@node9/proxy 1.20.1 → 1.21.1

package/dist/scan-ink.mjs

@@ -0,0 +1,1681 @@
+// src/cli/render/ink/StaticScorecard.tsx
+import { Box as Box11, render } from "ink";
+
+// src/cli/render/ink/SeverityBand.tsx
+import { Box, Text } from "ink";
+import { jsx, jsxs } from "react/jsx-runtime";
+function SeverityBand({ label, width }) {
+  const titleText = ` ${label} `;
+  const remaining = Math.max(2, width - titleText.length);
+  const leftDashes = "\u2501".repeat(Math.floor(remaining / 2));
+  const rightDashes = "\u2501".repeat(remaining - leftDashes.length);
+  return /* @__PURE__ */ jsxs(Box, { children: [
+    /* @__PURE__ */ jsx(Text, { dimColor: true, children: leftDashes }),
+    /* @__PURE__ */ jsx(Text, { bold: true, children: titleText }),
+    /* @__PURE__ */ jsx(Text, { dimColor: true, children: rightDashes })
+  ] });
+}
+
+// src/cli/render/ink/panels/Header.tsx
+import { Box as Box2, Text as Text2 } from "ink";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function Header({ rangeLabel }) {
+  return /* @__PURE__ */ jsxs2(Box2, { children: [
+    /* @__PURE__ */ jsx2(Text2, { bold: true, children: "\u{1F6E1}  node9 dashboard" }),
+    /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "  \xB7  " }),
+    /* @__PURE__ */ jsx2(Text2, { children: `scanned ${rangeLabel}` })
+  ] });
+}
+
+// src/cli/render/ink/panels/CostPanel.tsx
+import { Box as Box3, Text as Text3 } from "ink";
+
+// src/tui/dashboard/format.ts
+function formatCost(usd) {
+  if (usd === 0) return "$0";
+  if (usd < 1) return `$${usd.toFixed(2)}`;
+  if (usd < 100) return `$${usd.toFixed(2)}`;
+  if (usd < 1e4) return `$${Math.round(usd).toLocaleString()}`;
+  return `$${(usd / 1e3).toFixed(1)}K`;
+}
+
+// src/cli/render/ink/panels/CostPanel.tsx
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+var LABEL_W = 16;
+function CostPanel({ summary, width }) {
+  const total = summary.stats.totalCostUSD;
+  return /* @__PURE__ */ jsxs3(Box3, { borderStyle: "round", borderColor: "gray", paddingX: 1, flexDirection: "column", width, children: [
+    /* @__PURE__ */ jsx3(Text3, { bold: true, children: "COST" }),
+    /* @__PURE__ */ jsxs3(Box3, { children: [
+      /* @__PURE__ */ jsx3(Box3, { width: LABEL_W, children: /* @__PURE__ */ jsx3(Text3, { children: "Total" }) }),
+      /* @__PURE__ */ jsx3(Text3, { bold: true, children: formatCost(total) })
+    ] }),
+    summary.byAgent.map((agent) => /* @__PURE__ */ jsxs3(Box3, { children: [
+      /* @__PURE__ */ jsx3(Box3, { width: LABEL_W, children: /* @__PURE__ */ jsx3(Text3, { children: agent.label }) }),
+      /* @__PURE__ */ jsx3(Text3, { children: formatCost(agent.costUSD) })
+    ] }, agent.id)),
+    summary.loopWastedUSD > 0 ? /* @__PURE__ */ jsxs3(Box3, { children: [
+      /* @__PURE__ */ jsx3(Box3, { width: LABEL_W, children: /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "Wasted on loops" }) }),
+      /* @__PURE__ */ jsx3(Text3, { color: "yellow", children: "~" + formatCost(summary.loopWastedUSD) })
+    ] }) : null
+  ] });
+}
+
+// src/cli/render/ink/panels/ActivityPanel.tsx
+import { Box as Box4, Text as Text4 } from "ink";
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+var LABEL_W2 = 16;
+function fmtNum(n) {
+  return n.toLocaleString();
+}
+function countMcpFindings(scan) {
+  let n = 0;
+  for (const f of scan.findings) {
+    if (f.toolName.startsWith("mcp__")) n++;
+  }
+  return n;
+}
+function ActivityPanel({ summary, scan, width }) {
+  const { sessions, totalToolCalls, bashCalls, totalCostUSD } = summary.stats;
+  const perSession = sessions > 0 ? totalCostUSD / sessions : 0;
+  const toolsPerSession = sessions > 0 ? Math.round(totalToolCalls / sessions) : 0;
+  const mcpCount = countMcpFindings(scan);
+  const topAgent = summary.byAgent.slice().sort((a, b) => b.sessions - a.sessions)[0];
+  return /* @__PURE__ */ jsxs4(Box4, { borderStyle: "round", borderColor: "gray", paddingX: 1, flexDirection: "column", width, children: [
+    /* @__PURE__ */ jsx4(Text4, { bold: true, children: "ACTIVITY" }),
+    /* @__PURE__ */ jsxs4(Box4, { children: [
+      /* @__PURE__ */ jsx4(Box4, { width: LABEL_W2, children: /* @__PURE__ */ jsx4(Text4, { children: "Sessions" }) }),
+      /* @__PURE__ */ jsx4(Text4, { bold: true, children: fmtNum(sessions) })
+    ] }),
+    /* @__PURE__ */ jsxs4(Box4, { children: [
+      /* @__PURE__ */ jsx4(Box4, { width: LABEL_W2, children: /* @__PURE__ */ jsx4(Text4, { children: "Tools" }) }),
+      /* @__PURE__ */ jsx4(Text4, { children: fmtNum(totalToolCalls) })
+    ] }),
+    /* @__PURE__ */ jsxs4(Box4, { children: [
+      /* @__PURE__ */ jsx4(Box4, { width: LABEL_W2, children: /* @__PURE__ */ jsx4(Text4, { dimColor: true, children: "  Shell" }) }),
+      /* @__PURE__ */ jsx4(Text4, { dimColor: true, children: fmtNum(bashCalls) })
+    ] }),
+    mcpCount > 0 ? /* @__PURE__ */ jsxs4(Box4, { children: [
+      /* @__PURE__ */ jsx4(Box4, { width: LABEL_W2, children: /* @__PURE__ */ jsx4(Text4, { dimColor: true, children: "  MCP" }) }),
+      /* @__PURE__ */ jsx4(Text4, { dimColor: true, children: fmtNum(mcpCount) })
+    ] }) : null,
+    /* @__PURE__ */ jsxs4(Box4, { children: [
+      /* @__PURE__ */ jsx4(Box4, { width: LABEL_W2, children: /* @__PURE__ */ jsx4(Text4, { children: "Tools / session" }) }),
+      /* @__PURE__ */ jsx4(Text4, { children: "~" + fmtNum(toolsPerSession) })
+    ] }),
+    /* @__PURE__ */ jsxs4(Box4, { children: [
+      /* @__PURE__ */ jsx4(Box4, { width: LABEL_W2, children: /* @__PURE__ */ jsx4(Text4, { children: "Cost / session" }) }),
+      /* @__PURE__ */ jsx4(Text4, { children: "~$" + Math.round(perSession).toLocaleString() })
+    ] }),
+    topAgent ? /* @__PURE__ */ jsxs4(Box4, { children: [
+      /* @__PURE__ */ jsx4(Box4, { width: LABEL_W2, children: /* @__PURE__ */ jsx4(Text4, { dimColor: true, children: "Top agent" }) }),
+      /* @__PURE__ */ jsx4(Text4, { dimColor: true, children: `${topAgent.label} (${fmtNum(topAgent.sessions)})` })
+    ] }) : null
+  ] });
+}
+
+// src/cli/render/ink/panels/LeaksPanel.tsx
+import { Box as Box5, Text as Text5 } from "ink";
+
+// src/cli/render/scan-derive.ts
+import chalk from "chalk";
+import stringWidth from "string-width";
+function topRulesByVerdict(sections, verdict, n) {
+  const matched = [];
+  for (const section of sections) {
+    for (const rule of section.rules) {
+      const matches = verdict === "block" ? rule.verdict === "block" : rule.verdict !== "block";
+      if (matches) matched.push({ name: rule.name, count: rule.findings.length });
+    }
+  }
+  return matched.sort((a, b) => b.count - a.count).slice(0, n);
+}
+function computeLoopWaste(loops, totalToolCalls) {
+  const wastedCalls = loops.reduce((s, l) => s + Math.max(0, l.count - 1), 0);
+  const wastePct = totalToolCalls > 0 ? Math.round(wastedCalls / totalToolCalls * 100) : 0;
+  return { wastedCalls, wastePct };
+}
+function rollupByShield(sections, topRulesPerShield = 3) {
+  const out = [];
+  for (const section of sections) {
+    if (section.sourceType !== "shield") continue;
+    if (!section.shieldKey) continue;
+    const totalCatches = section.blockedCount + section.reviewCount;
+    const topRuleLabels = [...section.rules].sort((a, b) => b.findings.length - a.findings.length).slice(0, topRulesPerShield).map((r) => r.findings.length > 1 ? `${r.name} \xD7${r.findings.length}` : r.name);
+    out.push({
+      shieldName: section.shieldKey,
+      totalCatches,
+      blockCatches: section.blockedCount,
+      reviewCatches: section.reviewCount,
+      topRuleLabels
+    });
+  }
+  return out.sort((a, b) => b.totalCatches - a.totalCatches);
+}
+function relativeDate(timestamp, now = /* @__PURE__ */ new Date()) {
+  const t = new Date(timestamp).getTime();
+  if (Number.isNaN(t)) return "?";
+  const days = Math.floor((now.getTime() - t) / 864e5);
+  if (days < 1) return "today";
+  if (days > 90) return "90d+";
+  return `${days}d`;
+}
+
+// src/cli/render/ink/panels/LeaksPanel.tsx
+import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+var ROW_LIMIT = 4;
+function LeaksPanel({ summary, width }) {
+  const leaks = summary.leaks;
+  if (leaks.length === 0) return null;
+  const now = /* @__PURE__ */ new Date();
+  return /* @__PURE__ */ jsxs5(Box5, { borderStyle: "round", borderColor: "red", paddingX: 1, flexDirection: "column", width, children: [
+    /* @__PURE__ */ jsx5(Text5, { bold: true, color: "red", children: "CREDENTIAL LEAKS" }),
+    leaks.slice(0, ROW_LIMIT).map((leak, i) => /* @__PURE__ */ jsxs5(Box5, { children: [
+      /* @__PURE__ */ jsx5(Box5, { width: 5, children: /* @__PURE__ */ jsx5(Text5, { dimColor: true, children: relativeDate(leak.timestamp, now).padStart(4) }) }),
+      /* @__PURE__ */ jsx5(Box5, { width: 16, children: /* @__PURE__ */ jsx5(Text5, { color: "red", bold: true, wrap: "truncate-end", children: leak.patternName }) }),
+      /* @__PURE__ */ jsx5(Box5, { width: 15, children: /* @__PURE__ */ jsx5(Text5, { dimColor: true, wrap: "truncate-end", children: `[${leak.toolName}]` }) }),
+      /* @__PURE__ */ jsx5(Text5, { dimColor: true, wrap: "truncate-end", children: leak.agent })
+    ] }, i)),
+    /* @__PURE__ */ jsxs5(Box5, { children: [
+      /* @__PURE__ */ jsx5(Text5, { dimColor: true, children: "\u2192 " }),
+      /* @__PURE__ */ jsx5(Text5, { bold: true, color: "cyan", children: "DLP" }),
+      /* @__PURE__ */ jsx5(Text5, { dimColor: true, children: " \xB7 " }),
+      /* @__PURE__ */ jsx5(Text5, { bold: true, color: "cyan", children: "node9 mask" }),
+      /* @__PURE__ */ jsx5(Text5, { dimColor: true, wrap: "truncate-end", children: " (runtime + cleanup)" })
+    ] })
+  ] });
+}
+
+// src/cli/render/ink/panels/BlockedPanel.tsx
+import { Box as Box6, Text as Text6 } from "ink";
+import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+function originForRule(ruleName, sections) {
+  for (const section of sections) {
+    if (section.rules.some((r) => r.name === ruleName)) {
+      if (section.sourceType === "default") return "default";
+      if (section.sourceType === "shield") {
+        return `needs shield:${section.shieldKey ?? section.id}`;
+      }
+    }
+  }
+  return "";
+}
+var ROW_LIMIT2 = 12;
+function BlockedPanel({ summary, width }) {
+  const rules = topRulesByVerdict(summary.sections, "block", ROW_LIMIT2);
+  if (rules.length === 0) return null;
+  return /* @__PURE__ */ jsxs6(Box6, { borderStyle: "round", borderColor: "red", paddingX: 1, flexDirection: "column", width, children: [
+    /* @__PURE__ */ jsx6(Text6, { bold: true, color: "red", children: "WOULD HAVE BLOCKED" }),
+    rules.map((rule, i) => /* @__PURE__ */ jsxs6(Box6, { children: [
+      /* @__PURE__ */ jsx6(Box6, { width: 3, children: /* @__PURE__ */ jsx6(Text6, { color: "red", children: "\u2717" }) }),
+      /* @__PURE__ */ jsx6(Box6, { width: 24, children: /* @__PURE__ */ jsx6(Text6, { bold: true, wrap: "truncate-end", children: rule.name }) }),
+      /* @__PURE__ */ jsx6(Box6, { width: 6, children: /* @__PURE__ */ jsx6(Text6, { bold: true, children: `\xD7${rule.count}` }) }),
+      /* @__PURE__ */ jsx6(Text6, { dimColor: true, wrap: "truncate-end", children: originForRule(rule.name, summary.sections) })
+    ] }, i)),
+    /* @__PURE__ */ jsx6(Box6, { children: /* @__PURE__ */ jsx6(Text6, { dimColor: true, wrap: "truncate-end", children: "\u2192 install node9 + enable shields above" }) })
+  ] });
+}
+
+// src/cli/render/ink/panels/BlastRadiusPanel.tsx
+import { Box as Box7, Text as Text7 } from "ink";
+import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+var ROW_LIMIT3 = 4;
+function BlastRadiusPanel({
+  blast,
+  blastExposures,
+  width
+}) {
+  if (blastExposures === 0) return null;
+  return /* @__PURE__ */ jsxs7(Box7, { borderStyle: "round", borderColor: "yellow", paddingX: 1, flexDirection: "column", width, children: [
+    /* @__PURE__ */ jsx7(Text7, { bold: true, color: "yellow", children: "BLAST RADIUS" }),
+    blast.reachable.slice(0, ROW_LIMIT3).map((path, i) => {
+      const desc = path.description.split(" \u2014 ")[0].split(/—|--/)[0].trim();
+      return /* @__PURE__ */ jsxs7(Box7, { children: [
+        /* @__PURE__ */ jsx7(Box7, { width: 3, children: /* @__PURE__ */ jsx7(Text7, { color: "red", children: "\u2717" }) }),
+        /* @__PURE__ */ jsx7(Box7, { width: 36, children: /* @__PURE__ */ jsx7(Text7, { children: path.label }) }),
+        /* @__PURE__ */ jsx7(Text7, { dimColor: true, children: desc })
+      ] }, i);
+    }),
+    blast.envFindings.slice(0, 3).map((env, i) => /* @__PURE__ */ jsxs7(Box7, { children: [
+      /* @__PURE__ */ jsx7(Box7, { width: 3, children: /* @__PURE__ */ jsx7(Text7, { color: "yellow", children: "\u26A0" }) }),
+      /* @__PURE__ */ jsx7(Text7, { children: env.key }),
+      /* @__PURE__ */ jsx7(Text7, { dimColor: true, children: ` (${env.patternName})` })
+    ] }, `env-${i}`)),
+    /* @__PURE__ */ jsxs7(Box7, { children: [
+      /* @__PURE__ */ jsx7(Text7, { dimColor: true, children: "\u2192 " }),
+      /* @__PURE__ */ jsx7(Text7, { bold: true, color: "cyan", children: "project-jail" }),
+      /* @__PURE__ */ jsx7(Text7, { dimColor: true, children: " shield blocks agent reads of these paths" })
+    ] })
+  ] });
+}
+
+// src/cli/render/ink/panels/ReviewQueuePanel.tsx
+import { Box as Box8, Text as Text8 } from "ink";
+import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+function originForRule2(ruleName, sections) {
+  for (const section of sections) {
+    if (section.rules.some((r) => r.name === ruleName)) {
+      if (section.sourceType === "default") return "default";
+      if (section.sourceType === "shield") {
+        return `needs shield:${section.shieldKey ?? section.id}`;
+      }
+    }
+  }
+  return "";
+}
+var ROW_LIMIT4 = 5;
+function ReviewQueuePanel({ summary, width }) {
+  const rules = topRulesByVerdict(summary.sections, "review", ROW_LIMIT4);
+  if (rules.length === 0) return null;
+  return /* @__PURE__ */ jsxs8(Box8, { borderStyle: "round", borderColor: "gray", paddingX: 1, flexDirection: "column", width, children: [
+    /* @__PURE__ */ jsx8(Text8, { bold: true, children: "REVIEW QUEUE" }),
+    rules.map((rule, i) => /* @__PURE__ */ jsxs8(Box8, { children: [
+      /* @__PURE__ */ jsx8(Box8, { width: 22, children: /* @__PURE__ */ jsx8(Text8, { wrap: "truncate-end", children: rule.name }) }),
+      /* @__PURE__ */ jsx8(Box8, { width: 6, children: /* @__PURE__ */ jsx8(Text8, { bold: true, children: `\xD7${rule.count}` }) }),
+      /* @__PURE__ */ jsx8(Text8, { dimColor: true, wrap: "truncate-end", children: originForRule2(rule.name, summary.sections) })
+    ] }, i)),
+    /* @__PURE__ */ jsxs8(Box8, { children: [
+      /* @__PURE__ */ jsx8(Text8, { dimColor: true, wrap: "truncate-end", children: "\u2192 " }),
+      /* @__PURE__ */ jsx8(Text8, { bold: true, color: "cyan", wrap: "truncate-end", children: "runtime approval" })
+    ] })
+  ] });
+}
+
+// src/cli/render/ink/panels/AgentLoopsPanel.tsx
+import { Box as Box9, Text as Text9 } from "ink";
+import { Fragment, jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+var TOOL_ROW_LIMIT = 5;
+var STUCK_ROW_LIMIT = 1;
+function fmtNum2(n) {
+  return n.toLocaleString();
+}
+function trimRight(s, width) {
+  if (s.length <= width) return s;
+  return "\u2026" + s.slice(s.length - (width - 1));
+}
+function AgentLoopsPanel({ loopFindings, width }) {
+  if (loopFindings.length === 0) return null;
+  const byTool = /* @__PURE__ */ new Map();
+  let totalRepeats = 0;
+  for (const f of loopFindings) {
+    const repeats = Math.max(0, f.count - 1);
+    byTool.set(f.toolName, (byTool.get(f.toolName) ?? 0) + repeats);
+    totalRepeats += repeats;
+  }
+  const toolEntries = [...byTool.entries()].sort((a, b) => b[1] - a[1]).slice(0, TOOL_ROW_LIMIT);
+  const topStuck = [...loopFindings].sort((a, b) => b.count - a.count).slice(0, STUCK_ROW_LIMIT);
+  return /* @__PURE__ */ jsxs9(Box9, { borderStyle: "round", borderColor: "gray", paddingX: 1, flexDirection: "column", width, children: [
+    /* @__PURE__ */ jsx9(Text9, { bold: true, children: "AGENT LOOPS" }),
+    toolEntries.map(([tool, repeats]) => {
+      const pct = totalRepeats > 0 ? Math.round(repeats / totalRepeats * 100) : 0;
+      return /* @__PURE__ */ jsxs9(Box9, { children: [
+        /* @__PURE__ */ jsx9(Box9, { width: 10, children: /* @__PURE__ */ jsx9(Text9, { bold: true, children: tool }) }),
+        /* @__PURE__ */ jsx9(Box9, { width: 14, children: /* @__PURE__ */ jsx9(Text9, { children: `\xD7${fmtNum2(repeats)}` }) }),
+        /* @__PURE__ */ jsx9(Text9, { dimColor: true, children: `${pct}%` })
+      ] }, tool);
+    }),
+    topStuck.length > 0 ? /* @__PURE__ */ jsxs9(Fragment, { children: [
+      /* @__PURE__ */ jsx9(Text9, { dimColor: true, children: "Top stuck:" }),
+      topStuck.map((f, i) => {
+        const target = trimRight(f.commandPreview || f.toolName, 32);
+        return /* @__PURE__ */ jsxs9(Box9, { children: [
+          /* @__PURE__ */ jsx9(Box9, { width: 8, children: /* @__PURE__ */ jsx9(Text9, { bold: true, children: `\xD7${fmtNum2(f.count)}` }) }),
+          /* @__PURE__ */ jsx9(Text9, { dimColor: true, wrap: "truncate-end", children: target })
+        ] }, `stuck-${i}`);
+      })
+    ] }) : null,
+    /* @__PURE__ */ jsxs9(Box9, { children: [
+      /* @__PURE__ */ jsx9(Text9, { dimColor: true, wrap: "truncate-end", children: "\u2192 " }),
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: "cyan", wrap: "truncate-end", children: "live loop-detector" })
+    ] })
+  ] });
+}
+
+// src/cli/render/ink/panels/ShieldsPanel.tsx
+import { Box as Box10, Text as Text10 } from "ink";
+
+// src/protection.ts
+var PROTECTIVE_SHIELD_DISCOUNTS = {
+  "project-jail": 0.7
+};
+
+// packages/policy-engine/dist/index.mjs
+import safeRegex from "safe-regex2";
+import mvdanSh from "mvdan-sh";
+import pm from "picomatch";
+import safeRegex2 from "safe-regex2";
+import safeRegex3 from "safe-regex2";
+var DLP_PATTERNS = [
+  // ── AWS ───────────────────────────────────────────────────────────────────
+  {
+    name: "AWS Access Key ID",
+    regex: /\b(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16}\b/,
+    severity: "block",
+    keywords: ["akia", "asia", "abia", "acca", "a3t"]
+  },
+  // ── GitHub ────────────────────────────────────────────────────────────────
+  {
+    name: "GitHub Token",
+    regex: /\bgh[pous]_[A-Za-z0-9]{36}\b/,
+    severity: "block",
+    keywords: ["ghp_", "gho_", "ghu_", "ghs_"],
+    minEntropy: 3
+  },
+  {
+    name: "GitHub Fine-Grained PAT",
+    regex: /\bgithub_pat_\w{82}\b/,
+    severity: "block",
+    keywords: ["github_pat_"]
+  },
+  // ── Slack ─────────────────────────────────────────────────────────────────
+  {
+    name: "Slack Bot Token",
+    // Real tokens are ~50–80 chars; lower bound 20 avoids false negatives on partial tokens
+    regex: /\bxoxb-[0-9A-Za-z-]{20,100}\b/,
+    severity: "block",
+    keywords: ["xoxb-"]
+  },
+  // ── Anthropic ─────────────────────────────────────────────────────────────
+  // Listed before OpenAI — Anthropic keys start with sk-ant- which would also
+  // match the broader OpenAI sk- pattern; more specific rules must come first.
+  {
+    name: "Anthropic API Key",
+    regex: /\bsk-ant-api03-[a-zA-Z0-9_-]{93}AA\b/,
+    severity: "block",
+    keywords: ["sk-ant-api03"]
+  },
+  {
+    name: "Anthropic Admin Key",
+    regex: /\bsk-ant-admin01-[a-zA-Z0-9_-]{93}AA\b/,
+    severity: "block",
+    keywords: ["sk-ant-admin01"]
+  },
+  // ── OpenAI ────────────────────────────────────────────────────────────────
+  {
+    name: "OpenAI API Key",
+    regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/,
+    severity: "block",
+    keywords: ["sk-"],
+    minEntropy: 3.5
+  },
+  // ── Stripe ────────────────────────────────────────────────────────────────
+  {
+    name: "Stripe Secret Key",
+    regex: /\bsk_(?:live|test)_[0-9a-zA-Z]{24}\b/,
+    severity: "block",
+    keywords: ["sk_live_", "sk_test_"]
+  },
+  // ── GCP ───────────────────────────────────────────────────────────────────
+  {
+    name: "GCP API Key",
+    regex: /\bAIza[0-9A-Za-z_-]{35}\b/,
+    severity: "block",
+    keywords: ["aiza"],
+    minEntropy: 3
+  },
+  {
+    name: "GCP Service Account",
+    regex: /"type"\s*:\s*"service_account"/,
+    severity: "block",
+    keywords: ["service_account"]
+  },
+  // ── Azure ─────────────────────────────────────────────────────────────────
+  // Pattern: 3 alphanum chars + digit + Q~ + 31-34 alphanum chars
+  {
+    name: "Azure AD Client Secret",
+    regex: /(?:^|[\s>=:(,])([a-zA-Z0-9_~.]{3}\dQ~[a-zA-Z0-9_~.-]{31,34})(?:$|[\s<),])/,
+    severity: "block",
+    keywords: ["q~"]
+  },
+  // ── Databricks ────────────────────────────────────────────────────────────
+  {
+    name: "Databricks API Token",
+    regex: /\bdapi[a-f0-9]{32}(?:-\d)?\b/,
+    severity: "block",
+    keywords: ["dapi"]
+  },
+  // ── DigitalOcean ──────────────────────────────────────────────────────────
+  {
+    name: "DigitalOcean PAT",
+    regex: /\bdop_v1_[a-f0-9]{64}\b/,
+    severity: "block",
+    keywords: ["dop_v1_"]
+  },
+  {
+    name: "DigitalOcean Access Token",
+    regex: /\bdoo_v1_[a-f0-9]{64}\b/,
+    severity: "block",
+    keywords: ["doo_v1_"]
+  },
+  // ── Doppler ───────────────────────────────────────────────────────────────
+  {
+    name: "Doppler Token",
+    regex: /\bdp\.pt\.[a-z0-9]{43}\b/i,
+    severity: "block",
+    keywords: ["dp.pt."]
+  },
+  // ── HashiCorp Vault ───────────────────────────────────────────────────────
+  {
+    name: "HashiCorp Vault Service Token",
+    regex: /\bhvs\.[\w-]{90,120}\b/,
+    severity: "block",
+    keywords: ["hvs."]
+  },
+  {
+    name: "HashiCorp Vault Batch Token",
+    regex: /\bhvb\.[\w-]{138,300}\b/,
+    severity: "block",
+    keywords: ["hvb."]
+  },
+  // ── Hugging Face ──────────────────────────────────────────────────────────
+  {
+    name: "HuggingFace Token",
+    regex: /\bhf_[A-Za-z]{34}\b/,
+    severity: "block",
+    keywords: ["hf_"],
+    minEntropy: 3
+  },
+  // ── Postman ───────────────────────────────────────────────────────────────
+  {
+    name: "Postman API Token",
+    regex: /\bPMAK-[a-f0-9]{24}-[a-f0-9]{34}\b/i,
+    severity: "block",
+    keywords: ["pmak-"]
+  },
+  // ── Pulumi ────────────────────────────────────────────────────────────────
+  {
+    name: "Pulumi Access Token",
+    regex: /\bpul-[a-f0-9]{40}\b/,
+    severity: "block",
+    keywords: ["pul-"]
+  },
+  // ── SendGrid ──────────────────────────────────────────────────────────────
+  {
+    name: "SendGrid API Key",
+    regex: /\bSG\.[a-zA-Z0-9=_.-]{66}\b/,
+    severity: "block",
+    keywords: ["sg."]
+  },
+  // ── Private keys (PEM) ────────────────────────────────────────────────────
+  {
+    name: "Private Key (PEM)",
+    regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    severity: "block",
+    keywords: ["-----begin"]
+  },
+  // ── NPM ───────────────────────────────────────────────────────────────────
+  {
+    name: "NPM Auth Token",
+    regex: /_authToken\s*=\s*[A-Za-z0-9_-]{20,}/,
+    severity: "block",
+    keywords: ["_authtoken"]
+  },
+  // ── JWT ───────────────────────────────────────────────────────────────────
+  // review (not block): JWTs appear legitimately in API calls; flag for human approval
+  // contextBoost: promoted to block when assigned (e.g. TOKEN=eyJ...)
+  {
+    name: "JWT",
+    regex: /\bey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9\/_-]{17,}\.[a-zA-Z0-9\/_-]{10,}={0,2}\b/,
+    severity: "review",
+    keywords: ["eyj"],
+    contextBoost: true
+  },
+  // ── Stripe (extended — adds restricted key rk_ prefix) ──────────────────
+  {
+    name: "Stripe Restricted Key",
+    regex: /\brk_(?:live|test|prod)_[0-9a-zA-Z]{10,99}\b/,
+    severity: "block",
+    keywords: ["rk_live_", "rk_test_", "rk_prod_"]
+  },
+  // ── Slack (app token) ─────────────────────────────────────────────────────
+  {
+    name: "Slack App Token",
+    regex: /\bxapp-\d-[A-Z0-9]+-\d+-[a-f0-9]+\b/,
+    severity: "block",
+    keywords: ["xapp-"]
+  },
+  // ── GitLab ────────────────────────────────────────────────────────────────
+  { name: "GitLab PAT", regex: /\bglpat-[\w-]{20}\b/, severity: "block", keywords: ["glpat-"] },
+  {
+    name: "GitLab Deploy Token",
+    regex: /\bgldt-[0-9a-zA-Z_-]{20}\b/,
+    severity: "block",
+    keywords: ["gldt-"]
+  },
+  {
+    name: "GitLab CI Job Token",
+    regex: /\bglcbt-[0-9a-zA-Z]{1,5}_[0-9a-zA-Z_-]{20}\b/,
+    severity: "block",
+    keywords: ["glcbt-"]
+  },
+  // ── npm (publish token) ───────────────────────────────────────────────────
+  {
+    name: "npm Access Token",
+    regex: /\bnpm_[a-zA-Z0-9]{36}\b/,
+    severity: "block",
+    keywords: ["npm_"]
+  },
+  // ── Shopify ───────────────────────────────────────────────────────────────
+  {
+    name: "Shopify Access Token",
+    regex: /\bshpat_[a-fA-F0-9]{32}\b/,
+    severity: "block",
+    keywords: ["shpat_"]
+  },
+  {
+    name: "Shopify Custom Access Token",
+    regex: /\bshpca_[a-fA-F0-9]{32}\b/,
+    severity: "block",
+    keywords: ["shpca_"]
+  },
+  {
+    name: "Shopify Private App Token",
+    regex: /\bshppa_[a-fA-F0-9]{32}\b/,
+    severity: "block",
+    keywords: ["shppa_"]
+  },
+  {
+    name: "Shopify Shared Secret",
+    regex: /\bshpss_[a-fA-F0-9]{32}\b/,
+    severity: "block",
+    keywords: ["shpss_"]
+  },
+  // ── Linear ────────────────────────────────────────────────────────────────
+  {
+    name: "Linear API Key",
+    regex: /\blin_api_[a-zA-Z0-9]{40}\b/,
+    severity: "block",
+    keywords: ["lin_api_"]
+  },
+  // ── PlanetScale ───────────────────────────────────────────────────────────
+  {
+    name: "PlanetScale API Token",
+    regex: /\bpscale_tkn_[\w.-]{32,64}\b/,
+    severity: "block",
+    keywords: ["pscale_tkn_"]
+  },
+  {
+    name: "PlanetScale Password",
+    regex: /\bpscale_pw_[\w.-]{32,64}\b/,
+    severity: "block",
+    keywords: ["pscale_pw_"]
+  },
+  // ── Sentry ────────────────────────────────────────────────────────────────
+  {
+    name: "Sentry User Token",
+    regex: /\bsntryu_[a-f0-9]{64}\b/,
+    severity: "block",
+    keywords: ["sntryu_"]
+  },
+  // ── Grafana ───────────────────────────────────────────────────────────────
+  {
+    name: "Grafana Service Account Token",
+    regex: /\bglsa_[a-zA-Z0-9]{32}_[a-f0-9]{8}\b/,
+    severity: "block",
+    keywords: ["glsa_"]
+  },
+  // ── Heroku ────────────────────────────────────────────────────────────────
+  {
+    name: "Heroku API Key",
+    regex: /\bHRKU-AA[0-9a-zA-Z_-]{58}\b/,
+    severity: "block",
+    keywords: ["hrku-aa"]
+  },
+  // ── PyPI ──────────────────────────────────────────────────────────────────
+  {
+    name: "PyPI Upload Token",
+    regex: /\bpypi-[A-Za-z0-9_-]{50,}\b/,
+    severity: "block",
+    keywords: ["pypi-"],
+    minEntropy: 3
+  },
+  // ── Bearer Token ─────────────────────────────────────────────────────────
+  // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
+  {
+    name: "Bearer Token",
+    regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
+    severity: "review",
+    keywords: ["bearer"],
+    contextBoost: true,
+    minEntropy: 3
+  },
+  // ── Resend ────────────────────────────────────────────────────────────────
+  {
+    name: "Resend API Key",
+    regex: /\bre_[a-zA-Z0-9]{24}\b/,
+    severity: "block",
+    keywords: ["re_"]
+  },
+  // ── Telegram ──────────────────────────────────────────────────────────────
+  {
+    name: "Telegram Bot Token",
+    regex: /\b[0-9]{7,10}:AA[a-zA-Z0-9_-]{33}\b/,
+    severity: "block",
+    keywords: [":aa"]
+  },
+  // ── Mapbox ────────────────────────────────────────────────────────────────
+  {
+    name: "Mapbox Access Token",
+    regex: /\bpk\.eyJ1[a-zA-Z0-9._-]{20,}\b/,
+    severity: "block",
+    keywords: ["pk.eyj1"],
+    minEntropy: 3
+  },
+  // ── Notion ────────────────────────────────────────────────────────────────
+  {
+    name: "Notion Integration Token",
+    regex: /\bsecret_[a-zA-Z0-9]{43}\b/,
+    severity: "block",
+    keywords: ["secret_"]
+  },
+  // ── Square ────────────────────────────────────────────────────────────────
+  {
+    name: "Square Access Token",
+    regex: /\bsq0atp-[0-9A-Za-z_-]{22}\b/,
+    severity: "block",
+    keywords: ["sq0atp-"]
+  },
+  {
+    name: "Square OAuth Secret",
+    regex: /\bsq0csp-[0-9A-Za-z_-]{43}\b/,
+    severity: "block",
+    keywords: ["sq0csp-"]
+  },
+  // ── Typeform ──────────────────────────────────────────────────────────────
+  {
+    name: "Typeform Token",
+    regex: /\btfp_[a-zA-Z0-9_]{59}\b/,
+    severity: "block",
+    keywords: ["tfp_"]
+  },
+  // ── Cloudinary ────────────────────────────────────────────────────────────
+  {
+    name: "Cloudinary URL",
+    regex: /\bcloudinary:\/\/[0-9]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+/,
+    severity: "block",
+    keywords: ["cloudinary://"]
+  },
+  // ── Airtable ──────────────────────────────────────────────────────────────
+  // New PAT format: pat + 14 alphanum + . + 64 alphanum
+  {
+    name: "Airtable PAT",
+    regex: /\bpat[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{64}\b/,
+    severity: "block",
+    keywords: ["pat"]
+  },
+  // ── RubyGems ──────────────────────────────────────────────────────────────
+  {
+    name: "RubyGems API Key",
+    regex: /\brubygems_[a-f0-9]{48}\b/,
+    severity: "block",
+    keywords: ["rubygems_"]
+  },
+  // ── Shippo ────────────────────────────────────────────────────────────────
+  {
+    name: "Shippo Token",
+    regex: /\bshippo_(?:live|test)_[a-f0-9]{40}\b/,
+    severity: "block",
+    keywords: ["shippo_"]
+  },
+  // ── Plaid ─────────────────────────────────────────────────────────────────
+  {
+    name: "Plaid Access Token",
+    regex: /\baccess-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/,
+    severity: "block",
+    keywords: ["access-sandbox", "access-development", "access-production"]
+  },
+  // ── Age ───────────────────────────────────────────────────────────────────
+  {
+    name: "Age Identity Key",
+    regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
+    severity: "block",
+    keywords: ["age-secret-key-"]
+  }
+];
+var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
+  (p) => ({
+    pattern: p,
+    globalRegex: new RegExp(
+      p.regex.source,
+      p.regex.flags.includes("g") ? p.regex.flags : p.regex.flags + "g"
+    )
+  })
+);
+var SENSITIVE_PATH_PATTERNS = [
+  /[/\\]\.ssh[/\\]/i,
+  /[/\\]\.aws[/\\]/i,
+  /[/\\]\.config[/\\]gcloud[/\\]/i,
+  /[/\\]\.azure[/\\]/i,
+  /[/\\]\.kube[/\\]config$/i,
+  /[/\\]\.env($|\.)/i,
+  // .env, .env.local, .env.production — not .envoy
+  /[/\\]\.git-credentials$/i,
+  /[/\\]\.npmrc$/i,
+  /[/\\]\.docker[/\\]config\.json$/i,
+  /[/\\][^/\\]+\.pem$/i,
+  /[/\\][^/\\]+\.key$/i,
+  /[/\\][^/\\]+\.p12$/i,
+  /[/\\][^/\\]+\.pfx$/i,
+  /^(?:[a-zA-Z]:)?\/etc\/passwd$/,
+  /^(?:[a-zA-Z]:)?\/etc\/shadow$/,
+  /^(?:[a-zA-Z]:)?\/etc\/sudoers$/,
+  /[/\\]credentials\.json$/i,
+  /[/\\]id_rsa$/i,
+  /[/\\]id_ed25519$/i,
+  /[/\\]id_ecdsa$/i
+];
+function assertBuiltinPatternsAreSafe() {
+  for (const p of DLP_PATTERNS) {
+    if (!safeRegex(p.regex.source)) {
+      throw new Error(
+        `[node9 engine] Builtin DLP pattern '${p.name}' is vulnerable to ReDoS: ${p.regex.source}`
+      );
+    }
+  }
+  for (const re of SENSITIVE_PATH_PATTERNS) {
+    if (!safeRegex(re.source)) {
+      throw new Error(
+        `[node9 engine] Builtin sensitive-path pattern is vulnerable to ReDoS: ${re.source}`
+      );
+    }
+  }
+}
+assertBuiltinPatternsAreSafe();
+var { syntax } = mvdanSh;
+var sharedParser = syntax.NewParser();
+var aws_default = {
+  name: "aws",
+  description: "Protects AWS infrastructure from destructive AI operations",
+  aliases: ["amazon"],
+  smartRules: [
+    {
+      name: "shield:aws:block-delete-s3-bucket",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "aws\\s+s3.*rb\\s|aws\\s+s3api\\s+delete-bucket",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "S3 bucket deletion is irreversible \u2014 blocked by AWS shield"
+    },
+    {
+      name: "shield:aws:review-iam-changes",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "aws\\s+iam\\s+(create|delete|attach|detach|put|remove)",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "IAM changes require human approval (AWS shield)"
+    },
+    {
+      name: "shield:aws:block-ec2-terminate",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "aws\\s+ec2\\s+terminate-instances",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "EC2 instance termination is irreversible \u2014 blocked by AWS shield"
+    },
+    {
+      name: "shield:aws:review-rds-delete",
+      tool: "*",
+      conditions: [
+        { field: "command", op: "matches", value: "aws\\s+rds\\s+delete-", flags: "i" }
+      ],
+      verdict: "review",
+      reason: "RDS deletion requires human approval (AWS shield)"
+    }
+  ],
+  dangerousWords: []
+};
+var bash_safe_default = {
+  name: "bash-safe",
+  description: "Blocks high-risk bash patterns: pipe-to-shell, rm -rf /, disk overwrites, eval",
+  aliases: ["bash", "shell"],
+  smartRules: [
+    {
+      name: "shield:bash-safe:block-pipe-to-shell",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|&&|\\|\\||;)\\s*(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Pipe-to-shell is a common supply-chain attack vector \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:block-obfuscated-exec",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bbase64\\s+(-d|--decode)[^|;&]*\\|\\s*(bash|sh|zsh)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Obfuscated execution via base64 decode \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:block-rm-root",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "rm\\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r)[a-zA-Z]*\\s+(\\/|~|\\$HOME|\\$\\{HOME\\})\\s*$",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "rm -rf of root or home directory is catastrophic \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:block-disk-overwrite",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|&&|\\|\\||;)\\s*dd\\s+.*of=\\/dev\\/(sd|nvme|hd|vd|xvd)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Writing directly to a block device is irreversible \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:block-eval-remote",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|&&|\\|\\||;)\\s*eval\\s+.*\\$\\((curl|wget)\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "eval of remote download is a near-certain supply-chain attack \u2014 blocked by bash-safe shield"
+    },
+    {
+      name: "shield:bash-safe:review-eval-dynamic",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: '(^|&&|\\|\\||[;|\\n{(`])\\s*eval\\s+([\\$`(]|"[^"]*\\$)',
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "eval of dynamic content \u2014 backup regex rule for scan path (real-time uses AST detection)"
+    }
+  ],
+  dangerousWords: []
+};
+var docker_default = {
+  name: "docker",
+  description: "Protects Docker environments from destructive AI operations",
+  aliases: [],
+  smartRules: [
+    {
+      name: "shield:docker:block-system-prune",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+system\\s+prune",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "docker system prune removes all unused containers, images, and volumes \u2014 blocked by Docker shield"
+    },
+    {
+      name: "shield:docker:block-volume-prune",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+volume\\s+prune",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "docker volume prune destroys all unused volumes and their data \u2014 blocked by Docker shield"
+    },
+    {
+      name: "shield:docker:block-rm-force",
+      tool: "*",
+      conditionMode: "all",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+rm\\b",
+          flags: "i"
+        },
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|\\s)(-f|--force)(\\s|$)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Force-removing running containers is destructive \u2014 blocked by Docker shield"
+    },
+    {
+      name: "shield:docker:review-volume-rm",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+volume\\s+rm\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Volume removal deletes persistent data and requires human approval (Docker shield)"
+    },
+    {
+      name: "shield:docker:review-stop-kill",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+(stop|kill)\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Stopping or killing containers requires human approval (Docker shield)"
+    },
+    {
+      name: "shield:docker:review-image-rm",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+image\\s+rm\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Image removal requires human approval (Docker shield)"
+    },
+    {
+      name: "shield:docker:review-rmi-force",
+      tool: "*",
+      conditionMode: "all",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "docker\\s+rmi\\b",
+          flags: "i"
+        },
+        {
+          field: "command",
+          op: "matches",
+          value: "(^|\\s)(-f|--force)(\\s|$)",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Force image removal requires human approval (Docker shield)"
+    }
+  ],
+  dangerousWords: []
+};
+var filesystem_default = {
+  name: "filesystem",
+  description: "Protects the local filesystem from dangerous AI operations",
+  aliases: ["fs"],
+  smartRules: [
+    {
+      name: "shield:filesystem:review-chmod-777",
+      tool: "bash",
+      conditions: [
+        { field: "command", op: "matches", value: "chmod\\s+(777|a\\+rwx)", flags: "i" }
+      ],
+      verdict: "review",
+      reason: "chmod 777 requires human approval (filesystem shield)"
+    },
+    {
+      name: "shield:filesystem:review-write-etc",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(tee|\\bcp\\b|\\bmv\\b|install|>+)\\s+.*\\/etc\\/"
+        }
+      ],
+      verdict: "review",
+      reason: "Writing to /etc requires human approval (filesystem shield)"
+    }
+  ],
+  dangerousWords: ["wipefs"]
+};
+var github_default = {
+  name: "github",
+  description: "Protects GitHub repositories from destructive AI operations",
+  aliases: ["git"],
+  smartRules: [
+    {
+      name: "shield:github:review-delete-branch-remote",
+      tool: "bash",
+      conditions: [
+        { field: "command", op: "matches", value: "git\\s+push\\s+.*--delete", flags: "i" }
+      ],
+      verdict: "review",
+      reason: "Remote branch deletion requires human approval (GitHub shield)"
+    },
+    {
+      name: "shield:github:block-delete-repo",
+      tool: "*",
+      conditions: [
+        { field: "command", op: "matches", value: "gh\\s+repo\\s+delete", flags: "i" }
+      ],
+      verdict: "block",
+      reason: "Repository deletion is irreversible \u2014 blocked by GitHub shield"
+    }
+  ],
+  dangerousWords: []
+};
+var k8s_default = {
+  name: "k8s",
+  description: "Protects Kubernetes clusters from destructive AI operations",
+  aliases: ["kubernetes", "kubectl"],
+  smartRules: [
+    {
+      name: "shield:k8s:block-delete-namespace",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+delete\\s+(ns|namespace)\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Deleting a namespace destroys all resources inside it \u2014 blocked by k8s shield"
+    },
+    {
+      name: "shield:k8s:block-delete-all",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+delete\\s+.*--all\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "kubectl delete --all is irreversible \u2014 blocked by k8s shield"
+    },
+    {
+      name: "shield:k8s:block-helm-uninstall",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "helm\\s+(uninstall|delete|del)\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "helm uninstall removes a release and its resources \u2014 blocked by k8s shield"
+    },
+    {
+      name: "shield:k8s:review-scale-zero",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+scale\\s+.*--replicas=0",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Scaling to zero takes down a workload and requires human approval (k8s shield)"
+    },
+    {
+      name: "shield:k8s:review-delete-deployment",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+delete\\s+(deployment|deploy|statefulset|sts|daemonset|ds)\\s+",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Deleting a workload requires human approval (k8s shield)"
+    },
+    {
+      name: "shield:k8s:review-apply-force",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "kubectl\\s+(apply|replace)\\s+.*--force",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Force-apply overwrites live resources and requires human approval (k8s shield)"
+    }
+  ],
+  dangerousWords: []
+};
+var mongodb_default = {
+  name: "mongodb",
+  description: "Protects MongoDB databases from destructive AI operations",
+  aliases: ["mongo"],
+  smartRules: [
+    {
+      name: "shield:mongodb:block-drop-database",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.dropDatabase\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "dropDatabase is irreversible \u2014 blocked by MongoDB shield"
+    },
+    {
+      name: "shield:mongodb:block-drop-collection",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.drop\\s*\\(|db\\.getCollection\\([^)]+\\)\\.drop\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Collection drop is irreversible \u2014 blocked by MongoDB shield"
+    },
+    {
+      name: "shield:mongodb:block-delete-many-empty-filter",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.deleteMany\\s*\\(\\s*\\{\\s*\\}\\s*\\)",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "deleteMany({}) with empty filter wipes the entire collection \u2014 blocked by MongoDB shield"
+    },
+    {
+      name: "shield:mongodb:review-delete-many",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.deleteMany\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "deleteMany requires human approval (MongoDB shield)"
+    },
+    {
+      name: "shield:mongodb:review-drop-index",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\.dropIndex\\s*\\(|\\.dropIndexes\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Index drops affect query performance and require human approval (MongoDB shield)"
+    }
+  ],
+  dangerousWords: ["dropDatabase", "dropCollection", "mongodrop"]
+};
+var postgres_default = {
+  name: "postgres",
+  description: "Protects PostgreSQL databases from destructive AI operations",
+  aliases: ["pg", "postgresql"],
+  smartRules: [
+    {
+      name: "shield:postgres:block-drop-table",
+      tool: "*",
+      conditions: [{ field: "sql", op: "matches", value: "DROP\\s+TABLE", flags: "i" }],
+      verdict: "block",
+      reason: "DROP TABLE is irreversible \u2014 blocked by Postgres shield"
+    },
+    {
+      name: "shield:postgres:block-truncate",
+      tool: "*",
+      conditions: [
+        { field: "sql", op: "matches", value: "TRUNCATE\\s+TABLE", flags: "i" }
+      ],
+      verdict: "block",
+      reason: "TRUNCATE is irreversible \u2014 blocked by Postgres shield"
+    },
+    {
+      name: "shield:postgres:block-drop-column",
+      tool: "*",
+      conditions: [
+        { field: "sql", op: "matches", value: "ALTER\\s+TABLE.*DROP\\s+COLUMN", flags: "i" }
+      ],
+      verdict: "block",
+      reason: "DROP COLUMN is irreversible \u2014 blocked by Postgres shield"
+    },
+    {
+      name: "shield:postgres:review-grant-revoke",
+      tool: "*",
+      conditions: [
+        { field: "sql", op: "matches", value: "\\b(GRANT|REVOKE)\\b", flags: "i" }
+      ],
+      verdict: "review",
+      reason: "Permission changes require human approval (Postgres shield)"
+    }
+  ],
+  dangerousWords: ["dropdb", "pg_dropcluster"]
+};
+var project_jail_default = {
+  name: "project-jail",
+  description: "Restricts AI agents from reading sensitive credential files outside the current project",
+  aliases: ["jail"],
+  smartRules: [
+    {
+      name: "shield:project-jail:block-read-ssh",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*?\\.ssh[\\/\\\\]",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading SSH private keys is blocked by project-jail shield"
+    },
+    {
+      name: "shield:project-jail:block-read-aws",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*?\\.aws[\\/\\\\]",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading AWS credentials is blocked by project-jail shield"
+    },
+    {
+      name: "shield:project-jail:block-read-env",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*\\.env(\\.local|\\.production|\\.staging)?\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading .env files is blocked by project-jail shield"
+    },
+    {
+      name: "shield:project-jail:review-read-credentials",
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Reading credential files requires approval (project-jail shield)"
+    },
+    {
+      name: "shield:project-jail:block-read-ssh-any-tool",
+      tool: "*",
+      conditions: [
+        {
+          field: "file_path",
+          op: "matches",
+          value: "(^|[\\/\\\\])\\.ssh[\\/\\\\]",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading SSH private keys is blocked by project-jail shield"
+    },
+    {
+      name: "shield:project-jail:block-read-aws-any-tool",
+      tool: "*",
+      conditions: [
+        {
+          field: "file_path",
+          op: "matches",
+          value: "(^|[\\/\\\\])\\.aws[\\/\\\\]",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "Reading AWS credentials is blocked by project-jail shield"
+    },
+    {
+      name: "shield:project-jail:review-read-env-any-tool",
+      tool: "*",
+      conditions: [
+        {
+          field: "file_path",
+          op: "matches",
+          value: "(^|[\\/\\\\])\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?$",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Reading .env files requires approval (project-jail shield)"
+    },
+    {
+      name: "shield:project-jail:review-read-credentials-any-tool",
+      tool: "*",
+      conditions: [
+        {
+          field: "file_path",
+          op: "matches",
+          value: ".*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials|\\.kube[\\/\\\\]config)",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Reading credential files requires approval (project-jail shield)"
+    }
+  ],
+  dangerousWords: []
+};
+var redis_default = {
+  name: "redis",
+  description: "Protects Redis instances from destructive AI operations",
+  aliases: [],
+  smartRules: [
+    {
+      name: "shield:redis:block-flushall",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bFLUSHALL\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "FLUSHALL deletes every key in every database \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:block-flushdb",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bFLUSHDB\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "FLUSHDB deletes all keys in the current database \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:block-config-resetstat",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bCONFIG\\s+RESETSTAT\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "CONFIG RESETSTAT resets server statistics irreversibly \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:review-config-set",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bCONFIG\\s+SET\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
+    },
+    {
+      name: "shield:redis:review-del-wildcard",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Wildcard key deletion requires human approval (Redis shield)"
+    }
+  ],
+  dangerousWords: ["FLUSHALL", "FLUSHDB"]
+};
+var BUILTIN_SHIELDS = {
+  [aws_default.name]: aws_default,
+  [bash_safe_default.name]: bash_safe_default,
+  [docker_default.name]: docker_default,
+  [filesystem_default.name]: filesystem_default,
+  [github_default.name]: github_default,
+  [k8s_default.name]: k8s_default,
+  [mongodb_default.name]: mongodb_default,
+  [postgres_default.name]: postgres_default,
+  [project_jail_default.name]: project_jail_default,
+  [redis_default.name]: redis_default
+};
+function assertBuiltinShieldRegexesAreSafe() {
+  for (const shield of Object.values(BUILTIN_SHIELDS)) {
+    for (const rule of shield.smartRules) {
+      const conditions = rule.conditions ?? [];
+      for (const cond of conditions) {
+        if (cond.op !== "matches" && cond.op !== "notMatches") continue;
+        const pattern = cond.value;
+        if (!pattern) continue;
+        if (!safeRegex3(pattern)) {
+          throw new Error(
+            `[node9 engine] Shield '${shield.name}' rule '${rule.name ?? rule.tool}' has unsafe regex: ${pattern}`
+          );
+        }
+      }
+    }
+  }
+}
+assertBuiltinShieldRegexesAreSafe();
+var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
+
+// src/cli/render/ink/panels/ShieldsPanel.tsx
+import { jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+function ShieldsPanel({ summary, blastScore, width }) {
+  const impacts = rollupByShield(summary.sections);
+  const exposed = Math.max(0, 100 - blastScore);
+  const ranked = [...impacts].sort((a, b) => {
+    const aDiscount = PROTECTIVE_SHIELD_DISCOUNTS[a.shieldName] ?? 0;
+    const bDiscount = PROTECTIVE_SHIELD_DISCOUNTS[b.shieldName] ?? 0;
+    if (aDiscount !== bDiscount) return bDiscount - aDiscount;
+    return b.totalCatches - a.totalCatches;
+  });
+  const hitShields = ranked.filter((i) => i.totalCatches > 0);
+  const hitNames = new Set(hitShields.map((i) => i.shieldName));
+  const zeroHitBuiltins = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitNames.has(name)).sort();
+  const topRec = hitShields.find((r) => (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0);
+  const topRecBonus = topRec ? Math.round(exposed * (PROTECTIVE_SHIELD_DISCOUNTS[topRec.shieldName] ?? 0)) : 0;
+  return /* @__PURE__ */ jsxs10(Box10, { borderStyle: "round", borderColor: "cyan", paddingX: 1, flexDirection: "column", width, children: [
+    /* @__PURE__ */ jsx10(Text10, { bold: true, color: "cyan", children: "SHIELDS" }),
+    hitShields.map((impact) => {
+      const discount = PROTECTIVE_SHIELD_DISCOUNTS[impact.shieldName] ?? 0;
+      const bonus = Math.round(exposed * discount);
+      const noun = `op${impact.totalCatches !== 1 ? "s" : ""}`;
+      return /* @__PURE__ */ jsxs10(Box10, { children: [
+        /* @__PURE__ */ jsx10(Box10, { width: 16, children: /* @__PURE__ */ jsx10(Text10, { bold: true, color: discount > 0 ? "cyan" : void 0, dimColor: discount === 0, children: impact.shieldName }) }),
+        /* @__PURE__ */ jsx10(Box10, { width: 20, children: /* @__PURE__ */ jsx10(Text10, { dimColor: true, children: `catches ${impact.totalCatches} ${noun}` }) }),
+        bonus > 0 ? /* @__PURE__ */ jsx10(
+          Text10,
+          {
+            bold: true,
+            color: "green",
+            children: `\u2192 +${bonus} pts (${blastScore} \u2192 ${blastScore + bonus})`
+          }
+        ) : null
+      ] }, impact.shieldName);
+    }),
+    zeroHitBuiltins.length > 0 ? /* @__PURE__ */ jsx10(Box10, { flexDirection: "column", children: /* @__PURE__ */ jsx10(Text10, { dimColor: true, wrap: "truncate-end", children: zeroHitBuiltins.join(" \xB7 ") + "  (no hits \u2014 install proactively)" }) }) : null,
+    topRec ? /* @__PURE__ */ jsx10(Box10, { children: /* @__PURE__ */ jsx10(Text10, { color: "cyan", bold: true, children: `\u2192 node9 shield enable ${topRec.shieldName}   (start here \u2014 +${topRecBonus} pts)` }) }) : null
+  ] });
+}
+
+// src/cli/render/ink/StaticScorecard.tsx
+import { Fragment as Fragment2, jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
+var MAX_WIDTH = 90;
+function renderWidth() {
+  const term = process.stdout.columns ?? MAX_WIDTH;
+  return Math.min(term, MAX_WIDTH);
+}
+function StaticScorecard({ input, rangeLabel }) {
+  const { summary, blockedCount } = input;
+  const width = renderWidth();
+  const halfWidth = Math.floor((width - 1) / 2);
+  const leakCount = summary.leaks.length;
+  const hasCritical = leakCount > 0 || blockedCount > 0;
+  const criticalLabel = (() => {
+    const parts = [];
+    if (leakCount > 0) {
+      parts.push(`${leakCount} secret${leakCount !== 1 ? "s" : ""} leaked`);
+    }
+    if (blockedCount > 0) {
+      parts.push(`${blockedCount} op${blockedCount !== 1 ? "s" : ""} blocked`);
+    }
+    return `Critical (${parts.join(" + ")})`;
+  })();
+  return /* @__PURE__ */ jsxs11(Box11, { flexDirection: "column", paddingTop: 1, width, children: [
+    /* @__PURE__ */ jsx11(Header, { rangeLabel }),
+    /* @__PURE__ */ jsx11(SeverityBand, { label: "Spend & activity", width }),
+    /* @__PURE__ */ jsxs11(Box11, { flexDirection: "row", gap: 1, children: [
+      /* @__PURE__ */ jsx11(CostPanel, { summary, width: halfWidth }),
+      /* @__PURE__ */ jsx11(ActivityPanel, { summary, scan: input.scan, width: halfWidth })
+    ] }),
+    hasCritical ? /* @__PURE__ */ jsxs11(Fragment2, { children: [
+      /* @__PURE__ */ jsx11(SeverityBand, { label: criticalLabel, width }),
+      /* @__PURE__ */ jsxs11(Box11, { flexDirection: "row", gap: 1, children: [
+        /* @__PURE__ */ jsx11(LeaksPanel, { summary, width: halfWidth }),
+        /* @__PURE__ */ jsx11(BlockedPanel, { summary, width: halfWidth })
+      ] })
+    ] }) : null,
+    input.blastExposures > 0 ? /* @__PURE__ */ jsxs11(Fragment2, { children: [
+      /* @__PURE__ */ jsx11(
+        SeverityBand,
+        {
+          label: `High (${input.blastExposures} path${input.blastExposures !== 1 ? "s" : ""} reachable on disk)`,
+          width
+        }
+      ),
+      /* @__PURE__ */ jsx11(
+        BlastRadiusPanel,
+        {
+          blast: input.blast,
+          blastExposures: input.blastExposures,
+          width
+        }
+      )
+    ] }) : null,
+    (() => {
+      const reviewCount = input.reviewCount;
+      const loopCount = input.scan.loopFindings.length;
+      if (reviewCount === 0 && loopCount === 0) return null;
+      const { wastePct } = computeLoopWaste(input.scan.loopFindings, input.scan.totalToolCalls);
+      const parts = [];
+      if (reviewCount > 0) parts.push(`${reviewCount} op${reviewCount !== 1 ? "s" : ""} flagged`);
+      if (loopCount > 0)
+        parts.push(
+          `${loopCount} loop${loopCount !== 1 ? "s" : ""}${wastePct > 0 ? ` \xB7 ${wastePct}% wasted` : ""}`
+        );
+      return /* @__PURE__ */ jsxs11(Fragment2, { children: [
+        /* @__PURE__ */ jsx11(SeverityBand, { label: `Medium (${parts.join(" \xB7 ")})`, width }),
+        /* @__PURE__ */ jsxs11(Box11, { flexDirection: "row", gap: 1, children: [
+          /* @__PURE__ */ jsx11(ReviewQueuePanel, { summary: input.summary, width: halfWidth }),
+          /* @__PURE__ */ jsx11(AgentLoopsPanel, { loopFindings: input.scan.loopFindings, width: halfWidth })
+        ] })
+      ] });
+    })(),
+    /* @__PURE__ */ jsx11(SeverityBand, { label: "Recommended action", width }),
+    /* @__PURE__ */ jsx11(ShieldsPanel, { summary: input.summary, blastScore: input.blast.score, width })
+  ] });
+}
+function renderScanScorecardInk(input, rangeLabel) {
+  const { unmount } = render(/* @__PURE__ */ jsx11(StaticScorecard, { input, rangeLabel }), {
+    patchConsole: false
+  });
+  unmount();
+}
+export {
+  StaticScorecard,
+  renderScanScorecardInk
+};