@node9/proxy 1.12.5 → 1.12.7

package/dist/cli.js

@@ -1094,6 +1094,17 @@ var init_regex = __esm({
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
 }
+function shannonEntropy(s) {
+  if (s.length === 0) return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
 function scanFilePath(filePath, cwd = process.cwd()) {
   if (!filePath) return null;
   let resolved;
@@ -1162,8 +1173,9 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
         continue;
       }
       if (pattern.regex.test(text)) {
-        const matchedValue = (text.match(pattern.regex)?.[0] ?? "").toLowerCase();
-        if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+        const raw = text.match(pattern.regex)?.[0] ?? "";
+        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
         const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
         return {
           patternName: pattern.name,
@@ -1195,8 +1207,9 @@ function scanText(text) {
       continue;
     }
     if (pattern.regex.test(t)) {
-      const matchedValue = (t.match(pattern.regex)?.[0] ?? "").toLowerCase();
-      if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+      const raw = t.match(pattern.regex)?.[0] ?? "";
+      if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+      if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
       return {
         patternName: pattern.name,
         fieldPath: "response-text",
@@ -1236,7 +1249,9 @@ var init_dlp = __esm({
       "%{",
       "<your",
       "test_key",
-      "test_token"
+      "test_token",
+      "your",
+      "here"
     ];
     DLP_PATTERNS = [
       // ── AWS ───────────────────────────────────────────────────────────────────
@@ -1287,7 +1302,8 @@ var init_dlp = __esm({
         name: "OpenAI API Key",
         regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/,
         severity: "block",
-        keywords: ["sk-"]
+        keywords: ["sk-"],
+        minEntropy: 3.5
       },
       // ── Stripe ────────────────────────────────────────────────────────────────
       {
@@ -1358,7 +1374,13 @@ var init_dlp = __esm({
         keywords: ["hvb."]
       },
       // ── Hugging Face ──────────────────────────────────────────────────────────
-      { name: "HuggingFace Token", regex: /\bhf_[A-Za-z]{34}\b/, severity: "block", keywords: ["hf_"] },
+      {
+        name: "HuggingFace Token",
+        regex: /\bhf_[A-Za-z]{34}\b/,
+        severity: "block",
+        keywords: ["hf_"],
+        minEntropy: 3
+      },
       // ── Postman ───────────────────────────────────────────────────────────────
       {
         name: "Postman API Token",
@@ -1510,7 +1532,8 @@ var init_dlp = __esm({
         name: "PyPI Upload Token",
         regex: /\bpypi-[A-Za-z0-9_-]{50,}\b/,
         severity: "block",
-        keywords: ["pypi-"]
+        keywords: ["pypi-"],
+        minEntropy: 3
       },
       // ── Bearer Token ─────────────────────────────────────────────────────────
       // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
@@ -1519,7 +1542,99 @@ var init_dlp = __esm({
         regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
         severity: "review",
         keywords: ["bearer"],
-        contextBoost: true
+        contextBoost: true,
+        minEntropy: 3
+      },
+      // ── Resend ────────────────────────────────────────────────────────────────
+      {
+        name: "Resend API Key",
+        regex: /\bre_[a-zA-Z0-9]{24}\b/,
+        severity: "block",
+        keywords: ["re_"]
+      },
+      // ── Telegram ──────────────────────────────────────────────────────────────
+      {
+        name: "Telegram Bot Token",
+        regex: /\b[0-9]{7,10}:AA[a-zA-Z0-9_-]{33}\b/,
+        severity: "block",
+        keywords: [":aa"]
+      },
+      // ── Mapbox ────────────────────────────────────────────────────────────────
+      {
+        name: "Mapbox Access Token",
+        regex: /\bpk\.eyJ1[a-zA-Z0-9._-]{20,}\b/,
+        severity: "block",
+        keywords: ["pk.eyj1"]
+      },
+      // ── Notion ────────────────────────────────────────────────────────────────
+      {
+        name: "Notion Integration Token",
+        regex: /\bsecret_[a-zA-Z0-9]{43}\b/,
+        severity: "block",
+        keywords: ["secret_"]
+      },
+      // ── Square ────────────────────────────────────────────────────────────────
+      {
+        name: "Square Access Token",
+        regex: /\bsq0atp-[0-9A-Za-z_-]{22}\b/,
+        severity: "block",
+        keywords: ["sq0atp-"]
+      },
+      {
+        name: "Square OAuth Secret",
+        regex: /\bsq0csp-[0-9A-Za-z_-]{43}\b/,
+        severity: "block",
+        keywords: ["sq0csp-"]
+      },
+      // ── Typeform ──────────────────────────────────────────────────────────────
+      {
+        name: "Typeform Token",
+        regex: /\btfp_[a-zA-Z0-9_]{59}\b/,
+        severity: "block",
+        keywords: ["tfp_"]
+      },
+      // ── Cloudinary ────────────────────────────────────────────────────────────
+      {
+        name: "Cloudinary URL",
+        regex: /\bcloudinary:\/\/[0-9]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+/,
+        severity: "block",
+        keywords: ["cloudinary://"]
+      },
+      // ── Airtable ──────────────────────────────────────────────────────────────
+      // New PAT format: pat + 14 alphanum + . + 64 alphanum
+      {
+        name: "Airtable PAT",
+        regex: /\bpat[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{64}\b/,
+        severity: "block",
+        keywords: ["pat"]
+      },
+      // ── RubyGems ──────────────────────────────────────────────────────────────
+      {
+        name: "RubyGems API Key",
+        regex: /\brubygems_[a-f0-9]{48}\b/,
+        severity: "block",
+        keywords: ["rubygems_"]
+      },
+      // ── Shippo ────────────────────────────────────────────────────────────────
+      {
+        name: "Shippo Token",
+        regex: /\bshippo_(?:live|test)_[a-f0-9]{40}\b/,
+        severity: "block",
+        keywords: ["shippo_"]
+      },
+      // ── Plaid ─────────────────────────────────────────────────────────────────
+      {
+        name: "Plaid Access Token",
+        regex: /\baccess-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/,
+        severity: "block",
+        keywords: ["access-sandbox", "access-development", "access-production"]
+      },
+      // ── Age ───────────────────────────────────────────────────────────────────
+      {
+        name: "Age Identity Key",
+        regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
+        severity: "block",
+        keywords: ["age-secret-key-"]
       }
     ];
     SENSITIVE_PATH_PATTERNS = [
@@ -7670,6 +7785,10 @@ var init_ui = __esm({
               btn.appendChild(badge);
             }
           }
+          // Auto-open when browser was launched directly from \`node9 scan\`
+          if (new URLSearchParams(location.search).get('openscan') === '1') {
+            openScanModal();
+          }
         } catch {}
       })();
 
@@ -9426,7 +9545,7 @@ function registerScanCommand(program2) {
       import_chalk2.default.cyan.bold("\u{1F50D}  Scanning your AI history") + import_chalk2.default.dim("  \u2014 what would node9 have caught?")
     );
     console.log("");
-    const useTTY = process.stdout.isTTY === true;
+    const useTTY = process.stdout.isTTY === true && process.env.NODE9_WRAPPER !== "1";
     if (!useTTY) {
       process.stdout.write(
         "  " + import_chalk2.default.dim("Scanning your history \u2014 this may take a moment...\n")
@@ -9508,14 +9627,9 @@ function registerScanCommand(program2) {
       );
       console.log(heroLine);
       console.log("");
-      if (blockedCount > 0) {
+      if (scan.totalCostUSD > 0) {
         console.log(
-          "    " + import_chalk2.default.red("\u{1F6D1}  Would have blocked") + "   " + import_chalk2.default.red.bold(String(blockedCount).padStart(5)) + import_chalk2.default.dim("   operations stopped before execution")
-        );
-      }
-      if (reviewCount > 0) {
-        console.log(
-          "    " + import_chalk2.default.yellow("\u{1F441}   Would have flagged") + "   " + import_chalk2.default.yellow.bold(String(reviewCount).padStart(5)) + import_chalk2.default.dim("   sent to you for approval")
+          "    " + import_chalk2.default.bold(fmtCost(scan.totalCostUSD)) + import_chalk2.default.dim(" AI spend  \xB7  ") + import_chalk2.default.dim(`${totalRisky} risky operations`)
         );
       }
       if (scan.dlpFindings.length > 0) {
@@ -9523,47 +9637,27 @@ function registerScanCommand(program2) {
           "    " + import_chalk2.default.red("\u{1F511}  Credential leak") + "     " + import_chalk2.default.red.bold(String(scan.dlpFindings.length).padStart(5)) + import_chalk2.default.dim("   secret detected in tool call")
         );
       }
-      if (scan.loopFindings.length > 0) {
+      if (blockedCount > 0) {
         console.log(
-          "    " + import_chalk2.default.yellow("\u{1F501}  Loop detected") + "      " + import_chalk2.default.yellow.bold(String(scan.loopFindings.length).padStart(5)) + import_chalk2.default.dim("   repeated tool call patterns found")
+          "    " + import_chalk2.default.red("\u{1F6D1}  Would have blocked") + "   " + import_chalk2.default.red.bold(String(blockedCount).padStart(5)) + import_chalk2.default.dim("   operations stopped before execution")
         );
       }
-      console.log("");
-      for (const section of summary.sections) {
-        const countParts = [];
-        if (section.blockedCount > 0)
-          countParts.push(import_chalk2.default.red(`${section.blockedCount} blocked`));
-        if (section.reviewCount > 0)
-          countParts.push(import_chalk2.default.yellow(`${section.reviewCount} review`));
-        const countStr = countParts.join(import_chalk2.default.dim(" \xB7 "));
-        const enableHint = section.shieldKey ? import_chalk2.default.dim(`  \u2192  node9 shield enable ${section.shieldKey}`) : "";
-        console.log("  " + import_chalk2.default.dim("\u2500".repeat(70)));
+      if (scan.loopFindings.length > 0) {
         console.log(
-          "  " + import_chalk2.default.bold(section.label) + (section.subtitle ? import_chalk2.default.dim(`  \xB7  ${section.subtitle}`) : "") + "  " + countStr + enableHint
+          "    " + import_chalk2.default.yellow("\u{1F501}  Loop detected") + "      " + import_chalk2.default.yellow.bold(String(scan.loopFindings.length).padStart(5)) + import_chalk2.default.dim("   repeated tool call patterns found")
         );
-        for (const rule of section.rules) {
-          printRuleGroup(rule, topN, drillDown, previewWidth);
-        }
-        console.log("");
       }
-      const activeShieldIds = new Set(
-        summary.sections.filter((s) => s.sourceType === "shield" && s.shieldKey).map((s) => s.shieldKey)
-      );
-      const emptyShields = Object.keys(SHIELDS).filter((n) => !activeShieldIds.has(n)).sort();
-      if (emptyShields.length > 0) {
-        console.log("  " + import_chalk2.default.dim("\u2500".repeat(70)));
+      if (reviewCount > 0) {
         console.log(
-          "  " + import_chalk2.default.bold("Shields") + import_chalk2.default.dim("  \xB7  no findings in your history") + "  " + import_chalk2.default.green("\u2713")
+          "    " + import_chalk2.default.yellow("\u{1F441}   Would have flagged") + "   " + import_chalk2.default.yellow.bold(String(reviewCount).padStart(5)) + import_chalk2.default.dim("   sent to you for approval")
         );
-        console.log("  " + import_chalk2.default.dim(emptyShields.join(" \xB7 ")));
-        console.log("  " + import_chalk2.default.dim("\u2192  node9 shield enable <name>  to activate any shield"));
-        console.log("");
       }
+      console.log("");
       if (scan.dlpFindings.length > 0) {
         console.log("  " + import_chalk2.default.dim("\u2500".repeat(70)));
         console.log(
           "  " + import_chalk2.default.red.bold("\u{1F511}  Credential Leaks") + import_chalk2.default.dim("  \xB7  ") + import_chalk2.default.red(
-            `${num(scan.dlpFindings.length)} potential secret leak${scan.dlpFindings.length !== 1 ? "s" : ""}`
+            `${num(scan.dlpFindings.length)} secret${scan.dlpFindings.length !== 1 ? "s" : ""} found in plain text`
           )
         );
         const shownDlp = drillDown ? scan.dlpFindings : scan.dlpFindings.slice(0, topN);
@@ -9573,7 +9667,7 @@ function registerScanCommand(program2) {
           const agentBadge = f.agent === "gemini" ? import_chalk2.default.blue("[Gemini]  ") : f.agent === "codex" ? import_chalk2.default.magenta("[Codex]   ") : import_chalk2.default.cyan("[Claude]  ");
           const sessionSuffix = f.sessionId ? import_chalk2.default.dim(`  \u2192 ${f.sessionId.slice(0, 8)}`) : "";
           console.log(
-            `    ${ts}${proj}${agentBadge}` + import_chalk2.default.yellow(f.patternName) + import_chalk2.default.dim("  ") + import_chalk2.default.gray(f.redactedSample) + sessionSuffix
+            `    \u{1F6A8} ${ts}${proj}${agentBadge}` + import_chalk2.default.yellow(f.patternName) + import_chalk2.default.dim("  ") + import_chalk2.default.gray(f.redactedSample) + sessionSuffix
           );
         }
         if (!drillDown && scan.dlpFindings.length > topN) {
@@ -9585,6 +9679,21 @@ function registerScanCommand(program2) {
         }
         console.log("");
       }
+      const blockedRuleSections = summary.sections.map((s) => ({ ...s, rules: s.rules.filter((r) => r.verdict === "block") })).filter((s) => s.rules.length > 0);
+      if (blockedRuleSections.length > 0) {
+        console.log("  " + import_chalk2.default.dim("\u2500".repeat(70)));
+        console.log(
+          "  " + import_chalk2.default.red.bold("\u{1F6D1}  Blocked") + import_chalk2.default.dim("  \xB7  ") + import_chalk2.default.red(
+            `${blockedCount} operation${blockedCount !== 1 ? "s" : ""} node9 would have stopped`
+          )
+        );
+        for (const section of blockedRuleSections) {
+          for (const rule of section.rules) {
+            printRuleGroup(rule, topN, drillDown, previewWidth);
+          }
+        }
+        console.log("");
+      }
       if (scan.loopFindings.length > 0) {
         console.log("  " + import_chalk2.default.dim("\u2500".repeat(70)));
         console.log(
@@ -9611,12 +9720,32 @@ function registerScanCommand(program2) {
         }
         console.log("");
       }
-    }
-    if (scan.totalCostUSD > 0) {
-      console.log(
-        "  " + import_chalk2.default.bold("Agent spend:") + "  " + import_chalk2.default.yellow(fmtCost(scan.totalCostUSD)) + import_chalk2.default.dim("  (for per-period breakdown: node9 report)")
+      for (const section of summary.sections) {
+        const reviewRules = section.rules.filter((r) => r.verdict !== "block");
+        if (reviewRules.length === 0) continue;
+        const enableHint = section.shieldKey ? import_chalk2.default.dim(`  \u2192  node9 shield enable ${section.shieldKey}`) : "";
+        console.log("  " + import_chalk2.default.dim("\u2500".repeat(70)));
+        console.log(
+          "  " + import_chalk2.default.bold(section.label) + (section.subtitle ? import_chalk2.default.dim(`  \xB7  ${section.subtitle}`) : "") + "  " + import_chalk2.default.yellow(`${section.reviewCount} review`) + enableHint
+        );
+        for (const rule of reviewRules) {
+          printRuleGroup(rule, topN, drillDown, previewWidth);
+        }
+        console.log("");
+      }
+      const activeShieldIds = new Set(
+        summary.sections.filter((s) => s.sourceType === "shield" && s.shieldKey).map((s) => s.shieldKey)
       );
-      console.log("");
+      const emptyShields = Object.keys(SHIELDS).filter((n) => !activeShieldIds.has(n)).sort();
+      if (emptyShields.length > 0) {
+        console.log("  " + import_chalk2.default.dim("\u2500".repeat(70)));
+        console.log(
+          "  " + import_chalk2.default.bold("\u{1F6E1}  Inactive Shields") + import_chalk2.default.dim("  \xB7  enable for more coverage")
+        );
+        console.log("  " + import_chalk2.default.dim(emptyShields.join(" \xB7 ")));
+        console.log("  " + import_chalk2.default.dim("\u2192  node9 shield enable <name>  to activate"));
+        console.log("");
+      }
     }
     if (isInstalled) {
       console.log(import_chalk2.default.green("  \u2705 node9 is active \u2014 your future sessions are protected."));
@@ -9657,7 +9786,7 @@ function registerScanCommand(program2) {
     console.log("");
     if (!isTestingMode()) {
       if (isInstalled) {
-        const url = `http://${DAEMON_HOST}:${DAEMON_PORT}/`;
+        const url = `http://${DAEMON_HOST}:${DAEMON_PORT}/?openscan=1`;
         if (isDaemonRunning()) {
           const internalToken = getInternalToken();
           if (internalToken) {

package/dist/cli.mjs

@@ -1074,6 +1074,17 @@ import path4 from "path";
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
 }
+function shannonEntropy(s) {
+  if (s.length === 0) return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
 function scanFilePath(filePath, cwd = process.cwd()) {
   if (!filePath) return null;
   let resolved;
@@ -1142,8 +1153,9 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
         continue;
       }
       if (pattern.regex.test(text)) {
-        const matchedValue = (text.match(pattern.regex)?.[0] ?? "").toLowerCase();
-        if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+        const raw = text.match(pattern.regex)?.[0] ?? "";
+        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
         const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
         return {
           patternName: pattern.name,
@@ -1175,8 +1187,9 @@ function scanText(text) {
       continue;
     }
     if (pattern.regex.test(t)) {
-      const matchedValue = (t.match(pattern.regex)?.[0] ?? "").toLowerCase();
-      if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+      const raw = t.match(pattern.regex)?.[0] ?? "";
+      if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+      if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
       return {
         patternName: pattern.name,
         fieldPath: "response-text",
@@ -1214,7 +1227,9 @@ var init_dlp = __esm({
       "%{",
       "<your",
       "test_key",
-      "test_token"
+      "test_token",
+      "your",
+      "here"
     ];
     DLP_PATTERNS = [
       // ── AWS ───────────────────────────────────────────────────────────────────
@@ -1265,7 +1280,8 @@ var init_dlp = __esm({
         name: "OpenAI API Key",
         regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/,
         severity: "block",
-        keywords: ["sk-"]
+        keywords: ["sk-"],
+        minEntropy: 3.5
       },
       // ── Stripe ────────────────────────────────────────────────────────────────
       {
@@ -1336,7 +1352,13 @@ var init_dlp = __esm({
         keywords: ["hvb."]
       },
       // ── Hugging Face ──────────────────────────────────────────────────────────
-      { name: "HuggingFace Token", regex: /\bhf_[A-Za-z]{34}\b/, severity: "block", keywords: ["hf_"] },
+      {
+        name: "HuggingFace Token",
+        regex: /\bhf_[A-Za-z]{34}\b/,
+        severity: "block",
+        keywords: ["hf_"],
+        minEntropy: 3
+      },
       // ── Postman ───────────────────────────────────────────────────────────────
       {
         name: "Postman API Token",
@@ -1488,7 +1510,8 @@ var init_dlp = __esm({
         name: "PyPI Upload Token",
         regex: /\bpypi-[A-Za-z0-9_-]{50,}\b/,
         severity: "block",
-        keywords: ["pypi-"]
+        keywords: ["pypi-"],
+        minEntropy: 3
       },
       // ── Bearer Token ─────────────────────────────────────────────────────────
       // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
@@ -1497,7 +1520,99 @@ var init_dlp = __esm({
         regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
         severity: "review",
         keywords: ["bearer"],
-        contextBoost: true
+        contextBoost: true,
+        minEntropy: 3
+      },
+      // ── Resend ────────────────────────────────────────────────────────────────
+      {
+        name: "Resend API Key",
+        regex: /\bre_[a-zA-Z0-9]{24}\b/,
+        severity: "block",
+        keywords: ["re_"]
+      },
+      // ── Telegram ──────────────────────────────────────────────────────────────
+      {
+        name: "Telegram Bot Token",
+        regex: /\b[0-9]{7,10}:AA[a-zA-Z0-9_-]{33}\b/,
+        severity: "block",
+        keywords: [":aa"]
+      },
+      // ── Mapbox ────────────────────────────────────────────────────────────────
+      {
+        name: "Mapbox Access Token",
+        regex: /\bpk\.eyJ1[a-zA-Z0-9._-]{20,}\b/,
+        severity: "block",
+        keywords: ["pk.eyj1"]
+      },
+      // ── Notion ────────────────────────────────────────────────────────────────
+      {
+        name: "Notion Integration Token",
+        regex: /\bsecret_[a-zA-Z0-9]{43}\b/,
+        severity: "block",
+        keywords: ["secret_"]
+      },
+      // ── Square ────────────────────────────────────────────────────────────────
+      {
+        name: "Square Access Token",
+        regex: /\bsq0atp-[0-9A-Za-z_-]{22}\b/,
+        severity: "block",
+        keywords: ["sq0atp-"]
+      },
+      {
+        name: "Square OAuth Secret",
+        regex: /\bsq0csp-[0-9A-Za-z_-]{43}\b/,
+        severity: "block",
+        keywords: ["sq0csp-"]
+      },
+      // ── Typeform ──────────────────────────────────────────────────────────────
+      {
+        name: "Typeform Token",
+        regex: /\btfp_[a-zA-Z0-9_]{59}\b/,
+        severity: "block",
+        keywords: ["tfp_"]
+      },
+      // ── Cloudinary ────────────────────────────────────────────────────────────
+      {
+        name: "Cloudinary URL",
+        regex: /\bcloudinary:\/\/[0-9]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+/,
+        severity: "block",
+        keywords: ["cloudinary://"]
+      },
+      // ── Airtable ──────────────────────────────────────────────────────────────
+      // New PAT format: pat + 14 alphanum + . + 64 alphanum
+      {
+        name: "Airtable PAT",
+        regex: /\bpat[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{64}\b/,
+        severity: "block",
+        keywords: ["pat"]
+      },
+      // ── RubyGems ──────────────────────────────────────────────────────────────
+      {
+        name: "RubyGems API Key",
+        regex: /\brubygems_[a-f0-9]{48}\b/,
+        severity: "block",
+        keywords: ["rubygems_"]
+      },
+      // ── Shippo ────────────────────────────────────────────────────────────────
+      {
+        name: "Shippo Token",
+        regex: /\bshippo_(?:live|test)_[a-f0-9]{40}\b/,
+        severity: "block",
+        keywords: ["shippo_"]
+      },
+      // ── Plaid ─────────────────────────────────────────────────────────────────
+      {
+        name: "Plaid Access Token",
+        regex: /\baccess-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/,
+        severity: "block",
+        keywords: ["access-sandbox", "access-development", "access-production"]
+      },
+      // ── Age ───────────────────────────────────────────────────────────────────
+      {
+        name: "Age Identity Key",
+        regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
+        severity: "block",
+        keywords: ["age-secret-key-"]
       }
     ];
     SENSITIVE_PATH_PATTERNS = [
@@ -7647,6 +7762,10 @@ var init_ui = __esm({
               btn.appendChild(badge);
             }
           }
+          // Auto-open when browser was launched directly from \`node9 scan\`
+          if (new URLSearchParams(location.search).get('openscan') === '1') {
+            openScanModal();
+          }
         } catch {}
       })();
 
@@ -9406,7 +9525,7 @@ function registerScanCommand(program2) {
       chalk2.cyan.bold("\u{1F50D}  Scanning your AI history") + chalk2.dim("  \u2014 what would node9 have caught?")
     );
     console.log("");
-    const useTTY = process.stdout.isTTY === true;
+    const useTTY = process.stdout.isTTY === true && process.env.NODE9_WRAPPER !== "1";
     if (!useTTY) {
       process.stdout.write(
         "  " + chalk2.dim("Scanning your history \u2014 this may take a moment...\n")
@@ -9488,14 +9607,9 @@ function registerScanCommand(program2) {
       );
       console.log(heroLine);
       console.log("");
-      if (blockedCount > 0) {
+      if (scan.totalCostUSD > 0) {
         console.log(
-          "    " + chalk2.red("\u{1F6D1}  Would have blocked") + "   " + chalk2.red.bold(String(blockedCount).padStart(5)) + chalk2.dim("   operations stopped before execution")
-        );
-      }
-      if (reviewCount > 0) {
-        console.log(
-          "    " + chalk2.yellow("\u{1F441}   Would have flagged") + "   " + chalk2.yellow.bold(String(reviewCount).padStart(5)) + chalk2.dim("   sent to you for approval")
+          "    " + chalk2.bold(fmtCost(scan.totalCostUSD)) + chalk2.dim(" AI spend  \xB7  ") + chalk2.dim(`${totalRisky} risky operations`)
         );
       }
       if (scan.dlpFindings.length > 0) {
@@ -9503,47 +9617,27 @@ function registerScanCommand(program2) {
           "    " + chalk2.red("\u{1F511}  Credential leak") + "     " + chalk2.red.bold(String(scan.dlpFindings.length).padStart(5)) + chalk2.dim("   secret detected in tool call")
         );
       }
-      if (scan.loopFindings.length > 0) {
+      if (blockedCount > 0) {
         console.log(
-          "    " + chalk2.yellow("\u{1F501}  Loop detected") + "      " + chalk2.yellow.bold(String(scan.loopFindings.length).padStart(5)) + chalk2.dim("   repeated tool call patterns found")
+          "    " + chalk2.red("\u{1F6D1}  Would have blocked") + "   " + chalk2.red.bold(String(blockedCount).padStart(5)) + chalk2.dim("   operations stopped before execution")
         );
       }
-      console.log("");
-      for (const section of summary.sections) {
-        const countParts = [];
-        if (section.blockedCount > 0)
-          countParts.push(chalk2.red(`${section.blockedCount} blocked`));
-        if (section.reviewCount > 0)
-          countParts.push(chalk2.yellow(`${section.reviewCount} review`));
-        const countStr = countParts.join(chalk2.dim(" \xB7 "));
-        const enableHint = section.shieldKey ? chalk2.dim(`  \u2192  node9 shield enable ${section.shieldKey}`) : "";
-        console.log("  " + chalk2.dim("\u2500".repeat(70)));
+      if (scan.loopFindings.length > 0) {
         console.log(
-          "  " + chalk2.bold(section.label) + (section.subtitle ? chalk2.dim(`  \xB7  ${section.subtitle}`) : "") + "  " + countStr + enableHint
+          "    " + chalk2.yellow("\u{1F501}  Loop detected") + "      " + chalk2.yellow.bold(String(scan.loopFindings.length).padStart(5)) + chalk2.dim("   repeated tool call patterns found")
         );
-        for (const rule of section.rules) {
-          printRuleGroup(rule, topN, drillDown, previewWidth);
-        }
-        console.log("");
       }
-      const activeShieldIds = new Set(
-        summary.sections.filter((s) => s.sourceType === "shield" && s.shieldKey).map((s) => s.shieldKey)
-      );
-      const emptyShields = Object.keys(SHIELDS).filter((n) => !activeShieldIds.has(n)).sort();
-      if (emptyShields.length > 0) {
-        console.log("  " + chalk2.dim("\u2500".repeat(70)));
+      if (reviewCount > 0) {
         console.log(
-          "  " + chalk2.bold("Shields") + chalk2.dim("  \xB7  no findings in your history") + "  " + chalk2.green("\u2713")
+          "    " + chalk2.yellow("\u{1F441}   Would have flagged") + "   " + chalk2.yellow.bold(String(reviewCount).padStart(5)) + chalk2.dim("   sent to you for approval")
         );
-        console.log("  " + chalk2.dim(emptyShields.join(" \xB7 ")));
-        console.log("  " + chalk2.dim("\u2192  node9 shield enable <name>  to activate any shield"));
-        console.log("");
       }
+      console.log("");
       if (scan.dlpFindings.length > 0) {
         console.log("  " + chalk2.dim("\u2500".repeat(70)));
         console.log(
           "  " + chalk2.red.bold("\u{1F511}  Credential Leaks") + chalk2.dim("  \xB7  ") + chalk2.red(
-            `${num(scan.dlpFindings.length)} potential secret leak${scan.dlpFindings.length !== 1 ? "s" : ""}`
+            `${num(scan.dlpFindings.length)} secret${scan.dlpFindings.length !== 1 ? "s" : ""} found in plain text`
           )
         );
         const shownDlp = drillDown ? scan.dlpFindings : scan.dlpFindings.slice(0, topN);
@@ -9553,7 +9647,7 @@ function registerScanCommand(program2) {
           const agentBadge = f.agent === "gemini" ? chalk2.blue("[Gemini]  ") : f.agent === "codex" ? chalk2.magenta("[Codex]   ") : chalk2.cyan("[Claude]  ");
           const sessionSuffix = f.sessionId ? chalk2.dim(`  \u2192 ${f.sessionId.slice(0, 8)}`) : "";
           console.log(
-            `    ${ts}${proj}${agentBadge}` + chalk2.yellow(f.patternName) + chalk2.dim("  ") + chalk2.gray(f.redactedSample) + sessionSuffix
+            `    \u{1F6A8} ${ts}${proj}${agentBadge}` + chalk2.yellow(f.patternName) + chalk2.dim("  ") + chalk2.gray(f.redactedSample) + sessionSuffix
           );
         }
         if (!drillDown && scan.dlpFindings.length > topN) {
@@ -9565,6 +9659,21 @@ function registerScanCommand(program2) {
         }
         console.log("");
       }
+      const blockedRuleSections = summary.sections.map((s) => ({ ...s, rules: s.rules.filter((r) => r.verdict === "block") })).filter((s) => s.rules.length > 0);
+      if (blockedRuleSections.length > 0) {
+        console.log("  " + chalk2.dim("\u2500".repeat(70)));
+        console.log(
+          "  " + chalk2.red.bold("\u{1F6D1}  Blocked") + chalk2.dim("  \xB7  ") + chalk2.red(
+            `${blockedCount} operation${blockedCount !== 1 ? "s" : ""} node9 would have stopped`
+          )
+        );
+        for (const section of blockedRuleSections) {
+          for (const rule of section.rules) {
+            printRuleGroup(rule, topN, drillDown, previewWidth);
+          }
+        }
+        console.log("");
+      }
       if (scan.loopFindings.length > 0) {
         console.log("  " + chalk2.dim("\u2500".repeat(70)));
         console.log(
@@ -9591,12 +9700,32 @@ function registerScanCommand(program2) {
         }
         console.log("");
       }
-    }
-    if (scan.totalCostUSD > 0) {
-      console.log(
-        "  " + chalk2.bold("Agent spend:") + "  " + chalk2.yellow(fmtCost(scan.totalCostUSD)) + chalk2.dim("  (for per-period breakdown: node9 report)")
+      for (const section of summary.sections) {
+        const reviewRules = section.rules.filter((r) => r.verdict !== "block");
+        if (reviewRules.length === 0) continue;
+        const enableHint = section.shieldKey ? chalk2.dim(`  \u2192  node9 shield enable ${section.shieldKey}`) : "";
+        console.log("  " + chalk2.dim("\u2500".repeat(70)));
+        console.log(
+          "  " + chalk2.bold(section.label) + (section.subtitle ? chalk2.dim(`  \xB7  ${section.subtitle}`) : "") + "  " + chalk2.yellow(`${section.reviewCount} review`) + enableHint
+        );
+        for (const rule of reviewRules) {
+          printRuleGroup(rule, topN, drillDown, previewWidth);
+        }
+        console.log("");
+      }
+      const activeShieldIds = new Set(
+        summary.sections.filter((s) => s.sourceType === "shield" && s.shieldKey).map((s) => s.shieldKey)
       );
-      console.log("");
+      const emptyShields = Object.keys(SHIELDS).filter((n) => !activeShieldIds.has(n)).sort();
+      if (emptyShields.length > 0) {
+        console.log("  " + chalk2.dim("\u2500".repeat(70)));
+        console.log(
+          "  " + chalk2.bold("\u{1F6E1}  Inactive Shields") + chalk2.dim("  \xB7  enable for more coverage")
+        );
+        console.log("  " + chalk2.dim(emptyShields.join(" \xB7 ")));
+        console.log("  " + chalk2.dim("\u2192  node9 shield enable <name>  to activate"));
+        console.log("");
+      }
     }
     if (isInstalled) {
       console.log(chalk2.green("  \u2705 node9 is active \u2014 your future sessions are protected."));
@@ -9637,7 +9766,7 @@ function registerScanCommand(program2) {
     console.log("");
     if (!isTestingMode()) {
       if (isInstalled) {
-        const url = `http://${DAEMON_HOST}:${DAEMON_PORT}/`;
+        const url = `http://${DAEMON_HOST}:${DAEMON_PORT}/?openscan=1`;
         if (isDaemonRunning()) {
           const internalToken = getInternalToken();
           if (internalToken) {

package/dist/index.js

@@ -995,6 +995,17 @@ var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
 }
+function shannonEntropy(s) {
+  if (s.length === 0) return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
 var DLP_STOPWORDS = [
   "example",
   "placeholder",
@@ -1017,7 +1028,9 @@ var DLP_STOPWORDS = [
   "%{",
   "<your",
   "test_key",
-  "test_token"
+  "test_token",
+  "your",
+  "here"
 ];
 var DLP_PATTERNS = [
   // ── AWS ───────────────────────────────────────────────────────────────────
@@ -1068,7 +1081,8 @@ var DLP_PATTERNS = [
     name: "OpenAI API Key",
     regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/,
     severity: "block",
-    keywords: ["sk-"]
+    keywords: ["sk-"],
+    minEntropy: 3.5
   },
   // ── Stripe ────────────────────────────────────────────────────────────────
   {
@@ -1139,7 +1153,13 @@ var DLP_PATTERNS = [
     keywords: ["hvb."]
   },
   // ── Hugging Face ──────────────────────────────────────────────────────────
-  { name: "HuggingFace Token", regex: /\bhf_[A-Za-z]{34}\b/, severity: "block", keywords: ["hf_"] },
+  {
+    name: "HuggingFace Token",
+    regex: /\bhf_[A-Za-z]{34}\b/,
+    severity: "block",
+    keywords: ["hf_"],
+    minEntropy: 3
+  },
   // ── Postman ───────────────────────────────────────────────────────────────
   {
     name: "Postman API Token",
@@ -1291,7 +1311,8 @@ var DLP_PATTERNS = [
     name: "PyPI Upload Token",
     regex: /\bpypi-[A-Za-z0-9_-]{50,}\b/,
     severity: "block",
-    keywords: ["pypi-"]
+    keywords: ["pypi-"],
+    minEntropy: 3
   },
   // ── Bearer Token ─────────────────────────────────────────────────────────
   // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
@@ -1300,7 +1321,99 @@ var DLP_PATTERNS = [
     regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
     severity: "review",
     keywords: ["bearer"],
-    contextBoost: true
+    contextBoost: true,
+    minEntropy: 3
+  },
+  // ── Resend ────────────────────────────────────────────────────────────────
+  {
+    name: "Resend API Key",
+    regex: /\bre_[a-zA-Z0-9]{24}\b/,
+    severity: "block",
+    keywords: ["re_"]
+  },
+  // ── Telegram ──────────────────────────────────────────────────────────────
+  {
+    name: "Telegram Bot Token",
+    regex: /\b[0-9]{7,10}:AA[a-zA-Z0-9_-]{33}\b/,
+    severity: "block",
+    keywords: [":aa"]
+  },
+  // ── Mapbox ────────────────────────────────────────────────────────────────
+  {
+    name: "Mapbox Access Token",
+    regex: /\bpk\.eyJ1[a-zA-Z0-9._-]{20,}\b/,
+    severity: "block",
+    keywords: ["pk.eyj1"]
+  },
+  // ── Notion ────────────────────────────────────────────────────────────────
+  {
+    name: "Notion Integration Token",
+    regex: /\bsecret_[a-zA-Z0-9]{43}\b/,
+    severity: "block",
+    keywords: ["secret_"]
+  },
+  // ── Square ────────────────────────────────────────────────────────────────
+  {
+    name: "Square Access Token",
+    regex: /\bsq0atp-[0-9A-Za-z_-]{22}\b/,
+    severity: "block",
+    keywords: ["sq0atp-"]
+  },
+  {
+    name: "Square OAuth Secret",
+    regex: /\bsq0csp-[0-9A-Za-z_-]{43}\b/,
+    severity: "block",
+    keywords: ["sq0csp-"]
+  },
+  // ── Typeform ──────────────────────────────────────────────────────────────
+  {
+    name: "Typeform Token",
+    regex: /\btfp_[a-zA-Z0-9_]{59}\b/,
+    severity: "block",
+    keywords: ["tfp_"]
+  },
+  // ── Cloudinary ────────────────────────────────────────────────────────────
+  {
+    name: "Cloudinary URL",
+    regex: /\bcloudinary:\/\/[0-9]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+/,
+    severity: "block",
+    keywords: ["cloudinary://"]
+  },
+  // ── Airtable ──────────────────────────────────────────────────────────────
+  // New PAT format: pat + 14 alphanum + . + 64 alphanum
+  {
+    name: "Airtable PAT",
+    regex: /\bpat[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{64}\b/,
+    severity: "block",
+    keywords: ["pat"]
+  },
+  // ── RubyGems ──────────────────────────────────────────────────────────────
+  {
+    name: "RubyGems API Key",
+    regex: /\brubygems_[a-f0-9]{48}\b/,
+    severity: "block",
+    keywords: ["rubygems_"]
+  },
+  // ── Shippo ────────────────────────────────────────────────────────────────
+  {
+    name: "Shippo Token",
+    regex: /\bshippo_(?:live|test)_[a-f0-9]{40}\b/,
+    severity: "block",
+    keywords: ["shippo_"]
+  },
+  // ── Plaid ─────────────────────────────────────────────────────────────────
+  {
+    name: "Plaid Access Token",
+    regex: /\baccess-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/,
+    severity: "block",
+    keywords: ["access-sandbox", "access-development", "access-production"]
+  },
+  // ── Age ───────────────────────────────────────────────────────────────────
+  {
+    name: "Age Identity Key",
+    regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
+    severity: "block",
+    keywords: ["age-secret-key-"]
   }
 ];
 var SENSITIVE_PATH_PATTERNS = [
@@ -1397,8 +1510,9 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
         continue;
       }
       if (pattern.regex.test(text)) {
-        const matchedValue = (text.match(pattern.regex)?.[0] ?? "").toLowerCase();
-        if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+        const raw = text.match(pattern.regex)?.[0] ?? "";
+        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
         const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
         return {
           patternName: pattern.name,

package/dist/index.mjs

@@ -965,6 +965,17 @@ var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
 }
+function shannonEntropy(s) {
+  if (s.length === 0) return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
 var DLP_STOPWORDS = [
   "example",
   "placeholder",
@@ -987,7 +998,9 @@ var DLP_STOPWORDS = [
   "%{",
   "<your",
   "test_key",
-  "test_token"
+  "test_token",
+  "your",
+  "here"
 ];
 var DLP_PATTERNS = [
   // ── AWS ───────────────────────────────────────────────────────────────────
@@ -1038,7 +1051,8 @@ var DLP_PATTERNS = [
     name: "OpenAI API Key",
     regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/,
     severity: "block",
-    keywords: ["sk-"]
+    keywords: ["sk-"],
+    minEntropy: 3.5
   },
   // ── Stripe ────────────────────────────────────────────────────────────────
   {
@@ -1109,7 +1123,13 @@ var DLP_PATTERNS = [
     keywords: ["hvb."]
   },
   // ── Hugging Face ──────────────────────────────────────────────────────────
-  { name: "HuggingFace Token", regex: /\bhf_[A-Za-z]{34}\b/, severity: "block", keywords: ["hf_"] },
+  {
+    name: "HuggingFace Token",
+    regex: /\bhf_[A-Za-z]{34}\b/,
+    severity: "block",
+    keywords: ["hf_"],
+    minEntropy: 3
+  },
   // ── Postman ───────────────────────────────────────────────────────────────
   {
     name: "Postman API Token",
@@ -1261,7 +1281,8 @@ var DLP_PATTERNS = [
     name: "PyPI Upload Token",
     regex: /\bpypi-[A-Za-z0-9_-]{50,}\b/,
     severity: "block",
-    keywords: ["pypi-"]
+    keywords: ["pypi-"],
+    minEntropy: 3
   },
   // ── Bearer Token ─────────────────────────────────────────────────────────
   // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
@@ -1270,7 +1291,99 @@ var DLP_PATTERNS = [
     regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
     severity: "review",
     keywords: ["bearer"],
-    contextBoost: true
+    contextBoost: true,
+    minEntropy: 3
+  },
+  // ── Resend ────────────────────────────────────────────────────────────────
+  {
+    name: "Resend API Key",
+    regex: /\bre_[a-zA-Z0-9]{24}\b/,
+    severity: "block",
+    keywords: ["re_"]
+  },
+  // ── Telegram ──────────────────────────────────────────────────────────────
+  {
+    name: "Telegram Bot Token",
+    regex: /\b[0-9]{7,10}:AA[a-zA-Z0-9_-]{33}\b/,
+    severity: "block",
+    keywords: [":aa"]
+  },
+  // ── Mapbox ────────────────────────────────────────────────────────────────
+  {
+    name: "Mapbox Access Token",
+    regex: /\bpk\.eyJ1[a-zA-Z0-9._-]{20,}\b/,
+    severity: "block",
+    keywords: ["pk.eyj1"]
+  },
+  // ── Notion ────────────────────────────────────────────────────────────────
+  {
+    name: "Notion Integration Token",
+    regex: /\bsecret_[a-zA-Z0-9]{43}\b/,
+    severity: "block",
+    keywords: ["secret_"]
+  },
+  // ── Square ────────────────────────────────────────────────────────────────
+  {
+    name: "Square Access Token",
+    regex: /\bsq0atp-[0-9A-Za-z_-]{22}\b/,
+    severity: "block",
+    keywords: ["sq0atp-"]
+  },
+  {
+    name: "Square OAuth Secret",
+    regex: /\bsq0csp-[0-9A-Za-z_-]{43}\b/,
+    severity: "block",
+    keywords: ["sq0csp-"]
+  },
+  // ── Typeform ──────────────────────────────────────────────────────────────
+  {
+    name: "Typeform Token",
+    regex: /\btfp_[a-zA-Z0-9_]{59}\b/,
+    severity: "block",
+    keywords: ["tfp_"]
+  },
+  // ── Cloudinary ────────────────────────────────────────────────────────────
+  {
+    name: "Cloudinary URL",
+    regex: /\bcloudinary:\/\/[0-9]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+/,
+    severity: "block",
+    keywords: ["cloudinary://"]
+  },
+  // ── Airtable ──────────────────────────────────────────────────────────────
+  // New PAT format: pat + 14 alphanum + . + 64 alphanum
+  {
+    name: "Airtable PAT",
+    regex: /\bpat[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{64}\b/,
+    severity: "block",
+    keywords: ["pat"]
+  },
+  // ── RubyGems ──────────────────────────────────────────────────────────────
+  {
+    name: "RubyGems API Key",
+    regex: /\brubygems_[a-f0-9]{48}\b/,
+    severity: "block",
+    keywords: ["rubygems_"]
+  },
+  // ── Shippo ────────────────────────────────────────────────────────────────
+  {
+    name: "Shippo Token",
+    regex: /\bshippo_(?:live|test)_[a-f0-9]{40}\b/,
+    severity: "block",
+    keywords: ["shippo_"]
+  },
+  // ── Plaid ─────────────────────────────────────────────────────────────────
+  {
+    name: "Plaid Access Token",
+    regex: /\baccess-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/,
+    severity: "block",
+    keywords: ["access-sandbox", "access-development", "access-production"]
+  },
+  // ── Age ───────────────────────────────────────────────────────────────────
+  {
+    name: "Age Identity Key",
+    regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
+    severity: "block",
+    keywords: ["age-secret-key-"]
   }
 ];
 var SENSITIVE_PATH_PATTERNS = [
@@ -1367,8 +1480,9 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
         continue;
       }
       if (pattern.regex.test(text)) {
-        const matchedValue = (text.match(pattern.regex)?.[0] ?? "").toLowerCase();
-        if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+        const raw = text.match(pattern.regex)?.[0] ?? "";
+        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
         const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
         return {
           patternName: pattern.name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.12.5",
+  "version": "1.12.7",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",