@mrciphersmith/keryx 0.4.4 → 0.4.6

package/dist/core.js

@@ -2496,7 +2496,7 @@ function detectPii(content) {
   perRule[PHONE_RULE] = dropRescansInsideCards(perRule[PHONE_RULE], perRule[CARD_RULE]);
   return perRule.flat();
 }
-var UNICODE_EMAIL, ASCII_EMAIL, emailScanner, asciiEmailScanner, PHONE_FROM, PHONE_RUN_CHAR, PHONE_START_BLOCKER, DIGIT, PHONE_DIAL_GROUP, PHONE_FIRST_GROUP, PHONE_SEPARATOR, PHONE_NANP_SPACED, WHITESPACE, LINE_BREAK, PHONE_MAX_DIGITS = 15, PHONE_MIN_DIGITS = 9, rescanned, PHONE_JOINED_PIECE, PHONE_CARD_SHAPE, PHONE_GLUE, PHONE_GLUE_LETTER, PHONE_GLUE_EVIDENCE, phoneGlueScanner, phoneScanner, IBAN_START, IBAN_MAX_GROUPS = 8, IBAN_STATES, ibanFailed, ibanStamp = 0, ibanScanner, IBAN_LENGTHS, IBAN_GLUE_START, ibanGluedScanner, CARD_SEPARATOR = "[ \\t\\r\\n._/-]", CARD_EXTRA, CARD_GROUP_SEPARATOR, GLUE_LETTER_BEFORE, GLUE_LETTER_AFTER, NON_HEX_LETTER, GLUE_FLANK = 8, UUID_ANYWHERE, UUID_REACH = 36, SSN_BREAK_EXTRA, IPV4_EXTRA, RULES, CALENDAR_DATE, IDENTIFIER_CHAR, TOKEN_SCAN_LIMIT = 64, UUID_TOKEN, rescanTag, NORMALIZE_CHUNK, NORMALIZE_OVERLAP = 512, NORMALIZE_SKIP = 256, NON_ASCII, DECIMAL_DIGIT, digitValues, BREAK_CHAR, PHONE_RULE, CARD_RULE, NUMBER_RULES, FULLWIDTH_CAPITAL, SOFT_HYPHEN, NUMBER_BREAK;
+var UNICODE_EMAIL, ASCII_EMAIL, emailScanner, asciiEmailScanner, PHONE_FROM, PHONE_RUN_CHAR, PHONE_START_BLOCKER, DIGIT, PHONE_DIAL_GROUP, PHONE_FIRST_GROUP, PHONE_SEPARATOR, PHONE_NANP_SPACED, WHITESPACE, LINE_BREAK, PHONE_MAX_DIGITS = 15, PHONE_MIN_DIGITS = 9, rescanned, PHONE_JOINED_PIECE, PHONE_CARD_SHAPE, PHONE_GLUE, PHONE_GLUE_LETTER, PHONE_GLUE_EVIDENCE, phoneGlueScanner, phoneScanner, IBAN_START, IBAN_MAX_GROUPS = 8, IBAN_STATES, ibanFailed, ibanStamp = 0, ibanScanner, IBAN_LENGTHS, IBAN_GLUE_START, ibanGluedScanner, CARD_SEPARATOR = "[ \\t\\r\\n._/-]", CARD_EXTRA, CARD_GROUP_SEPARATOR, GLUE_LETTER_BEFORE, GLUE_LETTER_AFTER, NON_HEX_LETTER, GLUE_FLANK = 8, UUID_ANYWHERE, UUID_REACH = 36, SSN_BREAK_EXTRA, IPV4_EXTRA, IPV6_COMPRESSED, RULES, CALENDAR_DATE, IDENTIFIER_CHAR, TOKEN_SCAN_LIMIT = 64, UUID_TOKEN, rescanTag, NORMALIZE_CHUNK, NORMALIZE_OVERLAP = 512, NORMALIZE_SKIP = 256, NON_ASCII, DECIMAL_DIGIT, digitValues, BREAK_CHAR, PHONE_RULE, CARD_RULE, NUMBER_RULES, FULLWIDTH_CAPITAL, SOFT_HYPHEN, NUMBER_BREAK;
 var init_pii = __esm(() => {
   UNICODE_EMAIL = {
     from: /(?:(?<=[\p{L}\p{N}\p{M}_])(?![\p{L}\p{N}\p{M}_])|(?<![\p{L}\p{N}\p{M}_])(?=[\p{L}\p{N}\p{M}_]))[\p{L}\p{N}\p{M}._%+-]+@[\p{L}\p{N}\p{M}.-]+\.[\p{L}\p{M}]{2,}(?![\p{L}\p{N}\p{M}_])/uy,
@@ -2794,6 +2794,7 @@ var init_pii = __esm(() => {
   UUID_ANYWHERE = /[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}/g;
   SSN_BREAK_EXTRA = /(?<![0-9])\d{3}(?:\r\n|[\t\r\n])\d{2}(?:\r\n|[\t\r\n])\d{4}(?![0-9])/g;
   IPV4_EXTRA = /(?<![0-9.])(?<!\b[vV])\d{1,3}(?:[\t\r\n]{0,2}\.[\t\r\n]{0,2}\d{1,3}){3}(?![0-9])/g;
+  IPV6_COMPRESSED = /(?<![0-9A-Fa-f:])(?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,6})?::(?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,6})?(?![0-9A-Fa-f:])/g;
   RULES = [
     {
       policyId: "pii.email",
@@ -2867,7 +2868,10 @@ var init_pii = __esm(() => {
       severity: "low",
       confidence: 0.6,
       validate: isValidIp,
-      also: [{ regex: IPV4_EXTRA, validate: (value) => isValidIp(value.replace(/[\t\r\n]/g, "")) }]
+      also: [
+        { regex: IPV4_EXTRA, validate: (value) => isValidIp(value.replace(/[\t\r\n]/g, "")) },
+        { regex: IPV6_COMPRESSED, validate: (value) => /[0-9]/.test(value) && isValidIp(value) }
+      ]
     }
   ];
   CALENDAR_DATE = /(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])/;
@@ -2888,29 +2892,55 @@ var init_pii = __esm(() => {
 });
 
 // src/security/detect/secrets.ts
+function scanPrivateKeyBlocks(content) {
+  const spans = [];
+  PRIVATE_KEY_BEGIN.lastIndex = 0;
+  let begin;
+  while ((begin = PRIVATE_KEY_BEGIN.exec(content)) !== null) {
+    PRIVATE_KEY_END.lastIndex = begin.index + begin[0].length;
+    const end = PRIVATE_KEY_END.exec(content);
+    if (end === null) {
+      spans.push([begin.index, content.length]);
+      break;
+    }
+    const stop = end.index + end[0].length;
+    spans.push([begin.index, stop]);
+    PRIVATE_KEY_BEGIN.lastIndex = stop;
+  }
+  return spans;
+}
 function detectSecrets(content) {
   const matches = [];
+  const push = (rule, start, end) => {
+    matches.push({
+      category: "secret",
+      policyId: rule.policyId,
+      severity: rule.severity,
+      confidence: rule.confidence,
+      start,
+      end,
+      value: content.slice(start, end),
+      mask: "secret",
+      remediation: rule.remediation
+    });
+  };
   for (const rule of RULES2) {
+    if (rule.scan) {
+      for (const [start, end] of rule.scan(content)) {
+        push(rule, start, end);
+      }
+      continue;
+    }
     rule.regex.lastIndex = 0;
     let m;
     while ((m = rule.regex.exec(content)) !== null) {
-      const group = rule.valueGroup ?? 0;
-      const value = m[group];
-      if (value === undefined || value.length === 0) {
+      const group = valueGroupOf(rule, m);
+      const value = group === undefined ? undefined : m[group];
+      if (group === undefined || value === undefined || value.length === 0) {
         continue;
       }
-      const start = group === 0 ? m.index : m.index + m[0].indexOf(value);
-      matches.push({
-        category: "secret",
-        policyId: rule.policyId,
-        severity: rule.severity,
-        confidence: rule.confidence,
-        start,
-        end: start + value.length,
-        value,
-        mask: "secret",
-        remediation: rule.remediation
-      });
+      const start = group === 0 ? m.index : m.indices?.[group]?.[0] ?? m.index + m[0].indexOf(value);
+      push(rule, start, start + value.length);
       if (m.index === rule.regex.lastIndex) {
         rule.regex.lastIndex += 1;
       }
@@ -2918,8 +2948,22 @@ function detectSecrets(content) {
   }
   return matches;
 }
-var RULES2;
+function valueGroupOf(rule, m) {
+  if (rule.valueGroup === undefined) {
+    return 0;
+  }
+  for (let group = rule.valueGroup;group < m.length; group += 1) {
+    if (m[group] !== undefined) {
+      return group;
+    }
+  }
+  return;
+}
+var PRIVATE_KEY_BEGIN, PRIVATE_KEY_END, ASSIGNED_VALUE, RULES2;
 var init_secrets = __esm(() => {
+  PRIVATE_KEY_BEGIN = /-----BEGIN (?:[A-Z0-9]{1,16} ){0,3}PRIVATE KEY(?: BLOCK)?-----/g;
+  PRIVATE_KEY_END = /-----END (?:[A-Z0-9]{1,16} ){0,3}PRIVATE KEY(?: BLOCK)?-----/g;
+  ASSIGNED_VALUE = String.raw`(?:"([^"\n]{6,})"|'([^'\n]{6,})'|["']?([^\s"'#]{6,}))`;
   RULES2 = [
     {
       policyId: "secrets.aws-access-key",
@@ -2935,6 +2979,13 @@ var init_secrets = __esm(() => {
       confidence: 0.97,
       remediation: "Revoke the GitHub token and rotate it."
     },
+    {
+      policyId: "secrets.github-token",
+      regex: /\bgithub_pat_[A-Za-z0-9_]{50,255}\b/g,
+      severity: "critical",
+      confidence: 0.97,
+      remediation: "Revoke the GitHub token and rotate it."
+    },
     {
       policyId: "secrets.google-api-key",
       regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
@@ -2965,14 +3016,15 @@ var init_secrets = __esm(() => {
     },
     {
       policyId: "secrets.private-key-block",
-      regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+      regex: PRIVATE_KEY_BEGIN,
+      scan: scanPrivateKeyBlocks,
       severity: "critical",
       confidence: 0.99,
       remediation: "Remove the private key and rotate the corresponding key pair."
     },
     {
       policyId: "secrets.url-credentials",
-      regex: /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:([^/\s:@]+)@[^\s/]+/gi,
+      regex: /[a-z][a-z0-9+.-]{0,31}:\/\/[^/\s:@]+:([^/\s:@]+)@[^\s/]+/gi,
       severity: "high",
       confidence: 0.92,
       remediation: "Remove inline credentials from URLs; use a secrets store."
@@ -3002,7 +3054,7 @@ var init_secrets = __esm(() => {
     },
     {
       policyId: "secrets.credential-file-assignment",
-      regex: /\b((?:aws_)?secret_access_key|aws_session_token|aws_secret_key|client_secret)\s*[:=]\s*["']?([^\s"'#]{6,})/gi,
+      regex: new RegExp(String.raw`\b((?:aws_)?secret_access_key|aws_session_token|aws_secret_key|client_secret)\s*[:=]\s*` + ASSIGNED_VALUE, "gid"),
       severity: "critical",
       confidence: 0.95,
       remediation: "Rotate the credential; it was read from a credentials file into agent-visible output.",
@@ -3010,7 +3062,7 @@ var init_secrets = __esm(() => {
     },
     {
       policyId: "secrets.env-assignment",
-      regex: /\b([A-Z0-9_]*(?:DATABASE_URL|JWT_SECRET|SECRET(?:_KEY)?|API_?KEY|ACCESS_?KEY|ACCESS_?TOKEN|AUTH_?TOKEN|PASSWORD|PRIVATE_?KEY|TOKEN))["']?\s*[:=]\s*["']?([^\s"'#]{6,})/g,
+      regex: new RegExp(String.raw`\b([A-Z0-9_]*(?:DATABASE_URL|JWT_SECRET|SECRET(?:_KEY)?|API_?KEY|ACCESS_?KEY|ACCESS_?TOKEN|AUTH_?TOKEN|PASSWORD|PRIVATE_?KEY|TOKEN))["']?\s*[:=]\s*` + ASSIGNED_VALUE, "gd"),
       severity: "high",
       confidence: 0.85,
       remediation: "Move the secret to an untracked env file or secrets manager.",
@@ -3021,7 +3073,16 @@ var init_secrets = __esm(() => {
 
 // src/security/detect/egress.ts
 function hostOf(url) {
-  const m = /^https?:\/\/([^/?#]+)/i.exec(url);
+  try {
+    const host = new URL(url).hostname;
+    if (host) {
+      return host.toLowerCase();
+    }
+  } catch {}
+  return literalHostOf(url);
+}
+function literalHostOf(url) {
+  const m = /^https?:[/\\]{2}([^/?#\\]+)/i.exec(url);
   if (!m || m[1] === undefined) {
     return null;
   }
@@ -3030,13 +3091,19 @@ function hostOf(url) {
   if (at >= 0) {
     authority = authority.slice(at + 1);
   }
-  if (!authority.startsWith("[")) {
-    const colon = authority.indexOf(":");
-    if (colon >= 0) {
-      authority = authority.slice(0, colon);
-    }
+  if (authority.startsWith("[")) {
+    const close = authority.indexOf("]");
+    return close > 0 ? authority.slice(0, close + 1).toLowerCase() : null;
+  }
+  const colon = authority.indexOf(":");
+  if (colon >= 0) {
+    authority = authority.slice(0, colon);
   }
-  return authority.toLowerCase();
+  return authority.toLowerCase() || null;
+}
+function hostCandidates(url) {
+  const hosts = [hostOf(url), literalHostOf(url)].filter((h) => !!h);
+  return [...new Set(hosts)];
 }
 function hostAllowed(host, allowlist) {
   const h = host.toLowerCase();
@@ -3045,46 +3112,130 @@ function hostAllowed(host, allowlist) {
     return h === e || h.endsWith(`.${e}`);
   });
 }
-function isSsrfHost(host) {
-  const h = host.toLowerCase().replace(/^\[|\]$/g, "");
-  if (h === "metadata.google.internal" || h === "localhost") {
+function isPrivateV4(a, b) {
+  if (a === 0)
     return true;
-  }
+  if (a === 10)
+    return true;
+  if (a === 100 && b >= 64 && b <= 127)
+    return true;
+  if (a === 127)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  return false;
+}
+function decimalV4(h) {
   const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+  if (!v4)
+    return null;
+  const o = v4.slice(1, 5).map((n) => Number(n));
+  if (o.some((n) => n > 255))
+    return null;
+  return [o[0], o[1]];
+}
+function whatwgV4(h) {
+  const parts = h.split(".");
+  if (parts.length > 1 && parts[parts.length - 1] === "")
+    parts.pop();
+  if (parts.length < 1 || parts.length > 4)
+    return null;
+  const nums = [];
+  for (const p of parts) {
+    let n;
+    if (/^0x[0-9a-f]*$/i.test(p))
+      n = p.length === 2 ? 0 : parseInt(p.slice(2), 16);
+    else if (/^0[0-7]+$/.test(p))
+      n = parseInt(p.slice(1), 8);
+    else if (/^(0|[1-9]\d*)$/.test(p))
+      n = Number(p);
+    else
+      return null;
+    nums.push(n);
+  }
+  const last = nums.pop();
+  if (nums.some((n) => n > 255) || last >= 256 ** (4 - nums.length))
+    return null;
+  let value = last;
+  nums.forEach((n, i) => {
+    value += n * 256 ** (3 - i);
+  });
+  return [Math.floor(value / 2 ** 24), Math.floor(value / 2 ** 16) % 256];
+}
+function parseV6(h) {
+  let text = h;
+  const tail = [];
+  const v4 = /^(.*:)(\d{1,3}(?:\.\d{1,3}){3})$/.exec(text);
   if (v4) {
-    const o = v4.slice(1, 5).map((n) => Number(n));
-    if (o.some((n) => n > 255)) {
-      return false;
+    const o = v4[2].split(".").map(Number);
+    if (o.some((n) => n > 255))
+      return null;
+    tail.push(o[0] << 8 | o[1], o[2] << 8 | o[3]);
+    text = `${v4[1]}0`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2)
+    return null;
+  const read = (s) => {
+    if (s === "")
+      return [];
+    const out = [];
+    for (const g of s.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g))
+        return null;
+      out.push(parseInt(g, 16));
     }
-    const [a, b] = o;
-    if (a === 10)
-      return true;
-    if (a === 127)
-      return true;
-    if (a === 169 && b === 254)
+    return out;
+  };
+  const head = read(halves[0]);
+  const rest = halves.length === 2 ? read(halves[1]) : [];
+  if (!head || !rest)
+    return null;
+  if (tail.length > 0)
+    (rest.length > 0 ? rest : head).pop();
+  const given = head.length + rest.length + tail.length;
+  if (halves.length === 1 ? given !== 8 : given > 7)
+    return null;
+  return [...head, ...new Array(8 - given).fill(0), ...rest, ...tail];
+}
+function isSsrfHost(host) {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (h === "metadata.google.internal" || h === "localhost" || h.endsWith(".localhost")) {
+    return true;
+  }
+  if (h.includes(":")) {
+    const g = parseV6(h.replace(/%.*$/, ""));
+    if (!g)
+      return false;
+    const [g0, , , , , g5, g6, g7] = g;
+    if (g.slice(0, 7).every((x) => x === 0) && g7 <= 1)
       return true;
-    if (a === 172 && b >= 16 && b <= 31)
+    if ((g0 & 65024) === 64512)
       return true;
-    if (a === 192 && b === 168)
+    if ((g0 & 65472) === 65152)
       return true;
+    if (g.slice(0, 5).every((x) => x === 0) && g5 === 65535) {
+      return isPrivateV4(g6 >> 8, g6 & 255);
+    }
     return false;
   }
-  if (h === "::1" || h.startsWith("fc") || h.startsWith("fd") || h.startsWith("fe80")) {
-    return true;
-  }
-  return false;
+  return [decimalV4(h), whatwgV4(h)].some((v4) => v4 !== null && isPrivateV4(v4[0], v4[1]));
 }
 function detectEgress(content, allowlist = []) {
   const matches = [];
-  const ssrfSpans = new Set;
+  const ssrfSpans = [];
   EXTERNAL_URL.lastIndex = 0;
   let m;
   while ((m = EXTERNAL_URL.exec(content)) !== null) {
     const url = m[0];
     const start = m.index;
     const end = start + url.length;
-    const host = hostOf(url);
-    if (host && isSsrfHost(host)) {
+    const hosts = hostCandidates(url);
+    if (hosts.some(isSsrfHost)) {
       matches.push({
         category: "egress",
         policyId: "egress.ssrf-metadata",
@@ -3095,8 +3246,8 @@ function detectEgress(content, allowlist = []) {
         value: url,
         remediation: "Block requests to private, loopback, link-local, or cloud-metadata hosts (SSRF)."
       });
-      ssrfSpans.add(`${start}:${end}`);
-    } else if (host && allowlist.length > 0 && !hostAllowed(host, allowlist)) {
+      ssrfSpans.push({ start, end });
+    } else if (hosts.length > 0 && allowlist.length > 0 && hosts.some((h) => !hostAllowed(h, allowlist))) {
       matches.push({
         category: "egress",
         policyId: "egress.non-allowlisted-domain",
@@ -3126,14 +3277,16 @@ function detectEgress(content, allowlist = []) {
     }
   }
   BARE_SSRF_HOST.lastIndex = 0;
+  let span = 0;
   while ((m = BARE_SSRF_HOST.exec(content)) !== null) {
     const value = m[0];
     const start = m.index;
     const end = start + value.length;
-    const covered = [...ssrfSpans].some((span) => {
-      const [s, e] = span.split(":").map((n) => Number(n));
-      return start >= (s ?? 0) && end <= (e ?? 0);
-    });
+    while (span < ssrfSpans.length && ssrfSpans[span].end <= start) {
+      span += 1;
+    }
+    const cur = ssrfSpans[span];
+    const covered = cur !== undefined && start >= cur.start && end <= cur.end;
     if (!covered && isSsrfHost(value)) {
       matches.push({
         category: "egress",
@@ -3258,7 +3411,7 @@ function isExfilDestination(url, allowlist) {
   return !(allowlist.length > 0 && hostAllowed(host, allowlist));
 }
 function considerUrl(hit, allowlist, out) {
-  if (!isExfilDestination(hit.classify ?? hit.url, allowlist)) {
+  if (!hit.unexamined && !isExfilDestination(hit.classify ?? hit.url, allowlist)) {
     return;
   }
   out.push({
@@ -3649,27 +3802,181 @@ function spanHasNonWhitespace(content, index, budget, start, end) {
   budget.work -= width;
   return stripBlockContainerMarkers(content.slice(start, end)).trim().length > 0;
 }
+function newInlineDestinationCache() {
+  return { readings: new Map, heads: null, bare: new Map };
+}
+function isAsciiPunctuation(code) {
+  return code >= 33 && code <= 47 || code >= 58 && code <= 64 || code >= 91 && code <= 96 || code >= 123 && code <= 126;
+}
+function classificationHeadEnd(content, from, cache) {
+  const heads = cache.heads ??= new Int32Array(content.length + 1);
+  let at = from;
+  while (at < content.length) {
+    const known = heads[at];
+    if (known !== 0) {
+      at = known - 1;
+      break;
+    }
+    const code = content.charCodeAt(at);
+    if (code === 41 || isCollapsibleSpace(code, content[at]))
+      break;
+    at += 1;
+  }
+  for (let fill = from;fill < at && heads[fill] === 0; fill += 1)
+    heads[fill] = at + 1;
+  return at;
+}
+function bareDestinationEnd(content, from, memo) {
+  const known = memo.get(from);
+  if (known !== undefined)
+    return known;
+  const opens = [];
+  const fail = () => {
+    for (const start of opens)
+      memo.set(start, -1);
+    memo.set(from, -1);
+    return -1;
+  };
+  let at = from;
+  for (;; ) {
+    const code = at < content.length ? content.charCodeAt(at) : 0;
+    if (code <= 32 || code === 127 || isCollapsibleSpace(code, content[at])) {
+      if (opens.length === 0)
+        break;
+      memo.set(opens.pop(), at);
+      return fail();
+    }
+    if (code === 92 && isAsciiPunctuation(content.charCodeAt(at + 1))) {
+      at += 2;
+      continue;
+    }
+    if (code === 40) {
+      const inner = memo.get(at + 1);
+      if (inner === undefined) {
+        if (opens.length >= MAX_DESTINATION_PAREN_DEPTH)
+          return fail();
+        opens.push(at + 1);
+        at += 1;
+        continue;
+      }
+      if (inner === -1 || content.charCodeAt(inner) !== 41)
+        return fail();
+      at = inner + 1;
+      continue;
+    }
+    if (code === 41) {
+      if (opens.length === 0)
+        break;
+      memo.set(opens.pop(), at);
+    }
+    at += 1;
+  }
+  memo.set(from, at);
+  return at;
+}
+function skipSpacesAndTabs(content, from) {
+  let at = from;
+  while (at < content.length) {
+    const code = content.charCodeAt(at);
+    if (code !== 32 && code !== 9)
+      break;
+    at += 1;
+  }
+  return at;
+}
+function resolvesAsInline(content, from, at, memo) {
+  for (let gap = from;gap < at; gap += 1) {
+    const code = content.charCodeAt(gap);
+    if (code !== 32 && code !== 9)
+      return false;
+  }
+  let cursor = at;
+  if (content.charCodeAt(cursor) === 60) {
+    for (cursor += 1;; cursor += 1) {
+      if (cursor >= content.length)
+        return false;
+      const code = content.charCodeAt(cursor);
+      if (code === 92 && isAsciiPunctuation(content.charCodeAt(cursor + 1))) {
+        cursor += 1;
+        continue;
+      }
+      if (code === 62)
+        break;
+      if (code === 60 || code === 10 || code === 13)
+        return false;
+    }
+    cursor += 1;
+  } else {
+    cursor = bareDestinationEnd(content, cursor, memo);
+    if (cursor === -1)
+      return false;
+  }
+  const destinationEnd = cursor;
+  cursor = skipSpacesAndTabs(content, cursor);
+  if (content[cursor] === ")")
+    return true;
+  if (cursor === destinationEnd)
+    return false;
+  const opener = content[cursor];
+  const closer = opener === "(" ? ")" : opener === '"' || opener === "'" ? opener : null;
+  if (closer === null)
+    return false;
+  for (cursor += 1;; cursor += 1) {
+    if (cursor >= content.length)
+      return false;
+    const code = content.charCodeAt(cursor);
+    if (code === 92 && isAsciiPunctuation(content.charCodeAt(cursor + 1))) {
+      cursor += 1;
+      continue;
+    }
+    if (content[cursor] === closer)
+      break;
+    if (opener === "(" && code === 40)
+      return false;
+    if (LINE_TERMINATORS.has(code))
+      return false;
+  }
+  return content[skipSpacesAndTabs(content, cursor + 1)] === ")";
+}
 function readInlineDestination(content, index, descriptionEnd, cache) {
-  const cached = cache.get(descriptionEnd);
+  const cached = cache.readings.get(descriptionEnd);
   if (cached !== undefined)
     return cached;
   let destination = null;
   if (content[descriptionEnd] === "(" && firstAtOrAfter(index.closeParens, descriptionEnd) !== -1) {
     const at = skipDestinationLeadingWhitespace(content, descriptionEnd + 1);
-    INLINE_DESTINATION.lastIndex = at;
-    const match = INLINE_DESTINATION.exec(content);
-    const url = match ? match[1] ?? match[2] ?? "" : "";
-    if (match && url) {
+    const head = readClassifiedHead(content, index, at, cache);
+    if (head) {
       destination = {
-        url,
-        start: at + match[0].indexOf(url),
-        end: INLINE_DESTINATION.lastIndex
+        ...head,
+        resolves: resolvesAsInline(content, descriptionEnd + 1, at, cache.bare)
       };
     }
   }
-  cache.set(descriptionEnd, destination);
+  cache.readings.set(descriptionEnd, destination);
   return destination;
 }
+function readClassifiedHead(content, index, at, cache) {
+  if (content[at] === "<") {
+    let close = at + 1;
+    while (close < content.length && !`<>
+`.includes(content[close])) {
+      close += 1;
+    }
+    const paren = content[close] === ">" ? firstAtOrAfter(index.closeParens, close + 1) : -1;
+    if (paren !== -1) {
+      const url = content.slice(at + 1, close);
+      return url ? { url, start: at + 1, end: paren + 1 } : null;
+    }
+  }
+  const headEnd = classificationHeadEnd(content, at, cache);
+  if (headEnd === at)
+    return null;
+  const paren = firstAtOrAfter(index.closeParens, headEnd);
+  if (paren === -1)
+    return null;
+  return { url: content.slice(at, headEnd), start: at, end: paren + 1 };
+}
 function readBracketConstructs(content, index, open, destinations, budget, wantReference) {
   const constructs = [];
   const { ends, blind } = descriptionEnds(index, open);
@@ -3684,7 +3991,8 @@ function readBracketConstructs(content, index, open, destinations, budget, wantR
         start: inline.start,
         descriptionEnd,
         end: inline.end,
-        escapeAware
+        escapeAware,
+        resolves: inline.resolves
       });
       continue;
     }
@@ -3792,13 +4100,8 @@ function readStartTag(content, from) {
   }
   return { attributes, end: index };
 }
-function isSensitiveDestination(url, descriptionEnd, cache) {
-  const cached = cache.get(descriptionEnd);
-  if (cached !== undefined)
-    return cached;
-  const sensitive = SENSITIVE_URL_VALUE.test(url);
-  cache.set(descriptionEnd, sensitive);
-  return sensitive;
+function isSensitiveDestination(url) {
+  return SENSITIVE_URL_VALUE.test(url) || SENSITIVE_URL_VALUE.test(renderableUrl(url));
 }
 function countCommas(value) {
   let total = 0;
@@ -3811,6 +4114,8 @@ function countCommas(value) {
 function detectExfil(content, allowlist = []) {
   const matches = [];
   let m;
+  if (!content.includes("[") && !content.includes("<"))
+    return matches;
   const {
     refs,
     maxLength: maxLabelLength,
@@ -3824,11 +4129,12 @@ function detectExfil(content, allowlist = []) {
     work: LABEL_WORK_FACTOR * content.length,
     exhausted: false
   };
-  const destinations = new Map;
+  const destinations = newInlineDestinationCache();
   let destinationStart = -1;
   let destinationEnd = -1;
-  const sensitive = new Map;
   const flaggedInlineStarts = new Set;
+  const examinedLinkStarts = new Set;
+  let classifyWork = INLINE_CLASSIFY_WORK_FACTOR * content.length;
   BRACKET_OPEN.lastIndex = 0;
   while ((m = BRACKET_OPEN.exec(content)) !== null) {
     const isImage = m[1] === "!";
@@ -3841,7 +4147,7 @@ function detectExfil(content, allowlist = []) {
     if (!inline || inline.kind !== "inline") {
       continue;
     }
-    if (inline.escapeAware) {} else if (isImage) {
+    if (inline.escapeAware || !inline.resolves) {} else if (isImage) {
       BRACKET_OPEN.lastIndex = inline.end;
     } else {
       destinationStart = inline.descriptionEnd;
@@ -3849,15 +4155,26 @@ function detectExfil(content, allowlist = []) {
     }
     if (flaggedInlineStarts.has(inline.start))
       continue;
-    if (!isImage && !isSensitiveDestination(inline.url, inline.descriptionEnd, sensitive)) {
-      continue;
+    if (!isImage) {
+      if (examinedLinkStarts.has(inline.start))
+        continue;
+      examinedLinkStarts.add(inline.start);
     }
-    flaggedInlineStarts.add(inline.start);
-    considerUrl({
+    const hit = {
       url: inline.url,
       start: inline.start,
       policyId: isImage ? "egress.markdown-image-exfil" : "egress.markdown-link-sensitive-value"
-    }, allowlist, matches);
+    };
+    if (inline.url.length > classifyWork) {
+      flaggedInlineStarts.add(inline.start);
+      considerUrl({ ...hit, unexamined: true }, allowlist, matches);
+      continue;
+    }
+    classifyWork -= inline.url.length;
+    if (!isImage && !isSensitiveDestination(inline.url))
+      continue;
+    flaggedInlineStarts.add(inline.start);
+    considerUrl(hit, allowlist, matches);
   }
   destinationStart = -1;
   destinationEnd = -1;
@@ -3873,7 +4190,7 @@ function detectExfil(content, allowlist = []) {
     const constructs = readBracketConstructs(content, index, open, destinations, budget, isImage);
     const inline = constructs.find((construct) => construct.kind === "inline");
     if (inline && inline.kind === "inline") {
-      if (!inline.escapeAware) {
+      if (!inline.escapeAware && inline.resolves) {
         if (isImage)
           BRACKET_OPEN.lastIndex = inline.end;
         else {
@@ -4035,7 +4352,7 @@ function scanHtmlStartTags(source, content, origin, allowlist, out) {
     }
   }
 }
-var EXFIL_CONFIDENCE = 0.85, NAMED_CHARACTER_REFERENCES, CHARACTER_REFERENCE, MAX_DECODE_PASSES = 3, MAX_CODE_POINT = 1114111, URL_STRIPPED_CHARACTERS, C0_OR_SPACE = 32, SYNTHETIC_BASE_PAIRS, FETCH_REMEDIATION = "Strip or allowlist auto-fetched destinations in rendered output \u2014 markdown images, <img>/<image>/<input type=image>/<video poster>/background, media and embedded-content elements, and any <base href> that re-points them; they exfiltrate context on render.", META_REFRESH_REMEDIATION = "Strip or allowlist this <meta http-equiv=refresh>. It is not a subresource fetch: on render it navigates the whole client to the destination, so the entire directive is masked rather than the URL alone.", BASE_REMEDIATION = "Strip or allowlist this <base href>. Unlike an <img src>, masking it re-points EVERY relative URL in the document to the reader's own origin, so a false positive here changes the whole document's resolution, not just one destination.", UNICODE_WHITESPACE, BRACKET_OPEN, INLINE_DESTINATION, REFERENCE_DESTINATION, LABEL_WHITESPACE_RUN, LINE_TERMINATORS, LABEL_WORK_FACTOR = 8, HTML_START_TAG, IMAGE_POLICY = "egress.html-image-exfil", MEDIA_POLICY = "egress.html-media-exfil", EMBEDDED_POLICY = "egress.html-embedded-document-exfil", IMAGE_URL, IMAGE_SRCSET, MEDIA_URL, MEDIA_SRCSET, EMBEDDED_URL, BACKGROUND_ONLY, FETCHING_ATTRIBUTES, META_REFRESH_CONTENT, SENSITIVE_URL_VALUE, SRCSET_DESCRIPTOR;
+var EXFIL_CONFIDENCE = 0.85, NAMED_CHARACTER_REFERENCES, CHARACTER_REFERENCE, MAX_DECODE_PASSES = 3, MAX_CODE_POINT = 1114111, URL_STRIPPED_CHARACTERS, C0_OR_SPACE = 32, SYNTHETIC_BASE_PAIRS, FETCH_REMEDIATION = "Strip or allowlist auto-fetched destinations in rendered output \u2014 markdown images, <img>/<image>/<input type=image>/<video poster>/background, media and embedded-content elements, and any <base href> that re-points them; they exfiltrate context on render.", META_REFRESH_REMEDIATION = "Strip or allowlist this <meta http-equiv=refresh>. It is not a subresource fetch: on render it navigates the whole client to the destination, so the entire directive is masked rather than the URL alone.", BASE_REMEDIATION = "Strip or allowlist this <base href>. Unlike an <img src>, masking it re-points EVERY relative URL in the document to the reader's own origin, so a false positive here changes the whole document's resolution, not just one destination.", UNICODE_WHITESPACE, BRACKET_OPEN, REFERENCE_DESTINATION, LABEL_WHITESPACE_RUN, LINE_TERMINATORS, LABEL_WORK_FACTOR = 8, MAX_DESTINATION_PAREN_DEPTH = 32, HTML_START_TAG, IMAGE_POLICY = "egress.html-image-exfil", MEDIA_POLICY = "egress.html-media-exfil", EMBEDDED_POLICY = "egress.html-embedded-document-exfil", IMAGE_URL, IMAGE_SRCSET, MEDIA_URL, MEDIA_SRCSET, EMBEDDED_URL, BACKGROUND_ONLY, FETCHING_ATTRIBUTES, META_REFRESH_CONTENT, SENSITIVE_URL_VALUE, INLINE_CLASSIFY_WORK_FACTOR = 8, SRCSET_DESCRIPTOR;
 var init_exfil = __esm(() => {
   init_egress();
   NAMED_CHARACTER_REFERENCES = {
@@ -4085,7 +4402,6 @@ var init_exfil = __esm(() => {
   ];
   UNICODE_WHITESPACE = /\s/;
   BRACKET_OPEN = /(!?)\[/g;
-  INLINE_DESTINATION = /(?:<([^<>\n]*)>|([^)\s]+))[^)]*\)/y;
   REFERENCE_DESTINATION = /(?:<([^<>\n]*)>|(\S+))/y;
   LABEL_WHITESPACE_RUN = /\s+/g;
   LINE_TERMINATORS = new Set([10, 13, 8232, 8233]);
@@ -4127,6 +4443,356 @@ var init_exfil = __esm(() => {
   SRCSET_DESCRIPTOR = /\s+/;
 });
 
+// src/security/detect/entropy.ts
+function isAdjacentLabel(content, start) {
+  const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
+  if (ADJACENT_LABEL.test(before)) {
+    return true;
+  }
+  if (before.trim().length > 0) {
+    return false;
+  }
+  let lineStart = start - 1;
+  while (lineStart >= 0 && content[lineStart] !== `
+` && /\s/.test(content[lineStart])) {
+    lineStart -= 1;
+  }
+  if (lineStart < 0 || content[lineStart] !== `
+`) {
+    return false;
+  }
+  const prevTail = lastLineOf(content.slice(Math.max(0, lineStart - CONTINUATION_WINDOW), lineStart)).trimEnd();
+  return CONTINUATION_LABEL_LINE_RE.test(prevTail);
+}
+function isHexBlob(value) {
+  return HEX_BLOB.test(value) && /[a-f]/i.test(value);
+}
+function isAllowShapedValue(value) {
+  return FULL_GIT_SHA_RE.test(value) || UUID_RE.test(value) || INTEGRITY_RE.test(value);
+}
+function lastLineOf(before) {
+  const newline = before.lastIndexOf(`
+`);
+  return newline < 0 ? before : before.slice(newline + 1);
+}
+function isPlainCasedWord(letters) {
+  return /^[a-z]+$/.test(letters) || /^[A-Z]+$/.test(letters) || /^[A-Z][a-z]*$/.test(letters);
+}
+function isSingleTransitionTag(segment) {
+  const letterThenDigit = /^([A-Za-z]+)([0-9]+)$/.exec(segment);
+  if (letterThenDigit !== null) {
+    const letters = letterThenDigit[1];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  const digitThenLetter = /^([0-9]+)([A-Za-z]+)$/.exec(segment);
+  if (digitThenLetter !== null) {
+    const letters = digitThenLetter[2];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  return false;
+}
+function isSlugHexTail(segment) {
+  return SLUG_HEX_TAIL_RE.test(segment);
+}
+function isWordSlug(value) {
+  const segments = value.split(/[-_]/);
+  if (segments.length < 3) {
+    return false;
+  }
+  let words = 0;
+  for (let i = 0;i < segments.length; i += 1) {
+    const segment = segments[i];
+    const isDigits = /^[0-9]+$/.test(segment);
+    if (isDigits) {
+      continue;
+    }
+    if (isPlainCasedWord(segment)) {
+      if (segment.length >= 3) {
+        words += 1;
+      }
+      continue;
+    }
+    if (isSingleTransitionTag(segment)) {
+      continue;
+    }
+    if (i === segments.length - 1 && isSlugHexTail(segment)) {
+      continue;
+    }
+    return false;
+  }
+  return words >= 1;
+}
+function shannonEntropy(value) {
+  const counts = new Map;
+  for (const ch of value) {
+    counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  }
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const p = count / value.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function bareShapeQualifies(head) {
+  if (!/[0-9]/.test(head) && !/[+=]/.test(head)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  if (isWordSlug(head)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  const entropy = shannonEntropy(head);
+  const hexBlob = isHexBlob(head);
+  if (entropy < ENTROPY_FLOOR_BITS && !hexBlob) {
+    return { qualifies: false, entropy };
+  }
+  return { qualifies: true, entropy };
+}
+function shapeQualifiesAsSecret(value) {
+  if (isAllowShapedValue(value)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  return bareShapeQualifies(value);
+}
+function looksSecretShaped(value) {
+  return shapeQualifiesAsSecret(value).qualifies;
+}
+function buildMatch(start, end, value, entropy) {
+  const confidence = Math.max(0.4, Math.min(0.7, 0.4 + (entropy - ENTROPY_FLOOR_BITS) * 0.21));
+  return {
+    category: "secret",
+    policyId: "secrets.high-entropy",
+    severity: "medium",
+    confidence: Number(confidence.toFixed(2)),
+    start,
+    end,
+    value,
+    mask: "entropy",
+    remediation: "Verify this high-entropy value is not a live credential."
+  };
+}
+function overlaps(a, start, end) {
+  return start < a.end && end > a.start;
+}
+function isKnownDocumentHost(authority) {
+  if (authority.includes("@")) {
+    return false;
+  }
+  const host = authority.replace(/:[0-9]*$/, "").toLowerCase();
+  return DOCUMENT_HOSTS.has(host) || NOTION_SITE_HOST_RE.test(host);
+}
+function findUrlSpans(content) {
+  const spans = [];
+  URL_SPAN_RE.lastIndex = 0;
+  let m;
+  while ((m = URL_SPAN_RE.exec(content)) !== null) {
+    let raw = m[0];
+    while (raw.length > 0 && URL_TRAILING_PUNCTUATION_RE.test(raw)) {
+      raw = raw.slice(0, -1);
+    }
+    if (raw.length > 0) {
+      spans.push({ start: m.index, end: m.index + raw.length, raw });
+    }
+    if (m.index === URL_SPAN_RE.lastIndex) {
+      URL_SPAN_RE.lastIndex += 1;
+    }
+  }
+  return spans;
+}
+function urlComponentSpans(raw) {
+  const spans = [];
+  const schemeMatch = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.exec(raw);
+  if (schemeMatch === null) {
+    return spans;
+  }
+  let i = schemeMatch[0].length;
+  while (i < raw.length && raw[i] !== "/" && raw[i] !== "?" && raw[i] !== "#") {
+    i += 1;
+  }
+  const documentHost = isKnownDocumentHost(raw.slice(schemeMatch[0].length, i));
+  let pathEnd = i;
+  while (pathEnd < raw.length && raw[pathEnd] !== "?" && raw[pathEnd] !== "#") {
+    pathEnd += 1;
+  }
+  let segStart = i;
+  for (let j = i;j <= pathEnd; j += 1) {
+    if (j === pathEnd || raw[j] === "/") {
+      if (j > segStart && !documentHost) {
+        spans.push({ start: segStart, end: j, kind: "path" });
+      }
+      segStart = j + 1;
+    }
+  }
+  let cursor = pathEnd;
+  if (cursor < raw.length && raw[cursor] === "?") {
+    let queryEnd = cursor + 1;
+    while (queryEnd < raw.length && raw[queryEnd] !== "#") {
+      queryEnd += 1;
+    }
+    let pairStart = cursor + 1;
+    for (let j = cursor + 1;j <= queryEnd; j += 1) {
+      if (j === queryEnd || raw[j] === "&") {
+        const pair = raw.slice(pairStart, j);
+        const eq = pair.indexOf("=");
+        if (eq !== -1 && eq + 1 < pair.length) {
+          spans.push({ start: pairStart + eq + 1, end: j, kind: "query" });
+        } else if (eq === -1 && pair.length > 0) {
+          spans.push({ start: pairStart, end: j, kind: "query" });
+        }
+        pairStart = j + 1;
+      }
+    }
+    cursor = queryEnd;
+  }
+  if (cursor < raw.length && raw[cursor] === "#" && cursor + 1 < raw.length) {
+    spans.push({ start: cursor + 1, end: raw.length, kind: "fragment" });
+  }
+  return spans;
+}
+function isQueryWord(word) {
+  return /^(?:[A-Za-z]*|[0-9]+)$/.test(word) || isSingleTransitionTag(word);
+}
+function isQueryWordRun(run) {
+  return run.includes("+") && run.split("+").every((piece) => piece.split(/[-_]/).every(isQueryWord));
+}
+function secretShapedCandidatesIn(text) {
+  const normalized = text.replace(TOKEN_RUN, (run) => isQueryWordRun(run) ? run.replace(/\+/g, " ") : run);
+  const out = [];
+  TOKEN.lastIndex = 0;
+  let m;
+  while ((m = TOKEN.exec(normalized)) !== null) {
+    const value = m[0];
+    if (value.length < URL_COMPONENT_MIN_LENGTH) {
+      continue;
+    }
+    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
+    const { qualifies, entropy } = shapeQualifiesAsSecret(head);
+    if (!qualifies) {
+      continue;
+    }
+    const start = m.index;
+    const end = start + value.length;
+    out.push({ start, end, value: text.slice(start, end), entropy });
+  }
+  return out;
+}
+function looksSecretShapedIn(text) {
+  return secretShapedCandidatesIn(text).length > 0;
+}
+function labelledPieceQualifies(piece) {
+  if (isAllowShapedValue(piece)) {
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (isHexBlob(piece)) {
+    return { entropy: shannonEntropy(piece) };
+  }
+  if (!/[0-9]/.test(piece) && !/[+=]/.test(piece)) {
+    return null;
+  }
+  const withoutSeparators = piece.replace(/[-_.+]/g, "");
+  const entropy = shannonEntropy(withoutSeparators.length > 0 ? withoutSeparators : piece);
+  if (entropy >= ENTROPY_FLOOR_BITS) {
+    return { entropy };
+  }
+  return null;
+}
+function isPathWordPiece(piece) {
+  return /^[A-Za-z]{3,}$/.test(piece) && isPlainCasedWord(piece) || isWordSlug(piece);
+}
+function labelledValueQualifies(head) {
+  if (!head.includes("/")) {
+    return labelledPieceQualifies(head);
+  }
+  let pathLike = false;
+  for (const piece of head.split("/")) {
+    if (piece.length === 0) {
+      continue;
+    }
+    const found = labelledPieceQualifies(piece);
+    if (found !== null) {
+      return found;
+    }
+    pathLike ||= isPathWordPiece(piece);
+  }
+  return pathLike ? null : labelledPieceQualifies(head.replace(/\//g, ""));
+}
+function detectEntropy(content) {
+  const matches = [];
+  const urlSpans = findUrlSpans(content);
+  for (const url of urlSpans) {
+    for (const comp of urlComponentSpans(url.raw)) {
+      const compText = url.raw.slice(comp.start, comp.end);
+      for (const cand of secretShapedCandidatesIn(compText)) {
+        const absStart = url.start + comp.start + cand.start;
+        const absEnd = url.start + comp.start + cand.end;
+        matches.push(buildMatch(absStart, absEnd, cand.value, cand.entropy));
+      }
+    }
+  }
+  LABEL_ASSIGNMENT_RE.lastIndex = 0;
+  let am;
+  while ((am = LABEL_ASSIGNMENT_RE.exec(content)) !== null) {
+    const value = am[1];
+    const end = am.index + am[0].length;
+    const start = end - value.length;
+    if (urlSpans.some((u) => overlaps(u, start, end))) {
+      continue;
+    }
+    const found = labelledValueQualifies(value.split(".")[0]);
+    if (found !== null) {
+      matches.push(buildMatch(start, end, value, found.entropy));
+    }
+  }
+  TOKEN.lastIndex = 0;
+  let m;
+  while ((m = TOKEN.exec(content)) !== null) {
+    const value = m[0];
+    const start = m.index;
+    const end = start + value.length;
+    if (urlSpans.some((u) => overlaps(u, start, end))) {
+      continue;
+    }
+    if (matches.some((existing) => overlaps(existing, start, end))) {
+      continue;
+    }
+    if (!isAdjacentLabel(content, start)) {
+      continue;
+    }
+    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
+    const found = labelledValueQualifies(head);
+    if (found === null) {
+      continue;
+    }
+    matches.push(buildMatch(start, end, value, found.entropy));
+  }
+  return matches.sort((a, b) => a.start - b.start);
+}
+var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", LABEL_CONTINUATION_MAX = 40, ENTROPY_FLOOR_BITS = 3.6, caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), FILLER_WORDS = "is|was|set|to|the|value|now", ADJACENT_LABEL, CONTINUATION_LABEL_LINE_RE, CONTINUATION_WINDOW, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20, DOCUMENT_HOSTS, NOTION_SITE_HOST_RE, TOKEN_RUN;
+var init_entropy = __esm(() => {
+  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]{0,${LABEL_CONTINUATION_MAX}}` + `(?:\\s+(?:${caseless(FILLER_WORDS)})){0,2}` + `["']?\\s*[:=]?\\s*["']?$`);
+  CONTINUATION_LABEL_LINE_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]{0,${LABEL_CONTINUATION_MAX}}["']?\\s*[:=]?\\s*\\\\\\s*$`);
+  CONTINUATION_WINDOW = 2 * LABEL_CONTINUATION_MAX;
+  LABEL_ASSIGNMENT_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${SENSITIVE_LABEL_WORDS})[A-Za-z0-9_-]{0,${LABEL_CONTINUATION_MAX}}"?\\s*=\\s*"?` + `([A-Za-z0-9+/_=-]{6,}(?:\\.[A-Za-z0-9+/_=-]{6,})*)`, "gi");
+  TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
+  TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
+  HEX_BLOB = /^[0-9a-f]{24,}$/i;
+  FULL_GIT_SHA_RE = /^[0-9a-f]{40}$/i;
+  UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  INTEGRITY_RE = /^(?:sha256|sha512)-[A-Za-z0-9+/]+=*$/;
+  SLUG_HEX_TAIL_RE = /^[0-9a-f]{10,16}$/i;
+  URL_SPAN_RE = /\bhttps?:\/\/[^\s<>"'\\]+/g;
+  URL_TRAILING_PUNCTUATION_RE = /[.,;:!?)\]}]$/;
+  DOCUMENT_HOSTS = new Set([
+    "docs.google.com",
+    "sheets.google.com",
+    "drive.google.com",
+    "notion.so",
+    "www.notion.so"
+  ]);
+  NOTION_SITE_HOST_RE = /^[a-z0-9-]+\.notion\.site$/;
+  TOKEN_RUN = /[A-Za-z0-9+/=_-]+/g;
+});
+
 // src/lib/contained-path.ts
 import { lstat as lstat3, realpath as realpath3 } from "fs/promises";
 import { existsSync as existsSync2, lstatSync, realpathSync } from "fs";
@@ -4157,7 +4823,7 @@ function isInside(root, candidate) {
 function outsideProjectMessage(candidate, rootReal) {
   return `refused: ${candidate} resolves outside the project root. Paths must stay inside ${rootReal}.`;
 }
-async function resolveContainedPath(projectRoot, candidate) {
+async function resolveContainedPath(projectRoot, candidate, baseDir) {
   try {
     const rootStat = await lstat3(projectRoot);
     if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
@@ -4167,7 +4833,7 @@ async function resolveContainedPath(projectRoot, candidate) {
     return { ok: false, reason: "not-found", message: `no such file or directory: ${candidate}` };
   }
   const rootReal = await realpath3(projectRoot).catch(() => path10.resolve(projectRoot));
-  const absolute = path10.resolve(rootReal, candidate);
+  const absolute = path10.resolve(baseDir ?? rootReal, candidate);
   const real = await realpath3(absolute).catch(() => null);
   const effective = real ?? absolute;
   if (!isInside(rootReal, effective)) {
@@ -4771,330 +5437,6 @@ var init_config = __esm(() => {
   ]);
 });
 
-// src/security/detect/entropy.ts
-function isAdjacentLabel(content, start) {
-  const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
-  if (ADJACENT_LABEL.test(before)) {
-    return true;
-  }
-  if (before.trim().length > 0) {
-    return false;
-  }
-  const lineStart = content.lastIndexOf(`
-`, start - 1);
-  if (lineStart < 0) {
-    return false;
-  }
-  const prevLineStart = content.lastIndexOf(`
-`, lineStart - 1) + 1;
-  const prevLine = content.slice(prevLineStart, lineStart);
-  return CONTINUATION_LABEL_LINE_RE.test(prevLine);
-}
-function isHexBlob(value) {
-  return HEX_BLOB.test(value) && /[a-f]/i.test(value);
-}
-function isAllowShapedValue(value) {
-  return FULL_GIT_SHA_RE.test(value) || UUID_RE.test(value) || INTEGRITY_RE.test(value);
-}
-function lastLineOf(before) {
-  const newline = before.lastIndexOf(`
-`);
-  return newline < 0 ? before : before.slice(newline + 1);
-}
-function isPlainCasedWord(letters) {
-  return /^[a-z]+$/.test(letters) || /^[A-Z]+$/.test(letters) || /^[A-Z][a-z]*$/.test(letters);
-}
-function isSingleTransitionTag(segment) {
-  const letterThenDigit = /^([A-Za-z]+)([0-9]+)$/.exec(segment);
-  if (letterThenDigit !== null) {
-    const letters = letterThenDigit[1];
-    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
-  }
-  const digitThenLetter = /^([0-9]+)([A-Za-z]+)$/.exec(segment);
-  if (digitThenLetter !== null) {
-    const letters = digitThenLetter[2];
-    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
-  }
-  return false;
-}
-function isSlugHexTail(segment) {
-  return SLUG_HEX_TAIL_RE.test(segment);
-}
-function isWordSlug(value) {
-  const segments = value.split(/[-_]/);
-  if (segments.length < 3) {
-    return false;
-  }
-  let words = 0;
-  for (let i = 0;i < segments.length; i += 1) {
-    const segment = segments[i];
-    const isDigits = /^[0-9]+$/.test(segment);
-    if (isDigits) {
-      continue;
-    }
-    if (isPlainCasedWord(segment)) {
-      if (segment.length >= 3) {
-        words += 1;
-      }
-      continue;
-    }
-    if (isSingleTransitionTag(segment)) {
-      continue;
-    }
-    if (i === segments.length - 1 && isSlugHexTail(segment)) {
-      continue;
-    }
-    return false;
-  }
-  return words >= 1;
-}
-function shannonEntropy(value) {
-  const counts = new Map;
-  for (const ch of value) {
-    counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  }
-  let entropy = 0;
-  for (const count of counts.values()) {
-    const p = count / value.length;
-    entropy -= p * Math.log2(p);
-  }
-  return entropy;
-}
-function bareShapeQualifies(head) {
-  if (!/[0-9]/.test(head) && !/[+=]/.test(head)) {
-    return { qualifies: false, entropy: 0 };
-  }
-  if (isWordSlug(head)) {
-    return { qualifies: false, entropy: 0 };
-  }
-  const entropy = shannonEntropy(head);
-  const hexBlob = isHexBlob(head);
-  if (entropy < 3.6 && !hexBlob) {
-    return { qualifies: false, entropy };
-  }
-  return { qualifies: true, entropy };
-}
-function shapeQualifiesAsSecret(value) {
-  if (isAllowShapedValue(value)) {
-    return { qualifies: false, entropy: 0 };
-  }
-  return bareShapeQualifies(value);
-}
-function looksSecretShaped(value) {
-  return shapeQualifiesAsSecret(value).qualifies;
-}
-function buildMatch(start, end, value, entropy) {
-  const confidence = Math.max(0.4, Math.min(0.7, 0.4 + (entropy - 3.6) * 0.21));
-  return {
-    category: "secret",
-    policyId: "secrets.high-entropy",
-    severity: "medium",
-    confidence: Number(confidence.toFixed(2)),
-    start,
-    end,
-    value,
-    mask: "entropy",
-    remediation: "Verify this high-entropy value is not a live credential."
-  };
-}
-function findUrlSpans(content) {
-  const spans = [];
-  URL_SPAN_RE.lastIndex = 0;
-  let m;
-  while ((m = URL_SPAN_RE.exec(content)) !== null) {
-    let raw = m[0];
-    while (raw.length > 0 && URL_TRAILING_PUNCTUATION_RE.test(raw)) {
-      raw = raw.slice(0, -1);
-    }
-    if (raw.length > 0) {
-      spans.push({ start: m.index, end: m.index + raw.length, raw });
-    }
-    if (m.index === URL_SPAN_RE.lastIndex) {
-      URL_SPAN_RE.lastIndex += 1;
-    }
-  }
-  return spans;
-}
-function urlComponentSpans(raw) {
-  const spans = [];
-  const schemeMatch = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.exec(raw);
-  if (schemeMatch === null) {
-    return spans;
-  }
-  let i = schemeMatch[0].length;
-  while (i < raw.length && raw[i] !== "/" && raw[i] !== "?" && raw[i] !== "#") {
-    i += 1;
-  }
-  let pathEnd = i;
-  while (pathEnd < raw.length && raw[pathEnd] !== "?" && raw[pathEnd] !== "#") {
-    pathEnd += 1;
-  }
-  let segStart = i;
-  for (let j = i;j <= pathEnd; j += 1) {
-    if (j === pathEnd || raw[j] === "/") {
-      if (j > segStart) {
-        spans.push({ start: segStart, end: j });
-      }
-      segStart = j + 1;
-    }
-  }
-  let cursor = pathEnd;
-  if (cursor < raw.length && raw[cursor] === "?") {
-    let queryEnd = cursor + 1;
-    while (queryEnd < raw.length && raw[queryEnd] !== "#") {
-      queryEnd += 1;
-    }
-    let pairStart = cursor + 1;
-    for (let j = cursor + 1;j <= queryEnd; j += 1) {
-      if (j === queryEnd || raw[j] === "&") {
-        const pair = raw.slice(pairStart, j);
-        const eq = pair.indexOf("=");
-        if (eq !== -1 && eq + 1 < pair.length) {
-          spans.push({ start: pairStart + eq + 1, end: j });
-        } else if (eq === -1 && pair.length > 0) {
-          spans.push({ start: pairStart, end: j });
-        }
-        pairStart = j + 1;
-      }
-    }
-    cursor = queryEnd;
-  }
-  if (cursor < raw.length && raw[cursor] === "#" && cursor + 1 < raw.length) {
-    spans.push({ start: cursor + 1, end: raw.length });
-  }
-  return spans;
-}
-function secretShapedCandidatesIn(text) {
-  const normalized = text.replace(/\+/g, " ");
-  const out = [];
-  TOKEN.lastIndex = 0;
-  let m;
-  while ((m = TOKEN.exec(normalized)) !== null) {
-    const value = m[0];
-    if (value.length < URL_COMPONENT_MIN_LENGTH) {
-      continue;
-    }
-    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
-    const { qualifies, entropy } = shapeQualifiesAsSecret(head);
-    if (!qualifies) {
-      continue;
-    }
-    const start = m.index;
-    const end = start + value.length;
-    out.push({ start, end, value: text.slice(start, end), entropy });
-  }
-  return out;
-}
-function looksSecretShapedIn(text) {
-  return secretShapedCandidatesIn(text).length > 0;
-}
-function labelledPieceQualifies(piece) {
-  if (isAllowShapedValue(piece)) {
-    return { entropy: shannonEntropy(piece) };
-  }
-  if (isHexBlob(piece)) {
-    return { entropy: shannonEntropy(piece) };
-  }
-  if (!/[0-9]/.test(piece) && !/[+=]/.test(piece)) {
-    return null;
-  }
-  const withoutSeparators = piece.replace(/[-_.+]/g, "");
-  const entropy = shannonEntropy(withoutSeparators.length > 0 ? withoutSeparators : piece);
-  if (entropy >= 3.6) {
-    return { entropy };
-  }
-  return null;
-}
-function firstQualifyingSlashPiece(head) {
-  let offset = 0;
-  for (const piece of head.split("/")) {
-    if (piece.length > 0) {
-      const found = labelledPieceQualifies(piece);
-      if (found !== null) {
-        return { offset, length: piece.length, entropy: found.entropy };
-      }
-    }
-    offset += piece.length + 1;
-  }
-  return null;
-}
-function detectEntropy(content) {
-  const matches = [];
-  const urlSpans = findUrlSpans(content);
-  for (const url of urlSpans) {
-    for (const comp of urlComponentSpans(url.raw)) {
-      const compText = url.raw.slice(comp.start, comp.end);
-      for (const cand of secretShapedCandidatesIn(compText)) {
-        const absStart = url.start + comp.start + cand.start;
-        const absEnd = url.start + comp.start + cand.end;
-        matches.push(buildMatch(absStart, absEnd, cand.value, cand.entropy));
-      }
-    }
-  }
-  LABEL_ASSIGNMENT_RE.lastIndex = 0;
-  let am;
-  while ((am = LABEL_ASSIGNMENT_RE.exec(content)) !== null) {
-    const value = am[1];
-    const end = am.index + am[0].length;
-    const start = end - value.length;
-    if (urlSpans.some((u) => start < u.end && end > u.start)) {
-      continue;
-    }
-    const found = labelledPieceQualifies(value);
-    if (found !== null) {
-      matches.push(buildMatch(start, end, value, found.entropy));
-    }
-  }
-  TOKEN.lastIndex = 0;
-  let m;
-  while ((m = TOKEN.exec(content)) !== null) {
-    const value = m[0];
-    const start = m.index;
-    const end = start + value.length;
-    if (urlSpans.some((u) => start < u.end && end > u.start)) {
-      continue;
-    }
-    if (matches.some((existing) => start < existing.end && end > existing.start)) {
-      continue;
-    }
-    if (!isAdjacentLabel(content, start)) {
-      continue;
-    }
-    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
-    if (head.includes("/")) {
-      const piece = firstQualifyingSlashPiece(head);
-      if (piece === null) {
-        continue;
-      }
-      const pieceStart = start + piece.offset;
-      const pieceEnd = pieceStart + piece.length;
-      matches.push(buildMatch(pieceStart, pieceEnd, content.slice(pieceStart, pieceEnd), piece.entropy));
-      continue;
-    }
-    const found = labelledPieceQualifies(head);
-    if (found === null) {
-      continue;
-    }
-    matches.push(buildMatch(start, end, value, found.entropy));
-  }
-  return matches.sort((a, b) => a.start - b.start);
-}
-var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), FILLER_WORDS = "is|was|set|to|the|value|now", ADJACENT_LABEL, CONTINUATION_LABEL_LINE_RE, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
-var init_entropy = __esm(() => {
-  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*` + `(?:\\s+(?:${caseless(FILLER_WORDS)})){0,2}` + `["']?\\s*[:=]?\\s*["']?$`);
-  CONTINUATION_LABEL_LINE_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*\\\\\\s*$`);
-  LABEL_ASSIGNMENT_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${SENSITIVE_LABEL_WORDS})[A-Za-z0-9_-]*"?\\s*=\\s*"?([A-Za-z0-9+/_=-]{6,})`, "gi");
-  TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
-  TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
-  HEX_BLOB = /^[0-9a-f]{24,}$/i;
-  FULL_GIT_SHA_RE = /^[0-9a-f]{40}$/i;
-  UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  INTEGRITY_RE = /^(?:sha256|sha512)-[A-Za-z0-9+/]+=*$/;
-  SLUG_HEX_TAIL_RE = /^[0-9a-f]{10,16}$/i;
-  URL_SPAN_RE = /\bhttps?:\/\/[^\s<>"'\\]+/g;
-  URL_TRAILING_PUNCTUATION_RE = /[.,;:!?)\]}]$/;
-});
-
 // src/security/entropy-gate.ts
 function ensureLoading() {
   if (loadStarted) {
@@ -5274,12 +5616,12 @@ function isNumericContextKey(key) {
 function isNumericText(value) {
   return /^[+-]?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value);
 }
-function redactString(value, key, exemptExfil) {
+function floorMatches(value, key, exemptExfil) {
   const secretMatches = detectSecrets(value);
   const piiMatches = detectPii(value);
   const allExfilMatches = detectExfil(value);
   const exfilMatches = exemptExfil ? allExfilMatches.filter((match) => !exemptExfil(match)) : allExfilMatches;
-  const exemptedCount = allExfilMatches.length - exfilMatches.length;
+  const entropyMatches = isEntropyBackendEnabled() ? detectEntropy(value) : [];
   const contextualMatches = isSensitiveFieldKey(key) && value.length > 0 && secretMatches.length === 0 ? [
     {
       category: "secret",
@@ -5293,21 +5635,23 @@ function redactString(value, key, exemptExfil) {
       remediation: "Keep credential fields out of transport output."
     }
   ] : [];
-  const matches = isNumericContextKey(key) && isNumericText(value) ? [
-    ...secretMatches,
-    ...contextualMatches,
-    ...piiMatches.filter((match) => match.policyId !== "pii.phone"),
-    ...exfilMatches
-  ] : [...secretMatches, ...contextualMatches, ...piiMatches, ...exfilMatches];
+  const pii = isNumericContextKey(key) && isNumericText(value) ? piiMatches.filter((match) => match.policyId !== "pii.phone") : piiMatches;
+  return [...secretMatches, ...contextualMatches, ...pii, ...exfilMatches, ...entropyMatches];
+}
+function redactString(value, key, exemptExfil) {
+  const matches = floorMatches(value, key, exemptExfil);
   if (matches.length === 0) {
     return { value, reasons: [] };
   }
-  const redacted = matches.length === secretMatches.length + piiMatches.length + exfilMatches.length && contextualMatches.length === 0 && exemptedCount === 0 ? redactSensitiveText(value) : applyRedaction(value, matches);
   return {
-    value: redacted,
+    value: applyRedaction(value, matches),
     reasons: matches.map((match) => match.policyId)
   };
 }
+function isSensitiveNumber(value, exemptExfil) {
+  const text = String(value);
+  return floorMatches(text, undefined, exemptExfil).some((match) => match.policyId !== "pii.phone" && (match.policyId !== "pii.credit-card" || CARD_LEADING_DIGIT.test(match.value)));
+}
 function isSensitivePropertyName(name) {
   if (name.length === 0) {
     return false;
@@ -5335,6 +5679,9 @@ function sanitizeJsonValue(value, key, active, exemptExfil) {
         reason: isSensitiveFieldKey(key) ? "sensitive-numeric-field" : "non-json-value"
       };
     }
+    if (isSensitiveNumber(value, exemptExfil)) {
+      return { ok: false, reason: "sensitive-numeric-value" };
+    }
     return { ok: true, value, reasons: [] };
   }
   if (typeof value !== "object") {
@@ -5705,6 +6052,9 @@ function validateSerializedContentForTransport(content, exemptExfil) {
   } catch {
     return validateOutputForTransport({ value: content, format: "text", ...exemption });
   }
+  if (typeof value === "number") {
+    return validateOutputForTransport({ value: content, format: "text", ...exemption });
+  }
   const result = validateOutputForTransport({ value, format: "json", ...exemption });
   if (!result.ok || result.redaction.state === "redacted") {
     return result;
@@ -5714,11 +6064,13 @@ function validateSerializedContentForTransport(content, exemptExfil) {
     redaction: { state: "redacted", reasons: [SERIALIZED_NORMALIZED_REASON] }
   };
 }
-var FORMAT_UNSAFE_OUTPUT_TEXT = "Output withheld: format-unsafe", SUPPORTED_SCHEMA_KEYS, JSON_TYPES, EXTERNAL_SCHEMA_REFS, SENSITIVE_NUMERIC_KEYS, REFERENCE_SAFE_SIBLINGS, SERIALIZED_NORMALIZED_REASON = "serialized-content-normalized", JSON_WHITESPACE, JSON_KEYWORDS;
+var FORMAT_UNSAFE_OUTPUT_TEXT = "Output withheld: format-unsafe", SUPPORTED_SCHEMA_KEYS, JSON_TYPES, EXTERNAL_SCHEMA_REFS, SENSITIVE_NUMERIC_KEYS, REFERENCE_SAFE_SIBLINGS, CARD_LEADING_DIGIT, SERIALIZED_NORMALIZED_REASON = "serialized-content-normalized", JSON_WHITESPACE, JSON_KEYWORDS;
 var init_output_validation = __esm(() => {
   init_pii();
   init_secrets();
   init_exfil();
+  init_entropy();
+  init_entropy_gate();
   init_redact();
   init_schemas();
   SUPPORTED_SCHEMA_KEYS = new Set([
@@ -5769,6 +6121,7 @@ var init_output_validation = __esm(() => {
     "token"
   ]);
   REFERENCE_SAFE_SIBLINGS = new Set(["$ref", "$schema", "$id", "title", "$defs"]);
+  CARD_LEADING_DIGIT = /^[2-6]/;
   JSON_WHITESPACE = new Set([" ", "\t", `
 `, "\r"]);
   JSON_KEYWORDS = [
@@ -5980,24 +6333,42 @@ var init_seam = __esm(() => {
 });
 
 // src/security/detect/injection.ts
-function foldForMatching(content) {
+function foldForMatching(content, map = CONFUSABLES) {
   let folded = "";
   for (let i = 0;i < content.length; i += 1) {
     const ch = content[i];
-    folded += CONFUSABLES[ch] ?? ch;
+    folded += map[ch] ?? ch;
   }
   const nfkc = folded.normalize("NFKC");
   return nfkc.length === folded.length ? nfkc : folded;
 }
 function detectInjection(content) {
   const matches = [];
-  const folded = foldForMatching(content);
+  const seen = new Set;
+  const views = [foldForMatching(content)];
+  if (HAS_ALT_CONFUSABLE.test(content)) {
+    views.push(foldForMatching(content, ALT_CONFUSABLES));
+  }
+  for (const folded of views) {
+    scanView(content, folded, matches, seen);
+  }
+  return matches;
+}
+function scanView(content, folded, matches, seen) {
   for (const pattern of PATTERNS) {
     pattern.regex.lastIndex = 0;
     let m;
     while ((m = pattern.regex.exec(folded)) !== null) {
       const start = Math.min(m.index, content.length);
       const end = Math.min(m.index + m[0].length, content.length);
+      const key = `${pattern.policyId}:${start}:${end}`;
+      if (seen.has(key)) {
+        if (m.index === pattern.regex.lastIndex) {
+          pattern.regex.lastIndex += 1;
+        }
+        continue;
+      }
+      seen.add(key);
       matches.push({
         category: "prompt-injection",
         policyId: pattern.policyId,
@@ -6013,9 +6384,8 @@ function detectInjection(content) {
       }
     }
   }
-  return matches;
 }
-var CONFUSABLES, PATTERNS;
+var CONFUSABLES, ALT_CONFUSABLES, HAS_ALT_CONFUSABLE, PATTERNS;
 var init_injection = __esm(() => {
   CONFUSABLES = {
     "\u0430": "a",
@@ -6034,8 +6404,8 @@ var init_injection = __esm(() => {
     "\u0423": "Y",
     "\u0455": "s",
     "\u0405": "S",
-    "\u0456": "o",
-    "\u0406": "O",
+    "\u0456": "i",
+    "\u0406": "I",
     "\u0458": "j",
     "\u0408": "J",
     "\u03B1": "a",
@@ -6059,6 +6429,8 @@ var init_injection = __esm(() => {
     "\u03C7": "x",
     "\u03A7": "X"
   };
+  ALT_CONFUSABLES = { ...CONFUSABLES, "\u0456": "o", "\u0406": "O" };
+  HAS_ALT_CONFUSABLE = /[\u0456\u0406]/;
   PATTERNS = [
     {
       policyId: "prompt-injection.ignore-instructions",
@@ -6289,16 +6661,48 @@ async function mergeAdapter(cwd, content, spec, into) {
   } catch {}
 }
 function dedupeOverlaps(matches) {
+  const trees = new Map;
+  for (const match of matches) {
+    const tree = trees.get(match.category) ?? { starts: [], maxEnd: [] };
+    tree.starts.push(match.start);
+    trees.set(match.category, tree);
+  }
+  for (const tree of trees.values()) {
+    tree.starts = [...new Set(tree.starts)].sort((a, b) => a - b);
+    tree.maxEnd = new Array(tree.starts.length + 1).fill(-Infinity);
+  }
   const kept = [];
   const sorted = [...matches].sort((a, b) => b.confidence - a.confidence);
   for (const candidate of sorted) {
-    const covered = kept.some((existing) => existing.category === candidate.category && candidate.start >= existing.start && candidate.end <= existing.end);
-    if (!covered) {
-      kept.push(candidate);
+    const tree = trees.get(candidate.category);
+    const position = upperBound(tree.starts, candidate.start);
+    let furthest = -Infinity;
+    for (let i = position;i > 0; i -= i & -i) {
+      furthest = Math.max(furthest, tree.maxEnd[i]);
+    }
+    if (furthest >= candidate.end) {
+      continue;
+    }
+    kept.push(candidate);
+    for (let i = position;i < tree.maxEnd.length; i += i & -i) {
+      tree.maxEnd[i] = Math.max(tree.maxEnd[i], candidate.end);
     }
   }
   return kept.sort((a, b) => a.start - b.start);
 }
+function upperBound(sorted, value) {
+  let low = 0;
+  let high = sorted.length;
+  while (low < high) {
+    const mid = low + high >> 1;
+    if (sorted[mid] <= value) {
+      low = mid + 1;
+    } else {
+      high = mid;
+    }
+  }
+  return low;
+}
 var SECURITY_MODEL_RUNTIME = "";
 var init_detect = __esm(() => {
   init_seam();
@@ -7398,16 +7802,16 @@ function isSecretRun(run) {
 function looksLikeSecret(text) {
   if (BOT_TOKEN_SHAPE.test(text))
     return true;
-  for (const run of text.match(TOKEN_RUN) ?? []) {
+  for (const run of text.match(TOKEN_RUN2) ?? []) {
     if (isSecretRun(run))
       return true;
   }
   return false;
 }
-var BOT_TOKEN_SHAPE, TOKEN_RUN, RUN_PARTS;
+var BOT_TOKEN_SHAPE, TOKEN_RUN2, RUN_PARTS;
 var init_secret_shape = __esm(() => {
   BOT_TOKEN_SHAPE = /\d{6,}:[A-Za-z0-9_-]{30,}/;
-  TOKEN_RUN = /[A-Za-z0-9_-]{32,}|[A-Za-z0-9+/]{40,}={0,2}/g;
+  TOKEN_RUN2 = /[A-Za-z0-9_-]{32,}|[A-Za-z0-9+/]{40,}={0,2}/g;
   RUN_PARTS = /[A-Z][a-z]+|[a-z]+|[A-Z]+(?![a-z])|\d+|[-_]/g;
 });
 
@@ -7616,11 +8020,119 @@ function parseScalar(raw) {
     return unescapeToml(match[1]);
   return;
 }
+function splitDepthAware(inner) {
+  const parts = [];
+  let quoted = false;
+  let depth = 0;
+  let start = 0;
+  for (let i = 0;i < inner.length; i++) {
+    const ch = inner[i];
+    if (ch === '"' && inner[i - 1] !== "\\")
+      quoted = !quoted;
+    if (quoted)
+      continue;
+    if (ch === "[" || ch === "{")
+      depth++;
+    if (ch === "]" || ch === "}")
+      depth--;
+    if (ch === "," && depth === 0) {
+      parts.push(inner.slice(start, i));
+      start = i + 1;
+    }
+  }
+  const tail = inner.slice(start).trim();
+  if (tail !== "")
+    parts.push(tail);
+  return parts;
+}
+function parseKeyPath(text) {
+  const segments = [];
+  let rest = text.trim();
+  for (;; ) {
+    const m = /^(?:"((?:[^"\\]|\\.)*)"|([A-Za-z0-9_-]+))\s*/.exec(rest);
+    if (m === null)
+      return;
+    segments.push(m[1] !== undefined ? unescapeToml(m[1]) : m[2]);
+    rest = rest.slice(m[0].length);
+    if (rest === "")
+      return segments;
+    if (!rest.startsWith("."))
+      return;
+    rest = rest.slice(1).trimStart();
+  }
+}
+function findKeyEquals(line) {
+  let quoted = false;
+  for (let i = 0;i < line.length; i++) {
+    const ch = line[i];
+    if (ch === '"' && line[i - 1] !== "\\")
+      quoted = !quoted;
+    if (ch === "=" && !quoted)
+      return i;
+  }
+  return -1;
+}
+function applyField(server, key, valueText) {
+  const value = valueText.trim();
+  if (value.startsWith("[")) {
+    const closeAt = findUnquotedClose(value);
+    if (closeAt === -1 || value.slice(closeAt + 1).trim() !== "")
+      return `value for "${key}" is not a single-line array`;
+    const parsed = parseStringArray(value.slice(1, closeAt));
+    if (parsed === undefined)
+      return `value for "${key}" is not an array of strings this reader supports`;
+    if (key === "command")
+      return '"command" must be a string, not an array';
+    if (key === "args")
+      server.args = parsed;
+    return;
+  }
+  if (value.startsWith("{")) {
+    if (key === "command" || key === "args")
+      return `"${key}" must not be a table`;
+    return value.endsWith("}") ? undefined : `value for "${key}" is an inline table this reader cannot read`;
+  }
+  const scalar = parseScalar(value);
+  if (scalar === undefined)
+    return `value for "${key}" is a TOML form this reader does not support (${value})`;
+  if (key === "command") {
+    if (typeof scalar !== "string")
+      return '"command" must be a string';
+    server.command = scalar;
+  }
+  return;
+}
+function applyInlineServer(server, table) {
+  const text = table.trim();
+  if (!text.startsWith("{") || !text.endsWith("}"))
+    return `"${server.name}" is not an inline table this reader understands`;
+  for (const entry of splitDepthAware(text.slice(1, -1))) {
+    const eq = findKeyEquals(entry);
+    const path = eq === -1 ? undefined : parseKeyPath(entry.slice(0, eq));
+    if (path === undefined || path.length !== 1)
+      return `cannot read "${entry.trim()}" as a key/value in "${server.name}"`;
+    const error = applyField(server, path[0], entry.slice(eq + 1));
+    if (error !== undefined)
+      return error;
+  }
+  return;
+}
 function parseCodexToml(text) {
   const servers = new Map;
   const order = [];
   let current;
+  let atRoot = true;
+  const serverFor = (name, line) => {
+    const existing = servers.get(name);
+    if (existing)
+      return existing;
+    const created = { name, line };
+    servers.set(name, created);
+    order.push(name);
+    return created;
+  };
   let pendingKey;
+  let pendingServer;
   let pendingBuffer = "";
   let pendingStartLine = 0;
   const lines = text.split(`
@@ -7647,13 +8159,14 @@ function parseCodexToml(text) {
           error: `line ${pendingStartLine}: value for "${pendingKey}" is not an array of strings this reader supports`
         };
       }
-      if (current && pendingKey === "command") {
+      if (pendingServer && pendingKey === "command") {
         return { ok: false, error: `line ${pendingStartLine}: "command" must be a string, not an array` };
       }
-      if (current && pendingKey === "args") {
-        current.args = parsedArray;
+      if (pendingServer && pendingKey === "args") {
+        pendingServer.args = parsedArray;
       }
       pendingKey = undefined;
+      pendingServer = undefined;
       pendingBuffer = "";
       continue;
     }
@@ -7661,6 +8174,7 @@ function parseCodexToml(text) {
     if (trimmed === "")
       continue;
     if (trimmed.startsWith("[")) {
+      atRoot = false;
       const header = HEADER.exec(trimmed);
       if (header !== null) {
         const name = header[1] ?? header[2];
@@ -7690,19 +8204,62 @@ function parseCodexToml(text) {
       current = undefined;
       continue;
     }
+    let target = current;
+    let kv;
     if (current === undefined) {
-      continue;
-    }
-    const pair = /^([A-Za-z_][A-Za-z0-9_-]*)\s*=\s*(.+)$/.exec(trimmed);
-    if (pair === null) {
-      return { ok: false, error: `line ${lineNo}: cannot read "${trimmed}" as a TOML key/value` };
+      if (!atRoot)
+        continue;
+      const eq = findKeyEquals(trimmed);
+      const path = eq === -1 ? undefined : parseKeyPath(trimmed.slice(0, eq));
+      if (path === undefined) {
+        if (/^"?mcp_servers"?\s*[.=]/.test(trimmed)) {
+          return { ok: false, error: `line ${lineNo}: cannot read "${trimmed}" as a TOML key/value` };
+        }
+        continue;
+      }
+      if (path[0] !== "mcp_servers")
+        continue;
+      const valueText = trimmed.slice(eq + 1).trim();
+      if (path.length === 1) {
+        if (!valueText.startsWith("{") || !valueText.endsWith("}")) {
+          return { ok: false, error: `line ${lineNo}: "mcp_servers" is not an inline table this reader understands` };
+        }
+        for (const entry of splitDepthAware(valueText.slice(1, -1))) {
+          const innerEq = findKeyEquals(entry);
+          const innerPath = innerEq === -1 ? undefined : parseKeyPath(entry.slice(0, innerEq));
+          if (innerPath === undefined || innerPath.length !== 1) {
+            return { ok: false, error: `line ${lineNo}: cannot read "${entry.trim()}" as an mcp_servers entry` };
+          }
+          const error = applyInlineServer(serverFor(innerPath[0], lineNo), entry.slice(innerEq + 1));
+          if (error !== undefined)
+            return { ok: false, error: `line ${lineNo}: ${error}` };
+        }
+        continue;
+      }
+      const server = serverFor(path[1], lineNo);
+      if (path.length === 2) {
+        const error = applyInlineServer(server, valueText);
+        if (error !== undefined)
+          return { ok: false, error: `line ${lineNo}: ${error}` };
+        continue;
+      }
+      if (path.length > 3)
+        continue;
+      target = server;
+      kv = { key: path[2], valueText };
+    } else {
+      const pair = /^([A-Za-z_][A-Za-z0-9_-]*)\s*=\s*(.+)$/.exec(trimmed);
+      if (pair === null) {
+        return { ok: false, error: `line ${lineNo}: cannot read "${trimmed}" as a TOML key/value` };
+      }
+      kv = { key: pair[1], valueText: pair[2].trim() };
     }
-    const key = pair[1];
-    const valueText = pair[2].trim();
+    const { key, valueText } = kv;
     if (valueText.startsWith("[")) {
       const closeAt = findUnquotedClose(valueText);
       if (closeAt === -1) {
         pendingKey = key;
+        pendingServer = target;
         pendingBuffer = `${valueText.slice(1)}
 `;
         pendingStartLine = lineNo;
@@ -7716,8 +8273,8 @@ function parseCodexToml(text) {
       if (parsedArray === undefined) {
         return { ok: false, error: `line ${lineNo}: value for "${key}" is not an array of strings this reader supports` };
       }
-      if (key === "args")
-        current.args = parsedArray;
+      if (key === "args" && target)
+        target.args = parsedArray;
       continue;
     }
     const scalar = parseScalar(valueText);
@@ -7728,7 +8285,8 @@ function parseCodexToml(text) {
       if (typeof scalar !== "string") {
         return { ok: false, error: `line ${lineNo}: "command" must be a string` };
       }
-      current.command = scalar;
+      if (target)
+        target.command = scalar;
     }
   }
   if (pendingKey !== undefined) {
@@ -13239,6 +13797,16 @@ function hashToolDefinition(tool) {
   });
   return createHash4("sha256").update(canonical).digest("hex");
 }
+function hasCommentPayload(text) {
+  const lower = text.toLowerCase();
+  return [
+    ["<!--", "-->"],
+    ["<important>", "</important>"]
+  ].some(([open, close]) => {
+    const at = lower.indexOf(open);
+    return at !== -1 && lower.indexOf(close, at + open.length) !== -1;
+  });
+}
 function makeMatch(category, policyId, severity, confidence, token, remediation) {
   return {
     category,
@@ -13273,30 +13841,45 @@ function parseTools(manifest) {
 }
 function toolText(tool) {
   const parts = [tool.description ?? ""];
-  const collect = (value, depth) => {
-    if (depth > 6 || !value || typeof value !== "object") {
-      return;
+  const stack = [tool.inputSchema];
+  let visited = 0;
+  while (stack.length > 0) {
+    const value = stack.pop();
+    if (!value || typeof value !== "object") {
+      continue;
+    }
+    visited += 1;
+    if (visited > SCHEMA_NODE_BUDGET) {
+      return { text: parts.join(`
+`), truncated: true };
     }
     for (const [key, nested] of Object.entries(value)) {
-      if ((key === "description" || key === "title") && typeof nested === "string") {
-        parts.push(nested);
-      } else if (nested && typeof nested === "object") {
-        collect(nested, depth + 1);
+      if (SCHEMA_TEXT_KEYS.has(key)) {
+        if (typeof nested === "string") {
+          parts.push(nested);
+        } else if (Array.isArray(nested)) {
+          parts.push(...nested.filter((item) => typeof item === "string"));
+        }
+      }
+      if (nested && typeof nested === "object") {
+        stack.push(nested);
       }
     }
-  };
-  collect(tool.inputSchema, 0);
-  return parts.join(`
-`);
+  }
+  return { text: parts.join(`
+`), truncated: false };
 }
 function scanMcpManifest(manifest, options = {}) {
   const tools = parseTools(manifest);
   const matches = [];
   const seenNames = new Map;
   for (const tool of tools) {
-    const text = toolText(tool);
+    const { text, truncated } = toolText(tool);
+    if (truncated) {
+      matches.push(makeMatch("prompt-injection", "mcp.schema-too-large", "medium", 0.5, `tool:${tool.name}`, `Tool "${tool.name}" input schema is too large to scan whole (over ${SCHEMA_NODE_BUDGET} nodes); review it by hand.`));
+    }
     for (const pattern of POISONING_PATTERNS) {
-      if (pattern.regex.test(text)) {
+      if (pattern.test ? pattern.test(text) : pattern.regex.test(text)) {
         const category = pattern.policyId === "mcp.poisoning.embedded-credential" ? "secret" : pattern.policyId === "mcp.poisoning.exfil-verb" ? "egress" : "prompt-injection";
         matches.push(makeMatch(category, pattern.policyId, "high", pattern.confidence, `tool:${tool.name}`, `Tool "${tool.name}" description contains a tool-poisoning signal; treat MCP tool metadata as untrusted.`));
       }
@@ -13324,7 +13907,7 @@ function scanMcpManifest(manifest, options = {}) {
   }
   return matches;
 }
-var POISONING_PATTERNS, LINE_JUMPING_PATTERNS, INVISIBLE_UNICODE;
+var POISONING_PATTERNS, LINE_JUMPING_PATTERNS, INVISIBLE_UNICODE, SCHEMA_TEXT_KEYS, SCHEMA_NODE_BUDGET = 1e4;
 var init_mcp = __esm(() => {
   POISONING_PATTERNS = [
     {
@@ -13354,7 +13937,8 @@ var init_mcp = __esm(() => {
     },
     {
       policyId: "mcp.poisoning.comment-payload",
-      regex: /<!--[\s\S]*?-->|<important>[\s\S]*?<\/important>/i,
+      regex: /<!--|<important>/i,
+      test: hasCommentPayload,
       confidence: 0.7
     }
   ];
@@ -13376,8 +13960,12 @@ var init_mcp = __esm(() => {
     }
   ];
   INVISIBLE_UNICODE = new RegExp("[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u206F\\uFEFF]" + "|[\\u{E0000}-\\u{E007F}]", "u");
+  SCHEMA_TEXT_KEYS = new Set(["description", "title", "default", "const", "examples", "enum"]);
 });
 
+// src/lib/args.ts
+var init_args = () => {};
+
 // src/lib/shell-syntax.ts
 function splitSegments(command) {
   const segments = [];
@@ -13494,7 +14082,7 @@ function stripAssignments(words) {
   return words.slice(i);
 }
 function commandWord(words) {
-  const first = stripAssignments(words)[0] ?? "";
+  const first = (stripAssignments(words)[0] ?? "").replace(/^[({]+/, "").replace(/\\(.)/g, "$1");
   const base = first.split("/").pop() ?? first;
   return base.toLowerCase();
 }
@@ -13526,13 +14114,197 @@ function isCatastrophicTarget(arg) {
 function hasRecursive(words) {
   return args(words).some((a) => RECURSIVE_FLAG.test(a));
 }
-function classifySegment(seg) {
+function gitConfigEntry(spec, fromEnv) {
+  const eq = spec.indexOf("=");
+  return { key: (eq < 0 ? spec : spec.slice(0, eq)).toLowerCase(), value: eq < 0 ? undefined : spec.slice(eq + 1), opaque: fromEnv || wordIsOpaque(spec) };
+}
+function parseGitInvocation(input) {
+  const bare = stripAssignments(input);
+  let envConfig = input.slice(0, input.length - bare.length).some((w) => GIT_CONFIG_SOURCE_ASSIGNMENT.test(w));
+  const words = bare.map(unescapeWord);
+  const config = [];
+  let unknownGlobal = false;
+  let i = 1;
+  for (;i < words.length; i += 1) {
+    const w = words[i];
+    if (!w.startsWith("-"))
+      break;
+    const eq = w.startsWith("--") ? w.indexOf("=") : -1;
+    const name = eq > 0 ? w.slice(0, eq) : w;
+    if (GIT_GLOBAL_VALUE_OPTIONS.has(name)) {
+      if (GIT_REPOSITORY_OPTIONS.has(name))
+        envConfig = true;
+      const value = eq > 0 ? w.slice(eq + 1) : words[++i];
+      if (name === "-c" || name === "--config-env")
+        config.push(gitConfigEntry(value ?? "", name === "--config-env"));
+      continue;
+    }
+    if (!GIT_GLOBAL_FLAGS.has(name))
+      unknownGlobal = true;
+  }
+  let rest = words.slice(i);
+  const invocation = (sub, opaqueSub, shellAlias) => ({
+    sub,
+    args: rest.slice(1),
+    config,
+    opaqueSub,
+    unknownGlobal,
+    envConfig,
+    ...shellAlias !== undefined ? { shellAlias } : {}
+  });
+  for (let guard = 0;guard < 8 && rest.length > 0; guard += 1) {
+    const head = rest[0];
+    if (wordIsOpaque(head))
+      return invocation(undefined, true);
+    if (GIT_COMMANDS.has(head.toLowerCase()))
+      return invocation(head.toLowerCase(), false);
+    const alias = [...config].reverse().find((c) => c.key === `alias.${head.toLowerCase()}`);
+    if (alias === undefined)
+      return invocation(head, false);
+    if (alias.opaque || alias.value === undefined)
+      return invocation(undefined, true);
+    if (alias.value.trimStart().startsWith("!"))
+      return invocation(undefined, true, [alias.value.trimStart().slice(1), ...rest.slice(1)].join(" "));
+    const expanded = splitWords(alias.value);
+    if (expanded.length === 0 || expanded[0].startsWith("-"))
+      return invocation(undefined, true);
+    rest = [...expanded, ...rest.slice(1)];
+  }
+  return invocation(undefined, rest.length > 0);
+}
+function resolvePushOption(name) {
+  if (PUSH_LONG_OPTIONS.has(name))
+    return name;
+  const candidates = [...PUSH_LONG_OPTIONS.keys()].filter((option) => option.startsWith(name));
+  return candidates.length === 1 ? candidates[0] : undefined;
+}
+function parsePushArgs(args) {
+  const request = { force: false, del: false, mirror: false, all: false, prune: false, unknown: false, positionals: [] };
+  const set = (option) => {
+    if (option === "force" || option === "force-with-lease" || option === "force-if-includes")
+      request.force = true;
+    else if (option === "delete")
+      request.del = true;
+    else if (option === "mirror")
+      request.mirror = true;
+    else if (option === "all" || option === "branches")
+      request.all = true;
+    else if (option === "prune")
+      request.prune = true;
+  };
+  let options = true;
+  for (let i = 0;i < args.length; i += 1) {
+    const w = args[i];
+    if (!options || w === "-" || !w.startsWith("-")) {
+      request.positionals.push(w);
+      continue;
+    }
+    if (w === "--") {
+      options = false;
+      continue;
+    }
+    if (w.startsWith("--")) {
+      const eq = w.indexOf("=");
+      const name = eq > 0 ? w.slice(2, eq) : w.slice(2);
+      if (name.startsWith("n"))
+        continue;
+      const option = resolvePushOption(name);
+      if (option === undefined) {
+        request.unknown = true;
+        continue;
+      }
+      if (PUSH_LONG_OPTIONS.get(option) === "value" && eq < 0)
+        i += 1;
+      set(option);
+      continue;
+    }
+    for (let at = 1;at < w.length; at += 1) {
+      const ch = w[at];
+      if (ch === "o") {
+        if (at === w.length - 1)
+          i += 1;
+        break;
+      }
+      if (!PUSH_SHORT_FLAGS.has(ch)) {
+        request.unknown = true;
+        break;
+      }
+      if (ch === "f")
+        request.force = true;
+      if (ch === "d")
+        request.del = true;
+    }
+  }
+  return request;
+}
+function isDangerousDestination(destination) {
+  const name = (destination.split("/").pop() ?? "").toLowerCase();
+  return destination.includes("*") || PROTECTED_BRANCHES.includes(name) || name === "" || name === "head" || name === "@";
+}
+function refspecDestroys(spec, force, del) {
+  if (wordIsOpaque(spec))
+    return true;
+  const plus = spec.startsWith("+");
+  const body = plus ? spec.slice(1) : spec;
+  if (del)
+    return isDangerousDestination(body);
+  if (body === ":")
+    return force || plus;
+  const deletes = body.startsWith(":");
+  if (!(force || plus || deletes))
+    return false;
+  const destination = body.slice(body.lastIndexOf(":") + 1);
+  if (deletes && destination !== "" && !destination.includes("*")) {
+    return PROTECTED_BRANCHES.includes((destination.split("/").pop() ?? "").toLowerCase());
+  }
+  return isDangerousDestination(destination);
+}
+function isConfigTrue(value) {
+  return value === undefined || !/^(?:false|no|off|0|)$/i.test(value.trim());
+}
+function configArmsPush(entry) {
+  if (CONFIG_INCLUDE_KEY.test(entry.key))
+    return true;
+  const match = PUSH_SHAPING_KEY.exec(entry.key);
+  if (match === null)
+    return false;
+  if (entry.opaque)
+    return true;
+  return match[1] === "mirror" ? isConfigTrue(entry.value) : refspecDestroys(entry.value ?? "", false, false);
+}
+function configWriteArmsPush(entry) {
+  if (!entry.key.startsWith("alias."))
+    return configArmsPush(entry);
+  if (entry.opaque || entry.value === undefined)
+    return true;
+  const value = entry.value.trimStart();
+  return /\bpush\b/i.test(value) || value.startsWith("!") && isDestructiveCommand(value.slice(1));
+}
+function gitWords(v) {
+  if (v.cmd === "git")
+    return v.words;
+  if (!WRAPPER_COMMANDS.has(v.cmd))
+    return;
+  const peeled = peelWrappers(v.words);
+  return peeled.inner === undefined && baseName(peeled.words[0]) === "git" ? peeled.words : undefined;
+}
+function assignsGitConfigSource(words) {
+  const bare = stripAssignments(words);
+  if (words.slice(0, words.length - bare.length + 1).some((w) => GIT_CONFIG_SOURCE_ASSIGNMENT.test(w)))
+    return true;
+  const cmd = commandWord(bare);
+  if (!ASSIGNING_BUILTINS.has(cmd) && !WRAPPER_COMMANDS.has(cmd))
+    return false;
+  return bare.slice(1).some((w) => GIT_CONFIG_SOURCE_ASSIGNMENT.test(w));
+}
+function classifySegment(seg, configRelocated) {
   const view = {
     raw: seg.raw,
     cmd: head(seg.words),
     args: args(seg.words),
     positionals: positionals(seg.words),
-    words: seg.words
+    words: seg.words,
+    configRelocated
   };
   return RULES3.some((rule) => rule(view));
 }
@@ -13540,8 +14312,10 @@ function classifyCommand(command) {
   if (command.trim().length === 0)
     return "shell";
   const segments = splitSegments(command);
+  let configRelocated = false;
   for (const seg of segments) {
-    if (classifySegment(seg))
+    configRelocated ||= assignsGitConfigSource(seg.words);
+    if (classifySegment(seg, configRelocated))
       return "destructive";
   }
   for (let i = 1;i < segments.length; i++) {
@@ -13560,8 +14334,78 @@ function isDestructiveCommand(command) {
   return classifyCommand(command) === "destructive";
 }
 function touchesAgentCredentials(command) {
-  const text = command.toLowerCase();
-  return CREDENTIAL_MARKERS.some((marker) => text.includes(marker));
+  return textSpellings(command).some((text) => CREDENTIAL_MARKERS.some((marker) => text.includes(marker)));
+}
+function textSpellings(command) {
+  return [command, collapseQuoting(joinContinuations(command))].map((text) => text.toLowerCase().replace(/\s+/g, " "));
+}
+function baseName(word) {
+  return ((word ?? "").split("/").pop() ?? "").toLowerCase();
+}
+function unescapeWord(word) {
+  return word.replace(/\\(.)/g, "$1");
+}
+function peelWrappers(input) {
+  let words = stripAssignments(input.map(unescapeWord));
+  for (let guard = 0;guard < 16 && words.length > 0; guard++) {
+    const cmd = (words[0].split("/").pop() ?? "").toLowerCase();
+    if (SHELLS.has(cmd)) {
+      const at = words.findIndex((w, i) => i > 0 && /^-[a-z]*c[a-z]*$/i.test(w));
+      const script = at > 0 ? words[at + 1] : undefined;
+      if (script !== undefined)
+        return { words, inner: script };
+      return { words };
+    }
+    if (cmd === "eval")
+      return { words, inner: words.slice(1).join(" ") };
+    if (!WRAPPER_COMMANDS.has(cmd))
+      return { words };
+    let i = 1;
+    while (i < words.length) {
+      const w = words[i];
+      if (w === "--") {
+        i++;
+        break;
+      }
+      if (w.startsWith("-")) {
+        i += WRAPPER_FLAGS_WITH_VALUE.has(w) ? 2 : 1;
+        continue;
+      }
+      if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w)) {
+        i++;
+        continue;
+      }
+      if ((cmd === "timeout" || cmd === "nice") && /^[0-9.]+[smhd]?$/.test(w)) {
+        i++;
+        continue;
+      }
+      break;
+    }
+    words = words.slice(i);
+  }
+  return { words };
+}
+function decodeAnsiC(body) {
+  return body.replace(/\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{1,4})|U([0-9a-fA-F]{1,8})|([0-7]{1,3})|(.))/gs, (_m, x, u, big, oct, ch) => {
+    const code = x ?? u ?? big;
+    if (code !== undefined)
+      return String.fromCodePoint(Math.min(Number.parseInt(code, 16), 1114111));
+    if (oct !== undefined)
+      return String.fromCharCode(Number.parseInt(oct, 8) & 255);
+    return ANSI_C_ESCAPES[ch ?? ""] ?? `\\${ch ?? ""}`;
+  });
+}
+function joinContinuations(command) {
+  return command.replace(/\\\r?\n/g, "");
+}
+function expandAnsiCQuotes(command) {
+  return command.replace(/\$'((?:[^'\\]|\\.)*)'/gs, (_m, body) => `'${decodeAnsiC(body).replace(/'/g, "'\\''")}'`);
+}
+function collapseQuoting(command) {
+  return expandAnsiCQuotes(command).replace(/["'\\]/g, "");
+}
+function wordIsOpaque(word) {
+  return /[$`{]/.test(word);
 }
 var CATASTROPHIC_TARGETS, RECURSIVE_FLAG, PRIVILEGE, INTERPRETERS, DOWNLOADERS, CONTAINER_RUNTIMES, PROTECTED_BRANCHES, BLOCK_DEVICE, rulePrivilege = (v) => PRIVILEGE.has(v.cmd), ruleBlockDeviceRedirect = (v) => BLOCK_DEVICE.test(v.raw) && /(?:^|\s)(?:>|>>)\s*\/dev\//.test(v.raw), ruleRm = (v) => v.cmd === "rm" && v.positionals.some(isCatastrophicTarget), ruleDd = (v) => v.cmd === "dd" && v.args.some((x) => /^of=/i.test(x) && BLOCK_DEVICE.test(x)), rulePermissionSweep = (v) => (v.cmd === "chmod" || v.cmd === "chown" || v.cmd === "chgrp") && hasRecursive(v.words) && v.positionals.some(isCatastrophicTarget), ruleHostState = (v) => {
   if (v.cmd === "shutdown" || v.cmd === "reboot" || v.cmd === "halt" || v.cmd === "poweroff")
@@ -13572,19 +14416,52 @@ var CATASTROPHIC_TARGETS, RECURSIVE_FLAG, PRIVILEGE, INTERPRETERS, DOWNLOADERS,
     return false;
   const joined = ` ${v.args.join(" ")}`;
   return /--privileged\b/.test(joined) || /--pid[= ]host\b/.test(joined) || /--(?:userns|ipc|uts|network|net)[= ]host\b/.test(joined) || /docker\.sock/.test(joined) || /(?:^|\s)(?:-v|--volume)[= ]\/:/.test(joined) || /source=\/(?:,|\s|$)/.test(joined);
-}, ruleForcePush = (v) => {
-  if (v.cmd !== "git" || !v.positionals.includes("push"))
+}, GIT_GLOBAL_VALUE_OPTIONS, GIT_GLOBAL_FLAGS, GIT_COMMANDS, GIT_CONFIG_SOURCE_ASSIGNMENT, GIT_REPOSITORY_OPTIONS, PUSH_LONG_OPTIONS, PUSH_SHORT_FLAGS, PUSH_SHAPING_KEY, CONFIG_INCLUDE_KEY, ruleForcePush = (v) => {
+  const words = gitWords(v);
+  if (words === undefined)
     return false;
-  const forced = v.args.some((x) => x === "-f" || x === "--force" || x.startsWith("--force-with-lease"));
-  if (!forced)
+  const git = parseGitInvocation(words);
+  if (git.shellAlias !== undefined)
+    return isDestructiveCommand(git.shellAlias) || /\bpush\b/.test(git.shellAlias);
+  if (git.opaqueSub)
+    return true;
+  if (git.unknownGlobal && positionals(words).includes("push"))
+    return true;
+  if (git.sub !== "push")
     return false;
-  const after = v.positionals.slice(v.positionals.indexOf("push") + 1);
-  if (after.length === 0)
+  if (git.envConfig || v.configRelocated === true || git.args.some(wordIsOpaque) || git.config.some(configArmsPush))
     return true;
-  const named = after.map((x) => x.split("/").pop()?.toLowerCase() ?? "");
-  return named.some((n) => PROTECTED_BRANCHES.includes(n));
-}, RULES3, CREDENTIAL_MARKERS, SYSTEMCTL_CONTROL_VERBS, SCHEDULE_VERBS, WRAPPER_COMMANDS, WRAPPER_FLAGS_WITH_VALUE, SHELLS, KERYX_ENTRY_NAMES, JS_RUNNERS, TERMINAL_DRIVERS;
+  const push = parsePushArgs(git.args);
+  if (push.unknown || push.mirror)
+    return true;
+  const refspecs = push.positionals.slice(1);
+  if (push.all && (push.force || push.prune))
+    return true;
+  if (push.prune && (refspecs.length === 0 || refspecs.some((spec) => spec.includes("*"))))
+    return true;
+  if (refspecs.length === 0)
+    return push.force;
+  return refspecs.some((spec) => refspecDestroys(spec, push.force, push.del));
+}, ruleArmsForcePush = (v) => {
+  const words = gitWords(v);
+  if (words === undefined)
+    return false;
+  const git = parseGitInvocation(words);
+  if (git.sub === "remote") {
+    if (git.args[0] !== "add")
+      return false;
+    return git.args.some((w) => {
+      const [name = "", value] = w.split("=", 2);
+      return name.length > 3 && "--mirror".startsWith(name) && value !== "fetch";
+    });
+  }
+  if (git.sub !== "config")
+    return false;
+  const operands = git.args.filter((w) => !w.startsWith("-"));
+  return operands.some((w, i) => i + 1 < operands.length && configWriteArmsPush(gitConfigEntry(`${w}=${operands[i + 1]}`, false)));
+}, RULES3, ASSIGNING_BUILTINS, CREDENTIAL_MARKERS, SYSTEMCTL_CONTROL_VERBS, SCHEDULE_VERBS, WRAPPER_COMMANDS, WRAPPER_FLAGS_WITH_VALUE, SHELLS, KERYX_ENTRY_NAMES, JS_RUNNERS, TERMINAL_DRIVERS, ANSI_C_ESCAPES, OPERATOR_REVIEW_VERBS, UNATTENDED_REVIEW_VERBS, HUB_MACHINE_OPERATOR_VERBS, OPERATOR_COMMAND_PATHS, MAX_COMMAND_PATH, OPERATOR_PATH_WORDS;
 var init_command_risk = __esm(() => {
+  init_args();
   init_shell_syntax();
   CATASTROPHIC_TARGETS = new Set([
     "/",
@@ -13631,6 +14508,255 @@ var init_command_risk = __esm(() => {
   CONTAINER_RUNTIMES = new Set(["docker", "podman", "nerdctl"]);
   PROTECTED_BRANCHES = ["main", "master", "develop", "development", "trunk"];
   BLOCK_DEVICE = /\/dev\/(?:sd[a-z]|nvme\d|disk\d|hd[a-z]|vd[a-z]|mmcblk\d)/i;
+  GIT_GLOBAL_VALUE_OPTIONS = new Set([
+    "-C",
+    "-c",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "--super-prefix",
+    "--config-env",
+    "--attr-source"
+  ]);
+  GIT_GLOBAL_FLAGS = new Set([
+    "-p",
+    "--paginate",
+    "-P",
+    "--no-pager",
+    "--no-replace-objects",
+    "--bare",
+    "--literal-pathspecs",
+    "--glob-pathspecs",
+    "--noglob-pathspecs",
+    "--icase-pathspecs",
+    "--no-optional-locks",
+    "--no-lazy-fetch",
+    "--no-advice",
+    "--html-path",
+    "--man-path",
+    "--info-path",
+    "--exec-path",
+    "--list-cmds",
+    "-v",
+    "--version",
+    "-h",
+    "--help"
+  ]);
+  GIT_COMMANDS = new Set([
+    "add",
+    "am",
+    "annotate",
+    "apply",
+    "archimport",
+    "archive",
+    "backfill",
+    "bisect",
+    "blame",
+    "branch",
+    "bugreport",
+    "bundle",
+    "cat-file",
+    "check-attr",
+    "check-ignore",
+    "check-mailmap",
+    "check-ref-format",
+    "checkout",
+    "checkout--worker",
+    "checkout-index",
+    "cherry",
+    "cherry-pick",
+    "clean",
+    "clone",
+    "column",
+    "commit",
+    "commit-graph",
+    "commit-tree",
+    "config",
+    "count-objects",
+    "credential",
+    "credential-cache",
+    "credential-cache--daemon",
+    "credential-netrc",
+    "credential-osxkeychain",
+    "credential-store",
+    "cvsexportcommit",
+    "cvsimport",
+    "cvsserver",
+    "daemon",
+    "describe",
+    "diagnose",
+    "diff",
+    "diff-files",
+    "diff-index",
+    "diff-pairs",
+    "diff-tree",
+    "difftool",
+    "difftool--helper",
+    "env--helper",
+    "fast-export",
+    "fast-import",
+    "fetch",
+    "fetch-pack",
+    "filter-branch",
+    "fmt-merge-msg",
+    "for-each-ref",
+    "for-each-repo",
+    "format-patch",
+    "fsck",
+    "fsck-objects",
+    "fsmonitor--daemon",
+    "gc",
+    "get-tar-commit-id",
+    "grep",
+    "hash-object",
+    "help",
+    "hook",
+    "http-backend",
+    "http-fetch",
+    "http-push",
+    "imap-send",
+    "index-pack",
+    "init",
+    "init-db",
+    "instaweb",
+    "interpret-trailers",
+    "log",
+    "ls-files",
+    "ls-remote",
+    "ls-tree",
+    "mailinfo",
+    "mailsplit",
+    "maintenance",
+    "merge",
+    "merge-base",
+    "merge-file",
+    "merge-index",
+    "merge-octopus",
+    "merge-one-file",
+    "merge-ours",
+    "merge-recursive",
+    "merge-recursive-ours",
+    "merge-recursive-theirs",
+    "merge-resolve",
+    "merge-subtree",
+    "merge-tree",
+    "mergetool",
+    "mktag",
+    "mktree",
+    "multi-pack-index",
+    "mv",
+    "name-rev",
+    "notes",
+    "p4",
+    "pack-objects",
+    "pack-redundant",
+    "pack-refs",
+    "patch-id",
+    "pickaxe",
+    "prune",
+    "prune-packed",
+    "pull",
+    "push",
+    "quiltimport",
+    "range-diff",
+    "read-tree",
+    "rebase",
+    "rebase--interactive",
+    "receive-pack",
+    "reflog",
+    "refs",
+    "remote",
+    "remote-ext",
+    "remote-fd",
+    "remote-ftp",
+    "remote-ftps",
+    "remote-http",
+    "remote-https",
+    "repack",
+    "replace",
+    "replay",
+    "request-pull",
+    "rerere",
+    "reset",
+    "restore",
+    "rev-list",
+    "rev-parse",
+    "revert",
+    "rm",
+    "send-email",
+    "send-pack",
+    "serve",
+    "sh-i18n--envsubst",
+    "shell",
+    "shortlog",
+    "show",
+    "show-branch",
+    "show-index",
+    "show-ref",
+    "sparse-checkout",
+    "stage",
+    "stash",
+    "status",
+    "stripspace",
+    "submodule",
+    "submodule--helper",
+    "subtree",
+    "switch",
+    "symbolic-ref",
+    "tag",
+    "unpack-file",
+    "unpack-objects",
+    "update-index",
+    "update-ref",
+    "update-server-info",
+    "upload-archive",
+    "upload-archive--writer",
+    "upload-pack",
+    "var",
+    "verify-commit",
+    "verify-pack",
+    "verify-tag",
+    "version",
+    "web--browse",
+    "whatchanged",
+    "worktree",
+    "write-tree"
+  ]);
+  GIT_CONFIG_SOURCE_ASSIGNMENT = /^[({]*(?:HOME|XDG_CONFIG_HOME|GIT_DIR|GIT_COMMON_DIR|GIT_WORK_TREE|GIT_CONFIG\w*)=/i;
+  GIT_REPOSITORY_OPTIONS = new Set(["--git-dir", "--work-tree"]);
+  PUSH_LONG_OPTIONS = new Map([
+    ["verbose", "flag"],
+    ["quiet", "flag"],
+    ["repo", "value"],
+    ["all", "flag"],
+    ["branches", "flag"],
+    ["mirror", "flag"],
+    ["delete", "flag"],
+    ["tags", "flag"],
+    ["dry-run", "flag"],
+    ["porcelain", "flag"],
+    ["force", "flag"],
+    ["force-with-lease", "optional"],
+    ["force-if-includes", "flag"],
+    ["recurse-submodules", "value"],
+    ["thin", "flag"],
+    ["receive-pack", "value"],
+    ["exec", "value"],
+    ["set-upstream", "flag"],
+    ["progress", "flag"],
+    ["prune", "flag"],
+    ["no-verify", "flag"],
+    ["verify", "flag"],
+    ["follow-tags", "flag"],
+    ["signed", "optional"],
+    ["atomic", "flag"],
+    ["push-option", "value"],
+    ["ipv4", "flag"],
+    ["ipv6", "flag"]
+  ]);
+  PUSH_SHORT_FLAGS = new Set(["v", "q", "d", "n", "f", "u", "4", "6"]);
+  PUSH_SHAPING_KEY = /^remote\..+\.(push|mirror)$/;
+  CONFIG_INCLUDE_KEY = /^include(?:if\..*)?\.path$/;
   RULES3 = [
     rulePrivilege,
     ruleBlockDeviceRedirect,
@@ -13640,8 +14766,10 @@ var init_command_risk = __esm(() => {
     ruleHostState,
     ruleMkfs,
     ruleContainerEscape,
-    ruleForcePush
+    ruleForcePush,
+    ruleArmsForcePush
   ];
+  ASSIGNING_BUILTINS = new Set(["export", "declare", "typeset", "readonly", "local"]);
   CREDENTIAL_MARKERS = [
     "permissions.json",
     "auth.json",
@@ -13696,6 +14824,21 @@ var init_command_risk = __esm(() => {
   KERYX_ENTRY_NAMES = new Set(["keryx", "cli.ts", "cli.js"]);
   JS_RUNNERS = new Set(["bun", "bunx", "node", "npx", "pnpx", "tsx", "deno"]);
   TERMINAL_DRIVERS = new Set(["script", "screen", "tmux", "unbuffer", "dtach", "abduco", "expect", "socat", "zpty"]);
+  ANSI_C_ESCAPES = { n: `
+`, t: "\t", r: "\r", a: "\x07", b: "\b", e: "\x1B", E: "\x1B", f: "\f", v: "\v", "\\": "\\", "'": "'", '"': '"', "?": "?" };
+  OPERATOR_REVIEW_VERBS = new Set(["waive-mutation", "override-reviewers", "confirm-plan", "decide-premise"]);
+  UNATTENDED_REVIEW_VERBS = new Set(["start", "attach", "plan"]);
+  HUB_MACHINE_OPERATOR_VERBS = new Set(["pair", "allow", "configure", "unpair"]);
+  OPERATOR_COMMAND_PATHS = [
+    ...["accept", "promote", "graduate"].map((verb) => ["learn", verb]),
+    ["agents", "external", "apply"],
+    ...[...OPERATOR_REVIEW_VERBS, ...UNATTENDED_REVIEW_VERBS, "estimate"].map((verb) => ["review", verb]),
+    ["review", "comments", "reply"],
+    ["review", "chunks", "estimate"],
+    ...[...HUB_MACHINE_OPERATOR_VERBS].map((verb) => ["hub", "machine", verb])
+  ];
+  MAX_COMMAND_PATH = Math.max(...OPERATOR_COMMAND_PATHS.map((path) => path.length));
+  OPERATOR_PATH_WORDS = new Set(OPERATOR_COMMAND_PATHS.flat());
 });
 
 // src/security/audit-harness/checks.ts
@@ -13736,6 +14879,9 @@ function foldFullWidth(ch) {
   const code = ch.codePointAt(0);
   return code >= 65281 && code <= 65374 ? String.fromCodePoint(code - 65248) : ch;
 }
+function isCodePoint(code) {
+  return Number.isInteger(code) && code >= 0 && code <= 1114111;
+}
 function decodeEntityStep(text) {
   const match = HTML_ENTITY_AT_RE.exec(text);
   if (!match)
@@ -13743,11 +14889,11 @@ function decodeEntityStep(text) {
   const body = match[1];
   if (body.startsWith("#x")) {
     const code = Number.parseInt(body.slice(2), 16);
-    return Number.isFinite(code) ? String.fromCodePoint(code) : undefined;
+    return isCodePoint(code) ? String.fromCodePoint(code) : undefined;
   }
   if (body.startsWith("#")) {
     const code = Number.parseInt(body.slice(1), 10);
-    return Number.isFinite(code) ? String.fromCodePoint(code) : undefined;
+    return isCodePoint(code) ? String.fromCodePoint(code) : undefined;
   }
   return NAMED_HTML_ENTITIES[body];
 }
@@ -13973,7 +15119,7 @@ function checkMissingDenyList(relativePath, settings) {
     return [];
   }
   const coversCredentials = deny.some((pattern) => touchesAgentCredentials(pattern));
-  if (coversCredentials && deny.length > 0) {
+  if (coversCredentials) {
     return [];
   }
   const pointer = "/permissions/deny";
@@ -14023,9 +15169,13 @@ function checkBypassFlagPresent(relativePath, settings) {
   const findings = [];
   const root = asRecord2(settings);
   const permissions = asRecord2(root?.permissions);
-  const defaultMode = root?.defaultMode ?? permissions?.defaultMode;
-  if (defaultMode === "bypassPermissions") {
-    const pointer = permissions?.defaultMode === "bypassPermissions" ? "/permissions/defaultMode" : "/defaultMode";
+  const modeLocations = [
+    { pointer: "/permissions/defaultMode", value: permissions?.defaultMode },
+    { pointer: "/defaultMode", value: root?.defaultMode }
+  ];
+  for (const { pointer, value } of modeLocations) {
+    if (value !== "bypassPermissions")
+      continue;
     findings.push({
       surface: "settings",
       check: "bypass-flag-present",
@@ -14037,7 +15187,7 @@ function checkBypassFlagPresent(relativePath, settings) {
       evidence: { category: "artifact-safety", matchedToken: "defaultMode:bypassPermissions" },
       internalProposal: {
         proposal: {
-          id: `reset-default-mode-${relativePath}`,
+          id: pointer === "/defaultMode" ? `reset-default-mode-root-${relativePath}` : `reset-default-mode-${relativePath}`,
           rationale: 'Set defaultMode back to "default" so the approval gate applies.',
           patch: `- "defaultMode": "bypassPermissions"
 + "defaultMode": "default"`
@@ -14069,18 +15219,11 @@ function checkBypassFlagPresent(relativePath, settings) {
 function isPinnedPackageSpec(spec) {
   if (spec.length === 0)
     return false;
-  if (spec.startsWith("@")) {
-    const secondAt = spec.indexOf("@", 1);
-    if (secondAt === -1)
-      return false;
-    const version = spec.slice(secondAt + 1);
-    return version.length > 0 && version !== "latest";
-  }
-  const at = spec.indexOf("@");
+  const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
   if (at === -1)
     return false;
   const version = spec.slice(at + 1);
-  return version.length > 0 && version !== "latest";
+  return EXACT_VERSION_RE.test(version) || COMMIT_SHA_RE.test(version) || INTEGRITY_HASH_RE.test(version);
 }
 function packageArgFromLauncher(command, argv) {
   const base = command.split("/").pop() ?? command;
@@ -14498,7 +15641,7 @@ function checkAgentMissingModelTier(relativePath, content) {
     }
   ];
 }
-var DROPPED_SINGLE_CODEPOINTS, COMBINING_MARK_RANGES, MATH_ALPHANUMERIC_LETTER_STYLE_STARTS, MATH_ALPHANUMERIC_DIGIT_STYLE_STARTS, MATH_ALPHANUMERIC_EXCEPTIONS, HTML_ENTITY_AT_RE, NAMED_HTML_ENTITIES, HOMOGLYPH_FOLD, QUOTE_CHARS_ANY, SENTENCE_END_CHARS, REPORTED_SPEECH_RE, SEVERITY_RANK, AUTO_RUN_PATTERNS, WILDCARD_ALLOW_PATTERNS, BYPASS_FLAGS, TOOL_INPUT_VAR = "(?:TOOL_INPUT|CLAUDE_TOOL_INPUT|tool_input|ARGUMENTS|1)", INTERP_VAR_RE, INSIDE_SUBSHELL_RE, INSIDE_BACKTICK_RE, INSIDE_DQUOTE_RE, NETWORK_CLIENTS, SHELL_INTERPRETERS = "sh|bash|zsh|dash|ksh|python3?|node|perl|ruby", SHELL_LIKE_INTERPRETERS = "sh|bash|zsh|dash|ksh", SCRIPT_STDIN_INTERPRETERS = "python3?|node|perl|ruby", DOWNLOAD_TOOLS = "curl|wget", ABS_PATH_PREFIX = "(?:/usr/bin/|/bin/|/usr/local/bin/)?", WRAPPER_PREFIX, TEE_HOP = `(?:tee\\s+\\S+\\s*\\|\\s*)?`, BACKTICK = "\\u0060", PIPE_TO_SHELL_RE, PIPE_TO_SCRIPT_STDIN_RE, DASH_C_COMMAND_SUB_RE, PROCESS_SUB_RE, SOURCE_PROCESS_SUB_RE, EVAL_COMMAND_SUB_RE, DOWNLOAD_THEN_EXEC_RE, POWERSHELL_IEX_RE, POWERSHELL_PIPE_IEX_RE, POWERSHELL_DOWNLOADSTRING_RE, REMOTE_EXEC_SHAPES, INTERPRETER_EXEC_FLAG_RE, REVERSE_SHELL_RE, BASE64_PIPE_SHELL_RE, XARGS_TO_SHELL_C_RE, DOWNLOAD_CHMOD_EXEC_RE, BEHAVIOR_CLASS_SHAPES, MAX_FENCE_INDENT = 3, TRAILING_EXIT0_RE, EMPTY_CATCH_RE, SCRIPT_SHELL_SUPPRESSION_RE;
+var DROPPED_SINGLE_CODEPOINTS, COMBINING_MARK_RANGES, MATH_ALPHANUMERIC_LETTER_STYLE_STARTS, MATH_ALPHANUMERIC_DIGIT_STYLE_STARTS, MATH_ALPHANUMERIC_EXCEPTIONS, HTML_ENTITY_AT_RE, NAMED_HTML_ENTITIES, HOMOGLYPH_FOLD, QUOTE_CHARS_ANY, SENTENCE_END_CHARS, REPORTED_SPEECH_RE, SEVERITY_RANK, AUTO_RUN_PATTERNS, WILDCARD_ALLOW_PATTERNS, BYPASS_FLAGS, EXACT_VERSION_RE, COMMIT_SHA_RE, INTEGRITY_HASH_RE, TOOL_INPUT_VAR = "(?:TOOL_INPUT|CLAUDE_TOOL_INPUT|tool_input|ARGUMENTS|1)", INTERP_VAR_RE, INSIDE_SUBSHELL_RE, INSIDE_BACKTICK_RE, INSIDE_DQUOTE_RE, NETWORK_CLIENTS, SHELL_INTERPRETERS = "sh|bash|zsh|dash|ksh|python3?|node|perl|ruby", SHELL_LIKE_INTERPRETERS = "sh|bash|zsh|dash|ksh", SCRIPT_STDIN_INTERPRETERS = "python3?|node|perl|ruby", DOWNLOAD_TOOLS = "curl|wget", ABS_PATH_PREFIX = "(?:/usr/bin/|/bin/|/usr/local/bin/)?", WRAPPER_PREFIX, TEE_HOP = `(?:tee\\s+\\S+\\s*\\|\\s*)?`, BACKTICK = "\\u0060", PIPE_TO_SHELL_RE, PIPE_TO_SCRIPT_STDIN_RE, DASH_C_COMMAND_SUB_RE, PROCESS_SUB_RE, SOURCE_PROCESS_SUB_RE, EVAL_COMMAND_SUB_RE, DOWNLOAD_THEN_EXEC_RE, POWERSHELL_IEX_RE, POWERSHELL_PIPE_IEX_RE, POWERSHELL_DOWNLOADSTRING_RE, REMOTE_EXEC_SHAPES, INTERPRETER_EXEC_FLAG_RE, REVERSE_SHELL_RE, BASE64_PIPE_SHELL_RE, XARGS_TO_SHELL_C_RE, DOWNLOAD_CHMOD_EXEC_RE, BEHAVIOR_CLASS_SHAPES, MAX_FENCE_INDENT = 3, TRAILING_EXIT0_RE, EMPTY_CATCH_RE, SCRIPT_SHELL_SUPPRESSION_RE;
 var init_checks = __esm(() => {
   init_injection();
   init_secrets();
@@ -14656,6 +15799,9 @@ var init_checks = __esm(() => {
     "--yolo",
     "--dangerously-bypass-approvals-and-sandbox"
   ];
+  EXACT_VERSION_RE = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+  COMMIT_SHA_RE = /^[0-9a-f]{40}$/i;
+  INTEGRITY_HASH_RE = /^sha(?:256|384|512)[-:][A-Za-z0-9+/=_-]+$/;
   INTERP_VAR_RE = new RegExp(`\\$\\{?\\s*${TOOL_INPUT_VAR}\\s*\\}?`);
   INSIDE_SUBSHELL_RE = new RegExp(`\\$\\([^)]*\\$${TOOL_INPUT_VAR}\\b[^)]*\\)`);
   INSIDE_BACKTICK_RE = new RegExp(`\`[^\`]*\\$${TOOL_INPUT_VAR}\\b[^\`]*\``);
@@ -15753,12 +16899,15 @@ function ephemeralHashFn() {
   const key = ephemeralHmacKey;
   return (value) => hmacHash(value, key);
 }
-async function analyze(cwd, input, opts = {}) {
+async function loadAnalysisContext(cwd) {
   const config = await loadSecurityConfig(cwd);
+  return { config, hashFn: await hashFnFor(cwd) };
+}
+async function detectAndResolve(cwd, input, context, opts) {
+  const { config, hashFn } = context;
   const original = await runDetectorsAsync(cwd, input.content, config);
   const contextual = opts.filesystemSourceScan && input.source === "trusted-project" && input.path ? await filterSourceMatches(input.content, input.path, original) : { matches: original };
   const matches = contextual.matches;
-  const hashFn = await hashFnFor(cwd);
   const buildOpts = {
     source: input.source,
     content: input.content,
@@ -15771,6 +16920,9 @@ async function analyze(cwd, input, opts = {}) {
     buildOpts.path = input.path;
   }
   const decision = resolveDecision(config, { ...buildOpts, matches });
+  return contextual.warning !== undefined ? { decision, warning: contextual.warning } : { decision };
+}
+async function runSelfProtection(cwd, config) {
   const previous = await readState(cwd);
   const selfProtection = evaluateSelfProtection(config, previous);
   if (selfProtection.incidents.length > 0) {
@@ -15779,6 +16931,13 @@ async function analyze(cwd, input, opts = {}) {
   if (!config.configUnreadable) {
     await writeState(cwd, currentState(config));
   }
+  return { findings: selfProtection.findings, warnings: selfProtection.warnings };
+}
+async function analyze(cwd, input, opts = {}) {
+  const context = await loadAnalysisContext(cwd);
+  const { config } = context;
+  const { decision, warning } = await detectAndResolve(cwd, input, context, opts);
+  const selfProtection = await runSelfProtection(cwd, config);
   if (selfProtection.findings.length > 0) {
     decision.findings.push(...selfProtection.findings);
     decision.gate = computeGate(decision.findings, config).gate;
@@ -15786,7 +16945,7 @@ async function analyze(cwd, input, opts = {}) {
   }
   return {
     decision,
-    warnings: [...selfProtection.warnings, ...contextual.warning ? [contextual.warning] : []],
+    warnings: [...selfProtection.warnings, ...warning !== undefined ? [warning] : []],
     config
   };
 }
@@ -15825,32 +16984,50 @@ async function runScanPath(cwd, input) {
   });
   const findings = [];
   const warnings = [];
-  let config;
   const files = traversal.files.map((file) => ({ ...file }));
+  const markIncomplete = () => {
+    traversal.coverage.status = "incomplete";
+    if (!traversal.coverage.reasons.includes("security analysis unavailable")) {
+      traversal.coverage.reasons.push("security analysis unavailable");
+    }
+  };
+  const context = await loadAnalysisContext(cwd).catch(() => {
+    return;
+  });
+  let analyzed = 0;
   for (const item of traversal.contents) {
     try {
-      const result = await analyze(cwd, {
+      if (context === undefined)
+        throw new Error("security analysis unavailable");
+      const result = await detectAndResolve(cwd, {
         content: item.content,
         source: input.source,
         path: item.path,
         ...input.target !== undefined ? { target: input.target } : {}
-      }, { filesystemSourceScan: true });
-      config ??= result.config;
+      }, context, { filesystemSourceScan: true });
+      analyzed += 1;
       findings.push(...result.decision.findings);
-      warnings.push(...result.warnings);
+      if (result.warning !== undefined)
+        warnings.push(result.warning);
     } catch {
       const file = files.find((entry) => entry.path === item.path && entry.status === "scanned");
       if (file !== undefined) {
         file.status = "failed";
         file.reason = "security analysis unavailable";
       }
-      traversal.coverage.status = "incomplete";
-      if (!traversal.coverage.reasons.includes("security analysis unavailable")) {
-        traversal.coverage.reasons.push("security analysis unavailable");
-      }
+      markIncomplete();
+    }
+  }
+  const config = context?.config ?? await loadSecurityConfig(cwd);
+  if (analyzed > 0) {
+    try {
+      const selfProtection = await runSelfProtection(cwd, config);
+      findings.push(...selfProtection.findings);
+      warnings.unshift(...selfProtection.warnings);
+    } catch {
+      markIncomplete();
     }
   }
-  config ??= await loadSecurityConfig(cwd);
   const computed = computeGate(findings, config);
   const gate = computed.gate === "pass" && traversal.coverage.status === "incomplete" ? "incomplete" : computed.gate;
   const action = strongestAction(findings.map((finding) => finding.action));
@@ -26350,6 +27527,7 @@ __export(exports_service9, {
   hashVerifiedTaskOutcome: () => hashVerifiedTaskOutcome,
   isExternalSlateStale: () => isExternalSlateStale,
   isSlateSeedKind: () => isSlateSeedKind,
+  isWorkspaceId: () => isWorkspaceId,
   listWorkspaceViews: () => listWorkspaceViews,
   localWorkspaceAuthorizationServer: () => localWorkspaceAuthorizationServer,
   lookupWorkspace: () => lookupWorkspace,
@@ -26359,6 +27537,7 @@ __export(exports_service9, {
   normalizeProposalLifecycleResult: () => normalizeProposalLifecycleResult,
   normalizeWorkspaceReference: () => normalizeWorkspaceReference,
   proposalNotePath: () => proposalNotePath,
+  proposeFromSession: () => proposeFromSession,
   readExternalSlate: () => readExternalSlate,
   reclaimStaleExternalSlates: () => reclaimStaleExternalSlates,
   redactSensitiveText: () => redactSensitiveText,
@@ -42670,7 +43849,7 @@ class WorkspaceService {
     }
   }
   async readManifest(id) {
-    if (!/^[a-z][a-z0-9-]{2,63}$/.test(id))
+    if (!isWorkspaceId(id))
       throw new WorkspaceServiceError("not_found", "workspace not found");
     let parsed;
     try {
@@ -42708,6 +43887,9 @@ function currentRoleOrRevoked(manifest, subject) {
 function localWorkspaceAuthorizationServer(subject = `user:local-${process.getuid?.() ?? process.pid}`) {
   return createSacAuthorizationServer({ authenticateRequest: async () => ({ subject, authenticationMethod: "local-os", roleRevision: "local-os-v1" }) });
 }
+function isWorkspaceId(id) {
+  return /^[a-z][a-z0-9-]{2,63}$/.test(id);
+}
 function newWorkspaceId() {
   return `workspace-${randomUUID4().replace(/-/g, "").slice(0, 16)}`;
 }
@@ -45676,9 +46858,44 @@ function createLocalFwkReadService(cwd, opts) {
 function normalizeFwkResult(result) {
   return JSON.parse(JSON.stringify(result));
 }
+// src/sac/propose-from-session.ts
+init_guard();
+import { randomUUID as randomUUID10 } from "crypto";
+import { writeFile as writeFile25 } from "fs/promises";
+async function proposeFromSession(input) {
+  const { cwd, workspaceId, kind, sessionRef } = input;
+  const session = findSession(cwd, sessionRef);
+  if (!session)
+    return { ok: false, reason: "session-not-found", message: `no session matching "${sessionRef}" in this project` };
+  const proposalId = `proposal-${randomUUID10().replace(/-/g, "").slice(0, 16)}`;
+  const notePath = proposalNotePath(cwd, workspaceId, proposalId);
+  const materializedNote = input.note === undefined ? undefined : prepareOutputForPersistence(await guardOutput({ cwd, content: input.note, target: "task", source: "generated", path: notePath }), input.note);
+  if (materializedNote !== undefined && !materializedNote.allowed) {
+    return { ok: false, reason: "note-refused", message: materializedNote.reason };
+  }
+  const persistedNote = materializedNote?.allowed ? materializedNote.content : undefined;
+  const { service, wrapUpAuthority, authorizationServer } = createHarnessProposalLifecycleService(cwd, { workspaceId, ...persistedNote ? { note: persistedNote } : {} });
+  const requestCorrelationId = randomUUID10();
+  const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
+  if (!actor)
+    return { ok: false, reason: "no-actor", message: "trusted ActorContext is required" };
+  const wrapUp = await wrapUpAuthority.issue({ actor, source: "session", sourceRef: sessionEvidenceRef(workspaceId, session.id) });
+  const proposal = await service.create({
+    request: undefined,
+    requestCorrelationId,
+    workspaceId,
+    id: proposalId,
+    proposalRevision: input.proposalRevision ?? "1",
+    kind,
+    wrapUp
+  });
+  if (persistedNote)
+    await writeFile25(notePath, persistedNote, "utf8");
+  return { ok: true, result: normalizeProposalLifecycleResult(proposal) };
+}
 // src/sac/collaboration-service.ts
 import { appendFile as appendFile9, mkdir as mkdir37, readFile as readFile75 } from "fs/promises";
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import path145 from "path";
 class CollaborationServiceError extends Error {
   code;
@@ -45725,7 +46942,7 @@ class CollaborationService {
       const activity = this.validate({
         ...supplied,
         schemaVersion: "1.0",
-        id: `activity-${randomUUID10()}`,
+        id: `activity-${randomUUID11()}`,
         workspaceId: manifest.id,
         actorSubject: actor.subject,
         occurredAt: (this.input.now ?? (() => new Date))().toISOString(),
@@ -45786,13 +47003,13 @@ import path147 from "path";
 // src/sac/machine-wrap-up.ts
 init_fs();
 init_slate();
-import { createHash as createHash36, randomUUID as randomUUID12 } from "crypto";
+import { createHash as createHash36, randomUUID as randomUUID13 } from "crypto";
 import { mkdir as mkdir38 } from "fs/promises";
 import path146 from "path";
 
 // src/sac/workspace-resolve.ts
 init_redact();
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 var DEFAULT_MODEL_TURN_TIMEOUT_MS = 15000;
 var TOPIC_HINT_MAX_LENGTH = 200;
 function workspaceStore(cwd) {
@@ -45820,7 +47037,7 @@ async function resolveOrCreateWorkspace(input) {
   const store = workspaceStore(input.cwd);
   let existing;
   try {
-    const listed = await store.list({ request: undefined, requestCorrelationId: randomUUID11(), includeArchived: false });
+    const listed = await store.list({ request: undefined, requestCorrelationId: randomUUID12(), includeArchived: false });
     existing = listed.filter((w) => w.status === "active").map((w) => ({ id: w.id, title: w.title, status: w.status }));
   } catch {
     return { ok: false, reason: "error" };
@@ -45886,7 +47103,7 @@ async function createWorkspace(store, title) {
   try {
     const workspace = await store.create({
       request: undefined,
-      requestCorrelationId: randomUUID11(),
+      requestCorrelationId: randomUUID12(),
       id: newWorkspaceId(),
       title
     });
@@ -46121,7 +47338,7 @@ async function proposeOneGroup(params) {
       workspaceId: params.workspaceId,
       now: params.now
     });
-    const requestCorrelationId = randomUUID12();
+    const requestCorrelationId = randomUUID13();
     const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
     if (!actor)
       throw new Error("trusted ActorContext is required for a machine wrap-up propose");
@@ -47360,6 +48577,12 @@ var HELP_GROUPS = [
     group: "External agents, ACP and MCP",
     summary: "Install, audit and uninstall Keryx's hooks and instructions in another coding agent (see also /integrate, unrelated)."
   },
+  {
+    kind: "cli",
+    name: "herdr",
+    group: "External agents, ACP and MCP",
+    summary: "Register Keryx with the Herdr desktop app and herdr-core (opt-in install, remove, status)."
+  },
   {
     kind: "cli",
     name: "serve-mcp",