addUrl(allowlist, value, entryReason, "ask");
+  } else if (type === "command") {
+    addCommand(allowlist, value, entryReason, "ask");
+  } else {
+    addFilePath(allowlist, value, entryReason, "ask");
+  }
+  const saved = await saveAllowlist(allowlist, config.allowlist, logger);
+  if (!saved) {
+    return "Failed to save allowlist. Approval preserved \u2014 retry is safe.";
+  }
+  store.consumeApprovedArtifact(type, value);
+  return `Added ${type} to Sage allowlist.`;
+}
+async function removeFromAllowlist(type, value, configPath, logger = nullLogger) {
+  const config = await loadConfig(configPath, logger);
+  const allowlist = await loadAllowlist(config.allowlist, logger);
+  let removed;
+  let removedViaHash = false;
+  switch (type) {
+    case "url":
+      removed = removeUrl(allowlist, value);
+      break;
+    case "command":
+      removed = removeCommand(allowlist, value);
+      if (!removed) {
+        removed = removeCommand(allowlist, hashCommand(value));
+        removedViaHash = true;
+      }
+      break;
+    case "file_path":
+      removed = removeFilePath(allowlist, value);
+      break;
+  }
+  if (!removed) {
+    return "Artifact not found in Sage allowlist.";
+  }
+  const saved = await saveAllowlist(allowlist, config.allowlist, logger);
+  if (!saved) {
+    return "Failed to save allowlist after removal. Please retry.";
+  }
+  let rendered;
+  switch (type) {
+    case "url":
+      rendered = normalizeUrl(value);
+      break;
+    case "command":
+      rendered = `${(removedViaHash ? hashCommand(value) : value).slice(0, 12)}...`;
+      break;
+    case "file_path":
+      rendered = normalizeFilePath(value);
+      break;
+  }
+  return `Removed ${type} from Sage allowlist: ${rendered}`;
+}
+
+// ../core/dist/installation-id.js
+var import_node_crypto4 = require("node:crypto");
 var import_promises4 = require("node:fs/promises");
-var import_node_os3 = require("node:os");
 var import_node_path7 = require("node:path");
-var DEFAULT_CACHE_PATH = (0, import_node_path7.join)((0, import_node_os3.homedir)(), ".sage", "plugin_scan_cache.json");
+async function getInstallationId(sageDirPath) {
+  const sageDir = sageDirPath ?? resolvePath("~/.sage");
+  const idPath = (0, import_node_path7.join)(sageDir, "installation-id");
+  let fileExists = false;
+  try {
+    const existing = await (0, import_promises4.readFile)(idPath, "utf-8");
+    const trimmed = existing.trim();
+    if (trimmed.length > 0)
+      return trimmed;
+    fileExists = true;
+  } catch {
+  }
+  try {
+    const id = (0, import_node_crypto4.randomUUID)();
+    await (0, import_promises4.mkdir)(sageDir, { recursive: true, mode: 448 });
+    await (0, import_promises4.writeFile)(idPath, id, { encoding: "utf-8", mode: 384, flag: fileExists ? "w" : "wx" });
+    return id;
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      try {
+        const existing = await (0, import_promises4.readFile)(idPath, "utf-8");
+        return existing.trim() || void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    return void 0;
+  }
+}
+
+// ../core/dist/plugin-scan-cache.js
+var import_node_crypto5 = require("node:crypto");
+var import_promises5 = require("node:fs/promises");
+var import_node_os3 = require("node:os");
+var import_node_path8 = require("node:path");
+var DEFAULT_CACHE_PATH = (0, import_node_path8.join)((0, import_node_os3.homedir)(), ".sage", "plugin_scan_cache.json");
 var CACHE_TTL_DAYS = 7;
 function cacheKey(pluginKey, version, lastUpdated) {
   return `${pluginKey}:${version}:${lastUpdated}`;
 }
 async function computeConfigHash(sageVersion, ...dirs) {
-  const h = (0, import_node_crypto3.createHash)("sha256");
+  const h = (0, import_node_crypto5.createHash)("sha256");
   if (sageVersion)
     h.update(sageVersion);
   for (const dir of dirs) {
     let files;
     try {
-      files = (await (0, import_promises4.readdir)(dir)).filter((f) => f.endsWith(".yaml")).sort();
+      files = (await (0, import_promises5.readdir)(dir)).filter((f) => f.endsWith(".yaml")).sort();
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const content = await getFileContent((0, import_node_path7.join)(dir, file));
+        const content = await getFileContent((0, import_node_path8.join)(dir, file));
         h.update(content);
       } catch {
       }
@@ -12787,11 +14521,11 @@ function storeResult(cache, pluginKey, version, lastUpdated, findings) {
 }
 
 // ../core/dist/plugin-scanner.js
-var import_node_crypto4 = require("node:crypto");
-var import_promises5 = require("node:fs/promises");
+var import_node_crypto6 = require("node:crypto");
+var import_promises6 = require("node:fs/promises");
 var import_node_os4 = require("node:os");
-var import_node_path8 = require("node:path");
-var DEFAULT_PLUGINS_REGISTRY = (0, import_node_path8.join)((0, import_node_os4.homedir)(), ".claude", "plugins", "installed_plugins.json");
+var import_node_path9 = require("node:path");
+var DEFAULT_PLUGINS_REGISTRY = (0, import_node_path9.join)((0, import_node_os4.homedir)(), ".claude", "plugins", "installed_plugins.json");
 var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".py",
   ".js",
@@ -12813,38 +14547,38 @@ var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "__pycache__"])
 var MAX_FILE_SIZE = 512 * 1024;
 async function walkPluginFiles(installPath, logger) {
   const files = [];
-  async function walk(dir) {
-    let entries;
+  async function walk(dirOrFile) {
+    let stats;
     try {
-      entries = await (0, import_promises5.readdir)(dir);
+      stats = await (0, import_promises6.stat)(dirOrFile);
     } catch {
       return;
     }
-    for (const entry of entries) {
-      if (SKIP_DIRS.has(entry))
-        continue;
-      const fullPath = (0, import_node_path8.join)(dir, entry);
-      let stats;
+    if (stats.isFile()) {
+      if (SCANNABLE_EXTENSIONS.has((0, import_node_path9.extname)(dirOrFile).toLowerCase()) && stats.size <= MAX_FILE_SIZE) {
+        files.push(dirOrFile);
+      }
+      return;
+    }
+    if (stats.isDirectory()) {
+      let entries;
       try {
-        stats = await (0, import_promises5.stat)(fullPath);
+        entries = await (0, import_promises6.readdir)(dirOrFile);
       } catch {
-        continue;
+        return;
       }
-      if (stats.isDirectory()) {
-        await walk(fullPath);
-      } else if (stats.isFile()) {
-        if (!SCANNABLE_EXTENSIONS.has((0, import_node_path8.extname)(fullPath).toLowerCase()))
+      for (const entry of entries) {
+        if (SKIP_DIRS.has(entry))
           continue;
-        if (stats.size > MAX_FILE_SIZE)
-          continue;
-        files.push(fullPath);
+        const fullPath = (0, import_node_path9.join)(dirOrFile, entry);
+        await walk(fullPath);
       }
     }
   }
   try {
     await walk(installPath);
   } catch (e) {
-    logger.warn(`Error walking plugin directory ${installPath}`, { error: String(e) });
+    logger.warn(`Error walking plugin path ${installPath}`, { error: String(e) });
   }
   return files;
 }
@@ -12862,7 +14596,7 @@ function extractArtifactsFromFile(filePath, content) {
       continue;
     artifacts.push({ type: "url", value: url, context: `plugin_file:${fileName}` });
   }
-  const ext = (0, import_node_path8.extname)(filePath).toLowerCase();
+  const ext = (0, import_node_path9.extname)(filePath).toLowerCase();
   if ([".sh", ".bash", ".zsh", ".py"].includes(ext)) {
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
@@ -12907,7 +14641,7 @@ async function scanPlugin(plugin, threats, options = {}) {
           confidence: match.threat.confidence,
           action: match.threat.action,
           artifact: match.artifact.slice(0, 200),
-          sourceFile: (0, import_node_path8.relative)(plugin.installPath, filePath)
+          sourceFile: (0, import_node_path9.relative)(plugin.installPath, filePath)
         });
       }
     }
@@ -12915,7 +14649,7 @@ async function scanPlugin(plugin, threats, options = {}) {
       allUrls.push(...extractUrls(content));
     }
     if (checkFileHashes) {
-      const sha256 = (0, import_node_crypto4.createHash)("sha256").update(rawBytes).digest("hex");
+      const sha256 = (0, import_node_crypto6.createHash)("sha256").update(rawBytes).digest("hex");
       const existing = hashToFiles.get(sha256);
       if (existing) {
         existing.push(filePath);
@@ -12962,7 +14696,7 @@ async function scanPlugin(plugin, threats, options = {}) {
               confidence: 1,
               action: "block",
               artifact: fr.sha256,
-              sourceFile: (0, import_node_path8.relative)(plugin.installPath, filePath)
+              sourceFile: (0, import_node_path9.relative)(plugin.installPath, filePath)
             });
           }
         }
@@ -12998,18 +14732,63 @@ function toFindingData(finding) {
   };
 }
 function toAuditFindingData(finding) {
-  return {
-    threat_id: finding.threatId,
-    title: finding.title,
-    severity: finding.severity,
-    confidence: finding.confidence,
-    artifact: finding.artifact,
-    source_file: finding.sourceFile
-  };
+  const { action: _, ...rest } = toFindingData(finding);
+  return rest;
+}
+async function runSessionStartScan(context) {
+  const logger = context.logger ?? nullLogger;
+  const threats = await loadThreats(context.threatsDir, logger);
+  const trustedDomains = await loadTrustedDomains(context.allowlistsDir, logger);
+  if (threats.length === 0) {
+    return [];
+  }
+  const plugins = context.plugins;
+  if (plugins.length === 0) {
+    return [];
+  }
+  const configHash = await computeConfigHash(context.sageVersion ?? "", context.threatsDir, context.allowlistsDir);
+  const cache = await loadScanCache(configHash, context.scanCachePath, logger);
+  const resultsWithFindings = [];
+  let cacheModified = false;
+  for (const plugin of plugins) {
+    const cached = getCached(cache, plugin.key, plugin.version, plugin.lastUpdated);
+    if (cached && cached.findings.length === 0) {
+      continue;
+    }
+    if (cached && cached.findings.length > 0) {
+      resultsWithFindings.push({
+        plugin,
+        findings: cached.findings.map(fromCachedFinding)
+      });
+      continue;
+    }
+    const result = await scanPlugin(plugin, threats, {
+      checkUrls: context.checkUrls ?? true,
+      checkFileHashes: context.checkFileHashes ?? true,
+      trustedDomains,
+      logger
+    });
+    storeResult(cache, plugin.key, plugin.version, plugin.lastUpdated, result.findings.map(toFindingData));
+    cacheModified = true;
+    if (result.findings.length > 0) {
+      resultsWithFindings.push(result);
+    }
+  }
+  if (cacheModified) {
+    await saveScanCache(cache, context.scanCachePath, logger);
+  }
+  try {
+    const sageConfig = await loadConfig(context.configPath, logger);
+    for (const result of resultsWithFindings) {
+      await logPluginScan(sageConfig.logging, result.plugin.key, result.plugin.version, result.findings.map(toAuditFindingData));
+    }
+  } catch {
+  }
+  return resultsWithFindings;
 }
 
 // ../core/dist/version-check.js
-var GITHUB_RAW_URL = "https://raw.githubusercontent.com/avast/sage/main/packages/core/package.json";
+var import_node_os5 = require("node:os");
 var DEFAULT_TIMEOUT_MS = 5e3;
 function isNewerVersion(current, latest) {
   const parse = (v) => v.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
@@ -13025,19 +14804,29 @@ function isNewerVersion(current, latest) {
   }
   return false;
 }
-async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = DEFAULT_TIMEOUT_MS) {
+async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = DEFAULT_TIMEOUT_MS, context) {
   if (currentVersion === "dev") {
     logger.debug("Skipping version check for dev build");
     return null;
   }
   try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    const response = await fetch(GITHUB_RAW_URL, {
-      signal: controller.signal,
-      headers: { Accept: "application/json" }
+    const response = await fetch(resolveEndpoint("/v1/version-check"), {
+      method: "POST",
+      signal: AbortSignal.timeout(timeoutMs),
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        sage_version: currentVersion,
+        agent_runtime: context?.agentRuntime,
+        agent_runtime_version: context?.agentRuntimeVersion,
+        os: process.platform,
+        os_version: (0, import_node_os5.release)(),
+        arch: process.arch,
+        iid: context?.iid
+      })
     });
-    clearTimeout(timer);
     if (!response.ok) {
       logger.debug(`Version check HTTP ${response.status}`);
       return null;
@@ -13059,61 +14848,147 @@ async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = D
   }
 }
 
-// src/approval-store.ts
-var DEFAULT_PATH = (0, import_node_path9.join)((0, import_node_os5.homedir)(), ".sage", "approvals.json");
-var DEFAULT_TTL_SECONDS = 300;
-var ApprovalStore = class {
-  data = {};
-  path;
-  logger;
-  constructor(logger, path = DEFAULT_PATH) {
-    this.logger = logger;
-    this.path = path;
-  }
-  async load() {
+// ../core/dist/session-start.js
+async function runSessionStart(ctx) {
+  const logger = ctx.logger ?? nullLogger;
+  const sageDirPath = resolvePath(ctx.sageDirPath ?? "~/.sage");
+  pruneOrphanedTmpFiles(sageDirPath).catch(() => {
+  });
+  const iidPromise = getInstallationId(sageDirPath).catch(() => void 0);
+  const [scanResults, versionCheck] = await Promise.all([
+    runSessionStartScan({
+      plugins: ctx.plugins,
+      threatsDir: ctx.threatsDir,
+      allowlistsDir: ctx.allowlistsDir,
+      sageVersion: ctx.version,
+      logger,
+      configPath: ctx.configPath,
+      scanCachePath: ctx.scanCachePath,
+      checkUrls: ctx.checkUrls,
+      checkFileHashes: ctx.checkFileHashes
+    }),
+    iidPromise.then((iid) => checkForUpdate(ctx.version, logger, void 0, {
+      agentRuntime: ctx.agentRuntime,
+      agentRuntimeVersion: ctx.agentRuntimeVersion,
+      iid
+    })).catch(() => null)
+  ]);
+  return { scanResults, versionCheck };
+}
+
+// ../core/dist/scan-handler.js
+async function runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime) {
+  logger.info(`Sage plugin scan started (${context})`, { threatsDir, allowlistsDir });
+  const result = await runSessionStart({
+    plugins,
+    threatsDir,
+    allowlistsDir,
+    version,
+    logger,
+    agentRuntime
+  });
+  logger.info(`Sage plugin scan (${context}) complete`, {
+    findings: result.scanResults.length,
+    updateAvailable: result.versionCheck?.updateAvailable ?? false
+  });
+  return formatSessionStartMessage(version, result);
+}
+function createScanHandler(options) {
+  const { logger, context, discoverPlugins: discoverPlugins2, selfPrefix, threatsDir, allowlistsDir, version, agentRuntime, onResult } = options;
+  return async () => {
     try {
-      const raw = await getFileContent(this.path);
-      const parsed = JSON.parse(raw);
-      const now = Date.now();
-      this.data = {};
-      for (const [id, entry] of Object.entries(parsed)) {
-        if (entry && new Date(entry.expiresAt).getTime() > now) {
-          this.data[id] = entry;
-        }
+      let plugins = await discoverPlugins2();
+      plugins = plugins.filter((p) => !p.key.startsWith(selfPrefix));
+      if (plugins.length === 0) {
+        logger.warn(`Sage plugin scan (${context}): no plugins to scan after filtering`);
       }
-    } catch {
-      this.data = {};
+      const msg = await runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime);
+      onResult?.(msg);
+    } catch (e) {
+      logger.error(`Sage ${context} scan failed`, { error: String(e) });
     }
-  }
-  isApproved(actionId) {
-    const entry = this.data[actionId];
-    if (!entry) return false;
-    if (new Date(entry.expiresAt).getTime() <= Date.now()) {
-      delete this.data[actionId];
-      return false;
+  };
+}
+
+// src/allowlist-tools.ts
+function createAllowlistAddTool(approvalStore, logger) {
+  return {
+    name: "sage_allowlist_add",
+    description: "Permanently allow a URL, command, or file path after recent user approval through Sage.",
+    parameters: {
+      type: "object",
+      properties: {
+        type: {
+          type: "string",
+          enum: ["url", "command", "file_path"],
+          description: "Artifact type"
+        },
+        value: {
+          type: "string",
+          description: "Exact URL, command, or file path to allowlist"
+        },
+        reason: {
+          type: "string",
+          description: "Optional reason for allowlist entry"
+        }
+      },
+      required: ["type", "value"]
+    },
+    async execute(_toolCallId, params) {
+      const { type, value, reason } = params;
+      const msg = await addToAllowlist(approvalStore, type, value, reason, void 0, logger);
+      return { content: [{ type: "text", text: msg }] };
     }
-    return true;
-  }
-  async approve(actionId, ttlSeconds = DEFAULT_TTL_SECONDS) {
-    const now = /* @__PURE__ */ new Date();
-    this.data[actionId] = {
-      approvedAt: now.toISOString(),
-      expiresAt: new Date(now.getTime() + ttlSeconds * 1e3).toISOString()
-    };
-    await this.save();
-  }
-  async save() {
-    try {
-      await atomicWriteJson(this.path, this.data);
-    } catch (e) {
-      this.logger.warn(`Failed to save approvals to ${this.path}`, { error: String(e) });
+  };
+}
+function createAllowlistRemoveTool(logger) {
+  return {
+    name: "sage_allowlist_remove",
+    description: "Remove a URL, command, or file path from the Sage allowlist.",
+    parameters: {
+      type: "object",
+      properties: {
+        type: {
+          type: "string",
+          enum: ["url", "command", "file_path"],
+          description: "Artifact type"
+        },
+        value: {
+          type: "string",
+          description: "URL/file path, or command text/command hash for command entries"
+        }
+      },
+      required: ["type", "value"]
+    },
+    async execute(_toolCallId, params) {
+      const { type, value } = params;
+      const msg = await removeFromAllowlist(type, value, void 0, logger);
+      return { content: [{ type: "text", text: msg }] };
     }
+  };
+}
+
+// src/bundled-dirs.ts
+var import_node_fs = require("node:fs");
+var import_node_path10 = require("node:path");
+var packageRoot = (0, import_node_path10.resolve)(__dirname, "..");
+function getBundledDataDirs() {
+  return {
+    threatsDir: (0, import_node_path10.join)(packageRoot, "resources", "threats"),
+    allowlistsDir: (0, import_node_path10.join)(packageRoot, "resources", "allowlists")
+  };
+}
+var cachedVersion;
+function getSageVersion() {
+  if (cachedVersion) return cachedVersion;
+  try {
+    const pkg = JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path10.join)(packageRoot, "package.json"), "utf-8"));
+    cachedVersion = pkg.version ?? "0.0.0";
+  } catch {
+    cachedVersion = "0.0.0";
   }
-  static actionId(toolName, params) {
-    const payload = JSON.stringify({ toolName, params });
-    return (0, import_node_crypto5.createHash)("sha256").update(payload).digest("hex");
-  }
-};
+  return cachedVersion;
+}
 
 // src/gate-tool.ts
 function createSageApproveTool(approvalStore) {
@@ -13135,14 +15010,15 @@ function createSageApproveTool(approvalStore) {
       required: ["actionId", "approved"]
     },
     async execute(_toolCallId, params) {
-      if (params.approved) {
-        await approvalStore.approve(params.actionId);
+      if (!params.approved) {
+        approvalStore.deletePending(params.actionId);
         return {
-          content: [{ type: "text", text: "Approved. Retry the tool call." }]
+          content: [{ type: "text", text: "Rejected by user." }]
         };
       }
+      const msg = await approveAction(approvalStore, params.actionId);
       return {
-        content: [{ type: "text", text: "Rejected by user." }]
+        content: [{ type: "text", text: msg }]
       };
     }
   };
@@ -13169,30 +15045,8 @@ function createLogger(pluginLogger) {
   };
 }
 
-// src/bundled-dirs.ts
-var import_node_fs = require("node:fs");
-var import_node_path10 = require("node:path");
-var packageRoot = (0, import_node_path10.resolve)(__dirname, "..");
-function getBundledDataDirs() {
-  return {
-    threatsDir: (0, import_node_path10.join)(packageRoot, "resources", "threats"),
-    allowlistsDir: (0, import_node_path10.join)(packageRoot, "resources", "allowlists")
-  };
-}
-var cachedVersion;
-function getSageVersion() {
-  if (cachedVersion) return cachedVersion;
-  try {
-    const pkg = JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path10.join)(packageRoot, "package.json"), "utf-8"));
-    cachedVersion = pkg.version ?? "0.0.0";
-  } catch {
-    cachedVersion = "0.0.0";
-  }
-  return cachedVersion;
-}
-
 // src/plugin-discovery.ts
-var import_promises6 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var import_node_os6 = require("node:os");
 var import_node_path11 = require("node:path");
 var DEFAULT_EXTENSIONS_DIR = (0, import_node_path11.join)((0, import_node_os6.homedir)(), ".openclaw", "extensions");
@@ -13200,7 +15054,7 @@ async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSION
   logger.info("Sage plugin discovery: scanning extensions directory", { path: extensionsDir });
   let entries;
   try {
-    entries = await (0, import_promises6.readdir)(extensionsDir);
+    entries = await (0, import_promises7.readdir)(extensionsDir);
   } catch {
     logger.debug("OpenClaw extensions directory not found", { path: extensionsDir });
     return [];
@@ -13210,7 +15064,7 @@ async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSION
     const extDir = (0, import_node_path11.join)(extensionsDir, entry);
     let stats;
     try {
-      stats = await (0, import_promises6.stat)(extDir);
+      stats = await (0, import_promises7.stat)(extDir);
       if (!stats.isDirectory()) continue;
     } catch {
       continue;
@@ -13240,111 +15094,26 @@ async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSION
 }
 
 // src/startup-scan.ts
-var SAGE_PLUGIN_ID = "sage-openclaw";
-async function runScan(logger, context) {
-  await pruneOrphanedTmpFiles(resolvePath("~/.sage"));
+function createOpenClawScanHandler(logger, context, onResult) {
   const { threatsDir, allowlistsDir } = getBundledDataDirs();
   const version = getSageVersion();
-  logger.info(`Sage plugin scan started (${context})`, { threatsDir, allowlistsDir });
-  const [threats, trustedDomains, versionCheck] = await Promise.all([
-    loadThreats(threatsDir, logger),
-    loadTrustedDomains(allowlistsDir, logger),
-    checkForUpdate(version, logger)
-  ]);
-  const updateNotice = versionCheck?.updateAvailable ? formatUpdateNotice(versionCheck) : null;
-  if (threats.length === 0) {
-    logger.warn(`Sage plugin scan (${context}): no threats loaded, skipping`);
-    return updateNotice;
-  }
-  logger.info(`Sage plugin scan (${context}): loaded ${threats.length} threat definitions`);
-  let plugins = await discoverOpenClawPlugins(logger);
-  plugins = plugins.filter((p) => !p.key.startsWith(`${SAGE_PLUGIN_ID}@`));
-  if (plugins.length === 0) {
-    logger.warn(`Sage plugin scan (${context}): no plugins to scan after filtering`);
-    return updateNotice;
-  }
-  logger.info(`Sage plugin scan (${context}): ${plugins.length} plugin(s) to scan`, {
-    keys: plugins.map((p) => p.key)
+  return createScanHandler({
+    logger,
+    context,
+    discoverPlugins: () => discoverOpenClawPlugins(logger),
+    selfPrefix: "sage-openclaw@",
+    threatsDir,
+    allowlistsDir,
+    version,
+    agentRuntime: "openclaw",
+    onResult
   });
-  const configHash = await computeConfigHash("", threatsDir, allowlistsDir);
-  const cache = await loadScanCache(configHash, void 0, logger);
-  const resultsWithFindings = [];
-  let cacheModified = false;
-  let scannedCount = 0;
-  for (const plugin of plugins) {
-    const cached = getCached(cache, plugin.key, plugin.version, plugin.lastUpdated);
-    if (cached && cached.findings.length === 0) {
-      logger.info(`Sage plugin scan (${context}): cache hit (clean) for ${plugin.key}`);
-      continue;
-    }
-    if (cached && cached.findings.length > 0) {
-      logger.info(
-        `Sage plugin scan (${context}): cache hit with ${cached.findings.length} finding(s) for ${plugin.key}`
-      );
-      resultsWithFindings.push({ plugin, findings: cached.findings.map(fromCachedFinding) });
-      continue;
-    }
-    logger.info(`Sage plugin scan (${context}): scanning ${plugin.key}`);
-    const result = await scanPlugin(plugin, threats, {
-      checkUrls: true,
-      trustedDomains,
-      logger
-    });
-    scannedCount++;
-    storeResult(
-      cache,
-      plugin.key,
-      plugin.version,
-      plugin.lastUpdated,
-      result.findings.map(toFindingData)
-    );
-    cacheModified = true;
-    if (result.findings.length > 0) {
-      resultsWithFindings.push(result);
-    }
-  }
-  if (cacheModified) {
-    await saveScanCache(cache, void 0, logger);
-  }
-  logger.info(
-    `Sage plugin scan (${context}) complete: ${scannedCount} scanned, ${resultsWithFindings.length} with findings, cache ${cacheModified ? "updated" : "unchanged"}`
-  );
-  try {
-    const sageConfig = await loadConfig(void 0, logger);
-    for (const result of resultsWithFindings) {
-      await logPluginScan(
-        sageConfig.logging,
-        result.plugin.key,
-        result.plugin.version,
-        result.findings.map(toAuditFindingData)
-      );
-    }
-  } catch {
-  }
-  if (resultsWithFindings.length > 0) {
-    const banner = formatThreatBanner(version, resultsWithFindings, versionCheck);
-    logger.warn(`Sage: threat findings detected`, {
-      plugins: resultsWithFindings.map((r) => r.plugin.key)
-    });
-    return banner;
-  }
-  return updateNotice;
 }
-function createScanHandler(logger, context, onFindings) {
-  return async () => {
-    try {
-      const findings = await runScan(logger, context);
-      onFindings?.(findings);
-    } catch (e) {
-      logger.error(`Sage ${context} scan failed`, { error: String(e) });
-    }
-  };
+function createStartupScanHandler(logger, onResult) {
+  return createOpenClawScanHandler(logger, "startup", onResult);
 }
-function createStartupScanHandler(logger, onFindings) {
-  return createScanHandler(logger, "startup", onFindings);
-}
-function createSessionScanHandler(logger, onFindings) {
-  return createScanHandler(logger, "session", onFindings);
+function createSessionScanHandler(logger, onResult) {
+  return createOpenClawScanHandler(logger, "session", onResult);
 }
 function createBeforeAgentStartHandler(getFindings, clearFindings, logger) {
   return () => {
@@ -13398,153 +15167,32 @@ function mapToolToArtifacts(toolName, params) {
       return null;
   }
 }
-function createToolCallHandler(approvalStore, logger, sessionKey = "unknown") {
-  return async (event) => {
+function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir) {
+  async function handleToolCall(event, ctx) {
     try {
       const { toolName, params } = event;
       const artifacts = mapToolToArtifacts(toolName, params);
       if (!artifacts || artifacts.length === 0) return void 0;
-      const actionId = ApprovalStore.actionId(toolName, params);
-      if (approvalStore.isApproved(actionId)) return void 0;
-      const config = await loadConfig(void 0, logger).catch(
-        () => loadConfig("/dev/null", logger)
+      const sessionId = ctx?.sessionKey ?? "unknown";
+      const { verdict, actionId } = await guardToolCall(
+        { sessionId, toolName, toolInput: params, artifacts },
+        { threatsDir, allowlistsDir, logger },
+        approvalStore
       );
-      try {
-        const allowlist = await loadAllowlist(config.allowlist, logger);
-        if (isAllowlisted(allowlist, artifacts)) {
-          await logVerdict(
-            config.logging,
-            sessionKey,
-            toolName,
-            params,
-            {
-              decision: "allow",
-              category: "none",
-              confidence: 1,
-              severity: "info",
-              source: "allowlisted",
-              artifacts: [],
-              matchedThreatId: null,
-              reasons: []
-            },
-            true
-          );
-          return void 0;
-        }
-      } catch {
-      }
-      let cache = null;
-      try {
-        cache = new VerdictCache(config.cache, logger);
-        await cache.load();
-      } catch {
-        cache = null;
-      }
-      const urls = artifacts.filter((a) => a.type === "url").map((a) => a.value);
-      const cachedUrlVerdicts = /* @__PURE__ */ new Map();
-      let uncachedUrls = [];
-      if (cache && urls.length > 0) {
-        try {
-          for (const url of urls) {
-            const cached = cache.getUrl(url);
-            if (cached) {
-              cachedUrlVerdicts.set(url, cached);
-            } else {
-              uncachedUrls.push(url);
-            }
-          }
-        } catch {
-          uncachedUrls = urls;
-        }
-      }
-      const { threatsDir, allowlistsDir } = getBundledDataDirs();
-      let heuristicMatches = [];
-      if (config.heuristics_enabled) {
-        const threats = await loadThreats(threatsDir, logger);
-        const trustedDomains = await loadTrustedDomains(allowlistsDir, logger);
-        const heuristics = new HeuristicsEngine(threats, trustedDomains);
-        heuristicMatches = heuristics.match(artifacts);
-      }
-      let urlCheckResults = [];
-      const urlsToCheck = cache ? uncachedUrls : urls;
-      if (urlsToCheck.length > 0 && config.url_check.enabled) {
-        try {
-          const client = new UrlCheckClient(config.url_check, logger);
-          urlCheckResults = await client.checkUrls(urlsToCheck);
-        } catch {
-        }
-      }
-      const engine = new DecisionEngine(config.sensitivity);
-      let verdict = await engine.decide(heuristicMatches, urlCheckResults);
-      if (cachedUrlVerdicts.size > 0 && verdict.decision === "allow") {
-        for (const [url, cv] of cachedUrlVerdicts) {
-          if (cv.verdict !== "allow") {
-            verdict = {
-              decision: cv.verdict,
-              category: "network_egress",
-              confidence: 1,
-              severity: cv.severity,
-              source: `cache(${cv.source})`,
-              artifacts: [url],
-              matchedThreatId: null,
-              reasons: cv.reasons
-            };
-            break;
-          }
-        }
-      }
-      if (cache) {
-        try {
-          for (const result of urlCheckResults) {
-            let cv;
-            if (result.isMalicious) {
-              cv = {
-                verdict: "deny",
-                severity: "critical",
-                reasons: [
-                  `URL check: malicious (${result.findings.map((f) => `${f.severityName}/${f.typeName}`).join(", ")})`
-                ],
-                source: "url_check"
-              };
-            } else if (result.flags.length > 0) {
-              cv = {
-                verdict: "ask",
-                severity: "warning",
-                reasons: [`URL check: suspicious (${result.flags.join(", ")})`],
-                source: "url_check"
-              };
-            } else {
-              cv = {
-                verdict: "allow",
-                severity: "info",
-                reasons: [],
-                source: "url_check"
-              };
-            }
-            cache.putUrl(result.url, cv, result.isMalicious);
-          }
-          await cache.save();
-        } catch {
-        }
-      }
-      try {
-        await logVerdict(config.logging, sessionKey, toolName, params, verdict);
-      } catch {
-      }
       if (verdict.decision === "allow") return void 0;
-      const reasonText = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 5).join("; ") : verdict.category;
       if (verdict.decision === "deny") {
-        return { block: true, blockReason: `Sage blocked: ${reasonText}` };
+        return { block: true, blockReason: formatDenyMessage(verdict) };
       }
       return {
         block: true,
-        blockReason: `Sage flagged: ${reasonText}. Ask the user whether to proceed \u2014 do NOT auto-approve. If the user confirms, call sage_approve({actionId: "${actionId}", approved: true}). If the user declines, call sage_approve({actionId: "${actionId}", approved: false}).`
+        blockReason: formatAskMessage(actionId, verdict, artifacts)
       };
     } catch (e) {
       logger.error("tool-handler error, failing open", { error: String(e) });
       return void 0;
     }
-  };
+  }
+  return handleToolCall;
 }
 
 // src/index.ts
@@ -13557,15 +15205,25 @@ var index_default = {
   },
   register(api) {
     const logger = createLogger(api.logger);
-    const approvalStore = new ApprovalStore(logger);
+    const approvalStore = new ApprovalStore();
+    const { threatsDir, allowlistsDir } = getBundledDataDirs();
+    const CLEANUP_INTERVAL_MS = 5 * 60 * 1e3;
+    const interval = setInterval(() => approvalStore.cleanup(), CLEANUP_INTERVAL_MS);
+    if (typeof interval.unref === "function") interval.unref();
     let pendingFindings = null;
     const onFindings = (msg) => {
-      if (msg) pendingFindings = msg;
+      pendingFindings = msg;
     };
-    api.on("before_tool_call", createToolCallHandler(approvalStore, logger), {
-      priority: 100
-    });
+    api.on(
+      "before_tool_call",
+      createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir),
+      { priority: 100 }
+    );
     api.registerTool(createSageApproveTool(approvalStore));
+    api.registerTool(
+      createAllowlistAddTool(approvalStore, logger)
+    );
+    api.registerTool(createAllowlistRemoveTool(logger));
     api.on("gateway_start", createStartupScanHandler(logger, onFindings));
     api.on("session_start", createSessionScanHandler(logger, onFindings));
     api.on(