@node9/policy-engine 1.0.0

package/dist/index.js

@@ -0,0 +1,2297 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  BUILTIN_SHIELDS: () => BUILTIN_SHIELDS,
+  DLP_PATTERNS: () => DLP_PATTERNS,
+  ENGINE_VERSION: () => ENGINE_VERSION,
+  FLAGS_WITH_VALUES: () => FLAGS_WITH_VALUES,
+  LOOP_MAX_RECORDS: () => LOOP_MAX_RECORDS,
+  SENSITIVE_PATH_REGEXES: () => SENSITIVE_PATH_REGEXES,
+  analyzePipeChain: () => analyzePipeChain,
+  analyzeShellCommand: () => analyzeShellCommand,
+  checkDangerousSql: () => checkDangerousSql,
+  computeArgsHash: () => computeArgsHash,
+  detectDangerousEval: () => detectDangerousEval,
+  detectDangerousShellExec: () => detectDangerousShellExec,
+  evaluateLoopWindow: () => evaluateLoopWindow,
+  evaluatePolicy: () => evaluatePolicy,
+  evaluateSmartConditions: () => evaluateSmartConditions,
+  extractAllSshHosts: () => extractAllSshHosts,
+  extractNetworkTargets: () => extractNetworkTargets,
+  extractPositionalArgs: () => extractPositionalArgs,
+  getCompiledRegex: () => getCompiledRegex,
+  getNestedValue: () => getNestedValue,
+  isIgnoredTool: () => isIgnoredTool,
+  isShieldVerdict: () => isShieldVerdict,
+  matchSensitivePath: () => matchSensitivePath,
+  matchesPattern: () => matchesPattern,
+  normalizeCommandForPolicy: () => normalizeCommandForPolicy,
+  parseAllSshHostsFromCommand: () => parseAllSshHostsFromCommand,
+  redactText: () => redactText,
+  scanArgs: () => scanArgs,
+  scanText: () => scanText,
+  sensitivePathMatch: () => sensitivePathMatch,
+  validateOverrides: () => validateOverrides,
+  validateRegex: () => validateRegex,
+  validateShieldDefinition: () => validateShieldDefinition
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/dlp/index.ts
+var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(?:_key|_token)?|credential|private[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*/i;
+function isAssignmentContext(text) {
+  return ASSIGNMENT_CONTEXT_RE.test(text);
+}
+function shannonEntropy(s) {
+  if (s.length === 0) return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+var DLP_STOPWORDS = [
+  "example",
+  "placeholder",
+  "changeme",
+  "your_key",
+  "your_token",
+  "your_secret",
+  "replace_me",
+  "insert_key",
+  "put_your",
+  "fake",
+  "dummy",
+  "sample",
+  "xxxxxxxx",
+  "aaaaaa",
+  "bbbbbb",
+  "00000000",
+  "${",
+  "{{",
+  "%{",
+  "<your",
+  "test_key",
+  "test_token",
+  "your",
+  "here"
+];
+var DLP_PATTERNS = [
+  // ── AWS ───────────────────────────────────────────────────────────────────
+  {
+    name: "AWS Access Key ID",
+    regex: /\b(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16}\b/,
+    severity: "block",
+    keywords: ["akia", "asia", "abia", "acca", "a3t"]
+  },
+  // ── GitHub ────────────────────────────────────────────────────────────────
+  {
+    name: "GitHub Token",
+    regex: /\bgh[pous]_[A-Za-z0-9]{36}\b/,
+    severity: "block",
+    keywords: ["ghp_", "gho_", "ghu_", "ghs_"],
+    minEntropy: 3
+  },
+  {
+    name: "GitHub Fine-Grained PAT",
+    regex: /\bgithub_pat_\w{82}\b/,
+    severity: "block",
+    keywords: ["github_pat_"]
+  },
+  // ── Slack ─────────────────────────────────────────────────────────────────
+  {
+    name: "Slack Bot Token",
+    // Real tokens are ~50–80 chars; lower bound 20 avoids false negatives on partial tokens
+    regex: /\bxoxb-[0-9A-Za-z-]{20,100}\b/,
+    severity: "block",
+    keywords: ["xoxb-"]
+  },
+  // ── Anthropic ─────────────────────────────────────────────────────────────
+  // Listed before OpenAI — Anthropic keys start with sk-ant- which would also
+  // match the broader OpenAI sk- pattern; more specific rules must come first.
+  {
+    name: "Anthropic API Key",
+    regex: /\bsk-ant-api03-[a-zA-Z0-9_-]{93}AA\b/,
+    severity: "block",
+    keywords: ["sk-ant-api03"]
+  },
+  {
+    name: "Anthropic Admin Key",
+    regex: /\bsk-ant-admin01-[a-zA-Z0-9_-]{93}AA\b/,
+    severity: "block",
+    keywords: ["sk-ant-admin01"]
+  },
+  // ── OpenAI ────────────────────────────────────────────────────────────────
+  {
+    name: "OpenAI API Key",
+    regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/,
+    severity: "block",
+    keywords: ["sk-"],
+    minEntropy: 3.5
+  },
+  // ── Stripe ────────────────────────────────────────────────────────────────
+  {
+    name: "Stripe Secret Key",
+    regex: /\bsk_(?:live|test)_[0-9a-zA-Z]{24}\b/,
+    severity: "block",
+    keywords: ["sk_live_", "sk_test_"]
+  },
+  // ── GCP ───────────────────────────────────────────────────────────────────
+  {
+    name: "GCP API Key",
+    regex: /\bAIza[0-9A-Za-z_-]{35}\b/,
+    severity: "block",
+    keywords: ["aiza"],
+    minEntropy: 3
+  },
+  {
+    name: "GCP Service Account",
+    regex: /"type"\s*:\s*"service_account"/,
+    severity: "block",
+    keywords: ["service_account"]
+  },
+  // ── Azure ─────────────────────────────────────────────────────────────────
+  // Pattern: 3 alphanum chars + digit + Q~ + 31-34 alphanum chars
+  {
+    name: "Azure AD Client Secret",
+    regex: /(?:^|[\s>=:(,])([a-zA-Z0-9_~.]{3}\dQ~[a-zA-Z0-9_~.-]{31,34})(?:$|[\s<),])/,
+    severity: "block",
+    keywords: ["q~"]
+  },
+  // ── Databricks ────────────────────────────────────────────────────────────
+  {
+    name: "Databricks API Token",
+    regex: /\bdapi[a-f0-9]{32}(?:-\d)?\b/,
+    severity: "block",
+    keywords: ["dapi"]
+  },
+  // ── DigitalOcean ──────────────────────────────────────────────────────────
+  {
+    name: "DigitalOcean PAT",
+    regex: /\bdop_v1_[a-f0-9]{64}\b/,
+    severity: "block",
+    keywords: ["dop_v1_"]
+  },
+  {
+    name: "DigitalOcean Access Token",
+    regex: /\bdoo_v1_[a-f0-9]{64}\b/,
+    severity: "block",
+    keywords: ["doo_v1_"]
+  },
+  // ── Doppler ───────────────────────────────────────────────────────────────
+  {
+    name: "Doppler Token",
+    regex: /\bdp\.pt\.[a-z0-9]{43}\b/i,
+    severity: "block",
+    keywords: ["dp.pt."]
+  },
+  // ── HashiCorp Vault ───────────────────────────────────────────────────────
+  {
+    name: "HashiCorp Vault Service Token",
+    regex: /\bhvs\.[\w-]{90,120}\b/,
+    severity: "block",
+    keywords: ["hvs."]
+  },
+  {
+    name: "HashiCorp Vault Batch Token",
+    regex: /\bhvb\.[\w-]{138,300}\b/,
+    severity: "block",
+    keywords: ["hvb."]
+  },
+  // ── Hugging Face ──────────────────────────────────────────────────────────
+  {
+    name: "HuggingFace Token",
+    regex: /\bhf_[A-Za-z]{34}\b/,
+    severity: "block",
+    keywords: ["hf_"],
+    minEntropy: 3
+  },
+  // ── Postman ───────────────────────────────────────────────────────────────
+  {
+    name: "Postman API Token",
+    regex: /\bPMAK-[a-f0-9]{24}-[a-f0-9]{34}\b/i,
+    severity: "block",
+    keywords: ["pmak-"]
+  },
+  // ── Pulumi ────────────────────────────────────────────────────────────────
+  {
+    name: "Pulumi Access Token",
+    regex: /\bpul-[a-f0-9]{40}\b/,
+    severity: "block",
+    keywords: ["pul-"]
+  },
+  // ── SendGrid ──────────────────────────────────────────────────────────────
+  {
+    name: "SendGrid API Key",
+    regex: /\bSG\.[a-zA-Z0-9=_.-]{66}\b/,
+    severity: "block",
+    keywords: ["sg."]
+  },
+  // ── Private keys (PEM) ────────────────────────────────────────────────────
+  {
+    name: "Private Key (PEM)",
+    regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    severity: "block",
+    keywords: ["-----begin"]
+  },
+  // ── NPM ───────────────────────────────────────────────────────────────────
+  {
+    name: "NPM Auth Token",
+    regex: /_authToken\s*=\s*[A-Za-z0-9_-]{20,}/,
+    severity: "block",
+    keywords: ["_authtoken"]
+  },
+  // ── JWT ───────────────────────────────────────────────────────────────────
+  // review (not block): JWTs appear legitimately in API calls; flag for human approval
+  // contextBoost: promoted to block when assigned (e.g. TOKEN=eyJ...)
+  {
+    name: "JWT",
+    regex: /\bey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9\/_-]{17,}\.[a-zA-Z0-9\/_-]{10,}={0,2}\b/,
+    severity: "review",
+    keywords: ["eyj"],
+    contextBoost: true
+  },
+  // ── Stripe (extended — adds restricted key rk_ prefix) ──────────────────
+  {
+    name: "Stripe Restricted Key",
+    regex: /\brk_(?:live|test|prod)_[0-9a-zA-Z]{10,99}\b/,
+    severity: "block",
+    keywords: ["rk_live_", "rk_test_", "rk_prod_"]
+  },
+  // ── Slack (app token) ─────────────────────────────────────────────────────
+  {
+    name: "Slack App Token",
+    regex: /\bxapp-\d-[A-Z0-9]+-\d+-[a-f0-9]+\b/,
+    severity: "block",
+    keywords: ["xapp-"]
+  },
+  // ── GitLab ────────────────────────────────────────────────────────────────
+  { name: "GitLab PAT", regex: /\bglpat-[\w-]{20}\b/, severity: "block", keywords: ["glpat-"] },
+  {
+    name: "GitLab Deploy Token",
+    regex: /\bgldt-[0-9a-zA-Z_-]{20}\b/,
+    severity: "block",
+    keywords: ["gldt-"]
+  },
+  {
+    name: "GitLab CI Job Token",
+    regex: /\bglcbt-[0-9a-zA-Z]{1,5}_[0-9a-zA-Z_-]{20}\b/,
+    severity: "block",
+    keywords: ["glcbt-"]
+  },
+  // ── npm (publish token) ───────────────────────────────────────────────────
+  {
+    name: "npm Access Token",
+    regex: /\bnpm_[a-zA-Z0-9]{36}\b/,
+    severity: "block",
+    keywords: ["npm_"]
+  },
+  // ── Shopify ───────────────────────────────────────────────────────────────
+  {
+    name: "Shopify Access Token",
+    regex: /\bshpat_[a-fA-F0-9]{32}\b/,
+    severity: "block",
+    keywords: ["shpat_"]
+  },
+  {
+    name: "Shopify Custom Access Token",
+    regex: /\bshpca_[a-fA-F0-9]{32}\b/,
+    severity: "block",
+    keywords: ["shpca_"]
+  },
+  {
+    name: "Shopify Private App Token",
+    regex: /\bshppa_[a-fA-F0-9]{32}\b/,
+    severity: "block",
+    keywords: ["shppa_"]
+  },
+  {
+    name: "Shopify Shared Secret",
+    regex: /\bshpss_[a-fA-F0-9]{32}\b/,
+    severity: "block",
+    keywords: ["shpss_"]
+  },
+  // ── Linear ────────────────────────────────────────────────────────────────
+  {
+    name: "Linear API Key",
+    regex: /\blin_api_[a-zA-Z0-9]{40}\b/,
+    severity: "block",
+    keywords: ["lin_api_"]
+  },
+  // ── PlanetScale ───────────────────────────────────────────────────────────
+  {
+    name: "PlanetScale API Token",
+    regex: /\bpscale_tkn_[\w.-]{32,64}\b/,
+    severity: "block",
+    keywords: ["pscale_tkn_"]
+  },
+  {
+    name: "PlanetScale Password",
+    regex: /\bpscale_pw_[\w.-]{32,64}\b/,
+    severity: "block",
+    keywords: ["pscale_pw_"]
+  },
+  // ── Sentry ────────────────────────────────────────────────────────────────
+  {
+    name: "Sentry User Token",
+    regex: /\bsntryu_[a-f0-9]{64}\b/,
+    severity: "block",
+    keywords: ["sntryu_"]
+  },
+  // ── Grafana ───────────────────────────────────────────────────────────────
+  {
+    name: "Grafana Service Account Token",
+    regex: /\bglsa_[a-zA-Z0-9]{32}_[a-f0-9]{8}\b/,
+    severity: "block",
+    keywords: ["glsa_"]
+  },
+  // ── Heroku ────────────────────────────────────────────────────────────────
+  {
+    name: "Heroku API Key",
+    regex: /\bHRKU-AA[0-9a-zA-Z_-]{58}\b/,
+    severity: "block",
+    keywords: ["hrku-aa"]
+  },
+  // ── PyPI ──────────────────────────────────────────────────────────────────
+  {
+    name: "PyPI Upload Token",
+    regex: /\bpypi-[A-Za-z0-9_-]{50,}\b/,
+    severity: "block",
+    keywords: ["pypi-"],
+    minEntropy: 3
+  },
+  // ── Bearer Token ─────────────────────────────────────────────────────────
+  // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
+  {
+    name: "Bearer Token",
+    regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
+    severity: "review",
+    keywords: ["bearer"],
+    contextBoost: true,
+    minEntropy: 3
+  },
+  // ── Resend ────────────────────────────────────────────────────────────────
+  {
+    name: "Resend API Key",
+    regex: /\bre_[a-zA-Z0-9]{24}\b/,
+    severity: "block",
+    keywords: ["re_"]
+  },
+  // ── Telegram ──────────────────────────────────────────────────────────────
+  {
+    name: "Telegram Bot Token",
+    regex: /\b[0-9]{7,10}:AA[a-zA-Z0-9_-]{33}\b/,
+    severity: "block",
+    keywords: [":aa"]
+  },
+  // ── Mapbox ────────────────────────────────────────────────────────────────
+  {
+    name: "Mapbox Access Token",
+    regex: /\bpk\.eyJ1[a-zA-Z0-9._-]{20,}\b/,
+    severity: "block",
+    keywords: ["pk.eyj1"],
+    minEntropy: 3
+  },
+  // ── Notion ────────────────────────────────────────────────────────────────
+  {
+    name: "Notion Integration Token",
+    regex: /\bsecret_[a-zA-Z0-9]{43}\b/,
+    severity: "block",
+    keywords: ["secret_"]
+  },
+  // ── Square ────────────────────────────────────────────────────────────────
+  {
+    name: "Square Access Token",
+    regex: /\bsq0atp-[0-9A-Za-z_-]{22}\b/,
+    severity: "block",
+    keywords: ["sq0atp-"]
+  },
+  {
+    name: "Square OAuth Secret",
+    regex: /\bsq0csp-[0-9A-Za-z_-]{43}\b/,
+    severity: "block",
+    keywords: ["sq0csp-"]
+  },
+  // ── Typeform ──────────────────────────────────────────────────────────────
+  {
+    name: "Typeform Token",
+    regex: /\btfp_[a-zA-Z0-9_]{59}\b/,
+    severity: "block",
+    keywords: ["tfp_"]
+  },
+  // ── Cloudinary ────────────────────────────────────────────────────────────
+  {
+    name: "Cloudinary URL",
+    regex: /\bcloudinary:\/\/[0-9]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+/,
+    severity: "block",
+    keywords: ["cloudinary://"]
+  },
+  // ── Airtable ──────────────────────────────────────────────────────────────
+  // New PAT format: pat + 14 alphanum + . + 64 alphanum
+  {
+    name: "Airtable PAT",
+    regex: /\bpat[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{64}\b/,
+    severity: "block",
+    keywords: ["pat"]
+  },
+  // ── RubyGems ──────────────────────────────────────────────────────────────
+  {
+    name: "RubyGems API Key",
+    regex: /\brubygems_[a-f0-9]{48}\b/,
+    severity: "block",
+    keywords: ["rubygems_"]
+  },
+  // ── Shippo ────────────────────────────────────────────────────────────────
+  {
+    name: "Shippo Token",
+    regex: /\bshippo_(?:live|test)_[a-f0-9]{40}\b/,
+    severity: "block",
+    keywords: ["shippo_"]
+  },
+  // ── Plaid ─────────────────────────────────────────────────────────────────
+  {
+    name: "Plaid Access Token",
+    regex: /\baccess-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/,
+    severity: "block",
+    keywords: ["access-sandbox", "access-development", "access-production"]
+  },
+  // ── Age ───────────────────────────────────────────────────────────────────
+  {
+    name: "Age Identity Key",
+    regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
+    severity: "block",
+    keywords: ["age-secret-key-"]
+  }
+];
+var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
+  (p) => ({
+    pattern: p,
+    globalRegex: new RegExp(
+      p.regex.source,
+      p.regex.flags.includes("g") ? p.regex.flags : p.regex.flags + "g"
+    )
+  })
+);
+var SENSITIVE_PATH_PATTERNS = [
+  /[/\\]\.ssh[/\\]/i,
+  /[/\\]\.aws[/\\]/i,
+  /[/\\]\.config[/\\]gcloud[/\\]/i,
+  /[/\\]\.azure[/\\]/i,
+  /[/\\]\.kube[/\\]config$/i,
+  /[/\\]\.env($|\.)/i,
+  // .env, .env.local, .env.production — not .envoy
+  /[/\\]\.git-credentials$/i,
+  /[/\\]\.npmrc$/i,
+  /[/\\]\.docker[/\\]config\.json$/i,
+  /[/\\][^/\\]+\.pem$/i,
+  /[/\\][^/\\]+\.key$/i,
+  /[/\\][^/\\]+\.p12$/i,
+  /[/\\][^/\\]+\.pfx$/i,
+  /^(?:[a-zA-Z]:)?\/etc\/passwd$/,
+  /^(?:[a-zA-Z]:)?\/etc\/shadow$/,
+  /^(?:[a-zA-Z]:)?\/etc\/sudoers$/,
+  /[/\\]credentials\.json$/i,
+  /[/\\]id_rsa$/i,
+  /[/\\]id_ed25519$/i,
+  /[/\\]id_ecdsa$/i
+];
+function matchSensitivePath(resolvedPath, originalPath) {
+  const normalised = resolvedPath.replace(/\\/g, "/");
+  for (const pattern of SENSITIVE_PATH_PATTERNS) {
+    if (pattern.test(normalised)) {
+      return {
+        patternName: "Sensitive File Path",
+        fieldPath: "file_path",
+        redactedSample: originalPath,
+        severity: "block"
+      };
+    }
+  }
+  return null;
+}
+function sensitivePathMatch(originalPath) {
+  return {
+    patternName: "Sensitive File Path",
+    fieldPath: "file_path",
+    redactedSample: originalPath,
+    severity: "block"
+  };
+}
+var SENSITIVE_PATH_REGEXES = SENSITIVE_PATH_PATTERNS;
+function maskSecret(raw, pattern) {
+  const match = raw.match(pattern);
+  if (!match) return "****";
+  const secret = match[0];
+  if (secret.length < 8) return "****";
+  const prefix = secret.slice(0, 4);
+  const suffix = secret.slice(-4);
+  const stars = "*".repeat(Math.min(secret.length - 8, 12));
+  return `${prefix}${stars}${suffix}`;
+}
+var MAX_DEPTH = 5;
+var MAX_STRING_BYTES = 1e5;
+var MAX_JSON_PARSE_BYTES = 1e4;
+function scanArgs(args, depth = 0, fieldPath = "args") {
+  if (depth > MAX_DEPTH || args === null || args === void 0) return null;
+  if (Array.isArray(args)) {
+    for (let i = 0; i < args.length; i++) {
+      const match = scanArgs(args[i], depth + 1, `${fieldPath}[${i}]`);
+      if (match) return match;
+    }
+    return null;
+  }
+  if (typeof args === "object") {
+    for (const [key, value] of Object.entries(args)) {
+      const match = scanArgs(value, depth + 1, `${fieldPath}.${key}`);
+      if (match) return match;
+    }
+    return null;
+  }
+  if (typeof args === "string") {
+    const text = args.length > MAX_STRING_BYTES ? args.slice(0, MAX_STRING_BYTES) : args;
+    const textLower = text.toLowerCase();
+    const assignmentCtx = isAssignmentContext(text);
+    for (const pattern of DLP_PATTERNS) {
+      if (pattern.keywords && !pattern.keywords.some((kw) => textLower.includes(kw.toLowerCase()))) {
+        continue;
+      }
+      if (pattern.regex.test(text)) {
+        const raw = text.match(pattern.regex)?.[0] ?? "";
+        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
+        const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
+        return {
+          patternName: pattern.name,
+          fieldPath,
+          redactedSample: maskSecret(text, pattern.regex),
+          severity
+        };
+      }
+    }
+    if (text.length < MAX_JSON_PARSE_BYTES) {
+      const trimmed = text.trim();
+      if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+        try {
+          const parsed = JSON.parse(text);
+          const inner = scanArgs(parsed, depth + 1, fieldPath);
+          if (inner) return inner;
+        } catch {
+        }
+      }
+    }
+  }
+  return null;
+}
+function scanText(text) {
+  const t = text.length > MAX_STRING_BYTES ? text.slice(0, MAX_STRING_BYTES) : text;
+  const tLower = t.toLowerCase();
+  for (const pattern of DLP_PATTERNS) {
+    if (pattern.keywords && !pattern.keywords.some((kw) => tLower.includes(kw.toLowerCase()))) {
+      continue;
+    }
+    if (pattern.regex.test(t)) {
+      const raw = t.match(pattern.regex)?.[0] ?? "";
+      if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+      if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
+      return {
+        patternName: pattern.name,
+        fieldPath: "response-text",
+        redactedSample: maskSecret(t, pattern.regex),
+        severity: pattern.severity
+      };
+    }
+  }
+  return null;
+}
+function redactText(text) {
+  const t = text.length > MAX_STRING_BYTES ? text.slice(0, MAX_STRING_BYTES) : text;
+  let result = t;
+  const found = [];
+  const lower = t.toLowerCase();
+  for (const { pattern, globalRegex } of DLP_PATTERNS_GLOBAL) {
+    if (pattern.keywords && !pattern.keywords.some((kw) => lower.includes(kw.toLowerCase()))) {
+      continue;
+    }
+    result = result.replace(globalRegex, (match) => {
+      if (DLP_STOPWORDS.some((sw) => match.toLowerCase().includes(sw))) return match;
+      if (pattern.minEntropy !== void 0 && shannonEntropy(match) < pattern.minEntropy)
+        return match;
+      if (!found.includes(pattern.name)) found.push(pattern.name);
+      return `[node9-redacted:${pattern.name}]`;
+    });
+  }
+  return { result, found };
+}
+
+// src/shell/index.ts
+var import_mvdan_sh = __toESM(require("mvdan-sh"));
+var { syntax } = import_mvdan_sh.default;
+var sharedParser = syntax.NewParser();
+var MESSAGE_FLAGS = /* @__PURE__ */ new Set([
+  "-m",
+  "--message",
+  "--body",
+  "--title",
+  "--description",
+  "--comment",
+  "--subject",
+  "--summary"
+]);
+var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "fish", "dash", "ksh"]);
+var DOWNLOAD_CMDS = /* @__PURE__ */ new Set(["curl", "wget"]);
+function normalizeCommandForPolicy(command) {
+  try {
+    const f = sharedParser.Parse(command, "cmd");
+    const strips = [];
+    syntax.Walk(f, (node) => {
+      if (!node) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      for (let i = 0; i < args.length - 1; i++) {
+        const argParts = args[i].Parts || [];
+        if (argParts.length !== 1 || syntax.NodeType(argParts[0]) !== "Lit") continue;
+        const flagVal = argParts[0].Value || "";
+        if (!MESSAGE_FLAGS.has(flagVal.toLowerCase())) continue;
+        const next = args[i + 1];
+        const nextParts = next.Parts || [];
+        if (nextParts.length !== 1) continue;
+        const quotedNode = nextParts[0];
+        const nt = syntax.NodeType(quotedNode);
+        if (nt === "SglQuoted") {
+          strips.push([next.Pos().Offset(), next.End().Offset()]);
+        } else if (nt === "DblQuoted") {
+          const innerParts = quotedNode.Parts || [];
+          const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
+          if (allLit) strips.push([next.Pos().Offset(), next.End().Offset()]);
+        }
+      }
+      return true;
+    });
+    if (strips.length === 0) return command;
+    strips.sort((a, b) => b[0] - a[0]);
+    let result = command;
+    for (const [start, end] of strips) {
+      result = result.slice(0, start) + '""' + result.slice(end);
+    }
+    return result;
+  } catch {
+    return command;
+  }
+}
+function scanArgsForDynamicExec(args, startIdx) {
+  let hasCmdSubst = false;
+  let hasParamExp = false;
+  let hasCurl = false;
+  for (let i = startIdx; i < args.length; i++) {
+    syntax.Walk(args[i], (inner) => {
+      if (!inner) return false;
+      const inn = inner;
+      const it = syntax.NodeType(inn);
+      if (it === "CmdSubst") hasCmdSubst = true;
+      if (it === "ParamExp") hasParamExp = true;
+      if (it === "Lit" && DOWNLOAD_CMDS.has(inn.Value?.toLowerCase())) hasCurl = true;
+      return true;
+    });
+  }
+  if (hasCmdSubst && hasCurl) return "block";
+  if (hasCmdSubst || hasParamExp) return "review";
+  return null;
+}
+function detectDangerousShellExec(command) {
+  try {
+    const f = sharedParser.Parse(command, "cmd");
+    let result = null;
+    syntax.Walk(f, (node) => {
+      if (!node || result === "block") return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      if (args.length === 0) return true;
+      const firstParts = args[0].Parts || [];
+      if (firstParts.length !== 1 || syntax.NodeType(firstParts[0]) !== "Lit") return true;
+      const cmdName = firstParts[0].Value?.toLowerCase() ?? "";
+      if (cmdName === "eval") {
+        const v = scanArgsForDynamicExec(args, 1);
+        if (v === "block" || v === "review" && result === null) result = v;
+      } else if (SHELL_INTERPRETERS.has(cmdName)) {
+        for (let i = 1; i < args.length - 1; i++) {
+          const flagParts = args[i].Parts || [];
+          if (flagParts.length !== 1 || syntax.NodeType(flagParts[0]) !== "Lit" || flagParts[0].Value !== "-c")
+            continue;
+          const v = scanArgsForDynamicExec(args, i + 1);
+          if (v === "block" || v === "review" && result === null) result = v;
+          break;
+        }
+      }
+      return true;
+    });
+    return result;
+  } catch {
+    return null;
+  }
+}
+var detectDangerousEval = detectDangerousShellExec;
+function analyzeShellCommand(command) {
+  const actions = [];
+  const paths = [];
+  const allTokens = [];
+  const addToken = (token) => {
+    const lower = token.toLowerCase();
+    allTokens.push(lower);
+    if (lower.includes("/")) allTokens.push(...lower.split("/").filter(Boolean));
+    if (lower.startsWith("-")) allTokens.push(lower.replace(/^-+/, ""));
+  };
+  try {
+    const f = sharedParser.Parse(command, "cmd");
+    syntax.Walk(f, (node) => {
+      if (!node) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const wordValues = (n.Args || []).map((arg) => {
+        return (arg.Parts || []).map((p) => (p.Value ?? "").replace(/\\(.)/g, "$1")).join("");
+      }).filter((s) => s.length > 0);
+      if (wordValues.length > 0) {
+        const cmd = wordValues[0].toLowerCase();
+        if (!actions.includes(cmd)) actions.push(cmd);
+        wordValues.forEach((w) => addToken(w));
+        wordValues.slice(1).forEach((w) => {
+          if (!w.startsWith("-")) paths.push(w);
+        });
+      }
+      return true;
+    });
+  } catch {
+  }
+  if (allTokens.length === 0) {
+    const normalized = command.replace(/\\(.)/g, "$1");
+    const sanitized = normalized.replace(/["'<>]/g, " ");
+    const segments = sanitized.split(/[|;&]|\$\(|\)|`/);
+    segments.forEach((segment) => {
+      const tokens = segment.trim().split(/\s+/).filter(Boolean);
+      if (tokens.length > 0) {
+        const action = tokens[0].toLowerCase();
+        if (!actions.includes(action)) actions.push(action);
+        tokens.forEach((t) => {
+          addToken(t);
+          if (t !== tokens[0] && !t.startsWith("-")) {
+            if (!paths.includes(t)) paths.push(t);
+          }
+        });
+      }
+    });
+  }
+  return { actions, paths, allTokens };
+}
+
+// src/policy/pipe-chain.ts
+var SOURCE_COMMANDS = /* @__PURE__ */ new Set([
+  "cat",
+  "head",
+  "tail",
+  "grep",
+  "awk",
+  "sed",
+  "cut",
+  "sort",
+  "tee",
+  "less",
+  "more",
+  "strings",
+  "xxd"
+]);
+var SINK_COMMANDS = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "nc",
+  "ncat",
+  "netcat",
+  "ssh",
+  "scp",
+  "rsync",
+  "socat",
+  "ftp",
+  "sftp",
+  "telnet"
+]);
+var OBFUSCATORS = /* @__PURE__ */ new Set([
+  "base64",
+  "gzip",
+  "gunzip",
+  "bzip2",
+  "xz",
+  "zstd",
+  "openssl",
+  "gpg",
+  "python",
+  "python3",
+  "perl",
+  "ruby",
+  "node"
+]);
+var SENSITIVE_PATTERNS = [
+  /(?:^|\/)\.env(?:\.|$)/i,
+  // .env, .env.local, .env.production
+  /id_rsa|id_ed25519|id_ecdsa|id_dsa/i,
+  // SSH private keys
+  /\.pem$|\.key$|\.p12$|\.pfx$/i,
+  // certificate files
+  /(?:^|\/)\.ssh\//i,
+  // ~/.ssh/ directory
+  /(?:^|\/)\.aws\/credentials/i,
+  // AWS credentials
+  /(?:^|\/)\.netrc$/i,
+  // netrc (stores HTTP credentials)
+  /(?:^|\/)(passwd|shadow|sudoers)$/i,
+  // /etc/passwd, /etc/shadow
+  /(?:^|\/)credentials(?:\.json)?$/i
+  // generic credentials files
+];
+function isSensitivePath(p) {
+  return SENSITIVE_PATTERNS.some((re) => re.test(p));
+}
+function splitOnPipe(cmd) {
+  const segments = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < cmd.length; i++) {
+    const ch = cmd[i];
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+      current += ch;
+    } else if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+      current += ch;
+    } else if (ch === "|" && !inSingle && !inDouble && cmd[i + 1] !== "|" && (i === 0 || cmd[i - 1] !== "|")) {
+      segments.push(current.trim());
+      current = "";
+    } else {
+      current += ch;
+    }
+  }
+  if (current.trim()) segments.push(current.trim());
+  return segments.filter(Boolean);
+}
+function positionalTokens(segment) {
+  return segment.split(/\s+/).slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
+}
+function analyzePipeChain(command) {
+  const segments = splitOnPipe(command);
+  if (segments.length < 2) {
+    return {
+      isPipeline: false,
+      hasSensitiveSource: false,
+      hasExternalSink: false,
+      hasObfuscation: false,
+      sourceFiles: [],
+      sinkTargets: [],
+      risk: "none"
+    };
+  }
+  const sourceFiles = [];
+  const sinkTargets = [];
+  let hasSensitiveSource = false;
+  let hasExternalSink = false;
+  let hasObfuscation = false;
+  for (const segment of segments) {
+    const tokens = segment.split(/\s+/).filter(Boolean);
+    if (tokens.length === 0) continue;
+    const binary = tokens[0].toLowerCase();
+    const args = positionalTokens(segment);
+    if (SOURCE_COMMANDS.has(binary)) {
+      sourceFiles.push(...args);
+      if (args.some(isSensitivePath)) hasSensitiveSource = true;
+    }
+    if (OBFUSCATORS.has(binary)) hasObfuscation = true;
+    if (SINK_COMMANDS.has(binary)) {
+      const targets = args.filter(
+        (a) => a.includes(".") || a.includes("://") || /^\d+\.\d+/.test(a)
+      );
+      sinkTargets.push(...targets);
+      if (targets.length > 0) hasExternalSink = true;
+    }
+  }
+  const fullCmd = command.toLowerCase();
+  if (!hasSensitiveSource) {
+    const redirMatch = fullCmd.match(/<\s*(\S+)/);
+    if (redirMatch && isSensitivePath(redirMatch[1])) {
+      hasSensitiveSource = true;
+      sourceFiles.push(redirMatch[1]);
+    }
+  }
+  const risk = hasSensitiveSource && hasExternalSink && hasObfuscation ? "critical" : hasSensitiveSource && hasExternalSink ? "high" : hasExternalSink ? "medium" : "none";
+  return {
+    isPipeline: true,
+    hasSensitiveSource,
+    hasExternalSink,
+    hasObfuscation,
+    sourceFiles,
+    sinkTargets,
+    risk
+  };
+}
+
+// src/policy/flag-tables.ts
+function basename(p) {
+  const segments = p.split(/[\\/]/);
+  return segments[segments.length - 1] || "";
+}
+var FLAGS_WITH_VALUES = {
+  curl: /* @__PURE__ */ new Set([
+    "-H",
+    "--header",
+    "-A",
+    "--user-agent",
+    "-e",
+    "--referer",
+    "-x",
+    "--proxy",
+    "-u",
+    "--user",
+    "-d",
+    "--data",
+    "--data-raw",
+    "--data-binary",
+    "-o",
+    "--output",
+    "-F",
+    "--form",
+    "--connect-to",
+    "--resolve",
+    "--cacert",
+    "--cert",
+    "--key",
+    "-m",
+    "--max-time"
+  ]),
+  wget: /* @__PURE__ */ new Set([
+    "-O",
+    "--output-document",
+    "-P",
+    "--directory-prefix",
+    "-U",
+    "--user-agent",
+    "-e",
+    "--execute",
+    "--proxy",
+    "--ca-certificate"
+  ]),
+  nc: /* @__PURE__ */ new Set(["-x", "-p", "-s", "-w", "-W", "-I", "-O"]),
+  ncat: /* @__PURE__ */ new Set(["-x", "-p", "-s", "--proxy", "--proxy-auth", "-w", "--wait"]),
+  netcat: /* @__PURE__ */ new Set(["-x", "-p", "-s", "-w"]),
+  ssh: /* @__PURE__ */ new Set([
+    "-i",
+    "-l",
+    "-p",
+    "-o",
+    "-E",
+    "-F",
+    "-J",
+    "-L",
+    "-R",
+    "-W",
+    "-b",
+    "-c",
+    "-D",
+    "-e",
+    "-I",
+    "-S"
+  ]),
+  scp: /* @__PURE__ */ new Set(["-i", "-o", "-P", "-S"]),
+  rsync: /* @__PURE__ */ new Set(["-e", "--rsh", "--rsync-path", "--password-file", "--log-file"]),
+  socat: /* @__PURE__ */ new Set([])
+  // socat uses address syntax, not flags — no value-flags
+};
+function extractPositionalArgs(tokens, binary) {
+  const binaryName = basename(binary).replace(/\.exe$/i, "");
+  const flagsWithValues = FLAGS_WITH_VALUES[binaryName] ?? /* @__PURE__ */ new Set();
+  const positional = [];
+  let skipNext = false;
+  for (const token of tokens) {
+    if (skipNext) {
+      skipNext = false;
+      continue;
+    }
+    if (token.startsWith("--") && token.includes("=")) continue;
+    if (token.startsWith("-") && token.length === 2 && flagsWithValues.has(token)) {
+      skipNext = true;
+      continue;
+    }
+    if (token.startsWith("--") && flagsWithValues.has(token)) {
+      skipNext = true;
+      continue;
+    }
+    const shortFlag = token.slice(0, 2);
+    if (token.startsWith("-") && token.length > 2 && flagsWithValues.has(shortFlag)) continue;
+    if (token.startsWith("-")) continue;
+    if (token.startsWith("@")) continue;
+    positional.push(token);
+  }
+  return positional;
+}
+function extractNetworkTargets(tokens, binary) {
+  return extractPositionalArgs(tokens, binary).map((t) => t.includes("@") ? t.split("@")[1] : t).map((t) => {
+    const colonIdx = t.indexOf(":");
+    if (colonIdx === -1) return t;
+    const afterColon = t.slice(colonIdx + 1);
+    if (/^\d+$/.test(afterColon)) return t.slice(0, colonIdx);
+    return t;
+  }).filter(Boolean);
+}
+
+// src/policy/ssh-parser.ts
+function tokenize(cmd) {
+  const tokens = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  for (const ch of cmd) {
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+    } else if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+    } else if ((ch === " " || ch === "	") && !inSingle && !inDouble) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+    } else {
+      current += ch;
+    }
+  }
+  if (current) tokens.push(current);
+  return tokens;
+}
+function parseHost(raw) {
+  return raw.split("@").pop().split(":")[0];
+}
+function extractAllSshHosts(tokens) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t === "-J" && tokens[i + 1]) {
+      for (const hop of tokens[++i].split(",")) {
+        const h = parseHost(hop);
+        if (h) hosts.add(h);
+      }
+      continue;
+    }
+    if (t === "-o" && tokens[i + 1]?.toLowerCase().startsWith("proxyjump=")) {
+      const val = tokens[++i].split("=").slice(1).join("=");
+      for (const hop of val.split(",")) {
+        const h = parseHost(hop);
+        if (h) hosts.add(h);
+      }
+      continue;
+    }
+    if (t === "-o" && tokens[i + 1]?.toLowerCase().startsWith("proxycommand=")) {
+      const raw = tokens[++i].split("=").slice(1).join("=").replace(/^['"]|['"]$/g, "");
+      const subTokens = tokenize(raw);
+      const binary = subTokens[0] ?? "";
+      extractNetworkTargets(subTokens.slice(1), binary).forEach((h) => hosts.add(h));
+      extractAllSshHosts(subTokens.slice(1)).forEach((h) => hosts.add(h));
+      continue;
+    }
+    if (!t.startsWith("-")) {
+      const h = parseHost(t);
+      if (h) hosts.add(h);
+    }
+  }
+  return [...hosts].filter(Boolean);
+}
+function parseAllSshHostsFromCommand(command) {
+  const tokens = tokenize(command);
+  return extractAllSshHosts(tokens.slice(1));
+}
+
+// src/rules/index.ts
+var import_picomatch = __toESM(require("picomatch"));
+
+// src/utils/regex.ts
+var import_safe_regex2 = __toESM(require("safe-regex2"));
+var MAX_REGEX_LENGTH = 100;
+var REGEX_CACHE_MAX = 500;
+var regexCache = /* @__PURE__ */ new Map();
+function validateRegex(pattern) {
+  if (!pattern) return "Pattern is required";
+  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return `Invalid regex syntax: ${e.message}`;
+  }
+  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
+  if (!(0, import_safe_regex2.default)(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
+  return null;
+}
+function getCompiledRegex(pattern, flags = "") {
+  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
+  const key = `${pattern}\0${flags}`;
+  if (regexCache.has(key)) {
+    const cached = regexCache.get(key);
+    regexCache.delete(key);
+    regexCache.set(key, cached);
+    return cached;
+  }
+  if (validateRegex(pattern) !== null) return null;
+  try {
+    const re = new RegExp(pattern, flags);
+    if (regexCache.size >= REGEX_CACHE_MAX) {
+      const oldest = regexCache.keys().next().value;
+      if (oldest) regexCache.delete(oldest);
+    }
+    regexCache.set(key, re);
+    return re;
+  } catch {
+    return null;
+  }
+}
+
+// src/rules/index.ts
+function matchesPattern(text, patterns) {
+  const p = Array.isArray(patterns) ? patterns : [patterns];
+  if (p.length === 0) return false;
+  const isMatch = (0, import_picomatch.default)(p, { nocase: true, dot: true });
+  const target = text.toLowerCase();
+  const directMatch = isMatch(target);
+  if (directMatch) return true;
+  const withoutDotSlash = text.replace(/^\.\//, "");
+  return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
+}
+function getNestedValue(obj, path) {
+  if (!obj || typeof obj !== "object") return null;
+  return path.split(".").reduce((prev, curr) => prev?.[curr], obj);
+}
+function evaluateSmartConditions(args, rule) {
+  if (!rule.conditions || rule.conditions.length === 0) return true;
+  const mode = rule.conditionMode ?? "all";
+  const results = rule.conditions.map((cond) => {
+    const rawVal = getNestedValue(args, cond.field);
+    const normalized = rawVal !== null && rawVal !== void 0 ? String(rawVal).replace(/\s+/g, " ").trim() : null;
+    const val = cond.field === "command" && normalized !== null ? normalizeCommandForPolicy(normalized) : normalized;
+    switch (cond.op) {
+      case "exists":
+        return val !== null && val !== "";
+      case "notExists":
+        return val === null || val === "";
+      case "contains":
+        return val !== null && cond.value ? val.includes(cond.value) : false;
+      case "notContains":
+        return val !== null && cond.value ? !val.includes(cond.value) : true;
+      case "matches": {
+        if (val === null || !cond.value) return false;
+        const reM = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reM) return false;
+        return reM.test(val);
+      }
+      case "notMatches": {
+        if (!cond.value) return false;
+        if (val === null) return true;
+        const reN = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reN) return false;
+        return !reN.test(val);
+      }
+      case "matchesGlob":
+        return val !== null && cond.value ? import_picomatch.default.isMatch(val, cond.value) : false;
+      case "notMatchesGlob":
+        return val !== null && cond.value ? !import_picomatch.default.isMatch(val, cond.value) : false;
+      default:
+        return false;
+    }
+  });
+  return mode === "any" ? results.some((r) => r) : results.every((r) => r);
+}
+
+// src/policy/index.ts
+function tokenize2(toolName) {
+  return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
+}
+function extractShellCommand(toolName, args, toolInspection) {
+  const patterns = Object.keys(toolInspection);
+  const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
+  if (!matchingPattern) return null;
+  const fieldPath = toolInspection[matchingPattern];
+  const value = getNestedValue(args, fieldPath);
+  return typeof value === "string" ? value : null;
+}
+function isSqlTool(toolName, toolInspection) {
+  const patterns = Object.keys(toolInspection);
+  const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
+  if (!matchingPattern) return false;
+  const fieldName = toolInspection[matchingPattern];
+  return fieldName === "sql" || fieldName === "query";
+}
+var SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
+function checkDangerousSql(sql) {
+  const norm = sql.replace(/\s+/g, " ").trim().toLowerCase();
+  const hasWhere = /\bwhere\b/.test(norm);
+  if (/^delete\s+from\s+\S+/.test(norm) && !hasWhere)
+    return "DELETE without WHERE \u2014 full table wipe";
+  if (/^update\s+\S+\s+set\s+/.test(norm) && !hasWhere)
+    return "UPDATE without WHERE \u2014 updates every row";
+  return null;
+}
+async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
+  const { agent, cwd, activeEnvironment } = context;
+  const { checkProvenance, isTrustedHost } = hooks;
+  const wouldBeIgnored = matchesPattern(toolName, config.policy.ignoredTools);
+  if (config.policy.dlp.enabled && (!wouldBeIgnored || config.policy.dlp.scanIgnoredTools)) {
+    const dlpMatch = args !== void 0 ? scanArgs(args) : null;
+    if (dlpMatch) {
+      return {
+        decision: dlpMatch.severity,
+        blockedByLabel: `DLP: ${dlpMatch.patternName}`,
+        reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
+      };
+    }
+  }
+  if (wouldBeIgnored) return { decision: "allow" };
+  if (config.policy.smartRules.length > 0) {
+    const matchedRule = config.policy.smartRules.find(
+      (rule) => matchesPattern(toolName, rule.tool) && evaluateSmartConditions(args, rule)
+    );
+    if (matchedRule) {
+      if (matchedRule.verdict === "allow")
+        return { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
+      return {
+        decision: matchedRule.verdict,
+        blockedByLabel: `Smart Rule: ${matchedRule.name ?? matchedRule.tool}`,
+        reason: matchedRule.reason,
+        tier: 2,
+        ruleName: matchedRule.name ?? matchedRule.tool,
+        ...(matchedRule.description ?? matchedRule.reason) && {
+          ruleDescription: matchedRule.description ?? matchedRule.reason
+        },
+        ...matchedRule.verdict === "block" && matchedRule.dependsOnState?.length && {
+          dependsOnStatePredicates: matchedRule.dependsOnState
+        },
+        ...matchedRule.verdict === "block" && matchedRule.recoveryCommand && {
+          recoveryCommand: matchedRule.recoveryCommand
+        }
+      };
+    }
+  }
+  let allTokens = [];
+  let pathTokens = [];
+  const shellCommand = extractShellCommand(toolName, args, config.policy.toolInspection);
+  if (shellCommand) {
+    const analyzed = analyzeShellCommand(shellCommand);
+    allTokens = analyzed.allTokens;
+    pathTokens = analyzed.paths;
+    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
+    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+      return {
+        decision: "review",
+        blockedByLabel: "Node9 Standard (Inline Execution)",
+        ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
+        tier: 3
+      };
+    }
+    const evalVerdict = detectDangerousShellExec(shellCommand);
+    if (evalVerdict === "block") {
+      return {
+        decision: "block",
+        blockedByLabel: "Node9: Eval Remote Execution",
+        reason: "eval of remote download (curl/wget) is a near-certain supply-chain attack",
+        ruleDescription: "The AI is downloading a script from the internet and running it immediately without inspection. This is a common way malware gets installed.",
+        tier: 3
+      };
+    }
+    if (evalVerdict === "review") {
+      return {
+        decision: "review",
+        blockedByLabel: "Node9: Eval Dynamic Content",
+        reason: "eval of dynamic content (variable or subshell expansion) requires approval",
+        ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
+        tier: 3
+      };
+    }
+    const pipeAnalysis = analyzePipeChain(shellCommand);
+    if (pipeAnalysis.isPipeline && (pipeAnalysis.risk === "critical" || pipeAnalysis.risk === "high")) {
+      const sinks = pipeAnalysis.sinkTargets;
+      const allTrusted = sinks.length > 0 && sinks.every((host) => isTrustedHost ? isTrustedHost(host) : false);
+      if (pipeAnalysis.risk === "critical") {
+        if (allTrusted) {
+          return {
+            decision: "review",
+            blockedByLabel: "Node9: Pipe-Chain to Trusted Host (obfuscated)",
+            reason: `Obfuscated pipe to trusted host(s): ${sinks.join(", ")} \u2014 requires approval`,
+            tier: 3
+          };
+        }
+        return {
+          decision: "block",
+          blockedByLabel: "Node9: Pipe-Chain Exfiltration (critical)",
+          reason: `Sensitive file piped through obfuscator to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
+          tier: 3
+        };
+      }
+      if (allTrusted) {
+        return {
+          decision: "allow",
+          blockedByLabel: "Node9: Pipe-Chain to Trusted Host",
+          reason: `Sensitive file piped to trusted host(s): ${sinks.join(", ")}`,
+          tier: 3
+        };
+      }
+      return {
+        decision: "review",
+        blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
+        reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
+        tier: 3
+      };
+    }
+    const firstToken = analyzed.actions[0] ?? "";
+    if (["ssh", "scp", "rsync"].includes(firstToken)) {
+      const rawTokens = shellCommand.trim().split(/\s+/);
+      const sshHosts = extractAllSshHosts(rawTokens.slice(1));
+      allTokens.push(...sshHosts);
+    }
+    if (firstToken && firstToken.startsWith("/") && checkProvenance) {
+      const prov = checkProvenance(firstToken, cwd);
+      if (prov.trustLevel === "suspect") {
+        return {
+          decision: config.settings.mode === "strict" ? "block" : "review",
+          blockedByLabel: "Node9: Suspect Binary",
+          reason: `Binary "${firstToken}" resolved to ${prov.resolvedPath} \u2014 ${prov.reason}`,
+          tier: 3
+        };
+      }
+      if (prov.trustLevel === "unknown" && config.settings.mode === "strict") {
+        return {
+          decision: "review",
+          blockedByLabel: "Node9: Unknown Binary (strict mode)",
+          reason: `Binary "${firstToken}" \u2014 ${prov.reason}`,
+          tier: 3
+        };
+      }
+    }
+    if (isSqlTool(toolName, config.policy.toolInspection)) {
+      allTokens = allTokens.filter((t) => !SQL_DML_KEYWORDS.has(t.toLowerCase()));
+    }
+  } else {
+    allTokens = tokenize2(toolName);
+    if (args && typeof args === "object") {
+      const flattenedArgs = JSON.stringify(args).toLowerCase();
+      const extraTokens = flattenedArgs.split(/[^a-zA-Z0-9]+/).filter((t) => t.length > 1);
+      allTokens.push(...extraTokens);
+    }
+  }
+  const isManual = agent === "Terminal";
+  if (isManual) {
+    const SYSTEM_DISASTER_COMMANDS = ["mkfs", "shred", "dd", "drop", "truncate", "purge"];
+    const hasSystemDisaster = allTokens.some(
+      (t) => SYSTEM_DISASTER_COMMANDS.includes(t.toLowerCase())
+    );
+    const isRootWipe = allTokens.includes("rm") && (allTokens.includes("/") || allTokens.includes("/*"));
+    if (hasSystemDisaster || isRootWipe) {
+      return { decision: "review", blockedByLabel: "Manual Nuclear Protection", tier: 3 };
+    }
+    return { decision: "allow" };
+  }
+  if (pathTokens.length > 0 && config.policy.sandboxPaths.length > 0) {
+    const allInSandbox = pathTokens.every((p) => matchesPattern(p, config.policy.sandboxPaths));
+    if (allInSandbox) return { decision: "allow" };
+  }
+  let matchedDangerousWord;
+  const isDangerous = allTokens.some(
+    (token) => config.policy.dangerousWords.some((word) => {
+      const w = word.toLowerCase();
+      const hit = token === w || (() => {
+        try {
+          return new RegExp(`\\b${w}\\b`, "i").test(token);
+        } catch {
+          return false;
+        }
+      })();
+      if (hit && !matchedDangerousWord) matchedDangerousWord = word;
+      return hit;
+    })
+  );
+  if (isDangerous) {
+    let matchedField;
+    if (matchedDangerousWord && args && typeof args === "object" && !Array.isArray(args)) {
+      const obj = args;
+      for (const [key, value] of Object.entries(obj)) {
+        if (typeof value === "string") {
+          try {
+            if (new RegExp(
+              `\\b${matchedDangerousWord.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`,
+              "i"
+            ).test(value)) {
+              matchedField = key;
+              break;
+            }
+          } catch {
+          }
+        }
+      }
+    }
+    return {
+      decision: "review",
+      blockedByLabel: `Project/Global Config \u2014 dangerous word: "${matchedDangerousWord}"`,
+      matchedWord: matchedDangerousWord,
+      matchedField,
+      ruleDescription: `This command contains a flagged keyword ("${matchedDangerousWord}") from your node9 config. Review it before allowing.`,
+      tier: 6
+    };
+  }
+  if (config.settings.mode === "strict") {
+    if (activeEnvironment?.requireApproval === false) return { decision: "allow" };
+    return { decision: "review", blockedByLabel: "Global Config (Strict Mode Active)", tier: 7 };
+  }
+  return { decision: "allow" };
+}
+function isIgnoredTool(toolName, config) {
+  return matchesPattern(toolName, config.policy.ignoredTools);
+}
+
+// src/shields/builtin/aws.json
+var aws_default = {
+  name: "aws",
+  description: "Protects AWS infrastructure from destructive AI operations",
+  aliases: ["amazon"],
+  smartRules: [
+    {
+      name: "shield:aws:block-delete-s3-bucket",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "aws\\s+s3.*rb\\s|aws\\s+s3api\\s+delete-bucket",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "S3 bucket deletion is irreversible \u2014 blocked by AWS shield"
+    },
+    {
+      name: "shield:aws:review-iam-changes",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "aws\\s+iam\\s+(create|delete|attach|detach|put|remove)",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "IAM changes require human approval (AWS shield)"
+    },
+    {
+      name: "shield:aws:block-ec2-terminate",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "aws\\s+ec2\\s+terminate-instances",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "EC2 instance termination is irreversible \u2014 blocked by AWS shield"
+    },
+    {
+      name: "shield:aws:review-rds-delete",
+      tool: "*",
+      conditions: [
+        { field: "command", op: "matches", value: "aws\\s+rds\\s+delete-", flags: "i" }
+      ],
+      verdict: "review",
+      reason: "RDS deletion requires human approval (AWS shield)"
+    }
+  ],
+  dangerousWords: []
+};
+
+// src/shields/builtin/bash-safe.json
+var bash_safe_default = {
+  name: "bash-safe",
+  description: "Blocks high-risk bash patterns: pipe-to-shell, rm -rf /, disk overwrites, eval",
+  aliases: ["bash", "shell"],
+  smartRules: [
+    {
+      name: "shield:bash-safe:block-pipe-to-shell",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|&&|\\|\\||;)\\s*(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Pipe-to-shell is a common supply-chain attack vector \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:block-obfuscated-exec",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bbase64\\s+(-d|--decode)[^|;&]*\\|\\s*(bash|sh|zsh)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Obfuscated execution via base64 decode \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:block-rm-root",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "rm\\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r)[a-zA-Z]*\\s+(\\/|~|\\$HOME|\\$\\{HOME\\})\\s*$",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "rm -rf of root or home directory is catastrophic \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:block-disk-overwrite",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|&&|\\|\\||;)\\s*dd\\s+.*of=\\/dev\\/(sd|nvme|hd|vd|xvd)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Writing directly to a block device is irreversible \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:block-eval-remote",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|&&|\\|\\||;)\\s*eval\\s+.*\\$\\((curl|wget)\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "eval of remote download is a near-certain supply-chain attack \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:review-eval-dynamic",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: '(^|&&|\\|\\||[;|\\n{(`])\\s*eval\\s+([\\$`(]|"[^"]*\\$)',
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "eval of dynamic content \u2014 backup regex rule for scan path (real-time uses AST detection)"
+    }
+  ],
+  dangerousWords: []
+};
+
+// src/shields/builtin/docker.json
+var docker_default = {
+  name: "docker",
+  description: "Protects Docker environments from destructive AI operations",
+  aliases: [],
+  smartRules: [
+    {
+      name: "shield:docker:block-system-prune",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+system\\s+prune",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "docker system prune removes all unused containers, images, and volumes \u2014 blocked by Docker shield"
+    },
+    {
+      name: "shield:docker:block-volume-prune",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+volume\\s+prune",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "docker volume prune destroys all unused volumes and their data \u2014 blocked by Docker shield"
+    },
+    {
+      name: "shield:docker:block-rm-force",
+      tool: "*",
+      conditionMode: "all",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+rm\\b",
+          flags: "i"
+        },
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|\\s)(-f|--force)(\\s|$)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Force-removing running containers is destructive \u2014 blocked by Docker shield"
+    },
+    {
+      name: "shield:docker:review-volume-rm",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+volume\\s+rm\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Volume removal deletes persistent data and requires human approval (Docker shield)"
+    },
+    {
+      name: "shield:docker:review-stop-kill",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+(stop|kill)\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Stopping or killing containers requires human approval (Docker shield)"
+    },
+    {
+      name: "shield:docker:review-image-rm",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+image\\s+rm\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Image removal requires human approval (Docker shield)"
+    },
+    {
+      name: "shield:docker:review-rmi-force",
+      tool: "*",
+      conditionMode: "all",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+rmi\\b",
+          flags: "i"
+        },
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|\\s)(-f|--force)(\\s|$)",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Force image removal requires human approval (Docker shield)"
+    }
+  ],
+  dangerousWords: []
+};
+
+// src/shields/builtin/filesystem.json
+var filesystem_default = {
+  name: "filesystem",
+  description: "Protects the local filesystem from dangerous AI operations",
+  aliases: ["fs"],
+  smartRules: [
+    {
+      name: "shield:filesystem:review-chmod-777",
+      tool: "bash",
+      conditions: [
+        { field: "command", op: "matches", value: "chmod\\s+(777|a\\+rwx)", flags: "i" }
+      ],
+      verdict: "review",
+      reason: "chmod 777 requires human approval (filesystem shield)"
+    },
+    {
+      name: "shield:filesystem:review-write-etc",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(tee|\\bcp\\b|\\bmv\\b|install|>+)\\s+.*\\/etc\\/"
+        }
+      ],
+      verdict: "review",
+      reason: "Writing to /etc requires human approval (filesystem shield)"
+    }
+  ],
+  dangerousWords: ["wipefs"]
+};
+
+// src/shields/builtin/github.json
+var github_default = {
+  name: "github",
+  description: "Protects GitHub repositories from destructive AI operations",
+  aliases: ["git"],
+  smartRules: [
+    {
+      name: "shield:github:review-delete-branch-remote",
+      tool: "bash",
+      conditions: [
+        { field: "command", op: "matches", value: "git\\s+push\\s+.*--delete", flags: "i" }
+      ],
+      verdict: "review",
+      reason: "Remote branch deletion requires human approval (GitHub shield)"
+    },
+    {
+      name: "shield:github:block-delete-repo",
+      tool: "*",
+      conditions: [
+        { field: "command", op: "matches", value: "gh\\s+repo\\s+delete", flags: "i" }
+      ],
+      verdict: "block",
+      reason: "Repository deletion is irreversible \u2014 blocked by GitHub shield"
+    }
+  ],
+  dangerousWords: []
+};
+
+// src/shields/builtin/k8s.json
+var k8s_default = {
+  name: "k8s",
+  description: "Protects Kubernetes clusters from destructive AI operations",
+  aliases: ["kubernetes", "kubectl"],
+  smartRules: [
+    {
+      name: "shield:k8s:block-delete-namespace",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+delete\\s+(ns|namespace)\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Deleting a namespace destroys all resources inside it \u2014 blocked by k8s shield"
+    },
+    {
+      name: "shield:k8s:block-delete-all",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+delete\\s+.*--all\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "kubectl delete --all is irreversible \u2014 blocked by k8s shield"
+    },
+    {
+      name: "shield:k8s:block-helm-uninstall",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "helm\\s+(uninstall|delete|del)\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "helm uninstall removes a release and its resources \u2014 blocked by k8s shield"
+    },
+    {
+      name: "shield:k8s:review-scale-zero",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+scale\\s+.*--replicas=0",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Scaling to zero takes down a workload and requires human approval (k8s shield)"
+    },
+    {
+      name: "shield:k8s:review-delete-deployment",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+delete\\s+(deployment|deploy|statefulset|sts|daemonset|ds)\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Deleting a workload requires human approval (k8s shield)"
+    },
+    {
+      name: "shield:k8s:review-apply-force",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+(apply|replace)\\s+.*--force",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Force-apply overwrites live resources and requires human approval (k8s shield)"
+    }
+  ],
+  dangerousWords: []
+};
+
+// src/shields/builtin/mcp-tool-gating.json
+var mcp_tool_gating_default = {
+  name: "mcp-tool-gating",
+  description: "Intercept MCP tool lists and require user approval before the agent can use any tools from a new server",
+  aliases: ["mcp-gating", "mcp-tools"],
+  smartRules: [],
+  dangerousWords: []
+};
+
+// src/shields/builtin/mongodb.json
+var mongodb_default = {
+  name: "mongodb",
+  description: "Protects MongoDB databases from destructive AI operations",
+  aliases: ["mongo"],
+  smartRules: [
+    {
+      name: "shield:mongodb:block-drop-database",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.dropDatabase\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "dropDatabase is irreversible \u2014 blocked by MongoDB shield"
+    },
+    {
+      name: "shield:mongodb:block-drop-collection",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.drop\\s*\\(|db\\.getCollection\\([^)]+\\)\\.drop\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Collection drop is irreversible \u2014 blocked by MongoDB shield"
+    },
+    {
+      name: "shield:mongodb:block-delete-many-empty-filter",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.deleteMany\\s*\\(\\s*\\{\\s*\\}\\s*\\)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "deleteMany({}) with empty filter wipes the entire collection \u2014 blocked by MongoDB shield"
+    },
+    {
+      name: "shield:mongodb:review-delete-many",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.deleteMany\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "deleteMany requires human approval (MongoDB shield)"
+    },
+    {
+      name: "shield:mongodb:review-drop-index",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.dropIndex\\s*\\(|\\.dropIndexes\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Index drops affect query performance and require human approval (MongoDB shield)"
+    }
+  ],
+  dangerousWords: ["dropDatabase", "dropCollection", "mongodrop"]
+};
+
+// src/shields/builtin/postgres.json
+var postgres_default = {
+  name: "postgres",
+  description: "Protects PostgreSQL databases from destructive AI operations",
+  aliases: ["pg", "postgresql"],
+  smartRules: [
+    {
+      name: "shield:postgres:block-drop-table",
+      tool: "*",
+      conditions: [{ field: "sql", op: "matches", value: "DROP\\s+TABLE", flags: "i" }],
+      verdict: "block",
+      reason: "DROP TABLE is irreversible \u2014 blocked by Postgres shield"
+    },
+    {
+      name: "shield:postgres:block-truncate",
+      tool: "*",
+      conditions: [
+        { field: "sql", op: "matches", value: "TRUNCATE\\s+TABLE", flags: "i" }
+      ],
+      verdict: "block",
+      reason: "TRUNCATE is irreversible \u2014 blocked by Postgres shield"
+    },
+    {
+      name: "shield:postgres:block-drop-column",
+      tool: "*",
+      conditions: [
+        { field: "sql", op: "matches", value: "ALTER\\s+TABLE.*DROP\\s+COLUMN", flags: "i" }
+      ],
+      verdict: "block",
+      reason: "DROP COLUMN is irreversible \u2014 blocked by Postgres shield"
+    },
+    {
+      name: "shield:postgres:review-grant-revoke",
+      tool: "*",
+      conditions: [
+        { field: "sql", op: "matches", value: "\\b(GRANT|REVOKE)\\b", flags: "i" }
+      ],
+      verdict: "review",
+      reason: "Permission changes require human approval (Postgres shield)"
+    }
+  ],
+  dangerousWords: ["dropdb", "pg_dropcluster"]
+};
+
+// src/shields/builtin/project-jail.json
+var project_jail_default = {
+  name: "project-jail",
+  description: "Restricts AI agents from reading sensitive credential files outside the current project",
+  aliases: ["jail"],
+  smartRules: [
+    {
+      name: "shield:project-jail:block-read-ssh",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*[\\/\\\\]\\.ssh[\\/\\\\]",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading SSH private keys is blocked by project-jail shield"
+    },
+    {
+      name: "shield:project-jail:block-read-aws",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*[\\/\\\\]\\.aws[\\/\\\\]",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading AWS credentials is blocked by project-jail shield"
+    },
+    {
+      name: "shield:project-jail:block-read-env",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*\\.env(\\.local|\\.production|\\.staging)?\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading .env files is blocked by project-jail shield"
+    },
+    {
+      name: "shield:project-jail:block-read-credentials",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading credential files is blocked by project-jail shield"
+    }
+  ],
+  dangerousWords: []
+};
+
+// src/shields/builtin/redis.json
+var redis_default = {
+  name: "redis",
+  description: "Protects Redis instances from destructive AI operations",
+  aliases: [],
+  smartRules: [
+    {
+      name: "shield:redis:block-flushall",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bFLUSHALL\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "FLUSHALL deletes every key in every database \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:block-flushdb",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bFLUSHDB\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "FLUSHDB deletes all keys in the current database \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:block-config-resetstat",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bCONFIG\\s+RESETSTAT\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "CONFIG RESETSTAT resets server statistics irreversibly \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:review-config-set",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bCONFIG\\s+SET\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
+    },
+    {
+      name: "shield:redis:review-del-wildcard",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Wildcard key deletion requires human approval (Redis shield)"
+    }
+  ],
+  dangerousWords: ["FLUSHALL", "FLUSHDB"]
+};
+
+// src/shields/index.ts
+function isShieldVerdict(v) {
+  return v === "allow" || v === "review" || v === "block";
+}
+function validateShieldDefinition(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { error: "Shield file is not an object" };
+  }
+  const r = raw;
+  if (typeof r.name !== "string" || !r.name) return { error: "Shield file missing 'name'" };
+  if (typeof r.description !== "string") return { error: "Shield file missing 'description'" };
+  if (!Array.isArray(r.aliases)) return { error: "Shield file missing 'aliases' array" };
+  if (!Array.isArray(r.smartRules)) return { error: "Shield file missing 'smartRules' array" };
+  if (!Array.isArray(r.dangerousWords))
+    return { error: "Shield file missing 'dangerousWords' array" };
+  return { ok: r };
+}
+function validateOverrides(raw) {
+  const warnings = [];
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { overrides: {}, warnings };
+  const result = {};
+  for (const [shieldName, rules] of Object.entries(raw)) {
+    if (!rules || typeof rules !== "object" || Array.isArray(rules)) continue;
+    const validRules = {};
+    for (const [ruleName, verdict] of Object.entries(rules)) {
+      if (isShieldVerdict(verdict)) {
+        validRules[ruleName] = verdict;
+      } else {
+        warnings.push(
+          `shields.json contains invalid verdict "${String(verdict)}" for ${shieldName}/${ruleName} \u2014 entry ignored. File may be corrupted or tampered with.`
+        );
+      }
+    }
+    if (Object.keys(validRules).length > 0) result[shieldName] = validRules;
+  }
+  return { overrides: result, warnings };
+}
+var BUILTIN_SHIELDS = {
+  [aws_default.name]: aws_default,
+  [bash_safe_default.name]: bash_safe_default,
+  [docker_default.name]: docker_default,
+  [filesystem_default.name]: filesystem_default,
+  [github_default.name]: github_default,
+  [k8s_default.name]: k8s_default,
+  [mcp_tool_gating_default.name]: mcp_tool_gating_default,
+  [mongodb_default.name]: mongodb_default,
+  [postgres_default.name]: postgres_default,
+  [project_jail_default.name]: project_jail_default,
+  [redis_default.name]: redis_default
+};
+
+// src/loop/index.ts
+var import_crypto = __toESM(require("crypto"));
+var LOOP_MAX_RECORDS = 500;
+function computeArgsHash(args) {
+  const str = JSON.stringify(args ?? "");
+  return import_crypto.default.createHash("sha256").update(str).digest("hex").slice(0, 16);
+}
+function evaluateLoopWindow(records, tool, args, threshold, windowMs, now) {
+  const hash = computeArgsHash(args);
+  const cutoff = now - windowMs;
+  const fresh = records.filter((r) => r.ts >= cutoff);
+  fresh.push({ t: tool, h: hash, ts: now });
+  const count = fresh.filter((r) => r.t === tool && r.h === hash).length;
+  const nextRecords = fresh.slice(-LOOP_MAX_RECORDS);
+  return { nextRecords, count, looping: count >= threshold };
+}
+
+// src/index.ts
+var ENGINE_VERSION = "1.0.0";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BUILTIN_SHIELDS,
+  DLP_PATTERNS,
+  ENGINE_VERSION,
+  FLAGS_WITH_VALUES,
+  LOOP_MAX_RECORDS,
+  SENSITIVE_PATH_REGEXES,
+  analyzePipeChain,
+  analyzeShellCommand,
+  checkDangerousSql,
+  computeArgsHash,
+  detectDangerousEval,
+  detectDangerousShellExec,
+  evaluateLoopWindow,
+  evaluatePolicy,
+  evaluateSmartConditions,
+  extractAllSshHosts,
+  extractNetworkTargets,
+  extractPositionalArgs,
+  getCompiledRegex,
+  getNestedValue,
+  isIgnoredTool,
+  isShieldVerdict,
+  matchSensitivePath,
+  matchesPattern,
+  normalizeCommandForPolicy,
+  parseAllSshHostsFromCommand,
+  redactText,
+  scanArgs,
+  scanText,
+  sensitivePathMatch,
+  validateOverrides,
+  validateRegex,
+  validateShieldDefinition
+});