@node9/proxy 2.13.0 → 2.14.0

package/dist/cli.js

@@ -1146,9 +1146,7 @@ function unwrapCommandHead(words) {
   while (i < words.length) {
     const head = (words[i] ?? "").toLowerCase().split("/").pop() ?? "";
     if (head === "find") {
-      const x = words.findIndex(
-        (w, k) => k > i && (w === "-exec" || w === "-execdir" || w === "-ok")
-      );
+      const x = words.findIndex((w, k) => k > i && w !== null && FIND_EXEC_FLAGS.has(w));
       if (x < 0) break;
       i = x + 1;
       continue;
@@ -1170,7 +1168,11 @@ function unwrapCommandHead(words) {
       if (t.startsWith("-")) {
         i++;
         const nxt = words[i];
-        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()))
+        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()) && // A reader is a command, never a flag's operand: `env - cat X`,
+        // `stdbuf -o0 cat X`, `ionice -c3 cat X`. Without this the head was
+        // swallowed and the jail needed a looser fallback whose cost was a
+        // false positive on `sudo echo cat X`.
+        !FS_READ_TOOLS.has(nxt.split("/").pop()?.toLowerCase() ?? ""))
           i++;
         continue;
       }
@@ -1289,36 +1291,32 @@ function isProtectedHomePath(rawPath) {
   }
   return true;
 }
-function extractLiteralArgs(callExpr) {
-  const args = callExpr.Args || [];
-  if (args.length === 0) return { name: "", flags: [], paths: [] };
-  const litFromWord = (w) => {
-    const parts = w?.Parts || [];
-    let s = "";
-    for (const p of parts) {
-      const t = syntax.NodeType(p);
-      if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-      else if (t === "SglQuoted") s += p.Value ?? "";
-      else if (t === "DblQuoted") {
-        const inner = p.Parts || [];
-        if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-        s += inner.map((ip) => ip.Value ?? "").join("");
-      } else {
-        return null;
-      }
+function positionedArgs(words, from = 1, to = words.length) {
+  const out = [];
+  let afterFlag = null;
+  for (let i = from; i < to; i++) {
+    const v = words[i];
+    if (v === null) {
+      afterFlag = null;
+      continue;
     }
-    return s;
-  };
-  const name = (litFromWord(args[0]) || "").toLowerCase();
-  const flags = [];
-  const paths = [];
-  for (let i = 1; i < args.length; i++) {
-    const v = litFromWord(args[i]);
-    if (v === null) continue;
-    if (v.startsWith("-")) flags.push(v);
-    else paths.push(v);
+    if (v.startsWith("-")) {
+      afterFlag = v;
+      continue;
+    }
+    out.push({ value: v, index: out.length, argv: i, afterFlag });
+    afterFlag = null;
   }
-  return { name, flags, paths };
+  return out;
+}
+function extractLiteralArgs(callExpr) {
+  const rawArgs = callExpr.Args || [];
+  if (rawArgs.length === 0) return { name: "", flags: [], paths: [], words: [], args: [] };
+  const words = rawArgs.map((a) => resolveWordLiteral(a));
+  const name = baseWord(words[0]);
+  const flags = words.slice(1).filter((w) => w !== null && w.startsWith("-"));
+  const args = positionedArgs(words);
+  return { name, flags, paths: args.map((a) => a.value), words, args };
 }
 function resolveWordLiteral(w) {
   const parts = w?.Parts || [];
@@ -1576,16 +1574,21 @@ function isRmCreatedInCommandCleanup(command) {
   }
   return sawRm && ok2;
 }
-function analyzeFsOperationImpl(command) {
+function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
   try {
     syntax.Walk(f, (node) => {
-      if (!node || result) return false;
+      if (!node || result?.verdict === "block") return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
-      const { name, flags, paths } = extractLiteralArgs(n);
+      const nodeType = syntax.NodeType(n);
+      if (nodeType === "Stmt") {
+        result = stricter(result, jailedRedirectRead(n));
+        return result?.verdict !== "block";
+      }
+      if (nodeType !== "CallExpr") return true;
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -1614,21 +1617,27 @@ function analyzeFsOperationImpl(command) {
           }
         }
       }
-      if (FS_READ_TOOLS.has(name)) {
-        for (const p of paths) {
-          for (const sp of SENSITIVE_PATH_RULES) {
-            if (sp.match(p)) {
-              result = {
-                ruleName: sp.rule,
-                verdict: sp.verdict ?? "block",
-                reason: sp.reason,
-                path: p
-              };
-              return false;
-            }
+      if (depth < 1) {
+        const payload = literalShellPayload(words, name);
+        if (payload !== null) {
+          const inner = analyzeFsOperationImpl(payload, depth + 1);
+          if (inner) {
+            result = inner;
+            return false;
           }
+          return true;
+        }
+      }
+      const readPaths = FS_READ_TOOLS.has(name) ? paths : wrappedReadPaths(words, name);
+      if (readPaths) {
+        for (const p of readPaths) {
+          result = stricter(result, matchSensitivePath2(p));
+          if (result?.verdict === "block") return false;
         }
       }
+      for (const p of copySourcePaths(words)) {
+        result = stricter(result, copyVerdictOf(matchSensitivePath2(p)));
+      }
       return true;
     });
     return result;
@@ -1636,6 +1645,183 @@ function analyzeFsOperationImpl(command) {
     return null;
   }
 }
+function stricter(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return b.verdict === "block" && a.verdict !== "block" ? b : a;
+}
+function flagInfo(w) {
+  if (w.startsWith("--")) {
+    const eq = w.indexOf("=");
+    return eq < 0 ? { letter: null, long: w, attached: null } : { letter: null, long: w.slice(0, eq), attached: w.slice(eq + 1) };
+  }
+  const m = /^-([a-zA-Z]+)(.*)$/.exec(w);
+  if (!m) return { letter: null, long: null, attached: null };
+  return { letter: m[1][m[1].length - 1], long: null, attached: m[2] === "" ? null : m[2] };
+}
+function flagIs(w, names) {
+  if (w === null) return false;
+  const f = flagInfo(w);
+  return names.some((n) => n.startsWith("--") ? f.long === n : f.letter === n);
+}
+function operandOf(a, names) {
+  if (!names || a.afterFlag === null) return false;
+  return flagIs(a.afterFlag, names) && flagInfo(a.afterFlag).attached === null;
+}
+function resolveCopyShape(words, h) {
+  const verb = baseWord(words[h]);
+  if (!verb) return null;
+  const direct = COPY_VERBS[verb];
+  if (direct) return { shape: direct, last: h };
+  const slots = positionedArgs(words, h + 1);
+  for (let i = 0; i < slots.length; i++) {
+    for (let n = 3; n >= 1; n--) {
+      const part = slots.slice(i, i + n);
+      if (part.length < n) continue;
+      const key = [verb, ...part.map((a) => a.value.toLowerCase())].join(" ");
+      const shape = COPY_VERBS[key];
+      if (shape) return { shape, last: part[n - 1].argv };
+    }
+    if (slots[i].afterFlag === null) return null;
+  }
+  return null;
+}
+function findStartPoints(words, h) {
+  const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
+  if (k < 0) return { k, starts: [] };
+  const firstPredicate = words.findIndex(
+    (w, i) => i > h && w !== null && w.startsWith("-") && !FIND_OPTIONS.has(w)
+  );
+  const end = firstPredicate > h ? firstPredicate : k;
+  return { k, starts: positionalAfter(words, h + 1, end) };
+}
+function copySourcePaths(words) {
+  const h = unwrapCommandHead(words);
+  const fi = words.findIndex((w, i) => i <= h && baseWord(w) === "find");
+  if (fi >= 0) {
+    const { k, starts } = findStartPoints(words, fi);
+    if (k < 0) return [];
+    const action = unwrapCommandHead(words.slice(k + 1));
+    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+  }
+  if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
+  const r = resolveCopyShape(words, h);
+  if (!r) return [];
+  const { shape, last } = r;
+  const args = positionedArgs(words, last + 1);
+  const tail = words.slice(last + 1);
+  const skipped = (a) => operandOf(a, shape.skipFlags);
+  const targetDir = shape.targetDirFlag === true && tail.some((w) => w !== null && w.startsWith("-") && flagIs(w, ["t", "--target-directory"]));
+  const targetOperand = (a) => targetDir && operandOf(a, ["t", "--target-directory"]);
+  const lastOperand = [...tail].reverse().find((w) => w === null || !w.startsWith("-"));
+  const dynamicDest = lastOperand === null;
+  const destIsLastOperand = (shape.source === "allButLast" || shape.source === "first") && !targetDir && !dynamicDest;
+  if (destIsLastOperand && typeof lastOperand === "string" && matchSensitivePath2(lastOperand))
+    return [];
+  let src;
+  switch (shape.source) {
+    case "all":
+      src = args;
+      break;
+    case "first":
+      src = targetDir ? args : args.slice(0, 1);
+      break;
+    case "flagOperand": {
+      const inline = tail.filter((w) => w !== null && w.startsWith("--")).map((w) => flagInfo(w)).filter((f) => f.attached !== null && (shape.sourceFlags ?? []).includes(f.long ?? "")).map((f) => f.attached);
+      return [
+        ...args.filter(
+          (a) => flagIs(a.afterFlag, shape.sourceFlags ?? []) && flagInfo(a.afterFlag).attached === null
+        ).map((a) => a.value),
+        ...inline
+      ];
+    }
+    case "archive":
+      src = archiveInputs(shape.archive, args, tail);
+      break;
+    case "allButLast":
+      src = targetDir || dynamicDest ? args : args.slice(0, -1);
+      break;
+  }
+  return src.filter((a) => !skipped(a) && !targetOperand(a)).map((a) => a.value);
+}
+function archiveInputs(kind, args, tail) {
+  const first = args[0];
+  const bareKey = first && first.afterFlag === null && TAR_MODE_WORD.test(first.value);
+  if (kind === "tar") {
+    const flagsText = tail.filter((w) => w !== null && w.startsWith("-")).join(" ");
+    const mode = (bareKey ? first.value : "") + flagsText;
+    const extracting = /x|t/.test(bareKey ? first.value.replace(/f/g, "") : "") || /(^|\s)-[a-zA-Z]*[xt]|--extract|--list|--get/.test(flagsText);
+    const writing = /[cruA]/.test(bareKey ? first.value : "") || /(^|\s)-[a-zA-Z]*[cruA]|--create|--append|--update|--concatenate/.test(flagsText);
+    if (extracting && !writing) return [];
+    void mode;
+    let i = 0;
+    if (bareKey) {
+      i = 1;
+      const next = args[1];
+      if (first.value.includes("f") && next && next.afterFlag === null) i = 2;
+    }
+    return args.slice(i);
+  }
+  if (kind === "zip") return first && first.afterFlag === "-" ? args : args.slice(1);
+  if (kind === "ar") return bareKey ? args.slice(2) : args.slice(1);
+  return args.slice(2);
+}
+function copyVerdictOf(hit) {
+  if (!hit) return null;
+  const ruleName = COPY_RULE_OF[hit.ruleName];
+  if (!ruleName) return null;
+  return {
+    ruleName,
+    verdict: "review",
+    reason: `Copying ${hit.path} moves a credential out of its jail (project-jail shield)`,
+    path: hit.path
+  };
+}
+function matchSensitivePath2(p) {
+  for (const sp of SENSITIVE_PATH_RULES) {
+    if (sp.match(p))
+      return { ruleName: sp.rule, verdict: sp.verdict ?? "block", reason: sp.reason, path: p };
+  }
+  return null;
+}
+function baseWord(w) {
+  return (w ?? "").split("/").pop()?.toLowerCase() ?? "";
+}
+function wrappedReadPaths(words, name) {
+  if (name === "find") {
+    const { k, starts } = findStartPoints(words, 0);
+    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
+  }
+  if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
+  const h = unwrapCommandHead(words);
+  return h > 0 && isReaderWord(words[h] ?? null) ? positionalAfter(words, h + 1) : null;
+}
+function literalShellPayload(words, name) {
+  const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
+  const head = (words[h] ?? "").split("/").pop()?.toLowerCase() ?? "";
+  if (head === "eval") {
+    const rest = words.slice(h + 1);
+    if (rest.length === 0 || rest.some((w) => w === null)) return null;
+    return rest.join(" ");
+  }
+  if (SHELL_INTERPRETERS.has(head)) {
+    const c = words.findIndex((w, i) => i > h && w !== null && isInlineCodeFlag(head, w));
+    if (c < 0) return null;
+    return words[c + 1] ?? null;
+  }
+  return null;
+}
+function jailedRedirectRead(stmt) {
+  const redirs = stmt.Redirs || [];
+  for (const r of redirs) {
+    if (!r || !REDIR_FILE_IN_OPS.has(r.Op)) continue;
+    const p = resolveWordLiteral(r.Word);
+    if (p === null || p === "") continue;
+    const hit = matchSensitivePath2(p);
+    if (hit) return hit;
+  }
+  return null;
+}
 function analyzeShellCommand(command) {
   const actions = [];
   const paths = [];
@@ -1771,8 +1957,8 @@ function splitOnPipe(cmd) {
   if (current.trim()) segments2.push(current.trim());
   return segments2.filter(Boolean);
 }
-function positionalTokens(segment) {
-  return segment.split(/\s+/).slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
+function positionalTokens(tokens) {
+  return tokens.slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
 }
 function analyzePipeChain(command) {
   const segments2 = splitOnPipe(command);
@@ -1795,8 +1981,10 @@ function analyzePipeChain(command) {
   for (const segment of segments2) {
     const tokens = segment.split(/\s+/).filter(Boolean);
     if (tokens.length === 0) continue;
-    const binary = tokens[0].toLowerCase();
-    const args = positionalTokens(segment);
+    const h = unwrapCommandHead(tokens);
+    const head = h < tokens.length ? h : 0;
+    const binary = tokens[head].toLowerCase();
+    const args = positionalTokens(tokens.slice(head));
     if (SOURCE_COMMANDS.has(binary)) {
       sourceFiles.push(...args);
       if (args.some(isSensitivePath)) hasSensitiveSource = true;
@@ -2274,6 +2462,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
+  let pendingAstReview;
   if (bashCommand !== null) {
     const pipeVerdict = pipeChainVerdict(
       bashCommand,
@@ -2285,7 +2474,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     if (fsVerdict) {
       const isShieldRule = fsVerdict.ruleName.startsWith("shield:");
       const labelPrefix = isShieldRule ? "project-jail (AST)" : "Node9 (AST)";
-      return {
+      const astVerdict = {
         decision: fsVerdict.verdict,
         blockedByLabel: `${labelPrefix}: ${fsVerdict.ruleName}`,
         reason: fsVerdict.reason,
@@ -2293,6 +2482,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleName: fsVerdict.ruleName,
         ruleDescription: fsVerdict.reason
       };
+      if (fsVerdict.verdict === "block") return astVerdict;
+      pendingAstReview = astVerdict;
     }
     const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
     const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
@@ -2335,7 +2526,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
       if (matchedRule.verdict === "allow")
-        return { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
+        return pendingAstReview ?? { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
       return {
         decision: matchedRule.verdict,
         blockedByLabel: `Smart Rule: ${matchedRule.name ?? matchedRule.tool}`,
@@ -2362,6 +2553,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
     const candidates2 = [];
+    if (pendingAstReview) candidates2.push(pendingAstReview);
     const evalVerdict = detectDangerousShellExec(shellCommand);
     if (evalVerdict === "block") {
       return {
@@ -2658,6 +2850,12 @@ function classifyRuleSeverity(name, verdict) {
     "read-ssh",
     "read-gcp",
     "read-cred",
+    // Stage 4 (2026-09-11): a copy of a credential file scores like a READ of it --
+    // read-ssh/aws/cred are critical, so copy-ssh/aws/cred are; read-env is high
+    // (below), so copy-env joins the high list, not this one (/code-review).
+    "copy-ssh",
+    "copy-aws",
+    "copy-cred",
     "delete-repo",
     "helm-uninstall",
     "drop-table",
@@ -2670,6 +2868,7 @@ function classifyRuleSeverity(name, verdict) {
   ];
   if (criticalPatterns.some((p) => n.includes(p))) return "critical";
   const highPatterns = [
+    "copy-env",
     "force-push",
     "force_push",
     "git-destructive",
@@ -2687,6 +2886,11 @@ function narrativeRuleLabel(name) {
   const map = {
     "read-aws": "AWS credentials read",
     "read-ssh": "SSH private key read",
+    // Stage 4 copy twins, so `scan --narrative` prints a label, not a raw slug.
+    "copy-ssh": "SSH private key copied out",
+    "copy-aws": "AWS credentials copied out",
+    "copy-env": ".env file copied out",
+    "copy-cred": "credential file copied out",
     "read-gcp": "GCP credentials read",
     "read-cred": "credential file read",
     "delete-repo": "GitHub repository deletion",
@@ -3276,7 +3480,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, SCP_VALUE_FLAGS, RSYNC_SKIP, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3901,13 +4105,32 @@ var init_dist = __esm({
       })
     );
     SENSITIVE_PATH_PATTERNS = [
-      /[/\\]\.ssh[/\\]/i,
-      /[/\\]\.aws[/\\]/i,
+      /[/\\]\.ssh([/\\]|$)/i,
+      /[/\\]\.aws([/\\]|$)/i,
       /[/\\]\.config[/\\]gcloud[/\\]/i,
       /[/\\]\.azure[/\\]/i,
       /[/\\]\.kube[/\\]config$/i,
-      /[/\\]\.env($|\.)/i,
-      // .env, .env.local, .env.production — not .envoy
+      // ⚠️ ONE SEMANTIC, FOUR COPIES. This is the AST tier's `.env` rule verbatim
+      // (shell/index.ts SENSITIVE_PATH_RULES), whose reasoning is documented there:
+      // structural suffix chain rather than a hand-written list, `example|sample|
+      // template` exempt because a fixture stays a fixture whatever follows, and
+      // `.test` anchored because `test` names an ENVIRONMENT -- `.env.test` is the
+      // committed template, `.env.test.local` is gitignored and holds real values.
+      //
+      // It was previously `[/\\]\.env($|\.)` with NO exemptions, so `Read .env.example`
+      // blocked while `cat .env.example` allowed: the same file, opposite verdicts,
+      // decided only by which tool asked. See src/__tests__/jail-both-doors.test.ts,
+      // which is the contract that now holds these copies in step, and stage 5 of
+      // doc/credential-jail-architecture.md, which replaces them with one generated
+      // source.
+      // ⚠️ The `.local` branch comes FIRST and takes no exemption. A fixture stays a
+      // fixture whatever follows it -- `.env.example.md` is documentation -- but
+      // `.env.example.local` is gitignored by the `.env*.local` convention and holds
+      // real values, exactly the reasoning that anchors `(?!\.test$)` rather than
+      // using `\b`. Without this branch the fixture exemption also bought a two-step
+      // bypass: `cp .env .env.sample`, then read the copy.
+      /[/\\]\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+      // .env + any suffix chain; fixtures exempt unless .local
       /[/\\]\.git-credentials$/i,
       /[/\\]\.npmrc$/i,
       /[/\\]\.docker[/\\]config\.json$/i,
@@ -3989,6 +4212,10 @@ var init_dist = __esm({
       "od",
       "xxd",
       "hexdump",
+      // Emits the file's bytes, re-encoded, so it is a read by the set's own test
+      // ("does it emit file contents"). Absent until 2026-09-10, which is why
+      // `base64 ~/.ssh/id_rsa` printed a private key with no verdict.
+      "base64",
       "strings",
       "sort",
       "uniq",
@@ -3996,8 +4223,56 @@ var init_dist = __esm({
       "nl",
       "dd"
     ]);
+    SCP_VALUE_FLAGS = ["i", "F", "o", "c", "S", "P", "J", "D", "W", "l"];
+    RSYNC_SKIP = [
+      "e",
+      "--rsh",
+      "--exclude",
+      "--exclude-from",
+      "--include",
+      "--include-from",
+      "--files-from",
+      "f",
+      "--filter"
+    ];
+    COPY_VERBS = {
+      cp: { source: "allButLast", targetDirFlag: true },
+      mv: { source: "allButLast", targetDirFlag: true },
+      install: { source: "allButLast", targetDirFlag: true },
+      ln: { source: "first", targetDirFlag: true },
+      scp: { source: "allButLast", skipFlags: SCP_VALUE_FLAGS },
+      rsync: { source: "allButLast", skipFlags: RSYNC_SKIP },
+      tar: {
+        source: "archive",
+        archive: "tar",
+        skipFlags: ["f", "X", "T", "--file", "--exclude", "--exclude-from", "--files-from"]
+      },
+      zip: { source: "archive", archive: "zip", skipFlags: ["x", "i", "--exclude", "--include"] },
+      ar: { source: "archive", archive: "ar" },
+      "7z": { source: "archive", archive: "7z", skipFlags: ["x", "--exclude"] },
+      gzip: { source: "all" },
+      bzip2: { source: "all" },
+      xz: { source: "all" },
+      "docker cp": { source: "allButLast" },
+      "kubectl cp": { source: "allButLast" },
+      "gsutil cp": { source: "allButLast" },
+      "gsutil rsync": { source: "allButLast" },
+      "rclone copy": { source: "allButLast" },
+      "rclone sync": { source: "allButLast" },
+      "aws s3 cp": { source: "allButLast" },
+      "aws s3 mv": { source: "allButLast" },
+      "aws s3 sync": { source: "allButLast" },
+      "gcloud storage cp": { source: "allButLast" },
+      "az storage blob upload": { source: "flagOperand", sourceFlags: ["f", "--file"] }
+    };
+    TAR_MODE_WORD = /^[a-zA-Z]+$/;
+    COPY_VERB_HEADS = new Set(Object.keys(COPY_VERBS).map((k) => k.split(" ")[0]));
     FS_OP_PRESCREEN_RE = new RegExp(
-      `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+      // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
+      // reader right after `"` / `'`, and without these two characters the
+      // prescreen rejected every string-wrapped read before the parser ran.
+      // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
+      `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
     );
     HOME_CACHE_ALLOWLIST = [
       ".cache",
@@ -4018,12 +4293,12 @@ var init_dist = __esm({
       {
         rule: "shield:project-jail:block-read-ssh",
         reason: "Reading SSH private keys is blocked by project-jail shield",
-        match: (p) => /(^|[\\/])\.ssh[\\/]/i.test(p)
+        match: (p) => /([\\/]\.ssh[\\/]|^\.ssh[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.ssh$)/i.test(p)
       },
       {
         rule: "shield:project-jail:block-read-aws",
         reason: "Reading AWS credentials is blocked by project-jail shield",
-        match: (p) => /(^|[\\/])\.aws[\\/]/i.test(p)
+        match: (p) => /([\\/]\.aws[\\/]|^\.aws[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.aws$)/i.test(p)
       },
       {
         // Mirrors the JSON shield's `.env` pattern (project-jail.json's
@@ -4067,7 +4342,9 @@ var init_dist = __esm({
         //     symmetry — silently exempts every `.env.test.*` file.
         //
         // shields.test.ts:983-995 is the canonical contract; keep both in step.
-        match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
+        match: (p) => /(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i.test(
+          p
+        )
       },
       {
         // verdict: 'review' (not 'block') is a deliberate design choice
@@ -4178,8 +4455,18 @@ var init_dist = __esm({
     _redirStdinOps = null;
     _listOps = null;
     WRAPPER_TAKES_TARGET = /* @__PURE__ */ new Set(["chroot"]);
+    FIND_EXEC_FLAGS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
     INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
-    NET_BINARIES = /* @__PURE__ */ new Set(["curl", "wget", "scp", "ssh", "nc", "ncat", "netcat"]);
+    NET_BINARIES = /* @__PURE__ */ new Set([
+      "curl",
+      "wget",
+      "scp",
+      "ssh",
+      "nc",
+      "ncat",
+      "netcat",
+      "rsync"
+    ]);
     VALUE_FLAGS = {
       curl: /* @__PURE__ */ new Set([
         "-d",
@@ -4268,10 +4555,22 @@ var init_dist = __esm({
     fsOpCache = /* @__PURE__ */ new Map();
     stripDotSlash = (p) => p.replace(/^\.\//, "");
     REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+    REDIR_FILE_IN_OPS = new Set(
+      [deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0)
+    );
     REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
       deriveRedirOp("cat <<X\nX"),
       deriveRedirOp("cat <<-X\nX")
     ]);
+    FIND_OPTIONS = /* @__PURE__ */ new Set(["-H", "-L", "-P"]);
+    COPY_RULE_OF = {
+      "shield:project-jail:block-read-ssh": "shield:project-jail:review-copy-ssh",
+      "shield:project-jail:block-read-aws": "shield:project-jail:review-copy-aws",
+      "shield:project-jail:block-read-env": "shield:project-jail:review-copy-env",
+      "shield:project-jail:review-read-credentials": "shield:project-jail:review-copy-credentials"
+    };
+    isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(baseWord(w));
+    positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
     DEFAULT_EGRESS_ALLOWLIST = [
       // node9's own control plane (api, app, dev-api, staging and the apex).
       // Without it, turning egress on asks the user to approve node9 itself.
@@ -4295,21 +4594,7 @@ var init_dist = __esm({
       "deb.debian.org",
       "*.ubuntu.com"
     ];
-    SOURCE_COMMANDS = /* @__PURE__ */ new Set([
-      "cat",
-      "head",
-      "tail",
-      "grep",
-      "awk",
-      "sed",
-      "cut",
-      "sort",
-      "tee",
-      "less",
-      "more",
-      "strings",
-      "xxd"
-    ]);
+    SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
     SINK_COMMANDS = /* @__PURE__ */ new Set([
       "curl",
       "wget",
@@ -4340,16 +4625,25 @@ var init_dist = __esm({
       "node"
     ]);
     SENSITIVE_PATTERNS = [
-      /(?:^|\/)\.env(?:\.|$)/i,
-      // .env, .env.local, .env.production
+      // Kept in step with the AST tier and dlp/ -- see jail-both-doors.test.ts.
+      /(?:^|\/)\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+      // .env chain; fixtures exempt unless .local
       /id_rsa|id_ed25519|id_ecdsa|id_dsa/i,
       // SSH private keys
       /\.pem$|\.key$|\.p12$|\.pfx$/i,
       // certificate files
-      /(?:^|\/)\.ssh\//i,
-      // ~/.ssh/ directory
-      /(?:^|\/)\.aws\/credentials/i,
-      // AWS credentials
+      // The `$` half mirrors shell/index.ts's SENSITIVE_PATH_RULES: a file INSIDE
+      // the directory counts wherever it appears, while the directory ITSELF counts
+      // only when the path is ROOTED (`~/.ssh`, `/home/u/.ssh`) -- an unrooted
+      // `config/.ssh` is more likely a search pattern than a read. These are
+      // extracted TOKENS (see `args.some(isSensitivePath)` below), the same input
+      // contract as the shell tier, so the same boundary is the right one.
+      // Without it `grep -r x ~/.ssh | curl -d @-` scored one tier BELOW the
+      // identical pipeline naming a file inside that directory.
+      /(?:^|\/)\.ssh\/|^(?:[~/]|[A-Za-z]:).*\/\.ssh$/i,
+      // ~/.ssh/ and ~/.ssh
+      /(?:^|\/)\.aws\/credentials|^(?:[~/]|[A-Za-z]:).*\/\.aws$/i,
+      // AWS creds + dir
       /(?:^|\/)\.netrc$/i,
       // netrc (stores HTTP credentials)
       /(?:^|\/)(passwd|shadow|sudoers)$/i,
@@ -5017,7 +5311,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
+              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
               flags: "i"
             }
           ],
@@ -5031,7 +5325,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
+              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
               flags: "i"
             }
           ],
@@ -5045,7 +5339,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
               flags: "i"
             }
           ],
@@ -5059,7 +5353,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
               flags: "i"
             }
           ],
@@ -5073,7 +5367,7 @@ var init_dist = __esm({
             {
               field: "file_path",
               op: "matches",
-              value: "(^|[\\/\\\\])\\.ssh[\\/\\\\]",
+              value: "([\\/\\\\]\\.ssh([\\/\\\\]|$)|^\\.ssh[\\/\\\\])",
               flags: "i"
             }
           ],
@@ -5087,7 +5381,7 @@ var init_dist = __esm({
             {
               field: "file_path",
               op: "matches",
-              value: "(^|[\\/\\\\])\\.aws[\\/\\\\]",
+              value: "([\\/\\\\]\\.aws([\\/\\\\]|$)|^\\.aws[\\/\\\\])",
               flags: "i"
             }
           ],
@@ -5101,7 +5395,7 @@ var init_dist = __esm({
             {
               field: "file_path",
               op: "matches",
-              value: "(^|[\\/\\\\])\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?$",
+              value: "(^|[\\/\\\\])\\.env(?![\\w-])(?:[\\w.-]*\\.local$|(?!\\.(example|sample|template)\\b)(?!\\.test$)[\\w.-]*$)",
               flags: "i"
             }
           ],
@@ -5244,7 +5538,7 @@ var init_dist = __esm({
     };
     LOOP_THRESHOLD_FOR_WASTE = 3;
     DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
-    SENSITIVE_PATH_RE = /\.aws\/(credentials|config)\b|\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b|\.env(\.|$|\b)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
+    SENSITIVE_PATH_RE = /[\\/]\.aws(?:[\\/]|$)|^\.aws[\\/]|[\\/]\.ssh(?:[\\/]|$)|^\.ssh[\\/]|(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
     FILE_TOOLS = /* @__PURE__ */ new Set([
       "read",
       "read_file",
@@ -5321,7 +5615,7 @@ var init_dist = __esm({
       { view: "separators-stripped", decoder: "separators", stripped: true }
     ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v14";
     DEDUPE_PREVIEW_LEN = 120;
     TERMINAL_ESCAPE_RE = // eslint-disable-next-line no-control-regex
     /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
@@ -8640,7 +8934,7 @@ function isNetworkTool(toolName, args) {
   if (t === "bash" || t === "shell" || t === "run_shell_command" || t === "terminal.execute") {
     const a = args;
     const cmd = typeof a?.command === "string" ? a.command : typeof a?.cmd === "string" ? a.cmd : "";
-    return /\b(curl|wget|scp|rsync|nc|ncat|netcat|ssh)\b/.test(cmd);
+    return NETWORK_COMMAND_RE.test(cmd);
   }
   return false;
 }
@@ -9515,7 +9809,7 @@ function canaryRecordById(id) {
     return null;
   }
 }
-var import_crypto7, WRITE_TOOLS;
+var import_crypto7, WRITE_TOOLS, NETWORK_COMMAND_RE;
 var init_orchestrator = __esm({
   "src/auth/orchestrator.ts"() {
     "use strict";
@@ -9546,6 +9840,7 @@ var init_orchestrator = __esm({
       "notebook_edit",
       "notebookedit"
     ]);
+    NETWORK_COMMAND_RE = new RegExp(`(?<![.\\w-])(${[...NET_BINARIES].join("|")})\\b`);
   }
 });
 
@@ -12609,9 +12904,10 @@ async function ensurePricingLoaded() {
   memCacheAt = Date.now();
   lookupCache.clear();
 }
-function pricingFor(model) {
+function pricingFor(model, options = {}) {
   const norm = normalizeModel(model);
-  const cached = lookupCache.get(norm);
+  const lookupKey = options.exact ? `exact:${norm}` : norm;
+  const cached = lookupCache.get(lookupKey);
   if (cached !== void 0) return cached;
   if (memCache === null && !diskChecked) {
     diskChecked = true;
@@ -12631,6 +12927,7 @@ function pricingFor(model) {
       resolved = exact;
       break;
     }
+    if (options.exact) continue;
     let best = null;
     for (const key of Object.keys(source)) {
       if (norm.startsWith(key.toLowerCase()) && (best === null || key.length > best.length)) {
@@ -12642,7 +12939,7 @@ function pricingFor(model) {
       break;
     }
   }
-  lookupCache.set(norm, resolved);
+  lookupCache.set(lookupKey, resolved);
   return resolved;
 }
 var import_fs18, import_path20, import_os17, LITELLM_URL, BUNDLED_PRICING, CACHE_FILE, TTL_MS, memCache, memCacheAt, diskChecked, lookupCache;
@@ -12679,6 +12976,18 @@ var init_litellm = __esm({
       "gpt-5": [125e-8, 1e-5, 0, 125e-9],
       "gpt-5-codex": [125e-8, 1e-5, 0, 125e-9],
       "gpt-5-mini": [25e-8, 2e-6, 0, 25e-9],
+      // Codex offline rates checked against official OpenAI model pages, 2026-09-11.
+      "gpt-5.1-codex": [125e-8, 1e-5, 0, 125e-9],
+      "gpt-5.1-codex-max": [125e-8, 1e-5, 0, 125e-9],
+      "gpt-5.1-codex-mini": [25e-8, 2e-6, 0, 25e-9],
+      "gpt-5.2-codex": [175e-8, 14e-6, 0, 175e-9],
+      "gpt-5.3-codex": [175e-8, 14e-6, 0, 175e-9],
+      "gpt-5.4": [25e-7, 15e-6, 0, 25e-8],
+      "gpt-5.4-mini": [75e-8, 45e-7, 0, 75e-9],
+      "gpt-5.5": [5e-6, 3e-5, 0, 5e-7],
+      "gpt-5.6-sol": [4e-6, 2e-5, 5e-6, 4e-7],
+      "gpt-5.6-terra": [2e-6, 12e-6, 25e-7, 2e-7],
+      "gpt-6-astra": [1e-5, 5e-5, 125e-7, 1e-6],
       o3: [2e-6, 8e-6, 0, 5e-7],
       "o4-mini": [11e-7, 44e-7, 0, 275e-9],
       // Google. Values copied from the live LiteLLM table (verified 2026-06-14)
@@ -12847,103 +13156,259 @@ var init_cost_gemini = __esm({
 
 // src/cost-codex.ts
 function codexSessionsDir() {
-  return import_path22.default.join(import_os19.default.homedir(), ".codex", "sessions");
+  return import_path22.default.join(process.env.CODEX_HOME?.trim() || import_path22.default.join(import_os19.default.homedir(), ".codex"), "sessions");
 }
 function codexPriceFor(model) {
-  return pricingFor(model) ?? CODEX_FALLBACK;
+  return pricingFor(codexModel(model), { exact: true }) ?? CODEX_FALLBACK;
 }
-function codexSessionCost(model, tokens) {
-  const nonCached = Math.max(0, tokens.input - tokens.cached);
-  const [pin, pout, , pcr] = codexPriceFor(model || "gpt-5");
-  return nonCached * pin + tokens.cached * pcr + tokens.output * pout;
+function codexModel(model) {
+  return normalizeModel(model.replace(/^openai\//i, "").replace(/-\d{4}-\d{2}-\d{2}$/, ""));
 }
-function listCodexSessionFiles(base) {
-  const out = [];
-  for (const y of safeReaddir2(base)) {
-    const yp = import_path22.default.join(base, y);
-    if (!isDir2(yp)) continue;
-    for (const m of safeReaddir2(yp)) {
-      const mp = import_path22.default.join(yp, m);
-      if (!isDir2(mp)) continue;
-      for (const d of safeReaddir2(mp)) {
-        const dp = import_path22.default.join(mp, d);
-        if (!isDir2(dp)) continue;
-        for (const f of safeReaddir2(dp)) {
-          if (f.endsWith(".jsonl")) out.push(import_path22.default.join(dp, f));
-        }
+function addTokens(previous, delta) {
+  return {
+    input: (previous?.input ?? 0) + delta.input,
+    cached: (previous?.cached ?? 0) + delta.cached,
+    output: (previous?.output ?? 0) + delta.output,
+    cacheWrite: (previous?.cacheWrite ?? 0) + delta.cacheWrite
+  };
+}
+function codexSessionCost(model, tokens, request2) {
+  const input = tokenNumber(tokens.input);
+  const cached = Math.min(input, tokenNumber(tokens.cached));
+  const written = Math.min(input - cached, tokenNumber(tokens.cacheWrite));
+  const [pin, pout, pcw, pcr] = codexPriceFor(model || "gpt-5");
+  const longContext = request2 && request2.inputTokens > 272e3 && ["gpt-5.4", "gpt-5.5", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-6-astra"].includes(
+    codexModel(model)
+  );
+  const inputMultiplier = longContext ? 2 : 1;
+  const outputMultiplier = longContext ? 1.5 : 1;
+  const tierMultiplier = request2?.serviceTier === "flex" ? 0.5 : codexModel(model) === "gpt-6-astra" && (request2?.serviceTier === "fast" || request2?.serviceTier === "priority") ? 2 : 1;
+  return (((input - cached - written) * pin + cached * pcr + written * (pcw || pin)) * inputMultiplier + tokenNumber(tokens.output) * pout * outputMultiplier) * tierMultiplier;
+}
+function statAndFirstLine(file) {
+  const CAP = 4 * 1024 * 1024;
+  const CHUNK = 64 * 1024;
+  const fd = import_fs20.default.openSync(file, "r");
+  try {
+    const stat = import_fs20.default.fstatSync(fd);
+    const limit = Math.min(stat.size, CAP);
+    const parts = [];
+    for (let pos = 0; pos < limit; pos += CHUNK) {
+      const buf = Buffer.alloc(Math.min(CHUNK, limit - pos));
+      const read2 = import_fs20.default.readSync(fd, buf, 0, buf.length, pos);
+      if (read2 <= 0) break;
+      const slice = buf.subarray(0, read2);
+      const nl = slice.indexOf(10);
+      parts.push(nl >= 0 ? slice.subarray(0, nl) : slice);
+      if (nl >= 0) break;
+    }
+    return { stat, first: Buffer.concat(parts).toString("utf8") };
+  } finally {
+    import_fs20.default.closeSync(fd);
+  }
+}
+function listCodexSessionFiles(base = codexSessionsDir()) {
+  const files = [];
+  const walk = (dir) => {
+    try {
+      for (const entry of import_fs20.default.readdirSync(dir, { withFileTypes: true })) {
+        const file = import_path22.default.join(dir, entry.name);
+        if (entry.isDirectory()) walk(file);
+        else if (entry.isFile() && entry.name.endsWith(".jsonl")) files.push(file);
+      }
+    } catch {
+    }
+  };
+  walk(base);
+  if (import_path22.default.basename(base) === "sessions") walk(import_path22.default.join(import_path22.default.dirname(base), "archived_sessions"));
+  const sessions = /* @__PURE__ */ new Map();
+  for (const file of files.sort()) {
+    try {
+      const { stat, first: head } = statAndFirstLine(file);
+      let id = "";
+      try {
+        const first = JSON.parse(head);
+        if (first?.type === "session_meta" && typeof first.payload?.id === "string")
+          id = first.payload.id;
+      } catch {
       }
+      const key = id ? `session:${id}` : `file:${file}`;
+      const prior = sessions.get(key);
+      if (!prior || stat.mtimeMs > prior.mtime || stat.mtimeMs === prior.mtime && stat.size > prior.size) {
+        sessions.set(key, { file, mtime: stat.mtimeMs, size: stat.size });
+      }
+    } catch {
     }
   }
-  return out;
+  return [...sessions.values()].map((s) => s.file);
 }
-function safeReaddir2(dir) {
-  try {
-    return import_fs20.default.readdirSync(dir);
-  } catch {
-    return [];
-  }
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function isDir2(p) {
-  try {
-    return import_fs20.default.statSync(p).isDirectory();
-  } catch {
-    return false;
+function tokenNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
+}
+function usage(value, fallback) {
+  const u = record(value);
+  if (!["input_tokens", "output_tokens"].some((k) => typeof u[k] === "number")) return null;
+  for (const key of [
+    "input_tokens",
+    "cached_input_tokens",
+    "cache_read_input_tokens",
+    "output_tokens",
+    "cache_write_input_tokens"
+  ]) {
+    if (u[key] !== void 0 && (typeof u[key] !== "number" || !Number.isFinite(u[key]) || u[key] < 0))
+      return null;
   }
+  return {
+    input: tokenNumber(u.input_tokens ?? fallback?.input),
+    cached: tokenNumber(u.cached_input_tokens ?? u.cache_read_input_tokens ?? fallback?.cached),
+    output: tokenNumber(u.output_tokens ?? fallback?.output),
+    cacheWrite: tokenNumber(u.cache_write_input_tokens ?? fallback?.cacheWrite)
+  };
 }
-function parseCodexSession(lines) {
-  let sessionStart = "";
-  let runId = "";
-  let cwd = "";
-  let model = "";
-  let input = 0;
-  let cached = 0;
-  let output = 0;
-  let sawUsage = false;
+function timestamp(value) {
+  return typeof value === "string" && Number.isFinite(Date.parse(value)) ? new Date(value).toISOString() : "";
+}
+function parseCodexUsage(lines) {
+  const result = {
+    events: [],
+    sessionStart: "",
+    runId: "",
+    workingDir: "",
+    legacyModels: []
+  };
+  let model = "gpt-5";
+  let serviceTier;
+  let previous = null;
+  const legacyModels = /* @__PURE__ */ new Set();
+  const seenStandalone = /* @__PURE__ */ new Set();
   for (const raw of lines) {
-    if (!raw.trim()) continue;
     let entry;
     try {
-      entry = JSON.parse(raw);
+      entry = record(JSON.parse(raw));
     } catch {
       continue;
     }
-    const p = entry.payload ?? {};
+    const p = record(entry.payload);
     if (entry.type === "session_meta") {
-      if (!sessionStart && typeof p["timestamp"] === "string") sessionStart = p["timestamp"];
-      if (!runId && typeof p["id"] === "string") runId = p["id"];
-      if (!cwd && typeof p["cwd"] === "string") cwd = p["cwd"];
+      result.sessionStart ||= timestamp(p.timestamp ?? entry.timestamp);
+      if (!result.runId && typeof p.id === "string") result.runId = p.id;
+      if (!result.workingDir && typeof p.cwd === "string") result.workingDir = p.cwd;
       continue;
     }
     if (entry.type === "turn_context") {
-      if (typeof p["model"] === "string") model = p["model"];
-      if (!cwd && typeof p["cwd"] === "string") cwd = p["cwd"];
+      if (typeof p.model === "string" && p.model) {
+        model = p.model;
+        legacyModels.add(normalizeModel(model));
+      }
+      if (!result.workingDir && typeof p.cwd === "string") result.workingDir = p.cwd;
+      serviceTier = typeof p.service_tier === "string" ? p.service_tier : void 0;
       continue;
     }
-    if (entry.type === "event_msg" && p["type"] === "token_count") {
-      const info = p["info"] ?? {};
-      const usage = info["total_token_usage"] ?? {};
-      if (typeof usage["input_tokens"] === "number") input = usage["input_tokens"];
-      if (typeof usage["cached_input_tokens"] === "number") cached = usage["cached_input_tokens"];
-      if (typeof usage["output_tokens"] === "number") output = usage["output_tokens"];
-      sawUsage = true;
+    if (entry.type !== "event_msg" || p.type !== "token_count") continue;
+    const info = record(p.info);
+    const total = usage(info.total_token_usage, previous);
+    const last = usage(info.last_token_usage);
+    if (!total && !last) continue;
+    const eventModel = [info.model, info.model_name, p.model].find(
+      (v) => typeof v === "string" && v
+    );
+    if (typeof eventModel === "string") model = eventModel;
+    let delta;
+    if (total) {
+      if (previous && Object.keys(total).every(
+        (k) => total[k] === previous[k]
+      ))
+        continue;
+      const reset = previous && (total.input < previous.input || total.output < previous.output);
+      delta = reset ? last ?? total : {
+        input: Math.max(0, total.input - (previous?.input ?? 0)),
+        cached: Math.max(0, total.cached - (previous?.cached ?? 0)),
+        output: Math.max(0, total.output - (previous?.output ?? 0)),
+        cacheWrite: Math.max(0, total.cacheWrite - (previous?.cacheWrite ?? 0))
+      };
+      previous = total;
+    } else {
+      delta = last;
+      const key = JSON.stringify([entry.timestamp, model, delta]);
+      if (entry.timestamp && seenStandalone.has(key)) continue;
+      if (entry.timestamp) seenStandalone.add(key);
+      previous = addTokens(previous, delta);
+    }
+    if (delta.input === 0 && delta.output === 0) continue;
+    const ts = timestamp(entry.timestamp) || result.sessionStart;
+    if (!ts) continue;
+    const cached = Math.min(delta.input, delta.cached);
+    const written = Math.min(delta.input - cached, delta.cacheWrite);
+    result.events.push({
+      timestamp: ts,
+      date: ts.slice(0, 10),
+      model: normalizeModel(model),
+      workingDir: result.workingDir,
+      runId: result.runId,
+      costUSD: codexSessionCost(model, delta, {
+        inputTokens: last?.input ?? delta.input,
+        serviceTier: typeof info.service_tier === "string" ? info.service_tier : serviceTier
+      }),
+      inputTokens: delta.input - cached - written,
+      outputTokens: delta.output,
+      cacheReadTokens: cached,
+      cacheWriteTokens: written
+    });
+  }
+  result.legacyModels = [...legacyModels.size ? legacyModels : ["gpt-5"]];
+  return result;
+}
+function codexUsageInWindow(usage2, start, end) {
+  return usage2.events.filter(
+    (e) => (!start || Date.parse(e.timestamp) >= start.getTime()) && (!end || Date.parse(e.timestamp) <= end.getTime())
+  );
+}
+function parseCodexSession(lines) {
+  const parsed = parseCodexUsage(lines);
+  if (!parsed.events.length) return [];
+  const rows = /* @__PURE__ */ new Map();
+  if (parsed.sessionStart) {
+    for (const model of parsed.legacyModels) {
+      rows.set(`${parsed.sessionStart.slice(0, 10)}::${model}`, {
+        date: parsed.sessionStart.slice(0, 10),
+        model,
+        workingDir: parsed.workingDir,
+        runId: parsed.runId,
+        costUSD: 0,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheWriteTokens: 0
+      });
+    }
+  }
+  for (const event of parsed.events) {
+    const e = {
+      date: event.date,
+      model: event.model,
+      workingDir: event.workingDir,
+      runId: event.runId,
+      costUSD: event.costUSD,
+      inputTokens: event.inputTokens,
+      outputTokens: event.outputTokens,
+      cacheReadTokens: event.cacheReadTokens,
+      cacheWriteTokens: event.cacheWriteTokens
+    };
+    const key = `${e.date}::${e.model}`;
+    const prev = rows.get(key);
+    if (!prev) rows.set(key, { ...e });
+    else {
+      prev.costUSD += e.costUSD;
+      prev.inputTokens += e.inputTokens;
+      prev.outputTokens += e.outputTokens;
+      prev.cacheReadTokens += e.cacheReadTokens;
+      prev.cacheWriteTokens += e.cacheWriteTokens;
     }
   }
-  if (!sessionStart || !sawUsage) return null;
-  const nonCached = Math.max(0, input - cached);
-  if (nonCached === 0 && output === 0 && cached === 0) return null;
-  const norm = normalizeModel(model || "gpt-5");
-  const costUSD = codexSessionCost(model, { input, cached, output });
-  return {
-    date: sessionStart.slice(0, 10),
-    model: norm,
-    workingDir: cwd,
-    runId,
-    costUSD,
-    inputTokens: nonCached,
-    outputTokens: output,
-    cacheReadTokens: cached,
-    cacheWriteTokens: 0
-  };
+  return [...rows.values()];
 }
 var import_fs20, import_os19, import_path22, CODEX_FALLBACK, codexSource;
 var init_cost_codex = __esm({
@@ -12956,43 +13421,17 @@ var init_cost_codex = __esm({
     CODEX_FALLBACK = [5e-6, 15e-6, 0, 25e-7];
     codexSource = {
       id: "codex",
-      available() {
-        try {
-          return import_fs20.default.existsSync(codexSessionsDir());
-        } catch {
-          return false;
-        }
-      },
+      available: () => import_fs20.default.existsSync(codexSessionsDir()) || import_fs20.default.existsSync(import_path22.default.join(import_path22.default.dirname(codexSessionsDir()), "archived_sessions")),
       collect(sinceMs) {
-        const base = codexSessionsDir();
-        const combined = /* @__PURE__ */ new Map();
-        for (const file of listCodexSessionFiles(base)) {
+        const entries = [];
+        for (const file of listCodexSessionFiles()) {
           try {
             if (sinceMs !== void 0 && import_fs20.default.statSync(file).mtimeMs < sinceMs) continue;
+            entries.push(...parseCodexSession(import_fs20.default.readFileSync(file, "utf8").split("\n")));
           } catch {
-            continue;
-          }
-          let content;
-          try {
-            content = import_fs20.default.readFileSync(file, "utf8");
-          } catch {
-            continue;
-          }
-          const e = parseCodexSession(content.split("\n"));
-          if (!e) continue;
-          const key = `${e.date}::${e.model}::${e.workingDir ?? ""}::${e.runId ?? ""}`;
-          const prev = combined.get(key);
-          if (prev) {
-            prev.costUSD += e.costUSD;
-            prev.inputTokens += e.inputTokens;
-            prev.outputTokens += e.outputTokens;
-            prev.cacheReadTokens += e.cacheReadTokens;
-            prev.cacheWriteTokens += e.cacheWriteTokens;
-          } else {
-            combined.set(key, { ...e });
           }
         }
-        return [...combined.values()];
+        return entries;
       }
     };
   }
@@ -13002,7 +13441,7 @@ var init_cost_codex = __esm({
 function copilotSessionsDir() {
   return import_path23.default.join(import_os20.default.homedir(), ".copilot", "session-state");
 }
-function safeReaddir3(dir) {
+function safeReaddir2(dir) {
   try {
     return import_fs21.default.readdirSync(dir);
   } catch {
@@ -13091,7 +13530,7 @@ var init_cost_copilot = __esm({
       collect(sinceMs) {
         const base = copilotSessionsDir();
         const combined = /* @__PURE__ */ new Map();
-        for (const sid of safeReaddir3(base)) {
+        for (const sid of safeReaddir2(base)) {
           const file = import_path23.default.join(base, sid, "events.jsonl");
           try {
             if (sinceMs !== void 0 && import_fs21.default.statSync(file).mtimeMs < sinceMs) continue;
@@ -13705,8 +14144,8 @@ function originForRule(ruleName, sections, enabled) {
   }
   return "";
 }
-function relativeDate(timestamp, now = /* @__PURE__ */ new Date()) {
-  const t = new Date(timestamp).getTime();
+function relativeDate(timestamp2, now = /* @__PURE__ */ new Date()) {
+  const t = new Date(timestamp2).getTime();
   if (Number.isNaN(t)) return "?";
   const days = Math.floor((now.getTime() - t) / 864e5);
   if (days < 1) return "today";
@@ -13817,7 +14256,7 @@ function readPreviousScan(opts = {}) {
     return null;
   }
 }
-function appendScanHistory(record, opts = {}) {
+function appendScanHistory(record2, opts = {}) {
   const filePath = opts.path ?? defaultHistoryPath();
   const cap = opts.cap ?? SCAN_HISTORY_CAP;
   try {
@@ -13832,7 +14271,7 @@ function appendScanHistory(record, opts = {}) {
       } catch {
       }
     }
-    history.push(record);
+    history.push(record2);
     if (history.length > cap) {
       history = history.slice(history.length - cap);
     }
@@ -13893,17 +14332,17 @@ function parseJSONLFile(filePath, fallbackWorkingDir) {
     if (row["type"] !== "assistant") continue;
     const msg = row["message"];
     if (!msg?.["usage"] || typeof msg["model"] !== "string") continue;
-    const usage = msg["usage"];
+    const usage2 = msg["usage"];
     const model = msg["model"];
-    const timestamp = row["timestamp"];
-    if (typeof timestamp !== "string" || timestamp.length < 10) continue;
-    const date = timestamp.slice(0, 10);
+    const timestamp2 = row["timestamp"];
+    if (typeof timestamp2 !== "string" || timestamp2.length < 10) continue;
+    const date = timestamp2.slice(0, 10);
     const p = pricingFor(model);
     if (!p) continue;
-    const inp = Number(usage["input_tokens"] ?? 0);
-    const out = Number(usage["output_tokens"] ?? 0);
-    const cw = Number(usage["cache_creation_input_tokens"] ?? 0);
-    const cr = Number(usage["cache_read_input_tokens"] ?? 0);
+    const inp = Number(usage2["input_tokens"] ?? 0);
+    const out = Number(usage2["output_tokens"] ?? 0);
+    const cw = Number(usage2["cache_creation_input_tokens"] ?? 0);
+    const cr = Number(usage2["cache_read_input_tokens"] ?? 0);
     const cost = inp * p[0] + out * p[1] + cw * p[2] + cr * p[3];
     const rowCwd = typeof row["cwd"] === "string" ? row["cwd"] : null;
     const workingDir = rowCwd && rowCwd.startsWith("/") ? rowCwd : fallbackWorkingDir;
@@ -14931,7 +15370,7 @@ function safeCanaryScanValues() {
     return [];
   }
 }
-function recordCanaries(scanned, toolName, timestamp, projLabel, sessionId, agent, result, dedup, values) {
+function recordCanaries(scanned, toolName, timestamp2, projLabel, sessionId, agent, result, dedup, values) {
   if (values.length === 0) return [];
   let pool = [...values];
   const matched = [];
@@ -14945,8 +15384,8 @@ function recordCanaries(scanned, toolName, timestamp, projLabel, sessionId, agen
     const existing = dedup.canaryIndex.get(key);
     if (existing) {
       existing.count++;
-      if (timestamp && (!existing.timestamp || timestamp < existing.timestamp)) {
-        existing.timestamp = timestamp;
+      if (timestamp2 && (!existing.timestamp || timestamp2 < existing.timestamp)) {
+        existing.timestamp = timestamp2;
       }
       continue;
     }
@@ -14959,7 +15398,7 @@ function recordCanaries(scanned, toolName, timestamp, projLabel, sessionId, agen
       view: hit.view,
       retired: hit.retired,
       toolName,
-      timestamp,
+      timestamp: timestamp2,
       project: projLabel,
       sessionId,
       agent,
@@ -14991,7 +15430,7 @@ function scrubDecoys(subject, values) {
   };
   return walk(subject, 0);
 }
-function pushFsOpAstFinding(command, toolName, input, timestamp, projLabel, sessionId, agent, result, dedup) {
+function pushFsOpAstFinding(command, toolName, input, timestamp2, projLabel, sessionId, agent, result, dedup) {
   const fsVerdict = analyzeFsOperation(command);
   if (!fsVerdict) return false;
   const synthRule = {
@@ -15021,7 +15460,7 @@ function pushFsOpAstFinding(command, toolName, input, timestamp, projLabel, sess
       source: synthSource,
       toolName,
       input,
-      timestamp,
+      timestamp: timestamp2,
       project: projLabel,
       sessionId,
       agent
@@ -15029,9 +15468,9 @@ function pushFsOpAstFinding(command, toolName, input, timestamp, projLabel, sess
   }
   return true;
 }
-function isStaleFinding(timestamp, now = Date.now()) {
-  if (!timestamp) return false;
-  const t = Date.parse(timestamp);
+function isStaleFinding(timestamp2, now = Date.now()) {
+  if (!timestamp2) return false;
+  const t = Date.parse(timestamp2);
   if (Number.isNaN(t)) return false;
   const ageDays = (now - t) / 864e5;
   return ageDays > STALE_AGE_DAYS;
@@ -15179,37 +15618,7 @@ function countScanFiles() {
     } catch {
     }
   }
-  const codexDir = import_path29.default.join(import_os26.default.homedir(), ".codex", "sessions");
-  if (import_fs27.default.existsSync(codexDir)) {
-    try {
-      for (const year of import_fs27.default.readdirSync(codexDir)) {
-        const yp = import_path29.default.join(codexDir, year);
-        try {
-          if (!import_fs27.default.statSync(yp).isDirectory()) continue;
-          for (const month of import_fs27.default.readdirSync(yp)) {
-            const mp = import_path29.default.join(yp, month);
-            try {
-              if (!import_fs27.default.statSync(mp).isDirectory()) continue;
-              for (const day of import_fs27.default.readdirSync(mp)) {
-                const dp = import_path29.default.join(mp, day);
-                try {
-                  if (!import_fs27.default.statSync(dp).isDirectory()) continue;
-                  total += listSessionFiles(dp).length;
-                } catch {
-                  continue;
-                }
-              }
-            } catch {
-              continue;
-            }
-          }
-        } catch {
-          continue;
-        }
-      }
-    } catch {
-    }
-  }
+  total += listCodexSessionFiles().length;
   return total;
 }
 function renderProgressBar(done, total, lines) {
@@ -15332,12 +15741,12 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
       }
       continue;
     }
-    const usage = entry.message?.usage;
+    const usage2 = entry.message?.usage;
     const model = entry.message?.model;
-    if (usage && model) {
+    if (usage2 && model) {
       const p = claudeModelPrice(model);
       if (p) {
-        const rowCost = (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+        const rowCost = (usage2.input_tokens ?? 0) * p.i + (usage2.output_tokens ?? 0) * p.o + (usage2.cache_creation_input_tokens ?? 0) * p.cw + (usage2.cache_read_input_tokens ?? 0) * p.cr;
         result.totalCostUSD += rowCost;
         session.costUSD += rowCost;
       }
@@ -15871,15 +16280,15 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
         } catch {
           continue;
         }
-        const timestamp = step.created_at ?? "";
-        if (startDate && timestamp && new Date(timestamp) < startDate) continue;
+        const timestamp2 = step.created_at ?? "";
+        if (startDate && timestamp2 && new Date(timestamp2) < startDate) continue;
         if (step.type === "USER_INPUT") {
           const text = typeof step.content === "string" ? step.content : "";
           if (text) {
             const decoysHere5 = recordCanaries(
               { text },
               "user-prompt",
-              timestamp,
+              timestamp2,
               projLabel,
               sessionId,
               "antigravity",
@@ -15896,7 +16305,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
                   patternName: dlpMatch.patternName,
                   redactedSample: dlpMatch.redactedSample,
                   toolName: "user-prompt",
-                  timestamp,
+                  timestamp: timestamp2,
                   project: projLabel,
                   sessionId,
                   agent: "antigravity"
@@ -15907,16 +16316,16 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
           continue;
         }
         if (!Array.isArray(step.tool_calls) || step.tool_calls.length === 0) continue;
-        if (timestamp) {
-          if (!result.firstDate || timestamp < result.firstDate) result.firstDate = timestamp;
-          if (!result.lastDate || timestamp > result.lastDate) result.lastDate = timestamp;
+        if (timestamp2) {
+          if (!result.firstDate || timestamp2 < result.firstDate) result.firstDate = timestamp2;
+          if (!result.lastDate || timestamp2 > result.lastDate) result.lastDate = timestamp2;
         }
         for (const tc of step.tool_calls) {
           result.totalToolCalls++;
           const toolName = tc.name ?? "";
           const toolNameLower = toolName.toLowerCase();
           const input = canonicalToolInput(toolName, tc.args ?? {});
-          sessionCalls.push({ toolName, input, timestamp });
+          sessionCalls.push({ toolName, input, timestamp: timestamp2 });
           const isShellTool = toolNameLower === "run_command";
           if (isShellTool) {
             result.bashCalls++;
@@ -15931,7 +16340,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
           const decoysHere6 = recordCanaries(
             input,
             toolName,
-            timestamp,
+            timestamp2,
             projLabel,
             sessionId,
             "antigravity",
@@ -15948,7 +16357,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
                 patternName: dlpMatch.patternName,
                 redactedSample: dlpMatch.redactedSample,
                 toolName,
-                timestamp,
+                timestamp: timestamp2,
                 project: projLabel,
                 sessionId,
                 agent: "antigravity"
@@ -15961,7 +16370,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
               String(input.command ?? ""),
               toolName,
               input,
-              timestamp,
+              timestamp2,
               projLabel,
               sessionId,
               "antigravity",
@@ -15985,7 +16394,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
                 source,
                 toolName,
                 input,
-                timestamp,
+                timestamp: timestamp2,
                 project: projLabel,
                 sessionId,
                 agent: "antigravity"
@@ -16017,7 +16426,7 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
                   },
                   toolName,
                   input,
-                  timestamp,
+                  timestamp: timestamp2,
                   project: projLabel,
                   sessionId,
                   agent: "antigravity"
@@ -16087,7 +16496,7 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
       } catch {
         continue;
       }
-      const timestamp = ev.timestamp ?? "";
+      const timestamp2 = ev.timestamp ?? "";
       if (ev.type === "session.start") {
         const cwd = ev.data?.context?.cwd;
         if (typeof cwd === "string" && cwd) {
@@ -16095,14 +16504,14 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
         }
         continue;
       }
-      if (startDate && timestamp && new Date(timestamp) < startDate) continue;
+      if (startDate && timestamp2 && new Date(timestamp2) < startDate) continue;
       if (ev.type === "user.message") {
         const text = ev.data?.content ?? ev.data?.text ?? "";
         if (typeof text === "string" && text) {
           const decoysHere7 = recordCanaries(
             { text },
             "user-prompt",
-            timestamp,
+            timestamp2,
             projLabel,
             sessionId,
             "copilot",
@@ -16119,7 +16528,7 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
                 patternName: dlpMatch2.patternName,
                 redactedSample: dlpMatch2.redactedSample,
                 toolName: "user-prompt",
-                timestamp,
+                timestamp: timestamp2,
                 project: projLabel,
                 sessionId,
                 agent: "copilot"
@@ -16134,19 +16543,19 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
       const toolNameLower = toolName.toLowerCase();
       const input = ev.data?.arguments ?? {};
       result.totalToolCalls++;
-      sessionCalls.push({ toolName, input, timestamp });
+      sessionCalls.push({ toolName, input, timestamp: timestamp2 });
       const isShellTool = isShellShapedTool(toolNameLower, toolInspectionMap);
       if (isShellTool) result.bashCalls++;
-      if (timestamp) {
-        if (!result.firstDate || timestamp < result.firstDate) result.firstDate = timestamp;
-        if (!result.lastDate || timestamp > result.lastDate) result.lastDate = timestamp;
+      if (timestamp2) {
+        if (!result.firstDate || timestamp2 < result.firstDate) result.firstDate = timestamp2;
+        if (!result.lastDate || timestamp2 > result.lastDate) result.lastDate = timestamp2;
       }
       const rawCmd = String(input.command ?? "").trimStart();
       if (/^node9\s+(scan|explain|report|tail|dlp|status|sessions|audit)\b/.test(rawCmd)) continue;
       const decoysHere8 = recordCanaries(
         input,
         toolName,
-        timestamp,
+        timestamp2,
         projLabel,
         sessionId,
         "copilot",
@@ -16163,7 +16572,7 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
             patternName: dlpMatch.patternName,
             redactedSample: dlpMatch.redactedSample,
             toolName,
-            timestamp,
+            timestamp: timestamp2,
             project: projLabel,
             sessionId,
             agent: "copilot"
@@ -16176,7 +16585,7 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
           String(input.command ?? ""),
           toolName,
           input,
-          timestamp,
+          timestamp2,
           projLabel,
           sessionId,
           "copilot",
@@ -16199,7 +16608,7 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
             source,
             toolName,
             input,
-            timestamp,
+            timestamp: timestamp2,
             project: projLabel,
             sessionId,
             agent: "copilot"
@@ -16231,7 +16640,7 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
               },
               toolName,
               input,
-              timestamp,
+              timestamp: timestamp2,
               project: projLabel,
               sessionId,
               agent: "copilot"
@@ -16246,7 +16655,6 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
 }
 function scanCodexHistory(startDate, onProgress, onLine) {
   const canaryVals = safeCanaryScanValues();
-  const sessionsBase = import_path29.default.join(import_os26.default.homedir(), ".codex", "sessions");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -16263,39 +16671,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     perSession: []
   };
   const dedup = emptyScanDedup();
-  if (!import_fs27.default.existsSync(sessionsBase)) return result;
-  const jsonlFiles = [];
-  try {
-    for (const year of import_fs27.default.readdirSync(sessionsBase)) {
-      const yearPath = import_path29.default.join(sessionsBase, year);
-      try {
-        if (!import_fs27.default.statSync(yearPath).isDirectory()) continue;
-      } catch {
-        continue;
-      }
-      for (const month of import_fs27.default.readdirSync(yearPath)) {
-        const monthPath = import_path29.default.join(yearPath, month);
-        try {
-          if (!import_fs27.default.statSync(monthPath).isDirectory()) continue;
-        } catch {
-          continue;
-        }
-        for (const day of import_fs27.default.readdirSync(monthPath)) {
-          const dayPath = import_path29.default.join(monthPath, day);
-          try {
-            if (!import_fs27.default.statSync(dayPath).isDirectory()) continue;
-          } catch {
-            continue;
-          }
-          for (const file of import_fs27.default.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(import_path29.default.join(dayPath, file));
-          }
-        }
-      }
-    }
-  } catch {
-    return result;
-  }
+  const jsonlFiles = listCodexSessionFiles();
   const ruleSources = buildRuleSources();
   for (const filePath of jsonlFiles) {
     result.filesScanned++;
@@ -16311,10 +16687,6 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     let projLabel = "";
     result.sessions++;
     const sessionCalls = [];
-    let lastTotalInput = 0;
-    let lastTotalCached = 0;
-    let lastTotalOutput = 0;
-    let model = "";
     for (const line of lines) {
       if (!line.trim()) continue;
       onLine?.();
@@ -16332,18 +16704,6 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         projLabel = stripTerminalEscapes(cwd.replace(import_os26.default.homedir(), "~")).slice(0, 40);
         continue;
       }
-      if (entry.type === "turn_context" && typeof payload["model"] === "string") {
-        model = payload["model"];
-        continue;
-      }
-      if (entry.type === "event_msg" && payload["type"] === "token_count") {
-        const info = payload["info"];
-        const usage = info?.["total_token_usage"] ?? {};
-        lastTotalInput = usage["input_tokens"] ?? lastTotalInput;
-        lastTotalCached = usage["cached_input_tokens"] ?? lastTotalCached;
-        lastTotalOutput = usage["output_tokens"] ?? lastTotalOutput;
-        continue;
-      }
       if (entry.type === "event_msg" && payload["type"] === "user_message") {
         const text = String(payload["message"] ?? "");
         if (text) {
@@ -16500,13 +16860,8 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         }
       }
     }
-    const withinWindow = !startDate || startTime !== "" && new Date(startTime) >= startDate;
-    if (withinWindow) {
-      result.totalCostUSD += codexSessionCost(model, {
-        input: lastTotalInput,
-        cached: lastTotalCached,
-        output: lastTotalOutput
-      });
+    for (const event of codexUsageInWindow(parseCodexUsage(lines), startDate)) {
+      result.totalCostUSD += event.costUSD;
     }
     result.loopFindings.push(...detectLoops(sessionCalls, projLabel, sessionId, "codex"));
   }
@@ -17943,13 +18298,13 @@ var init_taint_store = __esm({
        */
       check(filePath) {
         const resolved = this._resolve(filePath);
-        const record = this.records.get(resolved);
-        if (!record) return null;
-        if (Date.now() > record.expiresAt) {
+        const record2 = this.records.get(resolved);
+        if (!record2) return null;
+        if (Date.now() > record2.expiresAt) {
           this.records.delete(resolved);
           return null;
         }
-        return record;
+        return record2;
       }
       /**
        * Propagate taint from sourcePath to destPath (e.g. cp, mv).
@@ -17970,8 +18325,8 @@ var init_taint_store = __esm({
       /** Remove all expired records. Called periodically by the daemon. */
       prune() {
         const now = Date.now();
-        for (const [key, record] of this.records) {
-          if (now > record.expiresAt) this.records.delete(key);
+        for (const [key, record2] of this.records) {
+          if (now > record2.expiresAt) this.records.delete(key);
         }
       }
       /** Return all non-expired taint records (for audit/debug). */
@@ -18010,13 +18365,13 @@ var init_taint_store = __esm({
        *  Expired records are pruned on access. */
       check(sessionId) {
         if (!sessionId) return null;
-        const record = this.records.get(sessionId);
-        if (!record) return null;
-        if (Date.now() > record.expiresAt) {
+        const record2 = this.records.get(sessionId);
+        if (!record2) return null;
+        if (Date.now() > record2.expiresAt) {
           this.records.delete(sessionId);
           return null;
         }
-        return record;
+        return record2;
       }
       /** Clear a session's taint (e.g. the user resolved it). Returns true if a
        *  record was actually removed (false if the session wasn't tainted). */
@@ -18031,8 +18386,8 @@ var init_taint_store = __esm({
       /** Remove all expired records. Called periodically by the daemon. */
       prune() {
         const now = Date.now();
-        for (const [key, record] of this.records) {
-          if (now > record.expiresAt) this.records.delete(key);
+        for (const [key, record2] of this.records) {
+          if (now > record2.expiresAt) this.records.delete(key);
         }
       }
       /** Remove all records. Used by tests to reset state between runs. */
@@ -22765,10 +23120,10 @@ data: ${JSON.stringify(item.data)}
           return res.end(JSON.stringify({ error: "all paths must be strings" }));
         }
         for (const p of body.paths) {
-          const record = taintStore.check(p);
-          if (record) {
+          const record2 = taintStore.check(p);
+          if (record2) {
             res.writeHead(200, { "Content-Type": "application/json" });
-            return res.end(JSON.stringify({ tainted: true, record }));
+            return res.end(JSON.stringify({ tainted: true, record: record2 }));
           }
         }
         res.writeHead(200, { "Content-Type": "application/json" });
@@ -22817,9 +23172,9 @@ data: ${JSON.stringify(item.data)}
           res.writeHead(400, { "Content-Type": "application/json" });
           return res.end(JSON.stringify({ error: "sessionId must be a string" }));
         }
-        const record = sessionTaintStore.check(body.sessionId);
+        const record2 = sessionTaintStore.check(body.sessionId);
         res.writeHead(200, { "Content-Type": "application/json" });
-        return res.end(JSON.stringify(record ? { tainted: true, record } : { tainted: false }));
+        return res.end(JSON.stringify(record2 ? { tainted: true, record: record2 } : { tainted: false }));
       } catch {
         res.writeHead(400).end();
         return;
@@ -28773,8 +29128,8 @@ var require_util2 = __commonJS({
         request2.headersList.append("origin", serializedOrigin, true);
       }
     }
-    function coarsenTime(timestamp, crossOriginIsolatedCapability) {
-      return timestamp;
+    function coarsenTime(timestamp2, crossOriginIsolatedCapability) {
+      return timestamp2;
     }
     function clampAndCoarsenConnectionTimingInfo(connectionTimingInfo, defaultStartTime, crossOriginIsolatedCapability) {
       if (!connectionTimingInfo?.startTime || connectionTimingInfo.startTime < defaultStartTime) {
@@ -38855,20 +39210,20 @@ var require_dns = __commonJS({
         return ip;
       }
       setRecords(origin, addresses) {
-        const timestamp = Date.now();
+        const timestamp2 = Date.now();
         const records = { records: { 4: null, 6: null } };
         let minTTL = this.#maxTTL;
-        for (const record of addresses) {
-          record.timestamp = timestamp;
-          if (typeof record.ttl === "number") {
-            record.ttl = Math.min(record.ttl, this.#maxTTL);
-            minTTL = Math.min(minTTL, record.ttl);
+        for (const record2 of addresses) {
+          record2.timestamp = timestamp2;
+          if (typeof record2.ttl === "number") {
+            record2.ttl = Math.min(record2.ttl, this.#maxTTL);
+            minTTL = Math.min(minTTL, record2.ttl);
           } else {
-            record.ttl = this.#maxTTL;
+            record2.ttl = this.#maxTTL;
           }
-          const familyRecords = records.records[record.family] ?? { ips: [] };
-          familyRecords.ips.push(record);
-          records.records[record.family] = familyRecords;
+          const familyRecords = records.records[record2.family] ?? { ips: [] };
+          familyRecords.ips.push(record2);
+          records.records[record2.family] = familyRecords;
         }
         this.storage.set(origin.hostname, records, { ttl: minTTL });
       }
@@ -53532,15 +53887,15 @@ var import_fs55 = __toESM(require("fs"));
 var import_path53 = __toESM(require("path"));
 init_decision();
 var import_os49 = __toESM(require("os"));
-function formatRelativeTime(timestamp) {
-  const diff = Date.now() - new Date(timestamp).getTime();
+function formatRelativeTime(timestamp2) {
+  const diff = Date.now() - new Date(timestamp2).getTime();
   const sec = Math.floor(diff / 1e3);
   if (sec < 60) return `${sec}s ago`;
   const min = Math.floor(sec / 60);
   if (min < 60) return `${min}m ago`;
   const hrs = Math.floor(min / 60);
   if (hrs < 24) return `${hrs}h ago`;
-  return new Date(timestamp).toLocaleDateString();
+  return new Date(timestamp2).toLocaleDateString();
 }
 function registerAuditCommand(program2) {
   program2.command("audit").description("View local execution audit log").option("--tail <n>", "Number of entries to show", "20").option("--tool <pattern>", "Filter by tool name (substring match)").option("--deny", "Show only denied actions").option("--json", "Output raw JSON").action((options) => {
@@ -53786,15 +54141,15 @@ function processClaudeCostProject(proj, projectsDir, start, end, acc) {
         if (!entry.timestamp) continue;
         const ts = new Date(entry.timestamp);
         if (ts < start || ts > end) continue;
-        const usage = entry.message?.usage;
+        const usage2 = entry.message?.usage;
         const model = entry.message?.model;
-        if (!usage || !model) continue;
+        if (!usage2 || !model) continue;
         const p = claudeModelPrice2(model);
         if (!p) continue;
-        const inp = usage.input_tokens ?? 0;
-        const out = usage.output_tokens ?? 0;
-        const cw = usage.cache_creation_input_tokens ?? 0;
-        const cr = usage.cache_read_input_tokens ?? 0;
+        const inp = usage2.input_tokens ?? 0;
+        const out = usage2.output_tokens ?? 0;
+        const cw = usage2.cache_creation_input_tokens ?? 0;
+        const cr = usage2.cache_read_input_tokens ?? 0;
         const cost = inp * p.i + out * p.o + cw * p.cw + cr * p.cr;
         acc.total += cost;
         acc.inputTokens += inp;
@@ -53842,90 +54197,21 @@ function processCodexCostFile(filePath, start, end, acc) {
   } catch {
     return;
   }
-  let sessionStart = "";
-  let model = "";
-  let lastTotalInput = 0;
-  let lastTotalCached = 0;
-  let lastTotalOutput = 0;
-  let sessionToolCalls = 0;
+  const parsed = parseCodexUsage(lines);
+  for (const event of codexUsageInWindow(parsed, start, end)) {
+    acc.total += event.costUSD;
+    acc.byDay.set(event.date, (acc.byDay.get(event.date) ?? 0) + event.costUSD);
+    acc.byModel.set(event.model, (acc.byModel.get(event.model) ?? 0) + event.costUSD);
+  }
   for (const line of lines) {
-    if (!line.trim()) continue;
-    let entry;
     try {
-      entry = JSON.parse(line);
+      const entry = JSON.parse(line);
+      if (entry?.type !== "response_item" || entry.payload?.type !== "function_call") continue;
+      const ts = new Date(entry.timestamp ?? parsed.sessionStart);
+      if (ts >= start && ts <= end) acc.toolCalls++;
     } catch {
-      continue;
-    }
-    const p = entry.payload ?? {};
-    if (entry.type === "session_meta") {
-      sessionStart = String(p["timestamp"] ?? "");
-      continue;
-    }
-    if (entry.type === "turn_context" && typeof p["model"] === "string") {
-      model = p["model"];
-      continue;
-    }
-    if (entry.type === "event_msg" && p["type"] === "token_count") {
-      const info = p["info"] ?? {};
-      const usage = info["total_token_usage"] ?? {};
-      lastTotalInput = usage["input_tokens"] ?? lastTotalInput;
-      lastTotalCached = usage["cached_input_tokens"] ?? lastTotalCached;
-      lastTotalOutput = usage["output_tokens"] ?? lastTotalOutput;
-    }
-    if (entry.type === "response_item" && p["type"] === "function_call") {
-      sessionToolCalls++;
-    }
-  }
-  if (!sessionStart) return;
-  const ts = new Date(sessionStart);
-  if (ts < start || ts > end) return;
-  const cost = codexSessionCost(model, {
-    input: lastTotalInput,
-    cached: lastTotalCached,
-    output: lastTotalOutput
-  });
-  acc.total += cost;
-  acc.toolCalls += sessionToolCalls;
-  const dateKey = sessionStart.slice(0, 10);
-  acc.byDay.set(dateKey, (acc.byDay.get(dateKey) ?? 0) + cost);
-  const normModel = normalizeModel(model || "gpt-5");
-  acc.byModel.set(normModel, (acc.byModel.get(normModel) ?? 0) + cost);
-}
-function listCodexSessionFiles2(sessionsBase) {
-  const jsonlFiles = [];
-  if (!import_fs56.default.existsSync(sessionsBase)) return jsonlFiles;
-  try {
-    for (const year of import_fs56.default.readdirSync(sessionsBase)) {
-      const yearPath = import_path54.default.join(sessionsBase, year);
-      try {
-        if (!import_fs56.default.statSync(yearPath).isDirectory()) continue;
-      } catch {
-        continue;
-      }
-      for (const month of import_fs56.default.readdirSync(yearPath)) {
-        const monthPath = import_path54.default.join(yearPath, month);
-        try {
-          if (!import_fs56.default.statSync(monthPath).isDirectory()) continue;
-        } catch {
-          continue;
-        }
-        for (const day of import_fs56.default.readdirSync(monthPath)) {
-          const dayPath = import_path54.default.join(monthPath, day);
-          try {
-            if (!import_fs56.default.statSync(dayPath).isDirectory()) continue;
-          } catch {
-            continue;
-          }
-          for (const file of import_fs56.default.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(import_path54.default.join(dayPath, file));
-          }
-        }
-      }
     }
-  } catch {
-    return [];
   }
-  return jsonlFiles;
 }
 function mergeByModel(...maps) {
   const out = /* @__PURE__ */ new Map();
@@ -53941,7 +54227,7 @@ function loadCodexCost(start, end, sessionsBase) {
     byDay: /* @__PURE__ */ new Map(),
     byModel: /* @__PURE__ */ new Map()
   };
-  const files = listCodexSessionFiles2(sessionsBase);
+  const files = listCodexSessionFiles(sessionsBase);
   for (const filePath of files) {
     processCodexCostFile(filePath, start, end, acc);
   }
@@ -54081,7 +54367,7 @@ function aggregateReportFromAudit(period, opts = {}) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const auditLogPath = opts.auditLogPath ?? import_path54.default.join(import_os50.default.homedir(), ".node9", "audit.log");
   const claudeProjectsDir = opts.claudeProjectsDir ?? import_path54.default.join(import_os50.default.homedir(), ".claude", "projects");
-  const codexSessionsDir2 = opts.codexSessionsDir ?? import_path54.default.join(import_os50.default.homedir(), ".codex", "sessions");
+  const codexSessionsDir2 = opts.codexSessionsDir ?? codexSessionsDir();
   const geminiTmpDir2 = opts.geminiTmpDir ?? import_path54.default.join(import_os50.default.homedir(), ".gemini", "tmp");
   const hasAuditFile = import_fs56.default.existsSync(auditLogPath);
   const allEntries = opts.preloadedAuditEntries ?? parseAuditLog(auditLogPath);
@@ -59406,7 +59692,11 @@ var BUILTIN_JAIL = [
   "~/.ssh \u2014 SSH private keys",
   "~/.aws \u2014 AWS credentials",
   ".env files",
-  "credential files \u2014 credentials.json, .netrc, .npmrc, .docker, .kube, gcloud"
+  "credential files \u2014 credentials.json, .netrc, .npmrc, .docker, .kube, gcloud",
+  // Stage 4 (2026-09-11): reads are blocked; a COPY out of the jail (cp, tar,
+  // scp, rsync, aws s3 cp, ...) is reviewed, because a backup and a theft are
+  // the same command shape.
+  "copies out of the jail (cp, tar, scp, rsync, cloud upload) \u2014 review"
 ];
 function registerJailCommand(program2) {
   const jail = program2.command("jail").description("Grow the credential jail \u2014 block/review reads of your sensitive paths");
@@ -60280,12 +60570,12 @@ function parseSessionLines(lines) {
       continue;
     }
     if (entry.type !== "assistant") continue;
-    const usage = entry.message?.usage;
+    const usage2 = entry.message?.usage;
     const model = entry.message?.model;
-    if (usage && model) {
+    if (usage2 && model) {
       const p = modelPrice(model);
       if (p) {
-        costUSD += (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+        costUSD += (usage2.input_tokens ?? 0) * p.i + (usage2.output_tokens ?? 0) * p.o + (usage2.cache_creation_input_tokens ?? 0) * p.cw + (usage2.cache_read_input_tokens ?? 0) * p.cr;
       }
     }
     const content = entry.message?.content;
@@ -60465,46 +60755,13 @@ function buildGeminiSessions(days, allAuditEntries) {
   return summaries;
 }
 function buildCodexSessions(days, allAuditEntries) {
-  const sessionsBase = import_path65.default.join(import_os57.default.homedir(), ".codex", "sessions");
-  if (!import_fs70.default.existsSync(sessionsBase)) return [];
   const cutoff = days !== null ? (() => {
     const d = /* @__PURE__ */ new Date();
     d.setDate(d.getDate() - days);
     d.setHours(0, 0, 0, 0);
     return d;
   })() : null;
-  const jsonlFiles = [];
-  try {
-    for (const year of import_fs70.default.readdirSync(sessionsBase)) {
-      const yearPath = import_path65.default.join(sessionsBase, year);
-      try {
-        if (!import_fs70.default.statSync(yearPath).isDirectory()) continue;
-      } catch {
-        continue;
-      }
-      for (const month of import_fs70.default.readdirSync(yearPath)) {
-        const monthPath = import_path65.default.join(yearPath, month);
-        try {
-          if (!import_fs70.default.statSync(monthPath).isDirectory()) continue;
-        } catch {
-          continue;
-        }
-        for (const day of import_fs70.default.readdirSync(monthPath)) {
-          const dayPath = import_path65.default.join(monthPath, day);
-          try {
-            if (!import_fs70.default.statSync(dayPath).isDirectory()) continue;
-          } catch {
-            continue;
-          }
-          for (const file of import_fs70.default.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(import_path65.default.join(dayPath, file));
-          }
-        }
-      }
-    }
-  } catch {
-    return [];
-  }
+  const jsonlFiles = listCodexSessionFiles();
   const summaries = [];
   for (const filePath of jsonlFiles) {
     let lines;
@@ -60519,10 +60776,6 @@ function buildCodexSessions(days, allAuditEntries) {
     let firstPrompt = "";
     const toolCalls = [];
     let lastToolTs = "";
-    let lastTotalInput = 0;
-    let lastTotalCached = 0;
-    let lastTotalOutput = 0;
-    let model = "";
     for (const line of lines) {
       if (!line.trim()) continue;
       let entry;
@@ -60538,22 +60791,10 @@ function buildCodexSessions(days, allAuditEntries) {
         cwd = String(p["cwd"] ?? "");
         continue;
       }
-      if (entry.type === "turn_context" && typeof p["model"] === "string") {
-        model = p["model"];
-        continue;
-      }
       if (entry.type === "event_msg" && p["type"] === "user_message" && !firstPrompt) {
         firstPrompt = String(p["message"] ?? "");
         continue;
       }
-      if (entry.type === "event_msg" && p["type"] === "token_count") {
-        const info = p["info"] ?? {};
-        const usage = info["total_token_usage"] ?? {};
-        lastTotalInput = usage["input_tokens"] ?? lastTotalInput;
-        lastTotalCached = usage["cached_input_tokens"] ?? lastTotalCached;
-        lastTotalOutput = usage["output_tokens"] ?? lastTotalOutput;
-        continue;
-      }
       if (entry.type === "response_item" && p["type"] === "function_call") {
         const tool = String(p["name"] ?? "");
         let input = {};
@@ -60567,12 +60808,13 @@ function buildCodexSessions(days, allAuditEntries) {
       }
     }
     if (!sessionId || !startTime) continue;
-    if (cutoff && new Date(startTime) < cutoff) continue;
-    const costUSD = codexSessionCost(model, {
-      input: lastTotalInput,
-      cached: lastTotalCached,
-      output: lastTotalOutput
-    });
+    const parsedUsage = parseCodexUsage(lines);
+    const usageEvents = codexUsageInWindow(parsedUsage, cutoff);
+    if (cutoff && new Date(startTime) < cutoff && usageEvents.length === 0 && !toolCalls.some((call) => new Date(call.timestamp) >= cutoff))
+      continue;
+    const costUSD = usageEvents.reduce((sum, event) => sum + event.costUSD, 0);
+    const lastUsageTs = parsedUsage.events.at(-1)?.timestamp ?? "";
+    if (lastUsageTs > lastToolTs) lastToolTs = lastUsageTs;
     const windowEnd = new Date(
       Math.max(new Date(startTime).getTime(), lastToolTs ? new Date(lastToolTs).getTime() : 0) + 5 * 60 * 1e3
     ).toISOString();