@gendigital/sage-openclaw 0.8.0 → 0.9.0

package/dist/index.cjs

@@ -82,6 +82,35 @@ async function pruneOrphanedTmpFiles(resolvedDir, maxAgeMs = 3e5) {
     }
   } catch {
   }
+  await pruneOrphanedModelDownloads((0, import_node_path.join)(resolvedDir, "models", ".download"));
+}
+async function pruneOrphanedModelDownloads(stagingDir, maxAgeMs = 60 * 60 * 1e3) {
+  let entries;
+  try {
+    entries = await fsPromises.readdir(stagingDir);
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  for (const entry of entries) {
+    const fullPath = (0, import_node_path.join)(stagingDir, entry);
+    const isArchive = entry.endsWith(".tar.gz");
+    const isPartial = entry.endsWith(".partial");
+    const isStaging = entry.startsWith("stage-");
+    if (!isArchive && !isPartial && !isStaging)
+      continue;
+    try {
+      const s = await fsPromises.stat(fullPath);
+      if (now - s.mtimeMs <= maxAgeMs)
+        continue;
+      if (s.isDirectory()) {
+        await fsPromises.rm(fullPath, { recursive: true, force: true });
+      } else {
+        await fsPromises.unlink(fullPath);
+      }
+    } catch {
+    }
+  }
 }
 var import_node_crypto, fs, fsPromises, import_node_os, import_node_path, name1, name2;
 var init_file_utils = __esm({
@@ -4204,7 +4233,7 @@ var init_zod = __esm({
 });
 
 // ../core/dist/types.js
-var nullLogger, ArtifactTypeSchema, ArtifactSchema, SeveritySchema, ActionSchema, ThreatSchema, DecisionSchema, VerdictSeveritySchema, SensitivitySchema, UrlCheckConfigSchema, CacheConfigSchema, AllowlistConfigSchema, LoggingConfigSchema, FileCheckConfigSchema, PackageCheckConfigSchema, AmsiCheckConfigSchema, ExceptionDecisionSchema, ExceptionMatchSchema, ExceptionRuleSchema, ExceptionsFileSchema, ExceptionsConfigSchema, ConfigSchema, brandString, BrandingSchema, HookTypeSchema;
+var nullLogger, ArtifactTypeSchema, ArtifactSchema, SeveritySchema, ActionSchema, ThreatSchema, DecisionSchema, VerdictSeveritySchema, SensitivitySchema, UrlCheckConfigSchema, CacheConfigSchema, AllowlistConfigSchema, LoggingConfigSchema, FileCheckConfigSchema, PackageCheckConfigSchema, AmsiCheckConfigSchema, DEFAULT_PI_HIGH_RISK_THRESHOLD, DEFAULT_PI_MEDIUM_RISK_THRESHOLD, PiCheckConfigSchema, ExceptionDecisionSchema, ExceptionMatchSchema, ExceptionRuleSchema, ExceptionsFileSchema, ExceptionsConfigSchema, ConfigSchema, HookTypeSchema;
 var init_types2 = __esm({
   "../core/dist/types.js"() {
     "use strict";
@@ -4278,6 +4307,15 @@ var init_types2 = __esm({
     AmsiCheckConfigSchema = external_exports.object({
       enabled: external_exports.boolean().default(true)
     });
+    DEFAULT_PI_HIGH_RISK_THRESHOLD = 0.99;
+    DEFAULT_PI_MEDIUM_RISK_THRESHOLD = 0.5;
+    PiCheckConfigSchema = external_exports.object({
+      enabled: external_exports.boolean().default(false),
+      max_content_length: external_exports.number().default(16384),
+      model_path: external_exports.string().optional(),
+      high_risk_threshold: external_exports.number().default(DEFAULT_PI_HIGH_RISK_THRESHOLD),
+      medium_risk_threshold: external_exports.number().default(DEFAULT_PI_MEDIUM_RISK_THRESHOLD)
+    });
     ExceptionDecisionSchema = external_exports.enum(["allow", "deny"]);
     ExceptionMatchSchema = external_exports.enum(["executable", "domain", "path", "plugin", "regex"]);
     ExceptionRuleSchema = external_exports.object({
@@ -4298,6 +4336,7 @@ var init_types2 = __esm({
       file_check: FileCheckConfigSchema.default({}),
       package_check: PackageCheckConfigSchema.default({}),
       amsi_check: AmsiCheckConfigSchema.default({}),
+      pi_check: PiCheckConfigSchema.default({}),
       heuristics_enabled: external_exports.boolean().default(true),
       cache: CacheConfigSchema.default({}),
       allowlist: AllowlistConfigSchema.default({}),
@@ -4305,17 +4344,9 @@ var init_types2 = __esm({
       logging: LoggingConfigSchema.default({}),
       sensitivity: SensitivitySchema.default("balanced"),
       disabled_threats: external_exports.array(external_exports.string()).default([]),
+      brand_key: external_exports.string().min(1).max(32).regex(/^[a-z0-9_-]+$/u).optional(),
       community_iq: external_exports.boolean().default(true)
     });
-    brandString = external_exports.string().min(1).max(64).regex(/^[^\p{Cc}]+$/u, "No control characters");
-    BrandingSchema = external_exports.object({
-      product_name: brandString.default("Sage"),
-      banner_text: external_exports.string().min(1).max(128).regex(/^[^\p{Cc}]+$/u).optional(),
-      brand_key: external_exports.string().min(1).max(32).regex(/^[a-z0-9_-]+$/u).optional()
-    }).transform((b) => ({
-      ...b,
-      banner_text: b.banner_text ?? b.product_name
-    }));
     HookTypeSchema = external_exports.enum([
       "PreToolUse",
       "PostToolUse",
@@ -4333,6 +4364,7 @@ __export(config_exports, {
   HOOK_TIMEOUT_SECONDS: () => HOOK_TIMEOUT_SECONDS,
   SAGE_DIR: () => SAGE_DIR,
   loadConfig: () => loadConfig,
+  loadConfigSync: () => loadConfigSync,
   resolvePath: () => resolvePath
 });
 function resolvedSageDir() {
@@ -4396,28 +4428,39 @@ function normalizeStateFilePath(configuredPath, fallbackPath, field, logger) {
   });
   return fallbackPath;
 }
-function sanitizeConfigPaths(config, logger) {
+function sanitizeBrandKey(data, logger) {
+  const brandKey = data.brand_key;
+  if (brandKey === void 0)
+    return data;
+  if (typeof brandKey === "string" && brandKey.length >= 1 && brandKey.length <= 32 && BRAND_KEY_RE.test(brandKey)) {
+    return data;
+  }
+  logger.warn(`Invalid brand_key in config \u2014 ignoring`, { brand_key: brandKey });
+  const { brand_key: _, ...rest } = data;
+  return rest;
+}
+function sanitizeConfigPaths(config2, logger) {
   const cachePath = defaultCachePath();
   const allowlistPath = defaultAllowlistPath();
   const exceptionsPath = defaultExceptionsPath();
   const auditPath = defaultAuditPath();
   return {
-    ...config,
+    ...config2,
     cache: {
-      ...config.cache,
-      path: normalizeStateFilePath(config.cache.path, cachePath, "cache", logger)
+      ...config2.cache,
+      path: normalizeStateFilePath(config2.cache.path, cachePath, "cache", logger)
     },
     allowlist: {
-      ...config.allowlist,
-      path: normalizeStateFilePath(config.allowlist.path, allowlistPath, "allowlist", logger)
+      ...config2.allowlist,
+      path: normalizeStateFilePath(config2.allowlist.path, allowlistPath, "allowlist", logger)
     },
     exceptions: {
-      ...config.exceptions,
-      path: normalizeStateFilePath(config.exceptions.path, exceptionsPath, "exceptions", logger)
+      ...config2.exceptions,
+      path: normalizeStateFilePath(config2.exceptions.path, exceptionsPath, "exceptions", logger)
     },
     logging: {
-      ...config.logging,
-      path: normalizeStateFilePath(config.logging.path, auditPath, "logging", logger)
+      ...config2.logging,
+      path: normalizeStateFilePath(config2.logging.path, auditPath, "logging", logger)
     }
   };
 }
@@ -4440,14 +4483,42 @@ async function loadConfig(configPath, logger = nullLogger) {
     logger.warn(`Config file ${path} does not contain a JSON object`);
     return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
   }
+  const sanitized = sanitizeBrandKey(data, logger);
+  try {
+    return sanitizeConfigPaths(ConfigSchema.parse(sanitized), logger);
+  } catch (e) {
+    logger.warn(`Config validation failed, using defaults`, { error: String(e) });
+    return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
+  }
+}
+function loadConfigSync(configPath, logger = nullLogger) {
+  const path = configPath ?? defaultConfigPath();
+  let raw;
+  try {
+    raw = getFileContentSync(path);
+  } catch {
+    return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
+  }
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch (e) {
+    logger.warn(`Failed to parse config from ${path}`, { error: String(e) });
+    return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
+  }
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    logger.warn(`Config file ${path} does not contain a JSON object`);
+    return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
+  }
+  const sanitized = sanitizeBrandKey(data, logger);
   try {
-    return sanitizeConfigPaths(ConfigSchema.parse(data), logger);
+    return sanitizeConfigPaths(ConfigSchema.parse(sanitized), logger);
   } catch (e) {
     logger.warn(`Config validation failed, using defaults`, { error: String(e) });
     return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
   }
 }
-var import_node_path2, SAGE_DIR, HOOK_TIMEOUT_SECONDS;
+var import_node_path2, SAGE_DIR, HOOK_TIMEOUT_SECONDS, BRAND_KEY_RE;
 var init_config = __esm({
   "../core/dist/config.js"() {
     "use strict";
@@ -4456,6 +4527,7 @@ var init_config = __esm({
     init_types2();
     SAGE_DIR = "~/.sage";
     HOOK_TIMEOUT_SECONDS = 8;
+    BRAND_KEY_RE = /^[a-z0-9_-]+$/u;
   }
 });
 
@@ -5401,7 +5473,7 @@ var require_range = __commonJS({
       parseRange(range) {
         const memoOpts = (this.options.includePrerelease && FLAG_INCLUDE_PRERELEASE) | (this.options.loose && FLAG_LOOSE);
         const memoKey = memoOpts + ":" + range;
-        const cached = cache.get(memoKey);
+        const cached = cache2.get(memoKey);
         if (cached) {
           return cached;
         }
@@ -5435,7 +5507,7 @@ var require_range = __commonJS({
           rangeMap.delete("");
         }
         const result = [...rangeMap.values()];
-        cache.set(memoKey, result);
+        cache2.set(memoKey, result);
         return result;
       }
       intersects(range, options) {
@@ -5474,7 +5546,7 @@ var require_range = __commonJS({
     };
     module2.exports = Range;
     var LRU = require_lrucache();
-    var cache = new LRU();
+    var cache2 = new LRU();
     var parseOptions = require_parse_options();
     var Comparator = require_comparator();
     var debug = require_debug();
@@ -6389,6 +6461,363 @@ var require_semver2 = __commonJS({
   }
 });
 
+// ../core/dist/clients/tokenizer.js
+var tokenizer_exports = {};
+__export(tokenizer_exports, {
+  LocalTokenizer: () => LocalTokenizer
+});
+function isWhitespace(ch) {
+  if (ch === " " || ch === "	" || ch === "\n" || ch === "\r")
+    return true;
+  return new RegExp("^\\p{Zs}$", "u").test(ch);
+}
+function isControl(ch) {
+  if (ch === "	" || ch === "\n" || ch === "\r")
+    return false;
+  return new RegExp("^\\p{Cc}|\\p{Cf}$", "u").test(ch);
+}
+function isPunctuation(ch) {
+  const cp = ch.codePointAt(0) ?? 0;
+  if (33 <= cp && cp <= 47 || 58 <= cp && cp <= 64 || 91 <= cp && cp <= 96 || 123 <= cp && cp <= 126) {
+    return true;
+  }
+  return new RegExp("^\\p{P}$", "u").test(ch);
+}
+function isChineseChar(cp) {
+  return 19968 <= cp && cp <= 40959 || 13312 <= cp && cp <= 19903 || 131072 <= cp && cp <= 173791 || 173824 <= cp && cp <= 177983 || 177984 <= cp && cp <= 178207 || 178208 <= cp && cp <= 183983 || 63744 <= cp && cp <= 64255 || 194560 <= cp && cp <= 195103;
+}
+function cleanText(text) {
+  const chars = [];
+  const posMap = [];
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i] ?? "";
+    const cp = text.codePointAt(i) ?? 0;
+    if (cp === 0 || cp === 65533 || isControl(ch))
+      continue;
+    chars.push(isWhitespace(ch) ? " " : ch);
+    posMap.push(i);
+  }
+  return { chars, posMap };
+}
+function addChineseSpacing(chars, posMap) {
+  const out = [];
+  const newMap = [];
+  for (let i = 0; i < chars.length; i++) {
+    const ch = chars[i] ?? "";
+    const pos = posMap[i] ?? 0;
+    if (isChineseChar(ch.codePointAt(0) ?? 0)) {
+      out.push(" ", ch, " ");
+      newMap.push(pos, pos, pos);
+    } else {
+      out.push(ch);
+      newMap.push(pos);
+    }
+  }
+  return { chars: out, posMap: newMap };
+}
+function nfcNormalize(chars, posMap) {
+  const out = [];
+  const newMap = [];
+  for (let i = 0; i < chars.length; i++) {
+    const ch = chars[i] ?? "";
+    const nfc = ch.normalize("NFC");
+    for (const c of nfc) {
+      out.push(c);
+      newMap.push(posMap[i] ?? i);
+    }
+  }
+  return { chars: out, posMap: newMap };
+}
+function lowercaseChars(chars, posMap) {
+  return { chars: chars.map((ch) => ch.toLowerCase()), posMap };
+}
+function stripAccents(chars, posMap) {
+  const out = [];
+  const newMap = [];
+  for (let i = 0; i < chars.length; i++) {
+    const ch = chars[i] ?? "";
+    const nfd = ch.normalize("NFD");
+    for (const c of nfd) {
+      if (!new RegExp("^\\p{Mn}$", "u").test(c)) {
+        out.push(c);
+        newMap.push(posMap[i] ?? i);
+      }
+    }
+  }
+  return { chars: out, posMap: newMap };
+}
+function whitespaceSplit(chars, posMap) {
+  const words = [];
+  let currentChars = [];
+  let currentPos = [];
+  for (let i = 0; i < chars.length; i++) {
+    if (chars[i] === " ") {
+      if (currentChars.length > 0) {
+        words.push({ word: currentChars.join(""), positions: currentPos });
+        currentChars = [];
+        currentPos = [];
+      }
+    } else {
+      currentChars.push(chars[i] ?? "");
+      currentPos.push(posMap[i] ?? i);
+    }
+  }
+  if (currentChars.length > 0) {
+    words.push({ word: currentChars.join(""), positions: currentPos });
+  }
+  return words;
+}
+function splitOnPunctuation(word, positions) {
+  const tokens = [];
+  let currentChars = [];
+  let currentPos = [];
+  for (let i = 0; i < word.length; i++) {
+    const ch = word[i] ?? "";
+    const pos = positions[i] ?? i;
+    if (isPunctuation(ch)) {
+      if (currentChars.length > 0) {
+        tokens.push({ word: currentChars.join(""), positions: currentPos });
+        currentChars = [];
+        currentPos = [];
+      }
+      tokens.push({ word: ch, positions: [pos] });
+    } else {
+      currentChars.push(ch);
+      currentPos.push(pos);
+    }
+  }
+  if (currentChars.length > 0) {
+    tokens.push({ word: currentChars.join(""), positions: currentPos });
+  }
+  return tokens;
+}
+function pretokenize(text) {
+  if (!text)
+    return [];
+  let { chars, posMap } = cleanText(text);
+  ({ chars, posMap } = addChineseSpacing(chars, posMap));
+  ({ chars, posMap } = nfcNormalize(chars, posMap));
+  const words = whitespaceSplit(chars, posMap);
+  const result = [];
+  for (const { word, positions } of words) {
+    let wChars = [...word];
+    let wPos = [...positions];
+    ({ chars: wChars, posMap: wPos } = lowercaseChars(wChars, wPos));
+    ({ chars: wChars, posMap: wPos } = stripAccents(wChars, wPos));
+    const subTokens = splitOnPunctuation(wChars.join(""), wPos);
+    result.push(...subTokens);
+  }
+  return result;
+}
+function tokenizeSubwords(word, vocab, unkId) {
+  if (word.length > MAX_WORD_CHARS) {
+    return { tokens: ["[UNK]"], ids: [unkId], spans: [[0, word.length]] };
+  }
+  const tokens = [];
+  const ids = [];
+  const spans = [];
+  let start = 0;
+  while (start < word.length) {
+    let end = word.length;
+    let found = null;
+    let foundId = -1;
+    while (start < end) {
+      let substr = word.slice(start, end);
+      if (start > 0)
+        substr = `##${substr}`;
+      const id = vocab.get(substr);
+      if (id !== void 0) {
+        found = substr;
+        foundId = id;
+        break;
+      }
+      end--;
+    }
+    if (found === null) {
+      return { tokens: ["[UNK]"], ids: [unkId], spans: [[0, word.length]] };
+    }
+    tokens.push(found);
+    ids.push(foundId);
+    spans.push([start, end]);
+    start = end;
+  }
+  return { tokens, ids, spans };
+}
+var import_node_fs2, import_node_path7, MAX_WORD_CHARS, PAD_ID, UNK_ID, CLS_ID, SEP_ID, LocalTokenizer;
+var init_tokenizer = __esm({
+  "../core/dist/clients/tokenizer.js"() {
+    "use strict";
+    import_node_fs2 = require("node:fs");
+    import_node_path7 = require("node:path");
+    MAX_WORD_CHARS = 100;
+    PAD_ID = 0;
+    UNK_ID = 100;
+    CLS_ID = 101;
+    SEP_ID = 102;
+    LocalTokenizer = class _LocalTokenizer {
+      vocab;
+      maxLength;
+      constructor(vocabPath, maxLength = 512) {
+        this.maxLength = maxLength;
+        this.vocab = this.loadVocab(vocabPath);
+      }
+      static fromModelDir(modelDir, maxLength = 512) {
+        return new _LocalTokenizer((0, import_node_path7.resolve)(modelDir, "vocab.txt"), maxLength);
+      }
+      loadVocab(path) {
+        const vocab = /* @__PURE__ */ new Map();
+        const lines = (0, import_node_fs2.readFileSync)(path, "utf-8").split("\n");
+        for (let i = 0; i < lines.length; i++) {
+          const token = lines[i]?.replace(/\r$/, "");
+          if (token)
+            vocab.set(token, i);
+        }
+        return vocab;
+      }
+      tokenize(text, options = {}) {
+        const { addSpecialTokens = true, returnOffsetMapping = false, truncation = false, maxLength = this.maxLength } = options;
+        const preTokens = pretokenize(text);
+        const allIds = [];
+        const allOffsets = [];
+        for (const { word, positions } of preTokens) {
+          const { ids, spans } = tokenizeSubwords(word, this.vocab, UNK_ID);
+          for (let i = 0; i < ids.length; i++) {
+            allIds.push(ids[i] ?? UNK_ID);
+            const span = spans[i] ?? [0, 0];
+            const subPositions = positions.slice(span[0], span[1]);
+            if (subPositions.length > 0) {
+              const first = subPositions[0] ?? 0;
+              const last = subPositions[subPositions.length - 1] ?? 0;
+              allOffsets.push([first, last + 1]);
+            } else {
+              allOffsets.push([positions[0] ?? 0, positions[0] ?? 0]);
+            }
+          }
+        }
+        const contentMax = maxLength - (addSpecialTokens ? 2 : 0);
+        if (truncation && allIds.length > contentMax) {
+          allIds.length = contentMax;
+          allOffsets.length = contentMax;
+        }
+        if (addSpecialTokens) {
+          allIds.unshift(CLS_ID);
+          allIds.push(SEP_ID);
+          allOffsets.unshift([0, 0]);
+          allOffsets.push([0, 0]);
+        }
+        const result = {
+          input_ids: allIds,
+          attention_mask: new Array(allIds.length).fill(1),
+          token_type_ids: new Array(allIds.length).fill(0)
+        };
+        if (returnOffsetMapping) {
+          result.offset_mapping = allOffsets;
+        }
+        return result;
+      }
+      /**
+       * Callable interface using snake_case option keys.
+       * Supports: tokenizer(text, { truncation, max_length, padding })
+       */
+      call(text, options = {}) {
+        const result = this.tokenize(text, {
+          addSpecialTokens: options.add_special_tokens ?? true,
+          returnOffsetMapping: options.return_offsets_mapping ?? false,
+          truncation: options.truncation ?? false,
+          maxLength: options.max_length,
+          padding: options.padding ?? false
+        });
+        if (options.padding && result.input_ids.length < (options.max_length ?? this.maxLength)) {
+          const padLen = (options.max_length ?? this.maxLength) - result.input_ids.length;
+          result.input_ids.push(...new Array(padLen).fill(PAD_ID));
+          result.attention_mask.push(...new Array(padLen).fill(0));
+          result.token_type_ids.push(...new Array(padLen).fill(0));
+          if (result.offset_mapping) {
+            result.offset_mapping.push(...new Array(padLen).fill([0, 0]));
+          }
+        }
+        return result;
+      }
+    };
+  }
+});
+
+// ../core/dist/clients/pi-deps-installer.js
+var pi_deps_installer_exports = {};
+__export(pi_deps_installer_exports, {
+  ensurePiDeps: () => ensurePiDeps,
+  isLocalInstallValid: () => isLocalInstallValid
+});
+function isLocalInstallValid(modelPath) {
+  try {
+    const req = (0, import_node_module.createRequire)((0, import_node_path8.resolve)(modelPath, "package.json"));
+    const localPrefix = (0, import_node_fs3.realpathSync)((0, import_node_path8.resolve)(modelPath, "node_modules")) + import_node_path8.sep;
+    for (const pkg of REQUIRED_PACKAGES) {
+      const resolved = req.resolve(pkg);
+      if (!resolved.startsWith(localPrefix))
+        return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensurePiDeps(modelPath, logger = nullLogger) {
+  if (isLocalInstallValid(modelPath))
+    return true;
+  try {
+    require.resolve("onnxruntime-node");
+    return true;
+  } catch {
+  }
+  logger.info("Installing PI runtime dependencies (first-time setup)...");
+  try {
+    const pkgJsonPath = (0, import_node_path8.resolve)(modelPath, "package.json");
+    if (!(0, import_node_fs3.existsSync)(pkgJsonPath)) {
+      (0, import_node_fs3.mkdirSync)(modelPath, { recursive: true });
+      (0, import_node_fs3.writeFileSync)(pkgJsonPath, '{"private":true}');
+    }
+    await runNpm(modelPath, ["install", "--no-save", ...REQUIRED_PACKAGES], logger);
+    const verified = isLocalInstallValid(modelPath);
+    if (verified) {
+      logger.info("PI runtime dependencies installed successfully");
+    } else {
+      logger.warn("PI dependency installation may be incomplete");
+    }
+    return verified;
+  } catch (err) {
+    logger.warn(`Failed to install PI dependencies (PI check will be skipped): ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+function runNpm(cwd, args, logger) {
+  return new Promise((resolve9, reject) => {
+    const isWindows = process.platform === "win32";
+    const npmCmd = isWindows ? "npm.cmd" : "npm";
+    const child = (0, import_node_child_process.execFile)(npmCmd, args, { cwd, timeout: 3e4, shell: isWindows }, (error, _stdout, stderr) => {
+      if (error) {
+        logger.warn(`npm install error: ${stderr || error.message}`);
+        reject(error);
+      } else {
+        resolve9();
+      }
+    });
+    child.unref();
+  });
+}
+var import_node_child_process, import_node_fs3, import_node_module, import_node_path8, REQUIRED_PACKAGES;
+var init_pi_deps_installer = __esm({
+  "../core/dist/clients/pi-deps-installer.js"() {
+    "use strict";
+    import_node_child_process = require("node:child_process");
+    import_node_fs3 = require("node:fs");
+    import_node_module = require("node:module");
+    import_node_path8 = require("node:path");
+    init_types2();
+    REQUIRED_PACKAGES = ["onnxruntime-node"];
+  }
+});
+
 // ../../node_modules/.pnpm/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
   "../../node_modules/.pnpm/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js"(exports2) {
@@ -10337,10 +10766,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep3, value } = collItem;
+        const { start, key, sep: sep5, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep3?.[0],
+          next: key ?? sep5?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -10354,7 +10783,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep3) {
+          if (!keyProps.anchor && !keyProps.tag && !sep5) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -10378,7 +10807,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep3 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep5 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -10394,7 +10823,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep3, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep5, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -10485,7 +10914,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep3 = "";
+        let sep5 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -10499,13 +10928,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep3 + cb;
-              sep3 = "";
+                comment += sep5 + cb;
+              sep5 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep3 += source;
+                sep5 += source;
               hasSpace = true;
               break;
             default:
@@ -10548,18 +10977,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep: sep3, value } = collItem;
+        const { start, key, sep: sep5, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep3?.[0],
+          next: key ?? sep5?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep3 && !value) {
+          if (!props.anchor && !props.tag && !sep5 && !value) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -10613,8 +11042,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep3 && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep3, null, props, onError);
+        if (!isMap && !sep5 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep5, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -10626,7 +11055,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep3 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep5 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -10637,8 +11066,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep3)
-                for (const st of sep3) {
+              if (sep5)
+                for (const st of sep5) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -10655,7 +11084,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep3, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep5, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -10835,7 +11264,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value = "";
-      let sep3 = "";
+      let sep5 = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value += lines[i][0].slice(trimIndent) + "\n";
@@ -10852,24 +11281,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep3 + indent.slice(trimIndent) + content;
-          sep3 = "\n";
+          value += sep5 + indent.slice(trimIndent) + content;
+          sep5 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep3 === " ")
-            sep3 = "\n";
-          else if (!prevMoreIndented && sep3 === "\n")
-            sep3 = "\n\n";
-          value += sep3 + indent.slice(trimIndent) + content;
-          sep3 = "\n";
+          if (sep5 === " ")
+            sep5 = "\n";
+          else if (!prevMoreIndented && sep5 === "\n")
+            sep5 = "\n\n";
+          value += sep5 + indent.slice(trimIndent) + content;
+          sep5 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep3 === "\n")
+          if (sep5 === "\n")
             value += "\n";
           else
-            sep3 = "\n";
+            sep5 = "\n";
         } else {
-          value += sep3 + content;
-          sep3 = " ";
+          value += sep5 + content;
+          sep5 = " ";
           prevMoreIndented = false;
         }
       }
@@ -11051,25 +11480,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep3 = " ";
+      let sep5 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep3 === "\n")
-            res += sep3;
+          if (sep5 === "\n")
+            res += sep5;
           else
-            sep3 = "\n";
+            sep5 = "\n";
         } else {
-          res += sep3 + match[1];
-          sep3 = " ";
+          res += sep5 + match[1];
+          sep5 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep3 + (match?.[1] ?? "");
+      return res + sep5 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -11870,14 +12299,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep3, value }) {
+    function stringifyItem({ start, key, sep: sep5, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep3)
-        for (const st of sep3)
+      if (sep5)
+        for (const st of sep5)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -13026,18 +13455,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep3;
+          let sep5;
           if (scalar.end) {
-            sep3 = scalar.end;
-            sep3.push(this.sourceToken);
+            sep5 = scalar.end;
+            sep5.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep3 = [this.sourceToken];
+            sep5 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep3 }]
+            items: [{ start, key: scalar, sep: sep5 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -13190,15 +13619,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep3 = it.sep;
-                  sep3.push(this.sourceToken);
+                  const sep5 = it.sep;
+                  sep5.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep3 }]
+                    items: [{ start: start2, key, sep: sep5 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -13392,13 +13821,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep3 = fc.end.splice(1, fc.end.length);
-            sep3.push(this.sourceToken);
+            const sep5 = fc.end.splice(1, fc.end.length);
+            sep5.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep3 }]
+              items: [{ start, key: fc, sep: sep5 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -13731,8 +14160,8 @@ function parseEntries(raw) {
   }
   return entries;
 }
-async function loadAllowlist(config, logger = nullLogger) {
-  const path = resolvePath(config.path);
+async function loadAllowlist(config2, logger = nullLogger) {
+  const path = resolvePath(config2.path);
   let raw;
   try {
     raw = await getFileContent(path);
@@ -13889,6 +14318,7 @@ var import_node_path4 = require("node:path");
 init_config();
 init_file_utils();
 var MAX_SUMMARY_LEN = 200;
+var AUDIT_LOG_SCHEMA_VERSION = 1;
 function toolInputSummary(toolName, toolInput) {
   if (toolName === "Bash") {
     return String(toolInput.command ?? "").slice(0, MAX_SUMMARY_LEN);
@@ -13928,43 +14358,50 @@ async function rotateIfNeeded(filePath, maxBytes, maxFiles) {
   } catch {
   }
 }
-async function appendEntry(config, entry) {
-  const path = resolvePath(config.path);
+async function appendEntry(config2, entry) {
+  const path = resolvePath(config2.path);
   await (0, import_promises.mkdir)((0, import_node_path4.dirname)(path), { recursive: true });
-  await rotateIfNeeded(path, config.max_bytes, config.max_files);
-  await (0, import_promises.appendFile)(path, `${JSON.stringify(entry)}
+  await rotateIfNeeded(path, config2.max_bytes, config2.max_files);
+  const stamped = { ...entry, schema_version: AUDIT_LOG_SCHEMA_VERSION };
+  await (0, import_promises.appendFile)(path, `${JSON.stringify(stamped)}
 `);
 }
-async function logVerdict(config, sessionId, toolName, toolInput, verdict, userOverride = false, conversationId, agentRuntime, hookType, signals, eventId) {
-  if (!config.enabled)
+async function logVerdict(config2, input) {
+  if (!config2.enabled)
     return;
-  if (verdict.decision === "allow" && !config.log_clean && !userOverride)
+  const userOverride = input.userOverride ?? false;
+  const hasSignals = input.signals != null && Object.keys(input.signals).length > 0;
+  if (input.verdict.decision === "allow" && !config2.log_clean && !userOverride && !hasSignals)
     return;
   const entry = {
     type: "runtime_verdict",
-    entry_id: eventId ?? (0, import_node_crypto4.randomUUID)(),
+    entry_id: input.eventId ?? (0, import_node_crypto4.randomUUID)(),
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    session_id: sessionId,
-    conversation_id: conversationId ?? sessionId,
-    agent_runtime: agentRuntime,
-    hook_type: hookType,
-    tool_name: toolName,
-    tool_input_summary: toolInputSummary(toolName, toolInput),
-    artifacts: verdict.artifacts,
-    verdict: verdict.decision,
-    severity: verdict.severity,
-    reasons: verdict.reasons,
-    source: verdict.source,
+    session_id: input.sessionId,
+    conversation_id: input.conversationId ?? input.sessionId,
+    agent_runtime: input.agentRuntime,
+    hook_type: input.hookType,
+    tool_name: input.toolName,
+    tool_input_summary: toolInputSummary(input.toolName, input.toolInput),
+    artifacts: input.verdict.artifacts,
+    verdict: input.verdict.decision,
+    severity: input.verdict.severity,
+    reasons: input.verdict.reasons,
+    source: input.verdict.source,
     user_override: userOverride,
-    signals
+    signals: input.signals,
+    tool_use_id: input.toolUseId
   };
+  if (input.content !== void 0) {
+    entry.content = input.content;
+  }
   try {
-    await appendEntry(config, entry);
+    await appendEntry(config2, entry);
   } catch {
   }
 }
-async function logPluginScan(config, pluginKey, pluginVersion, findings) {
-  if (!config.enabled)
+async function logPluginScan(config2, pluginKey, pluginVersion, findings) {
+  if (!config2.enabled)
     return;
   const entry = {
     type: "plugin_scan",
@@ -13975,48 +14412,25 @@ async function logPluginScan(config, pluginKey, pluginVersion, findings) {
     findings
   };
   try {
-    await appendEntry(config, entry);
+    await appendEntry(config2, entry);
   } catch {
   }
 }
 
-// ../core/dist/branding.js
-var import_node_path5 = require("node:path");
-init_config();
-init_file_utils();
-init_types2();
-var defaultBranding = BrandingSchema.parse({});
-function defaultBrandingPath() {
-  return (0, import_node_path5.join)(resolvePath(SAGE_DIR), "branding.json");
-}
-function loadBrandingSync(logger = nullLogger, brandingPath) {
-  const path = brandingPath ?? defaultBrandingPath();
-  let raw;
-  try {
-    raw = getFileContentSync(path);
-  } catch {
-    return defaultBranding;
-  }
-  return parseBranding(raw, path, logger);
-}
-function parseBranding(raw, path, logger) {
-  let data;
-  try {
-    data = JSON.parse(raw);
-  } catch (e) {
-    logger.warn(`Failed to parse branding from ${path}`, { error: String(e) });
-    return defaultBranding;
-  }
-  if (typeof data !== "object" || data === null || Array.isArray(data)) {
-    logger.warn(`Branding file ${path} does not contain a JSON object`);
+// ../core/dist/brands.js
+var defaultBranding = { name: "Sage", short_name: "Sage" };
+var BRANDS = {
+  norton: { name: "Norton AI Agent Protection", short_name: "Norton" }
+};
+function resolveBranding(brandKey, logger) {
+  if (!brandKey)
     return defaultBranding;
-  }
-  try {
-    return BrandingSchema.parse(data);
-  } catch (e) {
-    logger.warn("Branding validation failed, using defaults", { error: String(e) });
+  const entry = BRANDS[brandKey];
+  if (!entry) {
+    logger?.warn(`Unknown brand_key "${brandKey}" in config \u2014 using default branding`);
     return defaultBranding;
   }
+  return { ...entry, brand_key: brandKey };
 }
 
 // ../core/dist/cache.js
@@ -14032,10 +14446,10 @@ var VerdictCache = class {
   config;
   logger;
   version;
-  constructor(config, logger = nullLogger, version) {
-    this.config = config;
+  constructor(config2, logger = nullLogger, version) {
+    this.config = config2;
     this.logger = logger;
-    this.path = resolvePath(config.path);
+    this.path = resolvePath(config2.path);
     this.version = version;
   }
   async load() {
@@ -14064,7 +14478,8 @@ var VerdictCache = class {
       verdict: entry.verdict,
       severity: entry.severity,
       reasons: entry.reasons,
-      source: entry.source
+      source: entry.source,
+      ...entry.urlSignalLabels !== void 0 ? { urlSignalLabels: entry.urlSignalLabels } : {}
     };
   }
   putUrl(url, verdict, isMalicious) {
@@ -14097,9 +14512,10 @@ var VerdictCache = class {
   putCommand(commandHash, verdict) {
     if (!this.config.enabled)
       return;
+    const { urlSignalLabels: _ignoredUrlLabels, ...rest } = verdict;
     const now = /* @__PURE__ */ new Date();
     this.store.commands[commandHash] = {
-      ...verdict,
+      ...rest,
       checkedAt: now.toISOString(),
       expiresAt: FAR_FUTURE,
       sageVersion: this.version
@@ -14121,11 +14537,12 @@ var VerdictCache = class {
   putPackage(key, verdict, packageAgeDays) {
     if (!this.config.enabled)
       return;
+    const { urlSignalLabels: _ignoredUrlLabels, ...rest } = verdict;
     const ttlSeconds = this.computePackageTtl(verdict.verdict, packageAgeDays);
     const now = /* @__PURE__ */ new Date();
     const expiresAt = new Date(now.getTime() + ttlSeconds * 1e3);
     this.store.packages[key] = {
-      ...verdict,
+      ...rest,
       checkedAt: now.toISOString(),
       expiresAt: expiresAt.toISOString(),
       sageVersion: this.version
@@ -14211,8 +14628,12 @@ function interpretAmsiResult(amsiResult, content, contentName) {
 var KoffiAmsiBackend = class {
   logger;
   context = null;
-  session = null;
   available = false;
+  /** Koffi library handle — must be closed to let the event loop drain. */
+  /* biome-ignore lint/suspicious/noExplicitAny: koffi Library type is not exported */
+  lib = null;
+  /* biome-ignore lint/suspicious/noExplicitAny: koffi FFI functions have dynamic signatures */
+  fnOpenSession = null;
   /* biome-ignore lint/suspicious/noExplicitAny: koffi FFI functions have dynamic signatures */
   fnScanBuffer = null;
   /* biome-ignore lint/suspicious/noExplicitAny: koffi FFI functions have dynamic signatures */
@@ -14230,10 +14651,11 @@ var KoffiAmsiBackend = class {
       const koffiModule = await import("koffi");
       const koffi = koffiModule.default ?? koffiModule;
       const lib = koffi.load("amsi.dll");
+      this.lib = lib;
       const _HAMSICONTEXT = koffi.pointer("HAMSICONTEXT", koffi.opaque());
       const _HAMSISESSION = koffi.pointer("HAMSISESSION", koffi.opaque());
       const AmsiInitialize = lib.func("int32 __stdcall AmsiInitialize(str16 appName, _Out_ HAMSICONTEXT *ctx)");
-      const AmsiOpenSession = lib.func("int32 __stdcall AmsiOpenSession(HAMSICONTEXT ctx, _Out_ HAMSISESSION *session)");
+      this.fnOpenSession = lib.func("int32 __stdcall AmsiOpenSession(HAMSICONTEXT ctx, _Out_ HAMSISESSION *session)");
       this.fnScanBuffer = lib.func("int32 __stdcall AmsiScanBuffer(HAMSICONTEXT ctx, void *buf, uint32 len, str16 contentName, HAMSISESSION session, _Out_ int32 *result)");
       this.fnCloseSession = lib.func("void __stdcall AmsiCloseSession(HAMSICONTEXT ctx, HAMSISESSION session)");
       this.fnUninitialize = lib.func("void __stdcall AmsiUninitialize(HAMSICONTEXT ctx)");
@@ -14241,39 +14663,44 @@ var KoffiAmsiBackend = class {
       const hr = AmsiInitialize("Sage", ctxOut);
       if (hr !== 0) {
         this.logger.warn("AMSI: koffi AmsiInitialize failed", { hr });
+        this.close();
         return;
       }
       this.context = ctxOut[0];
       const sessOut = [null];
-      const hr2 = AmsiOpenSession(this.context, sessOut);
+      const hr2 = this.fnOpenSession(this.context, sessOut);
       if (hr2 !== 0) {
         this.logger.warn("AMSI: koffi AmsiOpenSession failed", { hr: hr2 });
-        try {
-          if (this.fnUninitialize) {
-            this.fnUninitialize(this.context);
-          }
-        } catch {
-        }
-        this.context = null;
+        this.close();
         return;
       }
-      this.session = sessOut[0];
+      try {
+        this.fnCloseSession(this.context, sessOut[0]);
+      } catch {
+      }
       this.available = true;
       this.logger.debug("AMSI: koffi backend initialized");
     } catch (e) {
       this.logger.debug("AMSI: koffi backend init failed", { error: String(e) });
-      this.available = false;
+      this.close();
     }
   }
   async scanString(content, contentName) {
-    if (!this.available || !this.fnScanBuffer || !this.context || !this.session) {
+    if (!this.available || !this.fnOpenSession || !this.fnScanBuffer || !this.context) {
       return null;
     }
+    const sessOut = [null];
+    const hrOpen = this.fnOpenSession(this.context, sessOut);
+    if (hrOpen !== 0) {
+      this.logger.warn("AMSI: koffi AmsiOpenSession failed in scan", { hr: hrOpen, contentName });
+      return null;
+    }
+    const session = sessOut[0];
     try {
       const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
       const buf = Buffer.from(truncated, "utf-8");
       const resultOut = [0];
-      const hr = this.fnScanBuffer(this.context, buf, buf.length, contentName, this.session, resultOut);
+      const hr = this.fnScanBuffer(this.context, buf, buf.length, contentName, session, resultOut);
       if (hr !== 0) {
         this.logger.warn("AMSI: koffi AmsiScanBuffer failed", { hr, contentName });
         return null;
@@ -14284,24 +14711,33 @@ var KoffiAmsiBackend = class {
     } catch (e) {
       this.logger.warn("AMSI: koffi scanBuffer failed", { error: String(e), contentName });
       return null;
+    } finally {
+      try {
+        if (this.fnCloseSession && this.context) {
+          this.fnCloseSession(this.context, session);
+        }
+      } catch {
+      }
     }
   }
   close() {
-    try {
-      if (this.session && this.context && this.fnCloseSession) {
-        this.fnCloseSession(this.context, this.session);
-      }
-    } catch {
-    }
     try {
       if (this.context && this.fnUninitialize) {
         this.fnUninitialize(this.context);
       }
     } catch {
     }
-    this.session = null;
+    this.fnOpenSession = null;
+    this.fnScanBuffer = null;
+    this.fnCloseSession = null;
+    this.fnUninitialize = null;
     this.context = null;
     this.available = false;
+    try {
+      this.lib?.close();
+    } catch {
+    }
+    this.lib = null;
   }
 };
 var AMSI_CSHARP_TYPE = `
@@ -14328,34 +14764,45 @@ public class SageAmsi {
     static extern void AmsiUninitialize(IntPtr ctx);
 
     private static IntPtr _ctx;
-    private static IntPtr _session;
     private static bool _initialized;
 
     public static bool Init() {
         int hr = AmsiInitialize("Sage", out _ctx);
         if (hr != 0) return false;
-        hr = AmsiOpenSession(_ctx, out _session);
+        // Verify we can open a session, then close it immediately.
+        // Actual sessions are opened per-scan to avoid cross-file tainting.
+        IntPtr sess;
+        hr = AmsiOpenSession(_ctx, out sess);
         if (hr != 0) {
             AmsiUninitialize(_ctx);
             return false;
         }
+        AmsiCloseSession(_ctx, sess);
         _initialized = true;
         return true;
     }
 
     public static int Scan(string content, string contentName) {
         if (!_initialized) return -1;
-        byte[] bytes = Encoding.UTF8.GetBytes(content);
-        int result;
-        int hr = AmsiScanBuffer(_ctx, bytes, (uint)bytes.Length,
-                                contentName, _session, out result);
+        // Open a fresh session per scan so a detection in one file
+        // does not taint subsequent scans (sessions are correlation scopes).
+        IntPtr session;
+        int hr = AmsiOpenSession(_ctx, out session);
         if (hr != 0) return -1;
-        return result;
+        try {
+            byte[] bytes = Encoding.UTF8.GetBytes(content);
+            int result;
+            hr = AmsiScanBuffer(_ctx, bytes, (uint)bytes.Length,
+                                    contentName, session, out result);
+            if (hr != 0) return -1;
+            return result;
+        } finally {
+            AmsiCloseSession(_ctx, session);
+        }
     }
 
     public static void Shutdown() {
         if (!_initialized) return;
-        AmsiCloseSession(_ctx, _session);
         AmsiUninitialize(_ctx);
         _initialized = false;
     }
@@ -14435,17 +14882,24 @@ var PersistentPowershellAmsiBackend = class {
     return this.available;
   }
   waitForLine(timeout) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve9, reject) => {
       const timer = setTimeout(() => {
         this.pendingResponse = null;
         reject(new Error("timeout"));
       }, timeout);
-      this.pendingResponse = { resolve: resolve3, reject, timer };
+      this.pendingResponse = { resolve: resolve9, reject, timer };
     });
   }
   async init() {
     try {
-      this.process = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", PS_PERSISTENT_SCRIPT], {
+      this.process = spawn("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        PS_PERSISTENT_SCRIPT
+      ], {
         stdio: ["pipe", "pipe", "pipe"],
         windowsHide: true
       });
@@ -14475,10 +14929,10 @@ var PersistentPowershellAmsiBackend = class {
           const line = this.stdoutBuffer.slice(0, idx).trim();
           this.stdoutBuffer = this.stdoutBuffer.slice(idx + 1);
           if (this.pendingResponse) {
-            const { resolve: resolve3, timer } = this.pendingResponse;
+            const { resolve: resolve9, timer } = this.pendingResponse;
             this.pendingResponse = null;
             clearTimeout(timer);
-            resolve3(line);
+            resolve9(line);
           }
           idx = this.stdoutBuffer.indexOf("\n");
         }
@@ -14567,7 +15021,7 @@ var WslPowershellAmsiBackend = class {
     if (!this.available)
       return null;
     const truncated = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
-    return new Promise((resolve3) => {
+    return new Promise((resolve9) => {
       try {
         const ps = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", PS_ONESHOT_SCRIPT], { stdio: ["pipe", "pipe", "pipe"] });
         let stdout = "";
@@ -14577,7 +15031,7 @@ var WslPowershellAmsiBackend = class {
             ps.kill();
           } catch {
           }
-          resolve3(null);
+          resolve9(null);
         }, PS_TIMEOUT);
         ps.stdout?.on("data", (chunk) => {
           stdout += chunk.toString();
@@ -14590,7 +15044,7 @@ var WslPowershellAmsiBackend = class {
         ps.on("error", (err) => {
           clearTimeout(timer);
           this.logger.debug("AMSI: PowerShell one-shot error", { error: String(err) });
-          resolve3(null);
+          resolve9(null);
         });
         ps.on("exit", () => {
           clearTimeout(timer);
@@ -14600,11 +15054,11 @@ var WslPowershellAmsiBackend = class {
               stdout: stdout.slice(0, 100),
               contentName
             });
-            resolve3(null);
+            resolve9(null);
             return;
           }
           this.logger.debug("AMSI: PowerShell one-shot result", { contentName, amsiResult });
-          resolve3(interpretAmsiResult(amsiResult, content, contentName));
+          resolve9(interpretAmsiResult(amsiResult, content, contentName));
         });
         const req = JSON.stringify({ content: truncated, contentName });
         ps.stdin?.write(`${req}
@@ -14612,7 +15066,7 @@ var WslPowershellAmsiBackend = class {
         ps.stdin?.end();
       } catch (e) {
         this.logger.warn("AMSI: PowerShell one-shot failed", { error: String(e), contentName });
-        resolve3(null);
+        resolve9(null);
       }
     });
   }
@@ -14651,8 +15105,9 @@ var AmsiClient = class {
     }
     this.logger.debug("AMSI: no backend available");
   }
-  async scanString(content, contentName) {
-    return await this.backend?.scanString(content, contentName) ?? null;
+  async scanString(scanType, contentName, content) {
+    const formattedName = `[Sage:${scanType}]:${contentName}`;
+    return await this.backend?.scanString(content, formattedName) ?? null;
   }
   close() {
     this.backend?.close();
@@ -14660,19 +15115,106 @@ var AmsiClient = class {
   }
 };
 
+// ../core/dist/clients/content-fetch.js
+init_types2();
+var DEFAULT_TIMEOUT_MS = 4e3;
+var DEFAULT_MAX_CONTENT_LENGTH = 16384;
+var BINARY_SNIFF_LENGTH = 512;
+var TEXTUAL_APPLICATION_TYPES = /* @__PURE__ */ new Set([
+  "application/json",
+  "application/xml",
+  "application/xhtml+xml",
+  "application/javascript",
+  "application/x-yaml",
+  "application/yaml",
+  "application/rss+xml",
+  "application/atom+xml",
+  "application/ld+json"
+]);
+var ContentFetchClient = class _ContentFetchClient {
+  timeoutMs;
+  maxContentLength;
+  logger;
+  constructor(timeoutMs = DEFAULT_TIMEOUT_MS, maxContentLength = DEFAULT_MAX_CONTENT_LENGTH, logger = nullLogger) {
+    this.timeoutMs = timeoutMs;
+    this.maxContentLength = maxContentLength;
+    this.logger = logger;
+  }
+  async fetchTextContent(url) {
+    try {
+      const response = await fetch(url, {
+        signal: AbortSignal.timeout(this.timeoutMs),
+        redirect: "follow",
+        headers: { "User-Agent": "sage" }
+      });
+      if (!response.ok) {
+        this.logger.debug("Content fetch failed", { url, status: String(response.status) });
+        return null;
+      }
+      const contentType = response.headers.get("content-type");
+      if (!_ContentFetchClient.isTextualContentType(contentType)) {
+        this.logger.debug("Skipping non-textual content type", {
+          url,
+          contentType: contentType ?? "unknown"
+        });
+        return null;
+      }
+      const reader = response.body?.getReader();
+      if (!reader)
+        return null;
+      const decoder = new TextDecoder();
+      let text = "";
+      try {
+        while (text.length < this.maxContentLength) {
+          const { done, value } = await reader.read();
+          if (done)
+            break;
+          text += decoder.decode(value, { stream: true });
+        }
+        text += decoder.decode();
+      } finally {
+        reader.cancel();
+      }
+      if (text.length > this.maxContentLength) {
+        text = text.slice(0, this.maxContentLength);
+      }
+      if (_ContentFetchClient.hasBinaryContent(text)) {
+        this.logger.debug("Skipping binary content", { url });
+        return null;
+      }
+      return { content: text, contentType };
+    } catch (error) {
+      this.logger.debug("Content fetch error", { url, error: String(error) });
+      return null;
+    }
+  }
+  static isTextualContentType(contentType) {
+    if (contentType == null)
+      return true;
+    const mime = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+    if (mime.startsWith("text/"))
+      return true;
+    return TEXTUAL_APPLICATION_TYPES.has(mime);
+  }
+  static hasBinaryContent(text) {
+    const sniff = text.slice(0, BINARY_SNIFF_LENGTH);
+    return sniff.includes("\0");
+  }
+};
+
 // ../core/dist/clients/file-check.js
 init_types2();
 
 // ../core/dist/version.js
-var import_node_path6 = require("node:path");
+var import_node_path5 = require("node:path");
 var import_node_url = require("node:url");
 init_file_utils();
 var import_meta = {};
 function resolveVersion() {
   if (true)
-    return "0.8.0";
+    return "0.9.0";
   try {
-    const pkgPath = (0, import_node_path6.join)((0, import_node_path6.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "..", "package.json");
+    const pkgPath = (0, import_node_path5.join)((0, import_node_path5.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "..", "package.json");
     const pkg = JSON.parse(getFileContentSync(pkgPath));
     if (typeof pkg.version === "string")
       return pkg.version;
@@ -14701,9 +15243,9 @@ var FileCheckClient = class {
   endpoint;
   timeoutMs;
   logger;
-  constructor(config, logger = nullLogger) {
-    this.endpoint = config?.endpoint ?? this.resolveEndpoint();
-    this.timeoutMs = (config?.timeout_seconds ?? DEFAULT_TIMEOUT) * 1e3;
+  constructor(config2, logger = nullLogger) {
+    this.endpoint = config2?.endpoint ?? this.resolveEndpoint();
+    this.timeoutMs = (config2?.timeout_seconds ?? DEFAULT_TIMEOUT) * 1e3;
     this.logger = logger;
   }
   buildPath() {
@@ -14815,21 +15357,210 @@ var FileCheckClient = class {
   }
 };
 
-// ../core/dist/clients/package-registry.js
-var import_semver = __toESM(require_semver2(), 1);
+// ../core/dist/model-storage.js
+var import_node_fs = require("node:fs");
+var import_node_path6 = require("node:path");
+init_config();
+var MODEL_SCHEMA_VERSION = "v1";
+var REQUIRED_MODELS_BY_SCHEMA = {
+  v1: ["pi-model"]
+};
+var REQUIRED_MODEL_FILES = {
+  "pi-model": [
+    "model_int8.onnx",
+    "tokenizer.json",
+    "tokenizer_config.json",
+    "special_tokens_map.json",
+    "vocab.txt",
+    "config.json"
+  ]
+};
+function getModelStorageRoot(sageDir = resolvePath("~/.sage")) {
+  return (0, import_node_path6.join)(resolvePath(sageDir), "models");
+}
+function getModelDir(modelName, schema = MODEL_SCHEMA_VERSION, sageDir) {
+  return (0, import_node_path6.join)(getModelStorageRoot(sageDir), schema, modelName);
+}
+function isModelPresent(modelName, schema = MODEL_SCHEMA_VERSION, sageDir) {
+  const dir = getModelDir(modelName, schema, sageDir);
+  const files = REQUIRED_MODEL_FILES[modelName];
+  if (!files || files.length === 0)
+    return false;
+  return files.every((f) => (0, import_node_fs.existsSync)((0, import_node_path6.resolve)(dir, f)));
+}
+function missingRequiredModels(schema = MODEL_SCHEMA_VERSION, sageDir) {
+  const required = REQUIRED_MODELS_BY_SCHEMA[schema] ?? [];
+  return required.filter((name) => !isModelPresent(name, schema, sageDir));
+}
+function anyRequiredModelMissing(schema = MODEL_SCHEMA_VERSION, sageDir) {
+  return missingRequiredModels(schema, sageDir).length > 0;
+}
+
+// ../core/dist/clients/model-downloader.js
 init_types2();
-var NPM_REGISTRY = "https://registry.npmjs.org";
-var PYPI_REGISTRY = "https://pypi.org/pypi";
-var DEFAULT_TIMEOUT2 = 5;
-var NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
-var PYPI_NAME_RE = /^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$/;
-var RegistryClient = class {
-  timeoutMs;
-  logger;
-  constructor(config, logger = nullLogger) {
-    this.timeoutMs = (config?.timeout_seconds ?? DEFAULT_TIMEOUT2) * 1e3;
-    this.logger = logger;
-  }
+var STALE_LOCK_MS = 60 * 60 * 1e3;
+
+// ../core/dist/sage-proxy.js
+function mapSageProxyOs(platform) {
+  switch (platform) {
+    case "win32":
+      return "WINDOWS";
+    case "darwin":
+      return "MACOS";
+    case "linux":
+      return "LINUX";
+    default:
+      return platform;
+  }
+}
+function mapSageProxyArchitecture(arch) {
+  return arch.toUpperCase();
+}
+function buildSageProxyEnvelope(args) {
+  return {
+    identity: { uuid: args.iid },
+    product: { version_app: args.versionApp },
+    platform: {
+      os: args.platformOs ?? mapSageProxyOs(process.platform),
+      architecture: args.platformArchitecture ?? mapSageProxyArchitecture(process.arch)
+    },
+    agent: {
+      agent_runtime: args.agentRuntime,
+      agent_runtime_version: args.agentRuntimeVersion
+    }
+  };
+}
+
+// ../core/dist/clients/model-manifest.js
+init_types2();
+
+// ../core/dist/clients/url-check.js
+init_types2();
+var DEFAULT_TIMEOUT2 = 5;
+var MAX_URLS_PER_REQUEST = 50;
+var SERVICE_NAME2 = "sage";
+function getProviderTld2() {
+  return "com";
+}
+var REQUEST_HEADERS2 = [
+  { name: "Accept", value: "application/json" },
+  { name: "Content-Type", value: "application/json" },
+  { name: "User-Agent", value: SERVICE_NAME2 }
+];
+function getProviderName2() {
+  return "avast";
+}
+function getSubdomain() {
+  return "svc";
+}
+function buildDomain() {
+  return [getSubdomain(), getProviderName2(), getProviderTld2()].join(".");
+}
+function resolveEndpoint(path) {
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  return `https://${SERVICE_NAME2}-proxy.${buildDomain()}${normalizedPath}`;
+}
+var UrlCheckClient = class {
+  endpoint;
+  timeoutMs;
+  logger;
+  constructor(config2, logger = nullLogger) {
+    this.endpoint = config2?.endpoint ?? resolveEndpoint("/url-check");
+    this.timeoutMs = (config2?.timeout_seconds ?? DEFAULT_TIMEOUT2) * 1e3;
+    this.logger = logger;
+  }
+  async checkUrls(urls) {
+    if (urls.length === 0)
+      return [];
+    const batches = [];
+    for (let i = 0; i < urls.length; i += MAX_URLS_PER_REQUEST) {
+      batches.push(urls.slice(i, i + MAX_URLS_PER_REQUEST));
+    }
+    const batchResults = await Promise.all(batches.map((batch) => this.checkBatch(batch)));
+    return batchResults.flat();
+  }
+  async checkBatch(urls) {
+    const queries = urls.map((url) => ({
+      key: { "url-like": url },
+      include: { "detection-infos": true }
+    }));
+    const payload = {
+      queries,
+      "client-info": {
+        "product-name": SERVICE_NAME2,
+        "product-version": VERSION
+      }
+    };
+    try {
+      const response = await fetch(this.endpoint, {
+        method: "POST",
+        headers: Object.fromEntries(REQUEST_HEADERS2.map((h) => [h.name, h.value])),
+        body: JSON.stringify(payload),
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+      if (!response.ok) {
+        this.logger.warn(`URL check HTTP error: ${response.status}`);
+        return [];
+      }
+      const data = await response.json();
+      const answers = data.answers ?? [];
+      const results = [];
+      for (const answer of answers) {
+        const result = this.parseAnswer(answer);
+        if (result !== null) {
+          results.push(result);
+        }
+      }
+      return results;
+    } catch (e) {
+      this.logger.warn("URL check request failed", { error: String(e) });
+      return [];
+    }
+  }
+  parseAnswer(answer) {
+    try {
+      const url = answer.key ?? "";
+      const result = answer.result ?? {};
+      const success = result.success ?? {};
+      const classification = success.classification ?? {};
+      const detectionInfos = classification["detection-infos"] ?? [];
+      const classResult = classification.result ?? {};
+      const malicious = classResult.malicious;
+      const detections = detectionInfos.filter((info) => typeof info.name === "string").map((info) => {
+        return info.name;
+      });
+      const findings = malicious ? (malicious.findings ?? []).map((f) => ({
+        severityName: f["severity-name"] ?? "unknown",
+        typeName: f["type-name"] ?? "unknown"
+      })) : [];
+      return {
+        url,
+        isMalicious: Boolean(malicious),
+        detections,
+        findings
+      };
+    } catch (e) {
+      this.logger.warn("Failed to parse answer", { error: String(e) });
+      return null;
+    }
+  }
+};
+
+// ../core/dist/clients/package-registry.js
+var import_semver = __toESM(require_semver2(), 1);
+init_types2();
+var NPM_REGISTRY = "https://registry.npmjs.org";
+var PYPI_REGISTRY = "https://pypi.org/pypi";
+var DEFAULT_TIMEOUT3 = 5;
+var NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+var PYPI_NAME_RE = /^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$/;
+var RegistryClient = class {
+  timeoutMs;
+  logger;
+  constructor(config2, logger = nullLogger) {
+    this.timeoutMs = (config2?.timeout_seconds ?? DEFAULT_TIMEOUT3) * 1e3;
+    this.logger = logger;
+  }
   async getPackageMetadata(name, registry, version) {
     if (registry === "npm")
       return this.getNpmMetadata(name, version);
@@ -14983,131 +15714,693 @@ var RegistryClient = class {
       return null;
     }
   }
-};
+};
+
+// ../core/dist/clients/pi-check.js
+var import_node_path9 = require("node:path");
+init_types2();
+var DEFAULT_MAX_CONTENT_LENGTH2 = 16384;
+var MAX_TOKENS = 512;
+var OVERLAP_TOKENS = 128;
+var MODEL_FILE = "model_int8.onnx";
+var MODEL_METADATA_FILES = [
+  "config.json",
+  "special_tokens_map.json",
+  "tokenizer.json",
+  "tokenizer_config.json",
+  "vocab.txt",
+  MODEL_FILE
+];
+function softmax(logits) {
+  const max = Math.max(...logits);
+  const exp = logits.map((x) => Math.exp(x - max));
+  const sum = exp.reduce((a, b) => a + b, 0);
+  return exp.map((x) => x / sum);
+}
+function isModelMissingError(err) {
+  if (!(err instanceof Error))
+    return false;
+  const nodeErr = err;
+  if (nodeErr.code === "ENOENT")
+    return true;
+  const msg = err.message.toLowerCase();
+  return msg.includes("enoent") || msg.includes("no such file or directory") || MODEL_METADATA_FILES.some((name) => msg.includes(name.toLowerCase()));
+}
+var BundledPiProvider = class _BundledPiProvider {
+  /** Tracks whether any instance loaded the model runtime in this process. */
+  static modelRuntimeLoaded = false;
+  modelPath;
+  maxContentLength;
+  mediumRiskThreshold;
+  logger;
+  tokenizer = null;
+  session = null;
+  tensorClass = null;
+  inputNames = /* @__PURE__ */ new Set();
+  initPromise = null;
+  /**
+   * Call at the end of the process to prevent native model runtime cleanup
+   * crash (exit code 134/SIGABRT). Only exits if the runtime was actually
+   * loaded.
+   */
+  static exitIfModelLoaded() {
+    if (_BundledPiProvider.modelRuntimeLoaded)
+      process.exit(0);
+  }
+  constructor(options = {}) {
+    this.modelPath = options.modelPath ?? getModelDir("pi-model");
+    this.maxContentLength = options.maxContentLength ?? DEFAULT_MAX_CONTENT_LENGTH2;
+    this.mediumRiskThreshold = options.mediumRiskThreshold ?? DEFAULT_PI_MEDIUM_RISK_THRESHOLD;
+    this.logger = options.logger ?? nullLogger;
+  }
+  async checkContent(content, context) {
+    try {
+      const truncated = this.truncateContent(content);
+      if (truncated.length === 0)
+        return null;
+      const loaded = await this.ensureLoaded();
+      if (!loaded)
+        return null;
+      const chunks = this.chunkText(truncated);
+      let maxRisk = 0;
+      let maxChunk = "";
+      for (const chunk of chunks) {
+        if (chunk.length < 10)
+          continue;
+        const risk = await this.classifyChunk(chunk);
+        if (risk > maxRisk) {
+          maxRisk = risk;
+          maxChunk = chunk;
+        }
+      }
+      const findings = [];
+      if (maxRisk >= this.mediumRiskThreshold) {
+        const snippet = maxChunk.length > 80 ? `${maxChunk.slice(0, 77)}...` : maxChunk;
+        findings.push(snippet);
+      }
+      return {
+        risk: maxRisk,
+        findings,
+        contentName: context,
+        modelId: (0, import_node_path9.basename)(this.modelPath),
+        contentSnippet: maxChunk || void 0
+      };
+    } catch (err) {
+      this.logger.warn("PI check failed (fail-open)", {
+        error: err instanceof Error ? err.message : String(err),
+        context
+      });
+      return null;
+    }
+  }
+  async ensureLoaded() {
+    if (this.session && this.tokenizer)
+      return true;
+    if (this.initPromise)
+      return this.initPromise;
+    this.initPromise = this.loadModel();
+    return this.initPromise;
+  }
+  async loadModel() {
+    try {
+      const { LocalTokenizer: LocalTokenizer2 } = await Promise.resolve().then(() => (init_tokenizer(), tokenizer_exports));
+      this.tokenizer = LocalTokenizer2.fromModelDir(this.modelPath, MAX_TOKENS);
+      const { ensurePiDeps: ensurePiDeps2 } = await Promise.resolve().then(() => (init_pi_deps_installer(), pi_deps_installer_exports));
+      const depsReady = await ensurePiDeps2(this.modelPath, this.logger);
+      if (!depsReady)
+        return false;
+      const { createRequire: createRequire2 } = await import("node:module");
+      const requireFromModel = createRequire2((0, import_node_path9.resolve)(this.modelPath, "package.json"));
+      const runtime = requireFromModel("onnxruntime-node");
+      this.tensorClass = runtime.Tensor;
+      const modelFilePath = (0, import_node_path9.resolve)(this.modelPath, MODEL_FILE);
+      this.session = await runtime.InferenceSession.create(modelFilePath);
+      const sess = this.session;
+      this.inputNames = new Set(sess.inputNames);
+      _BundledPiProvider.modelRuntimeLoaded = true;
+      this.logger.info("PI model loaded", { path: this.modelPath });
+      return true;
+    } catch (err) {
+      if (isModelMissingError(err)) {
+        this.logger.debug("PI model not yet available; using heuristics only", {
+          path: this.modelPath,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        return false;
+      }
+      const errMsg = err instanceof Error ? `${err.message}
+${err.stack}` : String(err);
+      this.logger.warn(`PI model load failed (pi_check is enabled but inference will be skipped): ${errMsg}`);
+      return false;
+    }
+  }
+  /**
+   * Classify a single chunk. Returns P(injected) via softmax over two-class logits.
+   */
+  async classifyChunk(text) {
+    const tok = this.tokenizer;
+    const encoded = tok.call(text, {
+      truncation: true,
+      max_length: MAX_TOKENS,
+      padding: true
+    });
+    const inputIds = new BigInt64Array(encoded.input_ids.map((v) => BigInt(v)));
+    const attentionMask = new BigInt64Array(encoded.attention_mask.map((v) => BigInt(v)));
+    const TensorClass = this.tensorClass;
+    const feeds = {
+      input_ids: new TensorClass("int64", inputIds, [1, inputIds.length]),
+      attention_mask: new TensorClass("int64", attentionMask, [1, attentionMask.length])
+    };
+    if (this.inputNames.has("token_type_ids")) {
+      feeds.token_type_ids = new TensorClass("int64", new BigInt64Array(inputIds.length), [
+        1,
+        inputIds.length
+      ]);
+    }
+    const session = this.session;
+    const output = await session.run(feeds);
+    const logits = Array.from(output.logits?.data ?? []);
+    if (logits.length < 2)
+      return 0;
+    const probs = softmax(logits);
+    return probs[1] ?? 0;
+  }
+  /**
+   * Chunk text with a sliding window over tokenized input. Window size and
+   * overlap are tuned to the model's input window.
+   */
+  chunkText(text) {
+    const tok = this.tokenizer;
+    const encoded = tok.tokenize(text, {
+      addSpecialTokens: false,
+      returnOffsetMapping: true,
+      truncation: false
+    });
+    const tokenIds = encoded.input_ids;
+    const offsets = encoded.offset_mapping;
+    if (tokenIds.length <= MAX_TOKENS)
+      return [text];
+    const chunks = [];
+    let start = 0;
+    while (start < tokenIds.length) {
+      const end = Math.min(start + MAX_TOKENS, tokenIds.length);
+      const charStart = offsets[start]?.[0] ?? 0;
+      const charEnd = offsets[end - 1]?.[1] ?? text.length;
+      chunks.push(text.slice(charStart, charEnd));
+      if (end >= tokenIds.length)
+        break;
+      start = end - OVERLAP_TOKENS;
+    }
+    return chunks;
+  }
+  truncateContent(content) {
+    if (content.length <= this.maxContentLength)
+      return content;
+    const headLen = Math.floor(this.maxContentLength * 0.8);
+    const tailLen = this.maxContentLength - headLen;
+    return `${content.slice(0, headLen)}
+...[truncated]...
+${content.slice(-tailLen)}`;
+  }
+};
+
+// ../core/dist/index.js
+init_pi_deps_installer();
+
+// ../core/dist/clients/skill-check.js
+init_types2();
+var DEFAULT_TIMEOUT4 = 5;
+var SERVICE_NAME3 = "sage";
+var MAX_IDS_PER_REQUEST = 50;
+var REQUEST_HEADERS3 = [
+  { name: "Accept", value: "application/json" },
+  { name: "Content-Type", value: "application/json" },
+  { name: "User-Agent", value: SERVICE_NAME3 }
+];
+var SkillCheckClient = class {
+  endpoint;
+  timeoutMs;
+  logger;
+  constructor(config2, logger = nullLogger) {
+    this.endpoint = config2?.endpoint ?? resolveEndpoint("/v2/skill-check");
+    this.timeoutMs = (config2?.timeout_seconds ?? DEFAULT_TIMEOUT4) * 1e3;
+    this.logger = logger;
+  }
+  /**
+   * Check a list of skill IDs against the proxy.
+   *
+   * Returns a Map keyed by skill id. A `null` value means the proxy had
+   * no opinion on that skill (analogous to a clean verdict). Skill ids
+   * not found in the response are simply absent from the map.
+   *
+   * Fails-open: on any error returns an empty Map. Per-batch errors do
+   * not poison results from successful batches.
+   */
+  async checkSkills(skillIds) {
+    const out = /* @__PURE__ */ new Map();
+    if (skillIds.length === 0)
+      return out;
+    const unique = [...new Set(skillIds)];
+    const batches = [];
+    for (let i = 0; i < unique.length; i += MAX_IDS_PER_REQUEST) {
+      batches.push(unique.slice(i, i + MAX_IDS_PER_REQUEST));
+    }
+    const batchResults = await Promise.all(batches.map((batch) => this.checkBatch(batch)));
+    for (const batch of batchResults) {
+      for (const [id, result] of batch) {
+        out.set(id, result);
+      }
+    }
+    return out;
+  }
+  async checkBatch(skillIds) {
+    const out = /* @__PURE__ */ new Map();
+    try {
+      const response = await fetch(this.endpoint, {
+        method: "POST",
+        headers: Object.fromEntries(REQUEST_HEADERS3.map((h) => [h.name, h.value])),
+        body: JSON.stringify({
+          skill_ids: skillIds,
+          client_info: {
+            product_name: SERVICE_NAME3,
+            product_version: VERSION
+          }
+        }),
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+      if (!response.ok) {
+        this.logger.warn(`SkillCheck HTTP error: ${response.status}`);
+        return out;
+      }
+      const data = await response.json();
+      const results = data.results ?? {};
+      for (const id of skillIds) {
+        if (!(id in results))
+          continue;
+        const raw = results[id];
+        if (raw === null || raw === void 0) {
+          out.set(id, null);
+          continue;
+        }
+        const parsed = this.parseResult(id, raw);
+        out.set(id, parsed);
+      }
+    } catch (e) {
+      this.logger.warn("SkillCheck batch request failed", { error: String(e) });
+    }
+    return out;
+  }
+  parseResult(skillId, raw) {
+    const recommendationsRaw = raw.recommendations ?? [];
+    const recommendations = recommendationsRaw.filter((r) => typeof r === "string");
+    const categoriesRaw = raw.threat_categories ?? [];
+    const threatCategories = categoriesRaw.filter((c) => typeof c === "string");
+    return {
+      skillId,
+      verdict: typeof raw.verdict === "string" ? raw.verdict : void 0,
+      overallRiskLevel: typeof raw.overall_risk_level === "string" ? raw.overall_risk_level : void 0,
+      summary: typeof raw.summary === "string" ? raw.summary : void 0,
+      recommendations,
+      threatCategories
+    };
+  }
+};
+
+// ../core/dist/index.js
+init_config();
+
+// ../core/dist/content-policy.js
+var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".py",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".sh",
+  ".bash",
+  ".html",
+  ".htm",
+  ".json",
+  ".jsonc",
+  ".txt",
+  ".csv",
+  ".xml",
+  ".c",
+  ".h",
+  ".cpp",
+  ".cc",
+  ".cxx",
+  ".hpp",
+  ".yaml",
+  ".yml",
+  ".kt",
+  ".kts"
+]);
+function getUrlExtension(url) {
+  try {
+    const pathname = new URL(url).pathname;
+    const dot = pathname.lastIndexOf(".");
+    const slash = pathname.lastIndexOf("/");
+    if (dot <= slash || dot < 0)
+      return null;
+    return pathname.slice(dot).toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function extractWebFetchUrl(toolInput) {
+  if (typeof toolInput.url === "string")
+    return toolInput.url;
+  if (Array.isArray(toolInput.urls) && typeof toolInput.urls[0] === "string")
+    return toolInput.urls[0];
+  return null;
+}
+var SNIFF_HTML = /^\s*<!doctype\s+html|^\s*<html[\s>]/i;
+var SNIFF_HTML_TAGS = /<\/(head|body|html|div|p|script|style|form|table)>/i;
+var SNIFF_JSON = /^\s*[[{]/;
+var SNIFF_XML = /^\s*<\?xml\s/i;
+var SNIFF_YAML = /^---\s*$/m;
+var SNIFF_SHEBANG_SHELL = /^#!.*\b(sh|bash|zsh|dash)\b/;
+var SNIFF_SHEBANG_PYTHON = /^#!.*\bpython/i;
+var SNIFF_PYTHON = /^(?:import |from \S+ import |def \w+\(|class \w+[:(])/m;
+var SNIFF_JS_TS = /^(?:const |let |var |function |import |export |module\.exports)/m;
+var SNIFF_C_CPP = /^#include\s*[<"]/m;
+var SNIFF_KOTLIN = /^(?:package |fun |class |val |var |object |interface )\w/m;
+var SNIFF_CSV = /^[^,\n]+(?:,[^,\n]+){2,}$/m;
+function isScannableContent(content) {
+  const head = content.slice(0, 4096);
+  return SNIFF_HTML.test(head) || SNIFF_HTML_TAGS.test(head) || SNIFF_JSON.test(head) || SNIFF_XML.test(head) || SNIFF_YAML.test(head) || SNIFF_SHEBANG_SHELL.test(head) || SNIFF_SHEBANG_PYTHON.test(head) || SNIFF_PYTHON.test(head) || SNIFF_JS_TS.test(head) || SNIFF_C_CPP.test(head) || SNIFF_KOTLIN.test(head) || SNIFF_CSV.test(head);
+}
+
+// ../core/dist/content-snapshot.js
+var import_node_os2 = require("node:os");
+var CONTENT_FIELD_LIMITS = Object.freeze({
+  command: 512,
+  url: 512,
+  file_path: 512,
+  package_name: 256,
+  package_version: 128,
+  package_registry: 128
+});
+function safeTruncate(value, maxLen) {
+  if (maxLen <= 0)
+    return "";
+  if (value.length <= maxLen)
+    return value;
+  const cutIndex = maxLen;
+  const codeUnit = value.charCodeAt(cutIndex - 1);
+  if (codeUnit >= 55296 && codeUnit <= 56319) {
+    return value.slice(0, cutIndex - 1);
+  }
+  return value.slice(0, cutIndex);
+}
+function scrubHomePath(value) {
+  const home = (0, import_node_os2.homedir)();
+  if (!home)
+    return value;
+  const normalizedHome = home.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!normalizedHome)
+    return value;
+  const normalizedValue = value.replace(/\\/g, "/");
+  if (normalizedValue === normalizedHome)
+    return "~";
+  if (normalizedValue.startsWith(`${normalizedHome}/`)) {
+    return `~/${normalizedValue.slice(normalizedHome.length + 1)}`;
+  }
+  return value;
+}
+function asString(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function resolveFilePath(toolInput) {
+  return asString(toolInput.file_path) ?? asString(toolInput.filePath) ?? asString(toolInput.path);
+}
+function resolveWebFetchUrl(toolInput) {
+  const single = asString(toolInput.url);
+  if (single)
+    return single;
+  const urls = toolInput.urls;
+  if (Array.isArray(urls)) {
+    for (const u of urls) {
+      if (typeof u === "string" && u.length > 0)
+        return u;
+    }
+  }
+  return void 0;
+}
+function extractFirstApplyPatchPath(patchText) {
+  if (!patchText)
+    return void 0;
+  const headerMatch = /\*{3}\s+(?:Add|Update|Delete)\s+File:\s*(.+)/.exec(patchText);
+  if (headerMatch?.[1]) {
+    const trimmed = headerMatch[1].trim();
+    if (trimmed)
+      return trimmed;
+  }
+  const renameMatch = /\*{3}\s+(?:Move\s+to|Rename\s+File):\s*(.+)/i.exec(patchText);
+  if (renameMatch?.[1]) {
+    const raw = renameMatch[1].trim();
+    const arrow = raw.indexOf(" -> ");
+    if (arrow !== -1) {
+      const src = raw.slice(0, arrow).trim();
+      if (src)
+        return src;
+      const dst = raw.slice(arrow + 4).trim();
+      if (dst)
+        return dst;
+    } else if (raw) {
+      return raw;
+    }
+  }
+  return void 0;
+}
+function extractMcpContent(toolInput) {
+  const nestedRaw = toolInput.tool_input ?? toolInput.toolInput;
+  const candidate = nestedRaw && typeof nestedRaw === "object" && !Array.isArray(nestedRaw) ? nestedRaw : toolInput;
+  return {
+    command: asString(candidate.command),
+    url: asString(candidate.url) ?? resolveWebFetchUrl(candidate),
+    file_path: resolveFilePath(candidate)
+  };
+}
+function firstUrlArtifact(artifacts) {
+  for (const a of artifacts) {
+    if (a.type === "url" && typeof a.value === "string" && a.value.length > 0) {
+      return a.value;
+    }
+  }
+  return void 0;
+}
+function applyFieldLimits(content) {
+  for (const [key, value] of Object.entries(content)) {
+    if (typeof value !== "string")
+      continue;
+    let sanitized = value;
+    if (key === "file_path" || key === "command") {
+      sanitized = scrubHomePath(sanitized);
+    }
+    const limit = CONTENT_FIELD_LIMITS[key];
+    if (limit && sanitized.length > limit) {
+      sanitized = safeTruncate(sanitized, limit);
+    }
+    content[key] = sanitized;
+  }
+}
+function buildContentSnapshot(toolType, toolInput, artifacts = [], signals = {}) {
+  const content = {};
+  switch (toolType) {
+    case "Bash": {
+      const command = asString(toolInput.command);
+      if (command)
+        content.command = command;
+      break;
+    }
+    case "WebFetch": {
+      const url = resolveWebFetchUrl(toolInput) ?? firstUrlArtifact(artifacts);
+      if (url)
+        content.url = url;
+      break;
+    }
+    case "Write":
+    case "Edit":
+    case "Read":
+    case "Delete": {
+      const filePath = resolveFilePath(toolInput);
+      if (filePath)
+        content.file_path = filePath;
+      break;
+    }
+    case "ApplyPatch": {
+      const patchText = asString(toolInput.input) ?? asString(toolInput.patch) ?? "";
+      const filePath = extractFirstApplyPatchPath(patchText);
+      if (filePath)
+        content.file_path = filePath;
+      break;
+    }
+    case "MCP": {
+      const mcp = extractMcpContent(toolInput);
+      if (mcp.command)
+        content.command = mcp.command;
+      if (mcp.url)
+        content.url = mcp.url;
+      if (mcp.file_path)
+        content.file_path = mcp.file_path;
+      break;
+    }
+  }
+  if (!content.url && signals.url_checks && signals.url_checks.length > 0) {
+    const firstUrl = signals.url_checks[0]?.url;
+    if (firstUrl)
+      content.url = firstUrl;
+  }
+  if (signals.package_checks && signals.package_checks.length > 0) {
+    const p = signals.package_checks[0];
+    if (p?.package_name)
+      content.package_name = p.package_name;
+    if (p?.package_version)
+      content.package_version = p.package_version;
+    if (p?.package_registry)
+      content.package_registry = p.package_registry;
+  }
+  applyFieldLimits(content);
+  return content;
+}
 
-// ../core/dist/clients/url-check.js
+// ../core/dist/extended-info.js
+var import_promises2 = require("node:fs/promises");
+var import_node_os3 = require("node:os");
+var import_node_path10 = require("node:path");
+init_file_utils();
 init_types2();
-var DEFAULT_TIMEOUT3 = 5;
-var MAX_URLS_PER_REQUEST = 50;
-var SERVICE_NAME2 = "sage";
-function getProviderTld2() {
-  return "com";
-}
-var REQUEST_HEADERS2 = [
-  { name: "Accept", value: "application/json" },
-  { name: "Content-Type", value: "application/json" },
-  { name: "User-Agent", value: SERVICE_NAME2 }
-];
-function getProviderName2() {
-  return "avast";
+var EXTENDED_INFO_FILE_MAX_BYTES = 1024;
+var EXTENDED_INFO_MAX_GROUPS = 16;
+var EXTENDED_INFO_MAX_KEYS_PER_GROUP = 32;
+var EXTENDED_INFO_MAX_LEAF_CHARS = 256;
+var EXTENDED_INFO_FILENAME = "extended-info.json";
+var cache = /* @__PURE__ */ new Map();
+function isPlainObjectValue(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function getSubdomain() {
-  return "svc";
+function sanitizeLeaves(groupKey, rawGroup, logger) {
+  const entries = Object.entries(rawGroup);
+  const overflow = entries.length > EXTENDED_INFO_MAX_KEYS_PER_GROUP;
+  const retained = overflow ? entries.slice(0, EXTENDED_INFO_MAX_KEYS_PER_GROUP) : entries;
+  if (overflow) {
+    logger.debug(`extended-info: dropped overflow keys in group '${groupKey}' (kept first ${EXTENDED_INFO_MAX_KEYS_PER_GROUP} of ${entries.length})`);
+  }
+  const out = {};
+  for (const [leafKey, leafValue] of retained) {
+    if (typeof leafValue === "string") {
+      out[leafKey] = safeTruncate(leafValue, EXTENDED_INFO_MAX_LEAF_CHARS);
+      continue;
+    }
+    if (typeof leafValue === "number" || typeof leafValue === "boolean") {
+      out[leafKey] = leafValue;
+      continue;
+    }
+    logger.debug(`extended-info: dropped non-scalar leaf '${groupKey}.${leafKey}' (type ${typeof leafValue})`);
+  }
+  return out;
 }
-function buildDomain() {
-  return [getSubdomain(), getProviderName2(), getProviderTld2()].join(".");
+function sanitizeDocument(parsed, logger) {
+  const out = {};
+  for (const [groupKey, groupValue] of Object.entries(parsed)) {
+    if (!isPlainObjectValue(groupValue)) {
+      logger.debug(`extended-info: dropped non-object group '${groupKey}'`);
+      continue;
+    }
+    out[groupKey] = sanitizeLeaves(groupKey, groupValue, logger);
+  }
+  return out;
 }
-function resolveEndpoint(path) {
-  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-  return `https://${SERVICE_NAME2}-proxy.${buildDomain()}${normalizedPath}`;
+async function loadExtendedInfo(sageDirPath, logger = nullLogger) {
+  const sageDir = sageDirPath ?? (0, import_node_path10.join)((0, import_node_os3.homedir)(), ".sage");
+  const filePath = (0, import_node_path10.join)(sageDir, EXTENDED_INFO_FILENAME);
+  const cached = cache.get(filePath);
+  if (cached)
+    return cached.value;
+  const value = await loadExtendedInfoUncached(filePath, logger);
+  cache.set(filePath, { value });
+  return value;
 }
-var UrlCheckClient = class {
-  endpoint;
-  timeoutMs;
-  logger;
-  constructor(config, logger = nullLogger) {
-    this.endpoint = config?.endpoint ?? resolveEndpoint("/url-check");
-    this.timeoutMs = (config?.timeout_seconds ?? DEFAULT_TIMEOUT3) * 1e3;
-    this.logger = logger;
-  }
-  async checkUrls(urls) {
-    if (urls.length === 0)
-      return [];
-    const batches = [];
-    for (let i = 0; i < urls.length; i += MAX_URLS_PER_REQUEST) {
-      batches.push(urls.slice(i, i + MAX_URLS_PER_REQUEST));
+async function loadExtendedInfoUncached(filePath, logger) {
+  let size;
+  try {
+    const info = await (0, import_promises2.stat)(filePath);
+    if (!info.isFile()) {
+      logger.debug(`extended-info: not a regular file at ${filePath}`);
+      return null;
     }
-    const batchResults = await Promise.all(batches.map((batch) => this.checkBatch(batch)));
-    return batchResults.flat();
+    size = info.size;
+  } catch {
+    return null;
   }
-  async checkBatch(urls) {
-    const queries = urls.map((url) => ({ key: { "url-like": url } }));
-    const payload = {
-      queries,
-      "client-info": {
-        "product-name": SERVICE_NAME2,
-        "product-version": VERSION
-      }
-    };
-    try {
-      const response = await fetch(this.endpoint, {
-        method: "POST",
-        headers: Object.fromEntries(REQUEST_HEADERS2.map((h) => [h.name, h.value])),
-        body: JSON.stringify(payload),
-        signal: AbortSignal.timeout(this.timeoutMs)
-      });
-      if (!response.ok) {
-        this.logger.warn(`URL check HTTP error: ${response.status}`);
-        return [];
-      }
-      const data = await response.json();
-      const answers = data.answers ?? [];
-      const results = [];
-      for (const answer of answers) {
-        const result = this.parseAnswer(answer);
-        if (result !== null) {
-          results.push(result);
-        }
-      }
-      return results;
-    } catch (e) {
-      this.logger.warn("URL check request failed", { error: String(e) });
-      return [];
-    }
+  if (size > EXTENDED_INFO_FILE_MAX_BYTES) {
+    logger.debug(`extended-info: file size ${size} exceeds cap ${EXTENDED_INFO_FILE_MAX_BYTES}; ignoring`);
+    return null;
   }
-  parseAnswer(answer) {
-    try {
-      const url = answer.key ?? "";
-      const result = answer.result ?? {};
-      const success = result.success ?? {};
-      const classification = success.classification ?? {};
-      const detectionInfos = classification["detection-infos"] ?? [];
-      const classResult = classification.result ?? {};
-      const flags = success.flags ?? [];
-      const malicious = classResult.malicious;
-      const detections = detectionInfos.filter((info) => typeof info.name === "string").map((info) => {
-        return info.name;
-      });
-      const findings = malicious ? (malicious.findings ?? []).map((f) => ({
-        severityName: f["severity-name"] ?? "unknown",
-        typeName: f["type-name"] ?? "unknown"
-      })) : [];
-      return {
-        url,
-        isMalicious: Boolean(malicious),
-        detections,
-        findings,
-        flags
-      };
-    } catch (e) {
-      this.logger.warn("Failed to parse answer", { error: String(e) });
-      return null;
+  let raw;
+  try {
+    raw = await getFileContent(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    logger.debug(`extended-info: invalid JSON: ${err}`);
+    return null;
+  }
+  if (!isPlainObjectValue(parsed)) {
+    logger.debug("extended-info: top-level value is not a non-null object");
+    return null;
+  }
+  const groupCount = Object.keys(parsed).length;
+  if (groupCount > EXTENDED_INFO_MAX_GROUPS) {
+    logger.debug(`extended-info: ${groupCount} top-level groups exceed cap ${EXTENDED_INFO_MAX_GROUPS}; rejecting whole file`);
+    return null;
+  }
+  return sanitizeDocument(parsed, logger);
+}
+function mergeExtendedInfo(envelope, extendedInfo) {
+  const out = { ...envelope };
+  if (!extendedInfo)
+    return out;
+  for (const [groupKey, groupValue] of Object.entries(extendedInfo)) {
+    const existing = out[groupKey];
+    if (existing === void 0 || existing === null) {
+      out[groupKey] = { ...groupValue };
+      continue;
+    }
+    if (!isPlainObjectValue(existing)) {
+      continue;
+    }
+    const merged = { ...existing };
+    for (const [leafKey, leafValue] of Object.entries(groupValue)) {
+      const current = merged[leafKey];
+      if (current === void 0 || current === null) {
+        merged[leafKey] = leafValue;
+      }
     }
+    out[groupKey] = merged;
   }
-};
-
-// ../core/dist/index.js
-init_config();
+  return out;
+}
 
 // ../core/dist/installation-id.js
 var import_node_crypto5 = require("node:crypto");
-var import_promises2 = require("node:fs/promises");
-var import_node_path7 = require("node:path");
+var import_promises3 = require("node:fs/promises");
+var import_node_path11 = require("node:path");
 init_config();
 init_file_utils();
 async function getInstallationId(sageDirPath) {
   const sageDir = sageDirPath ?? resolvePath("~/.sage");
-  const idPath = (0, import_node_path7.join)(sageDir, "installation-id");
+  const idPath = (0, import_node_path11.join)(sageDir, "installation-id");
   let fileExists = false;
   try {
     const existing = await getFileContent(idPath, "utf-8");
@@ -15119,8 +16412,8 @@ async function getInstallationId(sageDirPath) {
   }
   try {
     const id = (0, import_node_crypto5.randomUUID)();
-    await (0, import_promises2.mkdir)(sageDir, { recursive: true, mode: 448 });
-    await (0, import_promises2.writeFile)(idPath, id, { encoding: "utf-8", mode: 384, flag: fileExists ? "w" : "wx" });
+    await (0, import_promises3.mkdir)(sageDir, { recursive: true, mode: 448 });
+    await (0, import_promises3.writeFile)(idPath, id, { encoding: "utf-8", mode: 384, flag: fileExists ? "w" : "wx" });
     return id;
   } catch (err) {
     if (err.code === "EEXIST") {
@@ -15135,146 +16428,17 @@ async function getInstallationId(sageDirPath) {
   }
 }
 
-// ../core/dist/sage-proxy.js
-function mapSageProxyOs(platform) {
-  switch (platform) {
-    case "win32":
-      return "WINDOWS";
-    case "darwin":
-      return "MACOS";
-    case "linux":
-      return "LINUX";
-    default:
-      return platform;
-  }
-}
-function mapSageProxyArchitecture(arch) {
-  return arch.toUpperCase();
-}
-function buildSageProxyEnvelope(args) {
-  return {
-    identity: { uuid: args.iid },
-    product: { version_app: args.versionApp },
-    platform: {
-      os: args.platformOs ?? mapSageProxyOs(process.platform),
-      architecture: args.platformArchitecture ?? mapSageProxyArchitecture(process.arch)
-    },
-    agent: {
-      agent_runtime: args.agentRuntime,
-      agent_runtime_version: args.agentRuntimeVersion
-    }
-  };
-}
-
 // ../core/dist/detection-telemetry.js
 init_types2();
 var MAX_EFFECTIVE_TIMEOUT_MS = 1e3;
-var DEFAULT_TIMEOUT_MS = 1e3;
-var OPENCLAW_MAP = {
-  bash: "Bash",
-  exec: "Bash",
-  web_fetch: "WebFetch",
-  write: "Write",
-  edit: "Edit",
-  read: "Read",
-  apply_patch: "ApplyPatch"
-};
-var OPENCODE_MAP = {
-  bash: "Bash",
-  webfetch: "WebFetch",
-  write: "Write",
-  edit: "Edit",
-  read: "Read",
-  glob: "Glob",
-  grep: "Grep",
-  ls: "List",
-  codesearch: "CodeSearch",
-  websearch: "WebSearch",
-  question: "Question",
-  task: "Task",
-  read_lines: "ReadLines"
-};
-var CANONICAL_SET = /* @__PURE__ */ new Set([
-  "Bash",
-  "WebFetch",
-  "Write",
-  "Edit",
-  "Read",
-  "Delete",
-  "ApplyPatch",
-  "Glob",
-  "Grep",
-  "List",
-  "CodeSearch",
-  "WebSearch",
-  "Question",
-  "Task",
-  "ReadLines",
-  "MCP",
-  "Unknown"
-]);
-function normalizeDetectionTelemetryContext(agentRuntime, toolName, toolInput) {
-  const toolType = canonicalizeToolName(agentRuntime, toolName);
-  const content = buildContent(toolType, toolInput);
-  return { toolType, content };
-}
-function canonicalizeToolName(agentRuntime, toolName) {
-  if (CANONICAL_SET.has(toolName))
-    return toolName;
-  if (agentRuntime === "openclaw") {
-    return OPENCLAW_MAP[toolName] ?? "Unknown";
-  }
-  if (agentRuntime === "opencode") {
-    return OPENCODE_MAP[toolName] ?? "Unknown";
-  }
-  return "Unknown";
-}
-function asString(v) {
-  return typeof v === "string" ? v : void 0;
-}
-function buildContent(toolType, toolInput) {
-  const content = {};
-  switch (toolType) {
-    case "Bash": {
-      const command = asString(toolInput.command);
-      if (command)
-        content.command = command;
-      break;
-    }
-    case "WebFetch": {
-      const url = asString(toolInput.url);
-      if (url)
-        content.url = url;
-      break;
-    }
-    case "Write":
-    case "Edit":
-    case "Read":
-    case "Delete": {
-      const filePath = asString(toolInput.file_path) ?? asString(toolInput.filePath) ?? asString(toolInput.path);
-      if (filePath)
-        content.file_path = filePath;
-      break;
-    }
-  }
-  const packageName = asString(toolInput.package_name);
-  if (packageName)
-    content.package_name = packageName;
-  const packageVersion = asString(toolInput.package_version);
-  if (packageVersion)
-    content.package_version = packageVersion;
-  const packageRegistry = asString(toolInput.package_registry);
-  if (packageRegistry)
-    content.package_registry = packageRegistry;
-  return content;
-}
+var DEFAULT_TIMEOUT_MS2 = 1e3;
 function resolveTimeoutMs() {
   const envVal = process.env.SAGE_COMMUNITY_IQ_TIMEOUT_SECONDS;
   if (envVal === void 0 || envVal === "")
-    return DEFAULT_TIMEOUT_MS;
+    return DEFAULT_TIMEOUT_MS2;
   const parsed = Number.parseFloat(envVal);
   if (!Number.isFinite(parsed) || parsed <= 0)
-    return DEFAULT_TIMEOUT_MS;
+    return DEFAULT_TIMEOUT_MS2;
   const ms = Math.floor(parsed * 1e3);
   return Math.min(ms, MAX_EFFECTIVE_TIMEOUT_MS);
 }
@@ -15293,7 +16457,6 @@ async function sendCommunityIqDetection(args) {
     logger.debug("Skipping detection telemetry: missing installation id");
     return;
   }
-  const { toolType, content } = normalizeDetectionTelemetryContext(args.agentRuntime, args.toolName, args.toolInput);
   const envelope = buildSageProxyEnvelope({
     iid,
     versionApp: VERSION,
@@ -15304,22 +16467,27 @@ async function sendCommunityIqDetection(args) {
     ...envelope,
     block_event: {
       hook_type: args.hookType ?? "PreToolUse",
-      tool_type: toolType,
+      // `args.toolName` is canonical (`CanonicalToolType`) — connectors
+      // canonicalize before calling `evaluateToolCall`, so no further
+      // mapping is needed here.
+      tool_type: args.toolName,
       verdict: "deny",
       user_action: "blocked",
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       ...args.signals && Object.keys(args.signals).length > 0 ? { signals: args.signals } : {},
-      content
+      content: args.content ?? {}
     },
     event_id: args.eventId,
     comment: ""
   };
+  const extendedInfo = await loadExtendedInfo(void 0, logger).catch(() => null);
+  const enriched = mergeExtendedInfo(payload, extendedInfo);
   const timeoutMs = resolveTimeoutMs();
   try {
     const response = await fetch(resolveEndpoint("/v2/detection"), {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(payload),
+      body: JSON.stringify(enriched),
       signal: AbortSignal.timeout(timeoutMs)
     });
     if (!response.ok) {
@@ -15331,6 +16499,7 @@ async function sendCommunityIqDetection(args) {
 }
 
 // ../core/dist/engine.js
+init_types2();
 var CONFIDENCE_THRESHOLD = 0.85;
 var SENSITIVITY_THRESHOLDS = {
   paranoid: 0.7,
@@ -15353,13 +16522,44 @@ var DECISION_PRIORITY = {
   ask: 1,
   deny: 2
 };
+var PI_LABEL_ONLY_SUFFIXES = /* @__PURE__ */ new Set([
+  "command",
+  "stdout",
+  "stderr",
+  "output"
+]);
+function displayContentName(contentName) {
+  const colonIdx = contentName.indexOf(":");
+  if (colonIdx === -1)
+    return contentName;
+  const rest = contentName.slice(colonIdx + 1);
+  if (PI_LABEL_ONLY_SUFFIXES.has(rest))
+    return contentName;
+  const trimmed = rest.replace(/[/\\]+$/, "");
+  const sepIdx = Math.max(trimmed.lastIndexOf("/"), trimmed.lastIndexOf("\\"));
+  const base = sepIdx === -1 ? trimmed : trimmed.slice(sepIdx + 1);
+  return base || rest;
+}
+function buildPiReason(prefix, result) {
+  return `${prefix} in ${formatPiFinding(result)}`;
+}
+function formatPiFinding(result) {
+  const where = displayContentName(result.contentName);
+  const score = `score: ${result.risk.toFixed(3)}`;
+  const snippet = result.findings[0]?.replace(/\s+/g, " ").trim();
+  if (snippet)
+    return `${where} (${score}): "${snippet}"`;
+  return `${where} (${score})`;
+}
 var DecisionEngine = class {
   threshold;
+  sensitivity;
   constructor(sensitivity = "balanced") {
     this.threshold = SENSITIVITY_THRESHOLDS[sensitivity] ?? CONFIDENCE_THRESHOLD;
+    this.sensitivity = sensitivity;
   }
   async decide(sources) {
-    const signals = this.collectSignals(sources.heuristicMatches, sources.urlCheckResults, sources.packageCheckResults, sources.amsiCheckResults);
+    const signals = this.collectSignals(sources.heuristicMatches, sources.urlCheckResults, sources.packageCheckResults, sources.amsiCheckResults, sources.piCheckResults, sources.piThresholds);
     if (signals.length === 0) {
       return this.allowVerdict();
     }
@@ -15372,7 +16572,7 @@ var DecisionEngine = class {
     const allReasons = [...new Map(signals.map((s) => [s.reason, s.reason])).values()];
     const maxConfidence = Math.max(...signals.map((s) => s.confidence));
     let decision = top.decision;
-    if (decision === "deny" && maxConfidence < this.threshold) {
+    if (decision === "deny" && maxConfidence < this.threshold && top.source !== "pi_check") {
       decision = "ask";
     }
     return {
@@ -15386,7 +16586,7 @@ var DecisionEngine = class {
       reasons: allReasons
     };
   }
-  collectSignals(heuristicMatches, urlCheckResults, packageCheckResults, amsiCheckResults) {
+  collectSignals(heuristicMatches, urlCheckResults, packageCheckResults, amsiCheckResults, piCheckResults, piThresholds) {
     const signals = [];
     for (const match of heuristicMatches) {
       signals.push({
@@ -15414,18 +16614,6 @@ var DecisionEngine = class {
           artifact: result.url
         });
       }
-      for (const flag of result.flags) {
-        signals.push({
-          decision: "ask",
-          category: "network_egress",
-          confidence: 0.75,
-          severity: "warning",
-          source: "url_check",
-          threatId: null,
-          reason: `Suspicious URL: ${flag}`,
-          artifact: result.url
-        });
-      }
     }
     if (packageCheckResults) {
       for (const pkg of packageCheckResults) {
@@ -15463,6 +16651,36 @@ var DecisionEngine = class {
         }
       }
     }
+    if (piCheckResults) {
+      const highRisk = piThresholds?.highRisk ?? DEFAULT_PI_HIGH_RISK_THRESHOLD;
+      const mediumRisk = piThresholds?.mediumRisk ?? DEFAULT_PI_MEDIUM_RISK_THRESHOLD;
+      const suppressMediumPi = this.sensitivity === "relaxed";
+      for (const result of piCheckResults) {
+        if (result.risk >= highRisk) {
+          signals.push({
+            decision: "deny",
+            category: "prompt_injection",
+            confidence: result.risk,
+            severity: "critical",
+            source: "pi_check",
+            threatId: "PROMPT_INJECTION",
+            reason: buildPiReason("Prompt injection detected", result),
+            artifact: result.contentName
+          });
+        } else if (!suppressMediumPi && result.risk >= mediumRisk) {
+          signals.push({
+            decision: "ask",
+            category: "prompt_injection",
+            confidence: result.risk,
+            severity: "warning",
+            source: "pi_check",
+            threatId: "PROMPT_INJECTION",
+            reason: buildPiReason("Suspicious content detected", result),
+            artifact: result.contentName
+          });
+        }
+      }
+    }
     return signals;
   }
   packageVerdictToSignal(pkg) {
@@ -15535,27 +16753,27 @@ init_config();
 
 // ../core/dist/exceptions.js
 var import_node_crypto6 = require("node:crypto");
-var import_node_path9 = require("node:path");
+var import_node_path13 = require("node:path");
 init_config();
 init_file_utils();
 
 // ../core/dist/trusted-domains.js
-var import_promises3 = require("node:fs/promises");
-var import_node_path8 = require("node:path");
+var import_promises4 = require("node:fs/promises");
+var import_node_path12 = require("node:path");
 var import_yaml = __toESM(require_dist(), 1);
 init_file_utils();
 init_types2();
 async function loadTrustedDomains(allowlistsDir, logger = nullLogger) {
   let files;
   try {
-    files = (await (0, import_promises3.readdir)(allowlistsDir)).filter((f) => f.endsWith(".yaml")).sort();
+    files = (await (0, import_promises4.readdir)(allowlistsDir)).filter((f) => f.endsWith(".yaml")).sort();
   } catch {
     logger.debug("Allowlists directory does not exist", { path: allowlistsDir });
     return [];
   }
   const domains = [];
   for (const filename of files) {
-    const filePath = (0, import_node_path8.join)(allowlistsDir, filename);
+    const filePath = (0, import_node_path12.join)(allowlistsDir, filename);
     let content;
     try {
       content = await getFileContent(filePath);
@@ -15623,8 +16841,8 @@ function computeRuleId(decision, match, pattern) {
   const hash = (0, import_node_crypto6.createHash)("sha256").update(`${decision}:${match}:${pattern}`).digest("hex");
   return hash.slice(0, 8);
 }
-async function loadExceptions(config, logger = nullLogger) {
-  const path = resolvePath(config.path);
+async function loadExceptions(config2, logger = nullLogger) {
+  const path = resolvePath(config2.path);
   let raw;
   try {
     raw = await getFileContent(path);
@@ -15707,8 +16925,8 @@ async function addException(artifact, reason, exceptionsPath, logger = nullLogge
   if (exceptionsPath) {
     excConfig = { path: exceptionsPath };
   } else {
-    const config = await Promise.resolve().then(() => (init_config(), config_exports)).then((m) => m.loadConfig(void 0, logger));
-    excConfig = config.exceptions;
+    const config2 = await Promise.resolve().then(() => (init_config(), config_exports)).then((m) => m.loadConfig(void 0, logger));
+    excConfig = config2.exceptions;
   }
   const pattern = `^${escapeRegexString(artifact.value)}$`;
   const rule = {
@@ -15820,7 +17038,7 @@ function matchesDomain(pattern, url) {
 function normalizePatternPath(pattern) {
   const home = getHomeDir();
   const expanded = pattern.startsWith("~/") || pattern === "~" ? `${home}${pattern.slice(1)}` : pattern;
-  return (0, import_node_path9.normalize)(expanded);
+  return (0, import_node_path13.normalize)(expanded);
 }
 function matchesPath(pattern, filePath) {
   const hasWildcard = pattern.includes("*");
@@ -15831,7 +17049,7 @@ function matchesPath(pattern, filePath) {
   const normalizedPath = normalizePatternPath(filePath);
   if (normalizedPath === normalizedPattern)
     return true;
-  if (normalizedPath.startsWith(normalizedPattern + import_node_path9.sep))
+  if (normalizedPath.startsWith(normalizedPattern + import_node_path13.sep))
     return true;
   return false;
 }
@@ -16132,12 +17350,12 @@ var PackageChecker = class {
   registryClient;
   fileCheckClient;
   logger;
-  constructor(config = {}, logger = nullLogger) {
+  constructor(config2 = {}, logger = nullLogger) {
     this.logger = logger;
-    this.registryClient = new RegistryClient({ timeout_seconds: config.registryTimeoutSeconds }, logger);
-    this.fileCheckClient = config.fileCheckEnabled !== false ? new FileCheckClient({
-      endpoint: config.fileCheckEndpoint,
-      timeout_seconds: config.fileCheckTimeoutSeconds
+    this.registryClient = new RegistryClient({ timeout_seconds: config2.registryTimeoutSeconds }, logger);
+    this.fileCheckClient = config2.fileCheckEnabled !== false ? new FileCheckClient({
+      endpoint: config2.fileCheckEndpoint,
+      timeout_seconds: config2.fileCheckTimeoutSeconds
     }, logger) : null;
   }
   async checkPackages(packages) {
@@ -16611,7 +17829,7 @@ function extractFromRequirementsTxt(content) {
 }
 
 // ../core/dist/statusline.js
-var import_node_path10 = require("node:path");
+var import_node_path14 = require("node:path");
 init_config();
 init_file_utils();
 var STATUS_PREFIX = "statusline-";
@@ -16620,7 +17838,7 @@ function sanitizeSessionId(sessionId) {
   return sessionId.replace(/[^a-zA-Z0-9-]/g, "_");
 }
 function statusFilePath(sessionId) {
-  return (0, import_node_path10.join)(resolvePath(SAGE_DIR), `${STATUS_PREFIX}${sanitizeSessionId(sessionId)}${STATUS_SUFFIX}`);
+  return (0, import_node_path14.join)(resolvePath(SAGE_DIR), `${STATUS_PREFIX}${sanitizeSessionId(sessionId)}${STATUS_SUFFIX}`);
 }
 function emptyStatus() {
   return {
@@ -16653,8 +17871,8 @@ async function updateSessionStatus(sessionId, verdict) {
 }
 
 // ../core/dist/threat-loader.js
-var import_promises4 = require("node:fs/promises");
-var import_node_path11 = require("node:path");
+var import_promises5 = require("node:fs/promises");
+var import_node_path15 = require("node:path");
 var import_yaml2 = __toESM(require_dist(), 1);
 init_file_utils();
 init_types2();
@@ -16688,13 +17906,13 @@ async function loadThreats(threatDir, logger = nullLogger) {
   const threats = [];
   let files;
   try {
-    files = (await (0, import_promises4.readdir)(threatDir)).filter((f) => f.endsWith(".yaml")).sort();
+    files = (await (0, import_promises5.readdir)(threatDir)).filter((f) => f.endsWith(".yaml")).sort();
   } catch {
     logger.warn("Threat directory does not exist or is unreadable", { path: threatDir });
     return threats;
   }
   for (const filename of files) {
-    const filePath = (0, import_node_path11.join)(threatDir, filename);
+    const filePath = (0, import_node_path15.join)(threatDir, filename);
     let content;
     try {
       content = await getFileContent(filePath);
@@ -16761,8 +17979,61 @@ async function loadThreats(threatDir, logger = nullLogger) {
   return threats;
 }
 
+// ../core/dist/tool-names.js
+var CANONICAL_TOOLS = [
+  "Bash",
+  "WebFetch",
+  "Write",
+  "Edit",
+  "Read",
+  "Delete",
+  "ApplyPatch",
+  "Glob",
+  "Grep",
+  "List",
+  "CodeSearch",
+  "WebSearch",
+  "Question",
+  "Task",
+  "ReadLines",
+  "MCP",
+  "Unknown"
+];
+var CANONICAL_SET = new Set(CANONICAL_TOOLS);
+function canonicalizeToolName(map, rawName) {
+  if (CANONICAL_SET.has(rawName))
+    return rawName;
+  return map[rawName] ?? "Unknown";
+}
+
 // ../core/dist/evaluator.js
 init_types2();
+var AMSI_CONTENT_SNIPPET_MAX = 200;
+var AMSI_CONTENT_NAME_MAX = 256;
+function scrubAmsiContentName(contentName) {
+  const colon = contentName.indexOf(":");
+  if (colon < 0)
+    return scrubHomePath(contentName);
+  const head = contentName.slice(0, colon + 1);
+  const tail = contentName.slice(colon + 1);
+  return `${head}${scrubHomePath(tail)}`;
+}
+function buildAmsiSignal(r) {
+  const detectionName = r.amsiResult >= 32768 ? "AMSI|DETECTED" : r.amsiResult >= 16384 ? "AMSI|BLOCKED_BY_ADMIN" : (
+    // Defensive: callers should filter these out via `isDetected || isBlockedByAdmin`,
+    // but if a non-detected/non-blocked result still reaches here we emit a
+    // meaningful label rather than silently dropping the entry.
+    "AMSI|UNKNOWN"
+  );
+  const contentName = safeTruncate(scrubAmsiContentName(r.contentName), AMSI_CONTENT_NAME_MAX);
+  const snippet = r.content ? safeTruncate(scrubHomePath(r.content), AMSI_CONTENT_SNIPPET_MAX) : "";
+  return {
+    detection_name: detectionName,
+    content_name: contentName,
+    amsi_result: r.amsiResult,
+    ...snippet ? { content_snippet: snippet } : {}
+  };
+}
 function allowVerdict(source = "none") {
   return {
     decision: "allow",
@@ -16777,12 +18048,12 @@ function allowVerdict(source = "none") {
 }
 async function evaluateToolCall(request, context) {
   const logger = context.logger ?? nullLogger;
-  const config = await loadConfig(context.configPath, logger).catch(() => ConfigSchema.parse({}));
-  if (request.artifacts.length === 0) {
+  const config2 = await loadConfig(context.configPath, logger).catch(() => ConfigSchema.parse({}));
+  if (request.artifacts.length === 0 && !config2.pi_check.enabled) {
     return allowVerdict("no_artifacts");
   }
   try {
-    const exceptions = await loadExceptions(config.exceptions, logger);
+    const exceptions = await loadExceptions(config2.exceptions, logger);
     const denyMatch = findDenyException(exceptions, request.artifacts);
     if (denyMatch) {
       const verdict2 = {
@@ -16798,16 +18069,33 @@ async function evaluateToolCall(request, context) {
         ]
       };
       try {
-        await logVerdict(config.logging, request.sessionId, request.toolName, request.toolInput, verdict2, false, request.conversationId, request.agentRuntime, request.hookType, void 0, void 0);
+        await logVerdict(config2.logging, {
+          sessionId: request.sessionId,
+          toolName: request.toolName,
+          toolInput: request.toolInput,
+          verdict: verdict2,
+          conversationId: request.conversationId,
+          agentRuntime: request.agentRuntime,
+          hookType: request.hookType
+        });
       } catch {
       }
       return verdict2;
     }
     try {
-      const allowlist = await loadAllowlist(config.allowlist, logger);
+      const allowlist = await loadAllowlist(config2.allowlist, logger);
       if (isAllowlisted(allowlist, request.artifacts)) {
         const allowV = allowVerdict("allowlisted");
-        await logVerdict(config.logging, request.sessionId, request.toolName, request.toolInput, allowV, true, request.conversationId, request.agentRuntime, request.hookType, void 0, void 0);
+        await logVerdict(config2.logging, {
+          sessionId: request.sessionId,
+          toolName: request.toolName,
+          toolInput: request.toolInput,
+          verdict: allowV,
+          userOverride: true,
+          conversationId: request.conversationId,
+          agentRuntime: request.agentRuntime,
+          hookType: request.hookType
+        });
         return allowV;
       }
     } catch {
@@ -16816,27 +18104,36 @@ async function evaluateToolCall(request, context) {
     if (allowMatch) {
       const allowV = allowVerdict("exception");
       try {
-        await logVerdict(config.logging, request.sessionId, request.toolName, request.toolInput, allowV, true, request.conversationId, request.agentRuntime, request.hookType, void 0, void 0);
+        await logVerdict(config2.logging, {
+          sessionId: request.sessionId,
+          toolName: request.toolName,
+          toolInput: request.toolInput,
+          verdict: allowV,
+          userOverride: true,
+          conversationId: request.conversationId,
+          agentRuntime: request.agentRuntime,
+          hookType: request.hookType
+        });
       } catch {
       }
       return allowV;
     }
   } catch {
   }
-  let cache = null;
+  let cache2 = null;
   try {
-    cache = new VerdictCache(config.cache, logger, VERSION);
-    await cache.load();
+    cache2 = new VerdictCache(config2.cache, logger, VERSION);
+    await cache2.load();
   } catch {
-    cache = null;
+    cache2 = null;
   }
   const urls = request.artifacts.filter((artifact) => artifact.type === "url").map((artifact) => artifact.value);
-  const { cachedUrlVerdicts, uncachedUrls } = partitionUrlsByCache(urls, cache);
+  const { cachedUrlVerdicts, uncachedUrls } = partitionUrlsByCache(urls, cache2);
   let heuristicMatches = [];
-  if (config.heuristics_enabled) {
+  if (config2.heuristics_enabled) {
     let threats = await loadThreats(context.threatsDir, logger);
-    if (config.disabled_threats.length > 0) {
-      const disabledSet = new Set(config.disabled_threats);
+    if (config2.disabled_threats.length > 0) {
+      const disabledSet = new Set(config2.disabled_threats);
       threats = threats.filter((t) => !disabledSet.has(t.id));
     }
     const trustedDomains = await loadTrustedDomains(context.allowlistsDir, logger);
@@ -16844,17 +18141,17 @@ async function evaluateToolCall(request, context) {
     heuristicMatches = heuristics.match(request.artifacts);
   }
   let urlCheckResults = [];
-  const urlsToCheck = cache ? uncachedUrls : urls;
-  if (urlsToCheck.length > 0 && config.url_check.enabled) {
+  const urlsToCheck = cache2 ? uncachedUrls : urls;
+  if (urlsToCheck.length > 0 && config2.url_check.enabled) {
     try {
-      const client = new UrlCheckClient(config.url_check, logger);
+      const client = new UrlCheckClient(config2.url_check, logger);
       urlCheckResults = await client.checkUrls(urlsToCheck);
     } catch {
     }
   }
-  const packageCheckResults = await checkPackages(request, config, cache, logger);
+  const packageCheckResults = await checkPackages(request, config2, cache2, logger);
   const amsiCheckResults = [];
-  if (config.amsi_check.enabled && isAmsiSupported()) {
+  if (config2.amsi_check.enabled && isAmsiSupported()) {
     let amsiClient = null;
     try {
       amsiClient = new AmsiClient(logger);
@@ -16864,23 +18161,33 @@ async function evaluateToolCall(request, context) {
         if (request.toolName === "Bash") {
           const command = request.toolInput.command ?? "";
           if (command) {
-            scans.push({ content: command, name: `Bash:command` });
+            scans.push({ scanType: "Bash", name: "command", content: command });
           }
         } else if (request.toolName === "Write") {
           const filePath = request.toolInput.file_path ?? "";
           const content = request.toolInput.content ?? "";
           if (content) {
-            scans.push({ content, name: `Write:${filePath}` });
+            scans.push({ scanType: "Write", name: filePath, content });
           }
         } else if (request.toolName === "Edit") {
           const filePath = request.toolInput.file_path ?? "";
           const newString = request.toolInput.new_string ?? "";
           if (newString) {
-            scans.push({ content: newString, name: `Edit:${filePath}` });
+            scans.push({ scanType: "Edit", name: filePath, content: newString });
+          }
+        } else if (request.toolName === "ApplyPatch") {
+          const patch = request.toolInput.input ?? request.toolInput.patch ?? "";
+          if (patch) {
+            const target = request.artifacts.find((a) => a.type === "file_path");
+            scans.push({
+              scanType: "ApplyPatch",
+              name: target?.value ?? "unknown",
+              content: patch
+            });
           }
         }
         for (const scan of scans) {
-          const result = await amsiClient.scanString(scan.content, scan.name);
+          const result = await amsiClient.scanString(scan.scanType, scan.name, scan.content);
           if (result) {
             amsiCheckResults.push(result);
           }
@@ -16891,12 +18198,50 @@ async function evaluateToolCall(request, context) {
       amsiClient?.close();
     }
   }
-  const engine = new DecisionEngine(config.sensitivity);
+  const allPiResults = [];
+  const piDenySignals = [];
+  const heuristicPiDeny = heuristicMatches.some((m) => m.threat.action === "block" && m.threat.category === "prompt_injection");
+  const heuristicDeny = heuristicMatches.some((m) => m.threat.action === "block");
+  const urlAlreadyDenied = cachedUrlVerdicts.size > 0 && [...cachedUrlVerdicts.values()].some((v) => v.verdict !== "allow");
+  const urlCheckDenied = urlCheckResults.some((r) => r.isMalicious);
+  if (config2.pi_check.enabled && !heuristicPiDeny && !heuristicDeny && !urlAlreadyDenied && !urlCheckDenied && request.toolName === "WebFetch") {
+    try {
+      const url = extractWebFetchUrl(request.toolInput);
+      if (url) {
+        const ext = getUrlExtension(url);
+        const skip = ext != null && !SCANNABLE_EXTENSIONS.has(ext);
+        if (!skip) {
+          const fetcher = new ContentFetchClient(4e3, config2.pi_check.max_content_length, logger);
+          const fetched = await fetcher.fetchTextContent(url);
+          if (fetched) {
+            const shouldScan = ext != null || isScannableContent(fetched.content);
+            if (shouldScan) {
+              const provider = createPiProvider(config2, context, logger);
+              const result = await provider.checkContent(fetched.content, `WebFetch:${url}`);
+              if (result) {
+                allPiResults.push(result);
+                if (result.risk >= config2.pi_check.high_risk_threshold) {
+                  piDenySignals.push(result);
+                }
+              }
+            }
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  const engine = new DecisionEngine(config2.sensitivity);
   let verdict = await engine.decide({
     heuristicMatches,
     urlCheckResults,
     packageCheckResults: packageCheckResults.length > 0 ? packageCheckResults : void 0,
-    amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0
+    amsiCheckResults: amsiCheckResults.length > 0 ? amsiCheckResults : void 0,
+    piCheckResults: piDenySignals.length > 0 ? piDenySignals : void 0,
+    piThresholds: {
+      highRisk: config2.pi_check.high_risk_threshold,
+      mediumRisk: config2.pi_check.medium_risk_threshold
+    }
   });
   if (cachedUrlVerdicts.size > 0 && verdict.decision === "allow") {
     for (const [url, cachedVerdict] of cachedUrlVerdicts) {
@@ -16916,7 +18261,7 @@ async function evaluateToolCall(request, context) {
       break;
     }
   }
-  await cacheUrlResults(urlCheckResults, cache);
+  await cacheUrlResults(urlCheckResults, cache2);
   function formatPackageDetectionName(p) {
     const base = `PKG|${p.verdict}|registry=${p.registry}|name=${p.packageName}`;
     if (p.verdict === "suspicious_age") {
@@ -16937,7 +18282,7 @@ async function evaluateToolCall(request, context) {
     }));
   }
   if (urlCheckResults.length > 0) {
-    const relevant = urlCheckResults.filter((r) => r.isMalicious || r.flags.length > 0);
+    const relevant = urlCheckResults.filter((r) => r.isMalicious);
     if (relevant.length > 0) {
       auditSignals.url_checks = relevant.flatMap((r) => {
         return r.detections.map((d) => ({
@@ -16947,6 +18292,20 @@ async function evaluateToolCall(request, context) {
       });
     }
   }
+  if (cachedUrlVerdicts.size > 0) {
+    for (const [url, cachedEntry] of cachedUrlVerdicts) {
+      if (cachedEntry.verdict !== "deny")
+        continue;
+      const labels = cachedEntry.urlSignalLabels ?? [];
+      if (labels.length === 0)
+        continue;
+      auditSignals.url_checks ??= [];
+      auditSignals.url_checks.push(...labels.map((label) => ({
+        detection_name: label,
+        url
+      })));
+    }
+  }
   if (packageCheckResults.length > 0) {
     const relevant = packageCheckResults.filter((p) => p.verdict !== "clean");
     if (relevant.length > 0) {
@@ -16965,10 +18324,39 @@ async function evaluateToolCall(request, context) {
       }));
     }
   }
+  if (allPiResults.length > 0) {
+    const piSnippetFloor = config2.pi_check.medium_risk_threshold;
+    auditSignals.pi_checks = allPiResults.map((r) => ({
+      risk: r.risk,
+      model_id: r.modelId,
+      content_name: r.contentName,
+      ...r.contentSnippet && r.risk >= piSnippetFloor ? { content_snippet: scrubHomePath(r.contentSnippet) } : {}
+    }));
+  }
+  if (amsiCheckResults.length > 0) {
+    const relevantAmsi = amsiCheckResults.filter((r) => r.isDetected || r.isBlockedByAdmin);
+    if (relevantAmsi.length > 0) {
+      auditSignals.amsi_checks = relevantAmsi.map((r) => buildAmsiSignal(r));
+    }
+  }
   const eventId = (0, import_node_crypto7.randomUUID)();
   const resolvedSignals = Object.keys(auditSignals).length > 0 ? auditSignals : void 0;
+  const builtContent = buildContentSnapshot(request.toolName, request.toolInput, request.artifacts, auditSignals);
+  const resolvedContent = Object.keys(builtContent).length > 0 ? builtContent : void 0;
   try {
-    await logVerdict(config.logging, request.sessionId, request.toolName, request.toolInput, verdict, false, request.conversationId, request.agentRuntime, request.hookType, resolvedSignals, eventId);
+    await logVerdict(config2.logging, {
+      sessionId: request.sessionId,
+      toolName: request.toolName,
+      toolInput: request.toolInput,
+      verdict,
+      conversationId: request.conversationId,
+      agentRuntime: request.agentRuntime,
+      hookType: request.hookType,
+      signals: resolvedSignals,
+      content: resolvedContent,
+      eventId,
+      toolUseId: request.toolUseId
+    });
   } catch {
   }
   if (verdict.decision === "deny") {
@@ -16976,11 +18364,12 @@ async function evaluateToolCall(request, context) {
       await sendCommunityIqDetection({
         eventId,
         agentRuntime: request.agentRuntime,
+        agentRuntimeVersion: request.agentRuntimeVersion,
         hookType: request.hookType,
         toolName: request.toolName,
-        toolInput: request.toolInput,
+        content: resolvedContent,
         signals: resolvedSignals,
-        communityIqEnabled: config.community_iq,
+        communityIqEnabled: config2.community_iq,
         logger
       });
     } catch {
@@ -16992,15 +18381,18 @@ async function evaluateToolCall(request, context) {
     } catch {
     }
   }
+  const piWarnings = allPiResults.filter((r) => r.risk >= config2.pi_check.medium_risk_threshold && r.risk < config2.pi_check.high_risk_threshold);
+  if (piWarnings.length > 0 && config2.sensitivity !== "relaxed")
+    verdict.piWarnings = piWarnings;
   return verdict;
 }
-function partitionUrlsByCache(urls, cache) {
+function partitionUrlsByCache(urls, cache2) {
   const cachedUrlVerdicts = /* @__PURE__ */ new Map();
   let uncachedUrls = [];
-  if (cache && urls.length > 0) {
+  if (cache2 && urls.length > 0) {
     try {
       for (const url of urls) {
-        const cached = cache.getUrl(url);
+        const cached = cache2.getUrl(url);
         if (cached !== null) {
           cachedUrlVerdicts.set(url, cached);
         } else {
@@ -17013,8 +18405,8 @@ function partitionUrlsByCache(urls, cache) {
   }
   return { cachedUrlVerdicts, uncachedUrls };
 }
-async function cacheUrlResults(urlCheckResults, cache) {
-  if (!cache)
+async function cacheUrlResults(urlCheckResults, cache2) {
+  if (!cache2)
     return;
   try {
     for (const result of urlCheckResults) {
@@ -17026,14 +18418,10 @@ async function cacheUrlResults(urlCheckResults, cache) {
           reasons: [
             `URL check: malicious (${result.findings.map((finding) => `${finding.severityName}/${finding.typeName}`).join(", ")})`
           ],
-          source: "url_check"
-        };
-      } else if (result.flags.length > 0) {
-        cachedVerdict = {
-          verdict: "ask",
-          severity: "warning",
-          reasons: [`URL check: suspicious (${result.flags.join(", ")})`],
-          source: "url_check"
+          source: "url_check",
+          // Always populated for malicious URLs (possibly empty array). Locked in by
+          // evaluator.test.ts so a future refactor cannot silently drop the labels.
+          urlSignalLabels: result.detections
         };
       } else {
         cachedVerdict = {
@@ -17043,15 +18431,15 @@ async function cacheUrlResults(urlCheckResults, cache) {
           source: "url_check"
         };
       }
-      cache.putUrl(result.url, cachedVerdict, result.isMalicious);
+      cache2.putUrl(result.url, cachedVerdict, result.isMalicious);
     }
-    await cache.save();
+    await cache2.save();
   } catch {
   }
 }
-async function checkPackages(request, config, cache, logger) {
+async function checkPackages(request, config2, cache2, logger) {
   const results = [];
-  if (!config.package_check.enabled)
+  if (!config2.package_check.enabled)
     return results;
   try {
     let parsedPackages;
@@ -17068,7 +18456,7 @@ async function checkPackages(request, config, cache, logger) {
     const uncached = [];
     for (const pkg of parsedPackages) {
       const cacheKey2 = `${pkg.registry}:${pkg.name}${pkg.version ? `@${pkg.version}` : ""}`;
-      const cached = cache?.getPackage(cacheKey2);
+      const cached = cache2?.getPackage(cacheKey2);
       if (cached && cached.verdict !== "allow") {
         results.push({
           packageName: pkg.name,
@@ -17083,19 +18471,19 @@ async function checkPackages(request, config, cache, logger) {
     }
     if (uncached.length > 0) {
       const checker = new PackageChecker({
-        registryTimeoutSeconds: config.package_check.timeout_seconds,
-        fileCheckEndpoint: config.file_check.endpoint,
-        fileCheckTimeoutSeconds: config.file_check.timeout_seconds,
-        fileCheckEnabled: config.file_check.enabled
+        registryTimeoutSeconds: config2.package_check.timeout_seconds,
+        fileCheckEndpoint: config2.file_check.endpoint,
+        fileCheckTimeoutSeconds: config2.file_check.timeout_seconds,
+        fileCheckEnabled: config2.file_check.enabled
       }, logger);
       const checked = await checker.checkPackages(uncached);
       results.push(...checked);
-      if (cache) {
+      if (cache2) {
         for (const result of checked) {
           const pkg = uncached.find((p) => p.name === result.packageName);
           const cacheKey2 = `${result.registry}:${result.packageName}${pkg?.version ? `@${pkg.version}` : ""}`;
           const isCritical = result.verdict === "malicious" || result.verdict === "not_found";
-          cache.putPackage(cacheKey2, {
+          cache2.putPackage(cacheKey2, {
             verdict: result.verdict === "clean" ? "allow" : isCritical ? "deny" : "ask",
             severity: isCritical ? "critical" : "warning",
             reasons: [result.details],
@@ -17108,6 +18496,14 @@ async function checkPackages(request, config, cache, logger) {
   }
   return results;
 }
+function createPiProvider(config2, _context, logger) {
+  return new BundledPiProvider({
+    modelPath: config2.pi_check.model_path,
+    maxContentLength: config2.pi_check.max_content_length,
+    mediumRiskThreshold: config2.pi_check.medium_risk_threshold,
+    logger
+  });
+}
 
 // ../core/dist/index.js
 init_file_utils();
@@ -17133,15 +18529,35 @@ function formatUpdateNotice(result) {
   return `\u2B06\uFE0F  Update available: v${result.currentVersion} \u2192 v${result.latestVersion} (https://github.com/gendigitalinc/sage)`;
 }
 function formatStartupClean(version, versionCheck, branding2 = defaultBranding) {
-  const base = `\u{1F6E1}\uFE0F ${branding2.banner_text} v${version} \u2705 No threats found`;
+  const base = `\u{1F6E1}\uFE0F ${branding2.name} v${version} \u2705 No threats found`;
   if (versionCheck?.updateAvailable) {
     return `${base}
 ${formatUpdateNotice(versionCheck)}`;
   }
   return base;
 }
-function formatThreatBanner(version, results, versionCheck, branding2 = defaultBranding) {
-  const header = `\u{1F6E1}\uFE0F ${branding2.banner_text} v${version} \u2014 Threat Detected`;
+function totalHighCrit(results) {
+  let n = 0;
+  for (const r of results) {
+    for (const f of r.findings) {
+      if (f.severity === "critical" || f.severity === "high")
+        n++;
+    }
+  }
+  return n;
+}
+function findFirstHighCrit(results) {
+  for (const r of results) {
+    for (const f of r.findings) {
+      if (f.severity === "critical" || f.severity === "high") {
+        return { plugin: r.plugin, finding: f };
+      }
+    }
+  }
+  return null;
+}
+function formatThreatBannerVerbose(version, results, versionCheck, branding2) {
+  const header = `\u{1F6E1}\uFE0F ${branding2.name} v${version} \u2014 Threat Detected`;
   const lines = [" ", header, separatorLine(SEPARATOR_WIDTH)];
   const MAX_FINDINGS = 5;
   let first = true;
@@ -17163,6 +18579,12 @@ function formatThreatBanner(version, results, versionCheck, branding2 = defaultB
       lines.push(kv("Source", f.sourceFile));
       const actionLabel = f.action === "block" ? "Blocked" : "Flagged";
       lines.push(kv("Action", actionLabel));
+      if (f.recommendations && f.recommendations.length > 0) {
+        lines.push(kv("Recommendations", ""));
+        for (const rec of f.recommendations) {
+          lines.push(`   ${" ".repeat(PAD)}- ${rec}`);
+        }
+      }
     }
     const overflow = highCrit.length - MAX_FINDINGS;
     if (overflow > 0) {
@@ -17176,9 +18598,36 @@ function formatThreatBanner(version, results, versionCheck, branding2 = defaultB
   }
   return lines.join("\n");
 }
-function formatSessionStartMessage(version, result, branding2 = defaultBranding) {
+function formatThreatBannerCompact(version, results, versionCheck, branding2) {
+  const total = totalHighCrit(results);
+  const first = findFirstHighCrit(results);
+  if (!first || total === 0) {
+    return formatStartupClean(version, versionCheck, branding2);
+  }
+  const emoji = severityEmoji(first.finding.severity);
+  const lines = [
+    `\u{1F6E1}\uFE0F ${branding2.name} v${version} \u2014 Threat Detected in ${first.plugin.key}`,
+    `${emoji} ${first.finding.title} (${first.finding.severity.toUpperCase()})`,
+    first.finding.sourceFile
+  ];
+  const remaining = total - 1;
+  if (remaining > 0) {
+    lines.push(`\u2026and ${remaining} more finding${remaining === 1 ? "" : "s"}`);
+  }
+  if (versionCheck?.updateAvailable) {
+    lines.push(formatUpdateNotice(versionCheck));
+  }
+  return lines.join("\n");
+}
+function formatThreatBanner(version, results, versionCheck, branding2 = defaultBranding, style = "verbose") {
+  if (style === "compact") {
+    return formatThreatBannerCompact(version, results, versionCheck, branding2);
+  }
+  return formatThreatBannerVerbose(version, results, versionCheck, branding2);
+}
+function formatSessionStartMessage(version, result, branding2 = defaultBranding, style = "verbose") {
   if (result.scanResults.length > 0) {
-    return formatThreatBanner(version, result.scanResults, result.versionCheck, branding2);
+    return formatThreatBanner(version, result.scanResults, result.versionCheck, branding2, style);
   }
   return formatStartupClean(version, result.versionCheck, branding2);
 }
@@ -17196,8 +18645,8 @@ async function guardToolCall(request, context, approvalStore) {
     return { verdict };
   }
   const logger = context.logger ?? nullLogger;
-  const config = await loadConfig(context.configPath, logger);
-  if (config.sensitivity === "paranoid") {
+  const config2 = await loadConfig(context.configPath, logger);
+  if (config2.sensitivity === "paranoid") {
     return { verdict: { ...verdict, decision: "deny" } };
   }
   approvalStore.setPending(actionId, {
@@ -17221,7 +18670,7 @@ function summarizeArtifacts(artifacts) {
 function formatDenyMessage(verdict, branding2 = defaultBranding) {
   const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 5).join("; ") : verdict.category;
   return [
-    `${branding2.product_name} blocked this action.`,
+    `${branding2.name} blocked this action.`,
     `Severity: ${verdict.severity}`,
     `Category: ${verdict.category}`,
     `Reason: ${reasons}`
@@ -17231,13 +18680,16 @@ function formatDenyMessage(verdict, branding2 = defaultBranding) {
 // ../core/dist/marketplace-migration.js
 init_config();
 
+// ../core/dist/model-download.js
+init_types2();
+
 // ../core/dist/plugin-scan-cache.js
 var import_node_crypto8 = require("node:crypto");
-var import_promises5 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
+var import_promises6 = require("node:fs/promises");
+var import_node_path16 = require("node:path");
 init_file_utils();
 init_types2();
-var DEFAULT_CACHE_PATH = (0, import_node_path12.join)(getHomeDir(), ".sage", "plugin_scan_cache.json");
+var DEFAULT_CACHE_PATH = (0, import_node_path16.join)(getHomeDir(), ".sage", "plugin_scan_cache.json");
 var CACHE_TTL_DAYS = 7;
 function cacheKey(pluginKey, version, lastUpdated) {
   return `${pluginKey}:${version}:${lastUpdated}`;
@@ -17249,13 +18701,13 @@ async function computeConfigHash(sageVersion, ...dirs) {
   for (const dir of dirs) {
     let files;
     try {
-      files = (await (0, import_promises5.readdir)(dir)).filter((f) => f.endsWith(".yaml")).sort();
+      files = (await (0, import_promises6.readdir)(dir)).filter((f) => f.endsWith(".yaml")).sort();
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const content = await getFileContent((0, import_node_path12.join)(dir, file));
+        const content = await getFileContent((0, import_node_path16.join)(dir, file));
         h.update(content);
       } catch {
       }
@@ -17296,11 +18748,11 @@ async function loadScanCache(configHash = "", cachePath = DEFAULT_CACHE_PATH, lo
     return { configHash, entries: {} };
   }
 }
-async function saveScanCache(cache, cachePath = DEFAULT_CACHE_PATH, logger = nullLogger) {
+async function saveScanCache(cache2, cachePath = DEFAULT_CACHE_PATH, logger = nullLogger) {
   try {
     const data = {
-      config_hash: cache.configHash,
-      entries: Object.fromEntries(Object.entries(cache.entries).map(([key, entry]) => [
+      config_hash: cache2.configHash,
+      entries: Object.fromEntries(Object.entries(cache2.entries).map(([key, entry]) => [
         key,
         {
           plugin_key: entry.pluginKey,
@@ -17315,9 +18767,9 @@ async function saveScanCache(cache, cachePath = DEFAULT_CACHE_PATH, logger = nul
     logger.warn(`Failed to save scan cache to ${cachePath}`, { error: String(e) });
   }
 }
-function isCached(cache, pluginKey, version, lastUpdated) {
+function isCached(cache2, pluginKey, version, lastUpdated) {
   const key = cacheKey(pluginKey, version, lastUpdated);
-  const entry = cache.entries[key];
+  const entry = cache2.entries[key];
   if (!entry)
     return false;
   try {
@@ -17328,15 +18780,15 @@ function isCached(cache, pluginKey, version, lastUpdated) {
     return false;
   }
 }
-function getCached(cache, pluginKey, version, lastUpdated) {
-  if (!isCached(cache, pluginKey, version, lastUpdated))
+function getCached(cache2, pluginKey, version, lastUpdated) {
+  if (!isCached(cache2, pluginKey, version, lastUpdated))
     return null;
   const key = cacheKey(pluginKey, version, lastUpdated);
-  return cache.entries[key] ?? null;
+  return cache2.entries[key] ?? null;
 }
-function storeResult(cache, pluginKey, version, lastUpdated, findings) {
+function storeResult(cache2, pluginKey, version, lastUpdated, findings) {
   const key = cacheKey(pluginKey, version, lastUpdated);
-  cache.entries[key] = {
+  cache2.entries[key] = {
     pluginKey,
     version,
     scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -17345,13 +18797,179 @@ function storeResult(cache, pluginKey, version, lastUpdated, findings) {
 }
 
 // ../core/dist/plugin-scanner.js
-var import_node_crypto9 = require("node:crypto");
-var import_promises6 = require("node:fs/promises");
-var import_node_path13 = require("node:path");
+var import_node_crypto10 = require("node:crypto");
+var import_promises8 = require("node:fs/promises");
+var import_node_path18 = require("node:path");
 init_file_utils();
+
+// ../core/dist/skill-id.js
+var import_node_crypto9 = require("node:crypto");
+var import_promises7 = require("node:fs/promises");
+var import_node_path17 = require("node:path");
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "__pycache__"]);
+function isContained(childReal, rootReal) {
+  return childReal === rootReal || childReal.startsWith(`${rootReal}${import_node_path17.sep}`);
+}
+function normalizePath(p) {
+  let out = p.replace(/\\/g, "/").normalize("NFC");
+  out = out.split("/").filter((c) => c !== "" && c !== ".").join("/");
+  while (out.startsWith("./") || out.startsWith("/")) {
+    out = out.startsWith("./") ? out.slice(2) : out.slice(1);
+  }
+  return out;
+}
+async function entriesFromDirectory(dirPath) {
+  const absDir = (0, import_node_path17.resolve)(dirPath);
+  const rootReal = await (0, import_promises7.realpath)(absDir);
+  const entries = [];
+  const visited = /* @__PURE__ */ new Set();
+  async function walk(currentPath) {
+    const real = await (0, import_promises7.realpath)(currentPath);
+    if (visited.has(real))
+      return;
+    if (!isContained(real, rootReal))
+      return;
+    visited.add(real);
+    const items = await (0, import_promises7.readdir)(currentPath);
+    const dirs = [];
+    const files = [];
+    for (const item of items) {
+      const fullPath = (0, import_node_path17.join)(currentPath, item);
+      const st = await (0, import_promises7.stat)(fullPath);
+      if (st.isDirectory())
+        dirs.push(item);
+      else if (st.isFile())
+        files.push(item);
+    }
+    dirs.sort();
+    files.sort();
+    for (const d of dirs) {
+      const fullPath = (0, import_node_path17.join)(currentPath, d);
+      const relPath = (0, import_node_path17.relative)(absDir, fullPath).replace(/\\/g, "/");
+      entries.push({ entryPath: relPath, isDir: true, content: Buffer.alloc(0) });
+      await walk(fullPath);
+    }
+    for (const f of files) {
+      const fullPath = (0, import_node_path17.join)(currentPath, f);
+      const fileReal = await (0, import_promises7.realpath)(fullPath);
+      if (!isContained(fileReal, rootReal))
+        continue;
+      const relPath = (0, import_node_path17.relative)(absDir, fullPath).replace(/\\/g, "/");
+      entries.push({
+        entryPath: relPath,
+        isDir: false,
+        content: await (0, import_promises7.readFile)(fullPath)
+      });
+    }
+  }
+  await walk(absDir);
+  return entries;
+}
+function computeSkillId(entries) {
+  let normalized = entries.map((e) => ({ ...e, entryPath: normalizePath(e.entryPath) })).filter((e) => e.entryPath !== "");
+  if (normalized.length > 0) {
+    const topLevel = new Set(normalized.map((e) => e.entryPath.split("/")[0]));
+    if (topLevel.size === 1) {
+      const prefix = `${[...topLevel][0]}/`;
+      normalized = normalized.map((e) => ({
+        ...e,
+        entryPath: e.entryPath.startsWith(prefix) ? e.entryPath.slice(prefix.length) : e.entryPath
+      })).filter((e) => e.entryPath !== "");
+    }
+  }
+  normalized = normalized.filter((e) => e.entryPath !== "skill.sig");
+  const fileHashes = {};
+  const treeEntries = [];
+  for (const e of normalized) {
+    const contentHash = (0, import_node_crypto9.createHash)("sha256").update(e.isDir ? Buffer.alloc(0) : e.content).digest("hex");
+    const entryType = e.isDir ? "dir" : "file";
+    treeEntries.push({ type: entryType, entryPath: e.entryPath, hash: contentHash });
+    if (!e.isDir)
+      fileHashes[e.entryPath] = contentHash;
+  }
+  treeEntries.sort((a, b) => a.entryPath < b.entryPath ? -1 : a.entryPath > b.entryPath ? 1 : 0);
+  const skillHasher = (0, import_node_crypto9.createHash)("sha256");
+  for (const e of treeEntries) {
+    skillHasher.update(Buffer.from(`${e.type}\0${e.entryPath}\0${e.hash}
+`, "utf8"));
+  }
+  return { skillId: skillHasher.digest("hex"), fileHashes };
+}
+async function findSkillPackages(rootDir) {
+  const found = [];
+  let rootReal;
+  try {
+    const rootStat = await (0, import_promises7.stat)(rootDir);
+    if (!rootStat.isDirectory())
+      return found;
+    rootReal = await (0, import_promises7.realpath)((0, import_node_path17.resolve)(rootDir));
+  } catch {
+    return found;
+  }
+  const visited = /* @__PURE__ */ new Set();
+  async function walk(dir) {
+    let real;
+    try {
+      real = await (0, import_promises7.realpath)(dir);
+    } catch {
+      return;
+    }
+    if (visited.has(real))
+      return;
+    if (!isContained(real, rootReal))
+      return;
+    visited.add(real);
+    let items;
+    try {
+      items = await (0, import_promises7.readdir)(dir);
+    } catch {
+      return;
+    }
+    items.sort();
+    if (items.includes("SKILL.md")) {
+      try {
+        const st = await (0, import_promises7.stat)((0, import_node_path17.join)(dir, "SKILL.md"));
+        if (st.isFile())
+          found.push(dir);
+      } catch {
+      }
+    }
+    for (const item of items) {
+      if (SKIP_DIRS.has(item))
+        continue;
+      const fullPath = (0, import_node_path17.join)(dir, item);
+      let st;
+      try {
+        st = await (0, import_promises7.stat)(fullPath);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        await walk(fullPath);
+      }
+    }
+  }
+  await walk((0, import_node_path17.resolve)(rootDir));
+  return found;
+}
+async function computeSkillIdsForRoot(rootDir) {
+  const folders = await findSkillPackages(rootDir);
+  const out = [];
+  for (const folder of folders) {
+    try {
+      const entries = await entriesFromDirectory(folder);
+      const { skillId } = computeSkillId(entries);
+      out.push({ folder, skillId });
+    } catch {
+    }
+  }
+  return out;
+}
+
+// ../core/dist/plugin-scanner.js
 init_types2();
-var DEFAULT_PLUGINS_REGISTRY = (0, import_node_path13.join)(getHomeDir(), ".claude", "plugins", "installed_plugins.json");
-var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+var DEFAULT_PLUGINS_REGISTRY = (0, import_node_path18.join)(getHomeDir(), ".claude", "plugins", "installed_plugins.json");
+var SCANNABLE_EXTENSIONS2 = /* @__PURE__ */ new Set([
   ".py",
   ".js",
   ".ts",
@@ -17370,19 +18988,18 @@ var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".ini",
   ".conf"
 ]);
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "__pycache__"]);
 var MAX_FILE_SIZE = 512 * 1024;
 async function walkPluginFiles(installPath, logger) {
   const files = [];
   async function walk(dirOrFile) {
     let stats;
     try {
-      stats = await (0, import_promises6.stat)(dirOrFile);
+      stats = await (0, import_promises8.stat)(dirOrFile);
     } catch {
       return;
     }
     if (stats.isFile()) {
-      if (SCANNABLE_EXTENSIONS.has((0, import_node_path13.extname)(dirOrFile).toLowerCase()) && stats.size <= MAX_FILE_SIZE) {
+      if (SCANNABLE_EXTENSIONS2.has((0, import_node_path18.extname)(dirOrFile).toLowerCase()) && stats.size <= MAX_FILE_SIZE) {
         files.push(dirOrFile);
       }
       return;
@@ -17390,14 +19007,14 @@ async function walkPluginFiles(installPath, logger) {
     if (stats.isDirectory()) {
       let entries;
       try {
-        entries = await (0, import_promises6.readdir)(dirOrFile);
+        entries = await (0, import_promises8.readdir)(dirOrFile);
       } catch {
         return;
       }
       for (const entry of entries) {
         if (SKIP_DIRS.has(entry))
           continue;
-        const fullPath = (0, import_node_path13.join)(dirOrFile, entry);
+        const fullPath = (0, import_node_path18.join)(dirOrFile, entry);
         await walk(fullPath);
       }
     }
@@ -17409,122 +19026,15 @@ async function walkPluginFiles(installPath, logger) {
   }
   return files;
 }
-function isHarmlessEcho(line) {
-  if (!/^(echo|printf)\b/.test(line))
-    return false;
-  const withoutQuotes = line.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, "");
-  return !withoutQuotes.includes("|");
-}
-var JS_TS_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".ts", ".mjs", ".mts"]);
-var STRING_OR_COMMENT_RE = /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`|\/\/.*$|\/\*[\s\S]*?\*\//gm;
-function stripJsComments(src) {
-  return src.replace(STRING_OR_COMMENT_RE, (match) => {
-    if (match.startsWith("//") || match.startsWith("/*"))
-      return "";
-    return match;
-  });
-}
-var STR_ARG = `(?:"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'|\`([^\`]*)\`)`;
-var JS_EXEC_RE = new RegExp(`\\bexec(?:File)?(?:Sync)?\\s*\\(\\s*${STR_ARG}`, "g");
-var JS_SPAWN_RE = new RegExp(`\\bspawn(?:Sync)?\\s*\\(\\s*${STR_ARG}`, "g");
-var JS_SPAWN_ARGS_RE = /\bspawn(?:Sync)?\s*\(\s*(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'|`([^`]*)`)\s*,\s*\[([^\]]*)\]/g;
-var SHELL_EXECUTABLES = /* @__PURE__ */ new Set([
-  "bash",
-  "sh",
-  "zsh",
-  "dash",
-  "ksh",
-  "csh",
-  "fish",
-  "cmd",
-  "cmd.exe",
-  "powershell",
-  "powershell.exe",
-  "pwsh"
-]);
-function isShellExecutable(exe) {
-  const basename = exe.split("/").pop()?.split("\\").pop() ?? exe;
-  return SHELL_EXECUTABLES.has(basename);
-}
-var JS_EXECA_RE = new RegExp(`\\bexeca\\s*\\(\\s*${STR_ARG}`, "g");
-var JS_EXECA_ARGS_RE = /\bexeca\s*\(\s*(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'|`([^`]*)`)\s*,\s*\[([^\]]*)\]/g;
-var JS_BUN_SHELL_RE = new RegExp(`\\bBun\\.shell\\s*\\(\\s*${STR_ARG}`, "g");
-var JS_BUN_DOLLAR_RE = /\bBun\.\$`([^`]+)`/g;
-var JS_ZX_RE = /(?<!\w)\$`([^`]+)`/g;
-function extractCommandsFromJsTs(content, fileName) {
-  const commands = /* @__PURE__ */ new Set();
-  const stripped = stripJsComments(content);
-  const collapsed = stripped.replace(/\n/g, " ");
-  function addMatch(m) {
-    const val = m[1] ?? m[2] ?? m[3];
-    if (val)
-      commands.add(val.trim());
-  }
-  for (const re of [JS_EXEC_RE, JS_SPAWN_RE, JS_EXECA_RE, JS_BUN_SHELL_RE]) {
-    for (const m of collapsed.matchAll(re)) {
-      addMatch(m);
-    }
-  }
-  for (const re of [JS_BUN_DOLLAR_RE, JS_ZX_RE]) {
-    for (const m of collapsed.matchAll(re)) {
-      if (m[1])
-        commands.add(m[1].trim());
-    }
-  }
-  for (const re of [JS_SPAWN_ARGS_RE, JS_EXECA_ARGS_RE]) {
-    for (const arrMatch of collapsed.matchAll(re)) {
-      const exe = (arrMatch[1] ?? arrMatch[2] ?? arrMatch[3] ?? "").trim();
-      if (!isShellExecutable(exe))
-        continue;
-      const arrayContent = arrMatch[4] ?? "";
-      const strLitRe = new RegExp(STR_ARG, "g");
-      for (const strMatch of arrayContent.matchAll(strLitRe)) {
-        const val = strMatch[1] ?? strMatch[2] ?? strMatch[3];
-        if (val)
-          commands.add(val.trim());
-      }
-    }
-  }
-  return [...commands].map((value) => ({
-    type: "command",
-    value,
-    context: `plugin_file:${fileName}`
-  }));
-}
-function extractArtifactsFromFile(filePath, content) {
-  const artifacts = [];
-  const fileName = filePath.split("/").pop() ?? filePath;
-  for (const url of extractUrls(content)) {
-    if (url.includes("://127.0.0.1") || url.includes("://localhost"))
-      continue;
-    artifacts.push({ type: "url", value: url, context: `plugin_file:${fileName}` });
-  }
-  const ext = (0, import_node_path13.extname)(filePath).toLowerCase();
-  if ([".sh", ".bash", ".zsh", ".py"].includes(ext)) {
-    for (const line of content.split("\n")) {
-      const trimmed = line.trim();
-      if (trimmed && !trimmed.startsWith("#") && !trimmed.startsWith("//") && !isHarmlessEcho(trimmed)) {
-        artifacts.push({
-          type: "command",
-          value: trimmed,
-          context: `plugin_file:${fileName}`
-        });
-      }
-    }
-  }
-  if (JS_TS_EXTENSIONS.has(ext)) {
-    artifacts.push(...extractCommandsFromJsTs(content, fileName));
-  }
-  return artifacts;
-}
-async function scanPlugin(plugin, threats, options = {}) {
-  const { checkUrls = true, checkFileHashes = true, trustedDomains, logger = nullLogger } = options;
+async function scanPlugin(plugin, options = {}) {
+  const { checkUrls = true, checkFileHashes = true, checkSkills = true, amsiClient = null, logger = nullLogger } = options;
   const result = { plugin, findings: [] };
+  const skillCheckPromise = checkSkills ? runSkillCheck(plugin, result.findings, logger) : Promise.resolve();
   const files = await walkPluginFiles(plugin.installPath, logger);
-  if (files.length === 0)
+  if (files.length === 0) {
+    await skillCheckPromise;
     return result;
-  const commandThreats = threats.filter((t) => t.matchOn.has("command"));
-  const heuristics = new HeuristicsEngine(commandThreats, trustedDomains);
+  }
   const allUrls = [];
   const hashToFiles = /* @__PURE__ */ new Map();
   for (const filePath of files) {
@@ -17536,26 +19046,29 @@ async function scanPlugin(plugin, threats, options = {}) {
     } catch {
       continue;
     }
-    const artifacts = extractArtifactsFromFile(filePath, content);
-    if (artifacts.length > 0) {
-      const matches = heuristics.match(artifacts);
-      for (const match of matches) {
-        result.findings.push({
-          threatId: match.threat.id,
-          title: match.threat.title,
-          severity: match.threat.severity,
-          confidence: match.threat.confidence,
-          action: match.threat.action,
-          artifact: match.artifact.slice(0, 200),
-          sourceFile: (0, import_node_path13.relative)(plugin.installPath, filePath)
-        });
+    if (amsiClient) {
+      try {
+        const scanName = `${plugin.key}/${(0, import_node_path18.relative)(plugin.installPath, filePath)}`;
+        const amsiResult = await amsiClient.scanString("Plugin", scanName, content);
+        if (amsiResult && (amsiResult.isDetected || amsiResult.isBlockedByAdmin)) {
+          result.findings.push({
+            threatId: "AMSI_SCAN",
+            title: `AMSI detection (result=${amsiResult.amsiResult})`,
+            severity: "critical",
+            confidence: 1,
+            action: "block",
+            artifact: content.slice(0, 200),
+            sourceFile: (0, import_node_path18.relative)(plugin.installPath, filePath)
+          });
+        }
+      } catch {
       }
     }
     if (checkUrls) {
       allUrls.push(...extractUrls(content));
     }
     if (checkFileHashes) {
-      const sha256 = (0, import_node_crypto9.createHash)("sha256").update(rawBytes).digest("hex");
+      const sha256 = (0, import_node_crypto10.createHash)("sha256").update(rawBytes).digest("hex");
       const existing = hashToFiles.get(sha256);
       if (existing) {
         existing.push(filePath);
@@ -17602,7 +19115,7 @@ async function scanPlugin(plugin, threats, options = {}) {
               confidence: 1,
               action: "block",
               artifact: fr.sha256,
-              sourceFile: (0, import_node_path13.relative)(plugin.installPath, filePath)
+              sourceFile: (0, import_node_path18.relative)(plugin.installPath, filePath)
             });
           }
         }
@@ -17610,11 +19123,44 @@ async function scanPlugin(plugin, threats, options = {}) {
     } catch {
     }
   })() : Promise.resolve();
-  await Promise.all([urlCheckPromise, fileCheckPromise]);
+  await Promise.all([urlCheckPromise, fileCheckPromise, skillCheckPromise]);
   return result;
 }
+async function runSkillCheck(plugin, findings, logger) {
+  try {
+    const skills = await computeSkillIdsForRoot(plugin.installPath);
+    if (skills.length === 0)
+      return;
+    const ids = skills.map((s) => s.skillId);
+    const client = new SkillCheckClient(void 0, logger);
+    const verdicts = await client.checkSkills(ids);
+    for (const { folder, skillId } of skills) {
+      const verdict = verdicts.get(skillId);
+      if (!verdict)
+        continue;
+      const risk = (verdict.overallRiskLevel ?? "").toUpperCase();
+      if (risk !== "HIGH" && risk !== "CRITICAL")
+        continue;
+      const severity = risk === "CRITICAL" ? "critical" : "high";
+      findings.push({
+        threatId: "SKILL_CHECK",
+        title: verdict.summary?.trim() || `Risky skill detected (${risk})`,
+        severity,
+        confidence: 1,
+        action: "log",
+        artifact: skillId.slice(0, 16),
+        sourceFile: (0, import_node_path18.relative)(plugin.installPath, folder) || ".",
+        recommendations: verdict.recommendations.length > 0 ? verdict.recommendations : void 0
+      });
+    }
+  } catch (e) {
+    logger.debug("Skill check failed", { error: String(e) });
+  }
+}
 
 // ../core/dist/session-start.js
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs4 = require("node:fs");
 init_config();
 init_file_utils();
 
@@ -17629,7 +19175,8 @@ function fromCachedFinding(finding) {
     confidence: finding.confidence,
     action: finding.action,
     artifact: finding.artifact,
-    sourceFile: finding.source_file
+    sourceFile: finding.source_file,
+    recommendations: finding.recommendations
   };
 }
 function toFindingData(finding) {
@@ -17640,7 +19187,8 @@ function toFindingData(finding) {
     confidence: finding.confidence,
     action: finding.action,
     artifact: finding.artifact,
-    source_file: finding.sourceFile
+    source_file: finding.sourceFile,
+    recommendations: finding.recommendations
   };
 }
 function toAuditFindingData(finding) {
@@ -17649,23 +19197,39 @@ function toAuditFindingData(finding) {
 }
 async function runSessionStartScan(context) {
   const logger = context.logger ?? nullLogger;
-  const threats = await loadThreats(context.threatsDir, logger);
-  const trustedDomains = await loadTrustedDomains(context.allowlistsDir, logger);
-  if (threats.length === 0) {
-    return [];
-  }
+  const sageConfig = await loadConfig(context.configPath, logger);
   const plugins = context.plugins;
   if (plugins.length === 0) {
     return [];
   }
   let exceptions = [];
   try {
-    const sageConfig = await loadConfig(context.configPath, logger);
     exceptions = await loadExceptions(sageConfig.exceptions, logger);
   } catch {
   }
+  let amsiClient = null;
+  if (sageConfig.amsi_check.enabled && isAmsiSupported()) {
+    try {
+      amsiClient = new AmsiClient(logger);
+      await amsiClient.init();
+      if (!amsiClient.isAvailable) {
+        amsiClient.close();
+        amsiClient = null;
+      }
+    } catch {
+      amsiClient?.close();
+      amsiClient = null;
+    }
+  }
+  try {
+    return await scanAllPlugins(context, sageConfig, plugins, exceptions, amsiClient, logger);
+  } finally {
+    amsiClient?.close();
+  }
+}
+async function scanAllPlugins(context, config2, plugins, exceptions, amsiClient, logger) {
   const configHash = await computeConfigHash(context.sageVersion ?? "", context.threatsDir, context.allowlistsDir);
-  const cache = await loadScanCache(configHash, context.scanCachePath, logger);
+  const cache2 = await loadScanCache(configHash, context.scanCachePath, logger);
   const resultsWithFindings = [];
   let cacheModified = false;
   for (const plugin of plugins) {
@@ -17691,7 +19255,7 @@ async function runSessionStartScan(context) {
     if (allowMatch) {
       continue;
     }
-    const cached = getCached(cache, plugin.key, plugin.version, plugin.lastUpdated);
+    const cached = getCached(cache2, plugin.key, plugin.version, plugin.lastUpdated);
     if (cached && cached.findings.length === 0) {
       continue;
     }
@@ -17702,25 +19266,24 @@ async function runSessionStartScan(context) {
       });
       continue;
     }
-    const result = await scanPlugin(plugin, threats, {
+    const result = await scanPlugin(plugin, {
       checkUrls: context.checkUrls ?? true,
       checkFileHashes: context.checkFileHashes ?? true,
-      trustedDomains,
+      amsiClient,
       logger
     });
-    storeResult(cache, plugin.key, plugin.version, plugin.lastUpdated, result.findings.map(toFindingData));
+    storeResult(cache2, plugin.key, plugin.version, plugin.lastUpdated, result.findings.map(toFindingData));
     cacheModified = true;
     if (result.findings.length > 0) {
       resultsWithFindings.push(result);
     }
   }
   if (cacheModified) {
-    await saveScanCache(cache, context.scanCachePath, logger);
+    await saveScanCache(cache2, context.scanCachePath, logger);
   }
   try {
-    const sageConfig = await loadConfig(context.configPath, logger);
     for (const result of resultsWithFindings) {
-      await logPluginScan(sageConfig.logging, result.plugin.key, result.plugin.version, result.findings.map(toAuditFindingData));
+      await logPluginScan(config2.logging, result.plugin.key, result.plugin.version, result.findings.map(toAuditFindingData));
     }
   } catch {
   }
@@ -17732,7 +19295,7 @@ init_types2();
 
 // ../core/dist/version-check.js
 init_types2();
-var DEFAULT_TIMEOUT_MS2 = 5e3;
+var DEFAULT_TIMEOUT_MS3 = 5e3;
 function isNewerVersion(current, latest) {
   const parse = (v) => v.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
   const cur = parse(current);
@@ -17747,7 +19310,7 @@ function isNewerVersion(current, latest) {
   }
   return false;
 }
-async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = DEFAULT_TIMEOUT_MS2, context) {
+async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = DEFAULT_TIMEOUT_MS3, context) {
   if (currentVersion === "dev") {
     logger.debug("Skipping version check for dev build");
     return null;
@@ -17757,6 +19320,14 @@ async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = D
       logger.debug("Skipping version check: missing installation id");
       return null;
     }
+    const envelope = buildSageProxyEnvelope({
+      iid: context.iid,
+      versionApp: currentVersion,
+      agentRuntime: context.agentRuntime,
+      agentRuntimeVersion: context.agentRuntimeVersion ?? "unknown"
+    });
+    const extendedInfo = await loadExtendedInfo(void 0, logger).catch(() => null);
+    const enriched = mergeExtendedInfo(envelope, extendedInfo);
     const response = await fetch(resolveEndpoint("/v2/version-check"), {
       method: "POST",
       signal: AbortSignal.timeout(timeoutMs),
@@ -17764,12 +19335,7 @@ async function checkForUpdate(currentVersion, logger = nullLogger, timeoutMs = D
         Accept: "application/json",
         "Content-Type": "application/json"
       },
-      body: JSON.stringify(buildSageProxyEnvelope({
-        iid: context.iid,
-        versionApp: currentVersion,
-        agentRuntime: context.agentRuntime,
-        agentRuntimeVersion: context.agentRuntimeVersion ?? "unknown"
-      }))
+      body: JSON.stringify(enriched)
     });
     if (!response.ok) {
       logger.debug(`Version check HTTP ${response.status}`);
@@ -17798,6 +19364,16 @@ async function runSessionStart(ctx) {
   const sageDirPath = resolvePath(ctx.sageDirPath ?? "~/.sage");
   pruneOrphanedTmpFiles(sageDirPath).catch(() => {
   });
+  maybeSpawnModelDownloadWorker({
+    sageDirPath,
+    workerPath: ctx.modelDownloadWorkerPath,
+    configPath: ctx.configPath,
+    agentRuntime: ctx.agentRuntime,
+    agentRuntimeVersion: ctx.agentRuntimeVersion,
+    versionApp: ctx.version,
+    logger
+  }).catch(() => {
+  });
   const iidPromise = getInstallationId(sageDirPath).catch(() => void 0);
   const [scanResults, versionCheck] = await Promise.all([
     runSessionStartScan({
@@ -17824,10 +19400,57 @@ async function runSessionStart(ctx) {
   ]);
   return { scanResults, versionCheck };
 }
+async function maybeSpawnModelDownloadWorker(args) {
+  if (!args.workerPath)
+    return;
+  if (!(0, import_node_fs4.existsSync)(args.workerPath)) {
+    args.logger.debug(`model download worker script not found at ${args.workerPath}`);
+    return;
+  }
+  if (!anyRequiredModelMissing(MODEL_SCHEMA_VERSION, args.sageDirPath))
+    return;
+  let piEnabled = false;
+  try {
+    const config2 = await loadConfig(args.configPath, args.logger);
+    piEnabled = config2.pi_check.enabled && !config2.pi_check.model_path;
+  } catch {
+    piEnabled = false;
+  }
+  if (!piEnabled)
+    return;
+  spawnModelDownloadWorker({
+    sageDirPath: args.sageDirPath,
+    workerPath: args.workerPath,
+    agentRuntime: args.agentRuntime,
+    agentRuntimeVersion: args.agentRuntimeVersion,
+    versionApp: args.versionApp,
+    logger: args.logger
+  });
+}
+function spawnModelDownloadWorker(args) {
+  const logger = args.logger ?? nullLogger;
+  try {
+    const child = (0, import_node_child_process2.spawn)(process.execPath, [args.workerPath], {
+      detached: true,
+      stdio: "ignore",
+      env: {
+        ...process.env,
+        SAGE_DIR: args.sageDirPath,
+        SAGE_AGENT_RUNTIME: String(args.agentRuntime ?? "unknown"),
+        SAGE_AGENT_RUNTIME_VERSION: args.agentRuntimeVersion ?? "",
+        SAGE_VERSION_APP: args.versionApp ?? "",
+        SAGE_MODEL_SCHEMA: MODEL_SCHEMA_VERSION
+      }
+    });
+    child.unref();
+  } catch (err) {
+    logger.debug(`failed to spawn model download worker: ${err}`);
+  }
+}
 
 // ../core/dist/scan-handler.js
-async function runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime, branding2 = defaultBranding) {
-  logger.info(`${branding2.product_name} plugin scan started (${context})`, {
+async function runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime, branding2 = defaultBranding, modelDownloadWorkerPath, style = "verbose") {
+  logger.info(`${branding2.name} plugin scan started (${context})`, {
     threatsDir,
     allowlistsDir
   });
@@ -17837,27 +19460,28 @@ async function runPluginScan(logger, context, plugins, threatsDir, allowlistsDir
     allowlistsDir,
     version,
     logger,
-    agentRuntime
+    agentRuntime,
+    modelDownloadWorkerPath
   });
-  logger.info(`${branding2.product_name} plugin scan (${context}) complete`, {
+  logger.info(`${branding2.name} plugin scan (${context}) complete`, {
     findings: result.scanResults.length,
     updateAvailable: result.versionCheck?.updateAvailable ?? false
   });
-  return formatSessionStartMessage(version, result, branding2);
+  return formatSessionStartMessage(version, result, branding2, style);
 }
 function createScanHandler(options) {
-  const { logger, context, discoverPlugins: discoverPlugins2, selfPrefix, threatsDir, allowlistsDir, version, agentRuntime, branding: branding2 = defaultBranding, onResult } = options;
+  const { logger, context, discoverPlugins: discoverPlugins2, selfPrefix, threatsDir, allowlistsDir, version, agentRuntime, branding: branding2 = defaultBranding, onResult, modelDownloadWorkerPath, style = "verbose" } = options;
   return async () => {
     try {
       let plugins = await discoverPlugins2();
       plugins = plugins.filter((p) => !p.key.startsWith(selfPrefix));
       if (plugins.length === 0) {
-        logger.warn(`${branding2.product_name} plugin scan (${context}): no plugins to scan after filtering`);
+        logger.warn(`${branding2.name} plugin scan (${context}): no plugins to scan after filtering`);
       }
-      const msg = await runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime, branding2);
+      const msg = await runPluginScan(logger, context, plugins, threatsDir, allowlistsDir, version, agentRuntime, branding2, modelDownloadWorkerPath, style);
       onResult?.(msg);
     } catch (e) {
-      logger.error(`${branding2.product_name} ${context} scan failed`, { error: String(e) });
+      logger.error(`${branding2.name} ${context} scan failed`, { error: String(e) });
     }
   };
 }
@@ -17866,19 +19490,19 @@ function createScanHandler(options) {
 init_types2();
 
 // src/bundled-dirs.ts
-var import_node_path14 = require("node:path");
-var packageRoot = (0, import_node_path14.resolve)(__dirname, "..");
+var import_node_path19 = require("node:path");
+var packageRoot = (0, import_node_path19.resolve)(__dirname, "..");
 function getBundledDataDirs() {
   return {
-    threatsDir: (0, import_node_path14.join)(packageRoot, "resources", "threats"),
-    allowlistsDir: (0, import_node_path14.join)(packageRoot, "resources", "allowlists")
+    threatsDir: (0, import_node_path19.join)(packageRoot, "resources", "threats"),
+    allowlistsDir: (0, import_node_path19.join)(packageRoot, "resources", "allowlists")
   };
 }
 var cachedVersion;
 function getSageVersion() {
   if (cachedVersion) return cachedVersion;
   try {
-    const pkg = JSON.parse(getFileContentSync((0, import_node_path14.join)(packageRoot, "package.json"), "utf-8"));
+    const pkg = JSON.parse(getFileContentSync((0, import_node_path19.join)(packageRoot, "package.json"), "utf-8"));
     cachedVersion = pkg.version ?? "0.0.0";
   } catch {
     cachedVersion = "0.0.0";
@@ -17907,35 +19531,38 @@ function createLogger(pluginLogger) {
   };
 }
 
+// src/startup-scan.ts
+var import_node_path21 = require("node:path");
+
 // src/plugin-discovery.ts
-var import_promises7 = require("node:fs/promises");
-var import_node_os2 = require("node:os");
-var import_node_path15 = require("node:path");
-var DEFAULT_EXTENSIONS_DIR = (0, import_node_path15.join)((0, import_node_os2.homedir)(), ".openclaw", "extensions");
+var import_promises9 = require("node:fs/promises");
+var import_node_os4 = require("node:os");
+var import_node_path20 = require("node:path");
+var DEFAULT_EXTENSIONS_DIR = (0, import_node_path20.join)((0, import_node_os4.homedir)(), ".openclaw", "extensions");
 async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSIONS_DIR, branding2 = defaultBranding) {
-  logger.info(`${branding2.product_name} plugin discovery: scanning extensions directory`, {
+  logger.info(`${branding2.name} plugin discovery: scanning extensions directory`, {
     path: extensionsDir
   });
   let entries;
   try {
-    entries = await (0, import_promises7.readdir)(extensionsDir);
+    entries = await (0, import_promises9.readdir)(extensionsDir);
   } catch {
     logger.debug("OpenClaw extensions directory not found", { path: extensionsDir });
     return [];
   }
   const plugins = [];
   for (const entry of entries) {
-    const extDir = (0, import_node_path15.join)(extensionsDir, entry);
+    const extDir = (0, import_node_path20.join)(extensionsDir, entry);
     let stats;
     try {
-      stats = await (0, import_promises7.stat)(extDir);
+      stats = await (0, import_promises9.stat)(extDir);
       if (!stats.isDirectory()) continue;
     } catch {
       continue;
     }
     let pkg;
     try {
-      const pkgPath = (0, import_node_path15.join)(extDir, "package.json");
+      const pkgPath = (0, import_node_path20.join)(extDir, "package.json");
       const raw = await getFileContent(pkgPath);
       pkg = JSON.parse(raw);
     } catch {
@@ -17945,7 +19572,7 @@ async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSION
     const name = pkg.name ?? entry;
     const version = pkg.version ?? "unknown";
     const key = `${name}@${version}`;
-    logger.debug(`${branding2.product_name} plugin discovery: found extension`, {
+    logger.debug(`${branding2.name} plugin discovery: found extension`, {
       key,
       path: extDir
     });
@@ -17956,7 +19583,7 @@ async function discoverOpenClawPlugins(logger, extensionsDir = DEFAULT_EXTENSION
       lastUpdated: stats.mtime.toISOString()
     });
   }
-  logger.info(`${branding2.product_name} plugin discovery: found ${plugins.length} extension(s)`);
+  logger.info(`${branding2.name} plugin discovery: found ${plugins.length} extension(s)`);
   return plugins;
 }
 
@@ -17974,7 +19601,8 @@ function createOpenClawScanHandler(logger, context, branding2 = defaultBranding,
     version,
     agentRuntime: "openclaw",
     branding: branding2,
-    onResult
+    onResult,
+    modelDownloadWorkerPath: (0, import_node_path21.resolve)(__dirname, "model-download-worker.cjs")
   });
 }
 function createStartupScanHandler(logger, branding2 = defaultBranding, onResult) {
@@ -17988,7 +19616,7 @@ function createBeforeAgentStartHandler(getFindings, clearFindings, logger, brand
     const findings = getFindings();
     if (!findings) return void 0;
     clearFindings();
-    logger.info(`${branding2.product_name}: surfacing plugin scan findings via before_agent_start`);
+    logger.info(`${branding2.name}: surfacing plugin scan findings via before_agent_start`);
     const prependContext = [
       '<security-alert source="sage-plugin-scan">',
       findings,
@@ -18001,6 +19629,15 @@ function createBeforeAgentStartHandler(getFindings, clearFindings, logger, brand
 }
 
 // src/tool-handler.ts
+var OPENCLAW_TOOL_MAP = {
+  bash: "Bash",
+  exec: "Bash",
+  web_fetch: "WebFetch",
+  write: "Write",
+  edit: "Edit",
+  read: "Read",
+  apply_patch: "ApplyPatch"
+};
 function extractFilePaths(patch) {
   const artifacts = [];
   for (const line of patch.split("\n")) {
@@ -18011,6 +19648,23 @@ function extractFilePaths(patch) {
   }
   return artifacts;
 }
+function normalizeToolInput(toolName, params) {
+  switch (toolName) {
+    case "write":
+      return {
+        ...params,
+        file_path: params.path ?? "",
+        content: params.content ?? ""
+      };
+    case "edit":
+      return {
+        ...params,
+        file_path: params.path ?? ""
+      };
+    default:
+      return params;
+  }
+}
 function mapToolToArtifacts(toolName, params) {
   switch (toolName) {
     case "bash":
@@ -18048,8 +19702,8 @@ function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir,
           sessionId,
           conversationId: sessionId,
           agentRuntime: "openclaw",
-          toolName,
-          toolInput: params,
+          toolName: canonicalizeToolName(OPENCLAW_TOOL_MAP, toolName),
+          toolInput: normalizeToolInput(toolName, params),
           artifacts
         },
         { threatsDir, allowlistsDir, logger },
@@ -18065,7 +19719,7 @@ function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir,
       return {
         requireApproval: {
           id: actionId,
-          title: `${branding2.product_name}: ${verdict.category}`,
+          title: `${branding2.name}: ${verdict.category}`,
           description: [
             `Severity: ${verdict.severity}`,
             `Reason: ${reasons}`,
@@ -18096,10 +19750,11 @@ function createToolCallHandler(approvalStore, logger, threatsDir, allowlistsDir,
 }
 
 // src/index.ts
-var branding = loadBrandingSync();
+var config = loadConfigSync();
+var branding = resolveBranding(config.brand_key);
 var index_default = {
   id: "sage-openclaw",
-  name: branding.product_name,
+  name: branding.name,
   description: "Safety for Agents \u2014 ADR layer that guards commands, files, and web requests",
   configSchema: {
     jsonSchema: { type: "object", additionalProperties: false, properties: {} }