@mrciphersmith/keryx 0.3.18 → 0.3.20

package/dist/core.js

@@ -4028,6 +4028,333 @@ var init_config2 = __esm(() => {
   ]);
 });
 
+// src/security/detect/entropy.ts
+function isHexBlob(value) {
+  return HEX_BLOB.test(value) && /[a-f]/i.test(value);
+}
+function isAllowShapedValue(value) {
+  return FULL_GIT_SHA_RE.test(value) || UUID_RE.test(value) || INTEGRITY_RE.test(value);
+}
+function lastLineOf(before) {
+  const newline = before.lastIndexOf(`
+`);
+  return newline < 0 ? before : before.slice(newline + 1);
+}
+function isPlainCasedWord(letters) {
+  return /^[a-z]+$/.test(letters) || /^[A-Z]+$/.test(letters) || /^[A-Z][a-z]*$/.test(letters);
+}
+function isSingleTransitionTag(segment) {
+  const letterThenDigit = /^([A-Za-z]+)([0-9]+)$/.exec(segment);
+  if (letterThenDigit !== null) {
+    const letters = letterThenDigit[1];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  const digitThenLetter = /^([0-9]+)([A-Za-z]+)$/.exec(segment);
+  if (digitThenLetter !== null) {
+    const letters = digitThenLetter[2];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  return false;
+}
+function isSlugHexTail(segment) {
+  return SLUG_HEX_TAIL_RE.test(segment);
+}
+function isWordSlug(value) {
+  const segments = value.split(/[-_]/);
+  if (segments.length < 3) {
+    return false;
+  }
+  let words = 0;
+  for (let i = 0;i < segments.length; i += 1) {
+    const segment = segments[i];
+    const isDigits = /^[0-9]+$/.test(segment);
+    if (isDigits) {
+      continue;
+    }
+    if (isPlainCasedWord(segment)) {
+      if (segment.length >= 3) {
+        words += 1;
+      }
+      continue;
+    }
+    if (isSingleTransitionTag(segment)) {
+      continue;
+    }
+    if (i === segments.length - 1 && isSlugHexTail(segment)) {
+      continue;
+    }
+    return false;
+  }
+  return words >= 1;
+}
+function shannonEntropy(value) {
+  const counts = new Map;
+  for (const ch of value) {
+    counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  }
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const p = count / value.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function bareShapeQualifies(head) {
+  if (!/[0-9]/.test(head) && !/[+=]/.test(head)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  if (isWordSlug(head)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  const entropy = shannonEntropy(head);
+  const hexBlob = isHexBlob(head);
+  if (entropy < 3.6 && !hexBlob) {
+    return { qualifies: false, entropy };
+  }
+  return { qualifies: true, entropy };
+}
+function shapeQualifiesAsSecret(value) {
+  if (isAllowShapedValue(value)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  return bareShapeQualifies(value);
+}
+function looksSecretShaped(value) {
+  return shapeQualifiesAsSecret(value).qualifies;
+}
+function buildMatch(start, end, value, entropy) {
+  const confidence = Math.max(0.4, Math.min(0.7, 0.4 + (entropy - 3.6) * 0.21));
+  return {
+    category: "secret",
+    policyId: "secrets.high-entropy",
+    severity: "medium",
+    confidence: Number(confidence.toFixed(2)),
+    start,
+    end,
+    value,
+    mask: "entropy",
+    remediation: "Verify this high-entropy value is not a live credential."
+  };
+}
+function findUrlSpans(content) {
+  const spans = [];
+  URL_SPAN_RE.lastIndex = 0;
+  let m;
+  while ((m = URL_SPAN_RE.exec(content)) !== null) {
+    let raw = m[0];
+    while (raw.length > 0 && URL_TRAILING_PUNCTUATION_RE.test(raw)) {
+      raw = raw.slice(0, -1);
+    }
+    if (raw.length > 0) {
+      spans.push({ start: m.index, end: m.index + raw.length, raw });
+    }
+    if (m.index === URL_SPAN_RE.lastIndex) {
+      URL_SPAN_RE.lastIndex += 1;
+    }
+  }
+  return spans;
+}
+function urlComponentSpans(raw) {
+  const spans = [];
+  const schemeMatch = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.exec(raw);
+  if (schemeMatch === null) {
+    return spans;
+  }
+  let i = schemeMatch[0].length;
+  while (i < raw.length && raw[i] !== "/" && raw[i] !== "?" && raw[i] !== "#") {
+    i += 1;
+  }
+  let pathEnd = i;
+  while (pathEnd < raw.length && raw[pathEnd] !== "?" && raw[pathEnd] !== "#") {
+    pathEnd += 1;
+  }
+  let segStart = i;
+  for (let j = i;j <= pathEnd; j += 1) {
+    if (j === pathEnd || raw[j] === "/") {
+      if (j > segStart) {
+        spans.push({ start: segStart, end: j });
+      }
+      segStart = j + 1;
+    }
+  }
+  let cursor = pathEnd;
+  if (cursor < raw.length && raw[cursor] === "?") {
+    let queryEnd = cursor + 1;
+    while (queryEnd < raw.length && raw[queryEnd] !== "#") {
+      queryEnd += 1;
+    }
+    let pairStart = cursor + 1;
+    for (let j = cursor + 1;j <= queryEnd; j += 1) {
+      if (j === queryEnd || raw[j] === "&") {
+        const pair = raw.slice(pairStart, j);
+        const eq = pair.indexOf("=");
+        if (eq !== -1 && eq + 1 < pair.length) {
+          spans.push({ start: pairStart + eq + 1, end: j });
+        } else if (eq === -1 && pair.length > 0) {
+          spans.push({ start: pairStart, end: j });
+        }
+        pairStart = j + 1;
+      }
+    }
+    cursor = queryEnd;
+  }
+  if (cursor < raw.length && raw[cursor] === "#" && cursor + 1 < raw.length) {
+    spans.push({ start: cursor + 1, end: raw.length });
+  }
+  return spans;
+}
+function secretShapedCandidatesIn(text) {
+  const normalized = text.replace(/\+/g, " ");
+  const out = [];
+  TOKEN.lastIndex = 0;
+  let m;
+  while ((m = TOKEN.exec(normalized)) !== null) {
+    const value = m[0];
+    if (value.length < URL_COMPONENT_MIN_LENGTH) {
+      continue;
+    }
+    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
+    const { qualifies, entropy } = shapeQualifiesAsSecret(head);
+    if (!qualifies) {
+      continue;
+    }
+    const start = m.index;
+    const end = start + value.length;
+    out.push({ start, end, value: text.slice(start, end), entropy });
+  }
+  return out;
+}
+function looksSecretShapedIn(text) {
+  return secretShapedCandidatesIn(text).length > 0;
+}
+function labelledPieceQualifies(piece) {
+  const base = bareShapeQualifies(piece);
+  if (base.qualifies) {
+    return { entropy: base.entropy };
+  }
+  if (isAllowShapedValue(piece)) {
+    return { entropy: base.entropy };
+  }
+  return null;
+}
+function firstQualifyingSlashPiece(head) {
+  let offset = 0;
+  for (const piece of head.split("/")) {
+    if (piece.length > 0) {
+      const found = labelledPieceQualifies(piece);
+      if (found !== null) {
+        return { offset, length: piece.length, entropy: found.entropy };
+      }
+    }
+    offset += piece.length + 1;
+  }
+  return null;
+}
+function detectEntropy(content) {
+  const matches = [];
+  const urlSpans = findUrlSpans(content);
+  for (const url of urlSpans) {
+    for (const comp of urlComponentSpans(url.raw)) {
+      const compText = url.raw.slice(comp.start, comp.end);
+      for (const cand of secretShapedCandidatesIn(compText)) {
+        const absStart = url.start + comp.start + cand.start;
+        const absEnd = url.start + comp.start + cand.end;
+        matches.push(buildMatch(absStart, absEnd, cand.value, cand.entropy));
+      }
+    }
+  }
+  LABEL_ASSIGNMENT_RE.lastIndex = 0;
+  let am;
+  while ((am = LABEL_ASSIGNMENT_RE.exec(content)) !== null) {
+    const value = am[1];
+    const end = am.index + am[0].length;
+    const start = end - value.length;
+    if (urlSpans.some((u) => start < u.end && end > u.start)) {
+      continue;
+    }
+    const { qualifies, entropy } = bareShapeQualifies(value);
+    if (qualifies) {
+      matches.push(buildMatch(start, end, value, entropy));
+    }
+  }
+  TOKEN.lastIndex = 0;
+  let m;
+  while ((m = TOKEN.exec(content)) !== null) {
+    const value = m[0];
+    const start = m.index;
+    const end = start + value.length;
+    if (urlSpans.some((u) => start < u.end && end > u.start)) {
+      continue;
+    }
+    if (matches.some((existing) => start < existing.end && end > existing.start)) {
+      continue;
+    }
+    const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
+    if (!ADJACENT_LABEL.test(before)) {
+      continue;
+    }
+    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
+    if (head.includes("/")) {
+      const piece = firstQualifyingSlashPiece(head);
+      if (piece === null) {
+        continue;
+      }
+      const pieceStart = start + piece.offset;
+      const pieceEnd = pieceStart + piece.length;
+      matches.push(buildMatch(pieceStart, pieceEnd, content.slice(pieceStart, pieceEnd), piece.entropy));
+      continue;
+    }
+    const found = labelledPieceQualifies(head);
+    if (found === null) {
+      continue;
+    }
+    matches.push(buildMatch(start, end, value, found.entropy));
+  }
+  return matches.sort((a, b) => a.start - b.start);
+}
+var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), ADJACENT_LABEL, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
+var init_entropy = __esm(() => {
+  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*["']?$`);
+  LABEL_ASSIGNMENT_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${SENSITIVE_LABEL_WORDS})[A-Za-z0-9_-]*"?\\s*=\\s*"?([A-Za-z0-9+/_=-]{6,})`, "gi");
+  TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
+  TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
+  HEX_BLOB = /^[0-9a-f]{24,}$/i;
+  FULL_GIT_SHA_RE = /^[0-9a-f]{40}$/i;
+  UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  INTEGRITY_RE = /^(?:sha256|sha512)-[A-Za-z0-9+/]+=*$/;
+  SLUG_HEX_TAIL_RE = /^[0-9a-f]{10,16}$/i;
+  URL_SPAN_RE = /\bhttps?:\/\/[^\s<>"'\\]+/g;
+  URL_TRAILING_PUNCTUATION_RE = /[.,;:!?)\]}]$/;
+});
+
+// src/security/entropy-gate.ts
+function ensureLoading() {
+  if (loadStarted) {
+    return;
+  }
+  loadStarted = true;
+  loadSecurityConfig(process.cwd()).then((config) => {
+    cachedEnabled = config.backends.entropy.enabled;
+  }).catch(() => {});
+}
+function isEntropyBackendEnabled() {
+  ensureLoading();
+  return cachedEnabled;
+}
+function setEntropyBackendEnabledForTests(enabled) {
+  loadStarted = true;
+  cachedEnabled = enabled;
+}
+function resetEntropyGateForTests() {
+  loadStarted = false;
+  cachedEnabled = DEFAULT_SECURITY_CONFIG.backends.entropy.enabled;
+}
+var cachedEnabled, loadStarted = false;
+var init_entropy_gate = __esm(() => {
+  init_config2();
+  cachedEnabled = DEFAULT_SECURITY_CONFIG.backends.entropy.enabled;
+});
+
 // src/security/redact.ts
 import path17 from "path";
 import { createHmac, randomBytes as randomBytes2 } from "crypto";
@@ -4097,7 +4424,12 @@ function redactSensitiveText(text) {
   if (text.length === 0) {
     return text;
   }
-  const matches = [...detectSecrets(text), ...detectPii(text), ...detectExfil(text)];
+  const matches = [
+    ...detectSecrets(text),
+    ...detectPii(text),
+    ...detectExfil(text),
+    ...isEntropyBackendEnabled() ? detectEntropy(text) : []
+  ];
   if (matches.length === 0) {
     return text;
   }
@@ -4134,6 +4466,8 @@ var init_redact = __esm(() => {
   init_secrets();
   init_pii();
   init_exfil();
+  init_entropy();
+  init_entropy_gate();
 });
 
 // src/security/output-validation.ts
@@ -4874,102 +5208,33 @@ var init_seam = __esm(() => {
   init_warn_once();
 });
 
-// src/security/detect/entropy.ts
-function lastLineOf(before) {
-  const newline = before.lastIndexOf(`
-`);
-  return newline < 0 ? before : before.slice(newline + 1);
-}
-function isWordSlug(value) {
-  const segments = value.split(/[-_]/);
-  if (segments.length < 3) {
-    return false;
-  }
-  let words = 0;
-  for (const segment of segments) {
-    const isAlpha = /^[A-Za-z]+$/.test(segment);
-    const isDigits = /^[0-9]+$/.test(segment);
-    if (!isAlpha && !isDigits) {
-      return false;
-    }
-    if (isAlpha && segment.length >= 3) {
-      words += 1;
-    }
-  }
-  return words >= 2;
-}
-function shannonEntropy(value) {
-  const counts = new Map;
-  for (const ch of value) {
-    counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  }
-  let entropy = 0;
-  for (const count of counts.values()) {
-    const p = count / value.length;
-    entropy -= p * Math.log2(p);
-  }
-  return entropy;
-}
-function detectEntropy(content) {
-  const matches = [];
-  TOKEN.lastIndex = 0;
-  let m;
-  while ((m = TOKEN.exec(content)) !== null) {
-    const value = m[0];
-    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
-    if (!/[0-9]/.test(head) && !/[+=]/.test(head)) {
-      continue;
-    }
-    if (isWordSlug(head)) {
-      continue;
-    }
-    const entropy = shannonEntropy(head);
-    const hexBlob = HEX_BLOB.test(head);
-    if (entropy < 3.6 && !hexBlob) {
-      continue;
-    }
-    const before = lastLineOf(content.slice(Math.max(0, m.index - LABEL_WINDOW), m.index));
-    if (!SENSITIVE_LABEL.test(before)) {
-      continue;
-    }
-    const confidence = Math.max(0.4, Math.min(0.7, 0.4 + (entropy - 3.6) * 0.21));
-    matches.push({
-      category: "secret",
-      policyId: "secrets.high-entropy",
-      severity: "medium",
-      confidence: Number(confidence.toFixed(2)),
-      start: m.index,
-      end: m.index + value.length,
-      value,
-      mask: "secret",
-      remediation: "Verify this high-entropy value is not a live credential."
-    });
+// src/security/detect/injection.ts
+function foldForMatching(content) {
+  let folded = "";
+  for (let i = 0;i < content.length; i += 1) {
+    const ch = content[i];
+    folded += CONFUSABLES[ch] ?? ch;
   }
-  return matches;
+  const nfkc = folded.normalize("NFKC");
+  return nfkc.length === folded.length ? nfkc : folded;
 }
-var SENSITIVE_LABEL, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB;
-var init_entropy = __esm(() => {
-  SENSITIVE_LABEL = /(key|secret|token|password|passwd|api|credential|auth)/i;
-  TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
-  TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
-  HEX_BLOB = /^[0-9a-f]{24,}$/i;
-});
-
-// src/security/detect/injection.ts
 function detectInjection(content) {
   const matches = [];
+  const folded = foldForMatching(content);
   for (const pattern of PATTERNS) {
     pattern.regex.lastIndex = 0;
     let m;
-    while ((m = pattern.regex.exec(content)) !== null) {
+    while ((m = pattern.regex.exec(folded)) !== null) {
+      const start = Math.min(m.index, content.length);
+      const end = Math.min(m.index + m[0].length, content.length);
       matches.push({
         category: "prompt-injection",
         policyId: pattern.policyId,
         severity: "low",
         confidence: pattern.confidence,
-        start: m.index,
-        end: m.index + m[0].length,
-        value: m[0],
+        start,
+        end,
+        value: content.slice(start, end),
         remediation: "Treat external content as data, not instruction; require human review."
       });
       if (m.index === pattern.regex.lastIndex) {
@@ -4979,27 +5244,69 @@ function detectInjection(content) {
   }
   return matches;
 }
-var PATTERNS;
+var CONFUSABLES, PATTERNS;
 var init_injection = __esm(() => {
+  CONFUSABLES = {
+    "\u0430": "a",
+    "\u0410": "A",
+    "\u0435": "e",
+    "\u0415": "E",
+    "\u043E": "o",
+    "\u041E": "O",
+    "\u0440": "p",
+    "\u0420": "P",
+    "\u0441": "c",
+    "\u0421": "C",
+    "\u0445": "x",
+    "\u0425": "X",
+    "\u0443": "y",
+    "\u0423": "Y",
+    "\u0455": "s",
+    "\u0405": "S",
+    "\u0456": "o",
+    "\u0406": "O",
+    "\u0458": "j",
+    "\u0408": "J",
+    "\u03B1": "a",
+    "\u0391": "A",
+    "\u03B2": "b",
+    "\u0392": "B",
+    "\u03B5": "e",
+    "\u0395": "E",
+    "\u03B9": "i",
+    "\u0399": "I",
+    "\u03BA": "k",
+    "\u039A": "K",
+    "\u03BF": "o",
+    "\u039F": "O",
+    "\u03C1": "p",
+    "\u03A1": "P",
+    "\u03C4": "t",
+    "\u03A4": "T",
+    "\u03C5": "u",
+    "\u03A5": "Y",
+    "\u03C7": "x",
+    "\u03A7": "X"
+  };
   PATTERNS = [
     {
       policyId: "prompt-injection.ignore-instructions",
-      regex: /\b(ignore|disregard|forget|override)\b[^.\n]{0,40}\b(all\s+)?(previous|prior|above|earlier|system|developer)\b[^.\n]{0,20}\b(instructions?|prompts?|rules?|context)\b/gi,
+      regex: /\b(ignore|disregard|forget|override)\b[^.]{0,40}\b(all\s+)?(previous|prior|above|earlier|system|developer)\b[^.]{0,20}\b(instructions?|prompts?|rules?|context)\b/gi,
       confidence: 0.4
     },
     {
       policyId: "prompt-injection.reveal-context",
-      regex: /\b(reveal|show|print|expose|leak|dump|repeat)\b[^.\n]{0,30}\b(your\s+)?(system\s+prompt|instructions?|memory|secrets?|hidden\s+context|api\s*keys?)\b/gi,
+      regex: /\b(reveal|show|print|expose|leak|dump|repeat)\b[^.]{0,30}\b(your\s+)?(system\s+prompt|instructions?|memory|secrets?|hidden\s+context|api\s*keys?)\b/gi,
       confidence: 0.45
     },
     {
       policyId: "prompt-injection.role-override",
-      regex: /\b(you\s+are\s+now|from\s+now\s+on|act\s+as|pretend\s+to\s+be)\b[^.\n]{0,40}\b(unrestricted|jailbroken|dan|admin|developer\s+mode|no\s+rules)\b/gi,
+      regex: /\b(you\s+are\s+now|from\s+now\s+on|act\s+as|pretend\s+to\s+be)\b[^.]{0,40}\b(unrestricted|jailbroken|dan|admin|developer\s+mode|no\s+rules)\b/gi,
       confidence: 0.4
     },
     {
       policyId: "prompt-injection.priority-override",
-      regex: /\b(treat|follow|obey)\b[^.\n]{0,30}\b(the\s+)?(following|external|below)\b[^.\n]{0,20}\b(as\s+)?(instructions?|higher\s+priority|commands?)\b/gi,
+      regex: /\b(treat|follow|obey)\b[^.]{0,30}\b(the\s+)?(following|external|below)\b[^.]{0,20}\b(as\s+)?(instructions?|higher\s+priority|commands?)\b/gi,
       confidence: 0.35
     }
   ];
@@ -6149,6 +6456,140 @@ var init_read_source = __esm(() => {
   init_contained_path();
 });
 
+// src/security/credential-shape.ts
+function isDeniedForMcpChild(name, value) {
+  if (value !== undefined && CREDENTIAL_IN_VALUE_RE.test(value))
+    return true;
+  const upper = name.toUpperCase();
+  if (MCP_ENV_ALLOW_EXACT.includes(upper))
+    return false;
+  const conditional = VALUE_DEPENDENT[upper];
+  if (conditional !== undefined) {
+    return value === undefined ? true : conditional(value);
+  }
+  if (EXTERNAL_ENV_DENY.some((denied) => denied.toUpperCase() === upper))
+    return true;
+  if (MCP_ENV_DENY.includes(upper))
+    return true;
+  if (EXTERNAL_ENV_PREFIX_SWEEPS.some((prefix) => upper.startsWith(prefix.toUpperCase())))
+    return true;
+  if (MCP_ENV_PREFIX_SWEEPS.some((prefix) => upper.startsWith(prefix)))
+    return true;
+  return SECRET_SEGMENT_RE.test(upper) || SECRET_SUBSTRING_RE.test(upper) || GLUED_SECRET_RE.test(upper) || CONNECTION_STRING_RE.test(upper);
+}
+var EXTERNAL_ENV_DENY, EXTERNAL_ENV_PREFIX_SWEEPS, MCP_ENV_ALLOW_EXACT, MCP_ENV_DENY, MCP_ENV_PREFIX_SWEEPS, SECRET_SEGMENTS, SECRET_SEGMENT_RE, SECRET_SUBSTRING_RE, GLUED_SECRET_RE, CONNECTION_STRING_RE, CREDENTIAL_IN_VALUE_RE, VALUE_DEPENDENT;
+var init_credential_shape = __esm(() => {
+  EXTERNAL_ENV_DENY = [
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+    "ANTHROPIC_MODEL",
+    "CLAUDE_CONFIG_DIR",
+    "CODEX_HOME",
+    "CLAUDECODE"
+  ];
+  EXTERNAL_ENV_PREFIX_SWEEPS = ["CLAUDE_CODE_", "KERYX_"];
+  MCP_ENV_ALLOW_EXACT = ["PWD", "OLDPWD"];
+  MCP_ENV_DENY = [
+    "SSH_AUTH_SOCK",
+    "SSH_AGENT_PID",
+    "GPG_AGENT_INFO",
+    "GNUPGHOME",
+    "GNOME_KEYRING_CONTROL",
+    "GNOME_KEYRING_PID",
+    "KDE_FULL_SESSION",
+    "GIT_ASKPASS",
+    "SSH_ASKPASS",
+    "SUDO_ASKPASS",
+    "GIT_CREDENTIAL_HELPER",
+    "GIT_SSH_COMMAND",
+    "KUBECONFIG",
+    "NETRC",
+    "PGPASSFILE",
+    "PGSERVICEFILE",
+    "GOOGLE_APPLICATION_CREDENTIALS",
+    "CLOUDSDK_CONFIG",
+    "DOCKER_CONFIG",
+    "AWS_SHARED_CREDENTIALS_FILE",
+    "AWS_CONFIG_FILE",
+    "BOTO_CONFIG",
+    "AZURE_CONFIG_DIR",
+    "CURLRC",
+    "WGETRC",
+    "NPMRC",
+    "NPM_CONFIG_USERCONFIG",
+    "PIP_CONFIG_FILE",
+    "RCLONE_CONFIG",
+    "MAVEN_SETTINGS",
+    "GIT_CONFIG",
+    "GIT_CONFIG_GLOBAL",
+    "HGRCPATH",
+    "ANSIBLE_VAULT_PASSWORD_FILE",
+    "AZURE_CLIENT_CERTIFICATE_PATH",
+    "ARM_CLIENT_CERTIFICATE_PATH",
+    "VAULT_CLIENT_CERT",
+    "VAULT_CLIENT_KEY",
+    "SSL_CLIENT_CERT_PATH",
+    "SSL_CLIENT_KEY_FILE",
+    "IDENTITY_FILE",
+    "SSH_IDENTITY_FILE",
+    "GCP_SERVICE_ACCOUNT",
+    "XAUTHORITY",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "GROQ_API_KEY",
+    "MISTRAL_API_KEY",
+    "XAI_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "OPENROUTER_API_KEY",
+    "TOGETHER_API_KEY",
+    "PERPLEXITY_API_KEY"
+  ];
+  MCP_ENV_PREFIX_SWEEPS = [
+    "OP_SESSION",
+    "BW_SESSION"
+  ];
+  SECRET_SEGMENTS = [
+    "KEY",
+    "KEYS",
+    "TOKEN",
+    "TOKENS",
+    "SECRET",
+    "SECRETS",
+    "PASSWORD",
+    "PASSWD",
+    "PWD",
+    "PASS",
+    "PASSPHRASE",
+    "PASSCODE",
+    "PASSKEY",
+    "CREDENTIAL",
+    "CREDENTIALS",
+    "CREDS",
+    "AUTH",
+    "AUTHORIZATION",
+    "BEARER",
+    "JWT",
+    "COOKIE",
+    "SIGNATURE",
+    "APIKEY",
+    "SECRETKEY",
+    "ACCESSKEY",
+    "AUTHTOKEN",
+    "PAT",
+    "WEBHOOK"
+  ];
+  SECRET_SEGMENT_RE = new RegExp(`(^|_)(${SECRET_SEGMENTS.join("|")})($|_)`);
+  SECRET_SUBSTRING_RE = /(PASSWORD|PASSWD|PASSPHRASE|PASSCODE|SSHPASS|SECRET|CREDENTIAL|APIKEY|KEYFILE|PRIVKEY)/;
+  GLUED_SECRET_RE = /(PRIVATE|SECRET|ACCESS|REFRESH|SESSION|CLIENT|API|APP)(KEY|TOKEN|SECRET)($|_)|DB(PASS|PWD)($|_)/;
+  CONNECTION_STRING_RE = /(^|_)(DSN|CONNECTION_STRING|CONNECTIONSTRING)($|_)/;
+  CREDENTIAL_IN_VALUE_RE = /:\/\/[^/\s@]*(:[^/\s@]*)?@/;
+  VALUE_DEPENDENT = {
+    DOCKER_HOST: (value) => !value.startsWith("unix://") && !value.startsWith("fd://")
+  };
+});
+
 // src/security/audit-harness/codex-toml.ts
 function stripComment(line) {
   let quoted = false;
@@ -18357,8 +18798,11 @@ var init_impact_evidence = __esm(() => {
 // src/security/service.ts
 var exports_service2 = {};
 __export(exports_service2, {
+  EXTERNAL_ENV_DENY: () => EXTERNAL_ENV_DENY,
+  EXTERNAL_ENV_PREFIX_SWEEPS: () => EXTERNAL_ENV_PREFIX_SWEEPS,
   addBaselineEntry: () => addBaselineEntry,
   analyze: () => analyze,
+  appendIncident: () => appendIncident,
   appendLogRecord: () => appendLogRecord,
   applyAuditProposal: () => applyAuditProposal,
   auditGate: () => auditGate,
@@ -18366,13 +18810,20 @@ __export(exports_service2, {
   createImpactEvidenceProvider: () => createImpactEvidenceProvider,
   createSecurityService: () => createSecurityService,
   defaultBaselinePath: () => defaultBaselinePath,
+  detectEntropy: () => detectEntropy,
+  detectSecrets: () => detectSecrets,
   hostDeliveryStatus: () => hostDeliveryStatus,
+  isDeniedForMcpChild: () => isDeniedForMcpChild,
+  isEntropyBackendEnabled: () => isEntropyBackendEnabled,
   loadSecurityConfig: () => loadSecurityConfig,
+  looksSecretShaped: () => looksSecretShaped,
+  looksSecretShapedIn: () => looksSecretShapedIn,
   memoizeResolved: () => memoizeResolved,
   normalizeRequestFiles: () => normalizeRequestFiles,
   readLogRecords: () => readLogRecords,
   redactSensitiveText: () => redactSensitiveText,
   renderEvidenceBlock: () => renderEvidenceBlock,
+  resetEntropyGateForTests: () => resetEntropyGateForTests,
   resolveImpactEvidenceConfig: () => resolveImpactEvidenceConfig,
   resolveImpactEvidenceConfigTrusted: () => resolveImpactEvidenceConfigTrusted,
   runGate: () => runGate,
@@ -18381,6 +18832,7 @@ __export(exports_service2, {
   runScan: () => runScan,
   runScanPath: () => runScanPath,
   scanContent: () => scanContent,
+  setEntropyBackendEnabledForTests: () => setEntropyBackendEnabledForTests,
   sourceForFileRead: () => sourceForFileRead2,
   validateSerializedOutput: () => validateSerializedOutput,
   verifyConfigChecksum: () => verifyConfigChecksum
@@ -18626,6 +19078,11 @@ var init_service4 = __esm(() => {
   init_path_scan();
   init_read_source();
   init_redact();
+  init_secrets();
+  init_entropy();
+  init_incidents();
+  init_entropy_gate();
+  init_credential_shape();
   init_audit_harness();
   init_config2();
   init_impact_evidence();