@node9/proxy 2.14.0 → 2.14.2

package/dist/cli.mjs

@@ -905,6 +905,19 @@ function parseShared(command) {
   astCache.set(command, parsed);
   return parsed;
 }
+function byteOffsetToCharIndex(command) {
+  if (!/[^\u0000-\u007F]/.test(command)) return null;
+  const map = /* @__PURE__ */ new Map();
+  let byte = 0;
+  for (let i = 0; i < command.length; ) {
+    map.set(byte, i);
+    const cp = command.codePointAt(i);
+    byte += cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+    i += cp > 65535 ? 2 : 1;
+  }
+  map.set(byte, command.length);
+  return (b) => map.get(b) ?? -1;
+}
 function cachedNormalize(command, compute) {
   const hit = normalizeCache.get(command);
   if (hit !== void 0) {
@@ -934,6 +947,8 @@ function normalizeCommandForPolicyImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return { posix: command, separator: command };
   try {
+    const toCharIndex = byteOffsetToCharIndex(command);
+    const at = (byteOffset) => toCharIndex === null ? byteOffset : toCharIndex(byteOffset);
     const strips = [];
     const rewrites = [];
     const quoteOnlyRewrites = [];
@@ -954,8 +969,9 @@ function normalizeCommandForPolicyImpl(command) {
         const quotedNode = nextParts[0];
         const nt = syntax.NodeType(quotedNode);
         const markStrip = () => {
-          const s = next.Pos().Offset();
-          const e = next.End().Offset();
+          const s = at(next.Pos().Offset());
+          const e = at(next.End().Offset());
+          if (s < 0 || e < 0) return;
           strips.push([s, e]);
           msgSpans.add(`${s}:${e}`);
         };
@@ -972,8 +988,9 @@ function normalizeCommandForPolicyImpl(command) {
         }
       }
       for (const arg of args) {
-        const s = arg.Pos().Offset();
-        const e = arg.End().Offset();
+        const s = at(arg.Pos().Offset());
+        const e = at(arg.End().Offset());
+        if (s < 0 || e < 0) continue;
         if (msgSpans.has(`${s}:${e}`)) continue;
         const resolved = resolveWordLiteral(arg);
         if (resolved === null) continue;
@@ -1599,7 +1616,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
         return result?.verdict !== "block";
       }
       if (nodeType !== "CallExpr") return true;
-      const { name, flags, paths, words } = extractLiteralArgs(n);
+      const { name, flags, paths, words, args } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -1639,7 +1656,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
           return true;
         }
       }
-      const readPaths = FS_READ_TOOLS.has(name) ? paths : wrappedReadPaths(words, name);
+      const readPaths = FS_READ_TOOLS.has(name) ? [...readTargets(name, args, flags, words, 1), ...flagOperandFiles(name, words, 1)] : wrappedReadPaths(words, name);
       if (readPaths) {
         for (const p of readPaths) {
           result = stricter(result, matchSensitivePath2(p));
@@ -1675,9 +1692,22 @@ function flagIs(w, names) {
   const f = flagInfo(w);
   return names.some((n) => n.startsWith("--") ? f.long === n : f.letter === n);
 }
-function operandOf(a, names) {
+function operandOf(a, names, valueLetters) {
   if (!names || a.afterFlag === null) return false;
-  return flagIs(a.afterFlag, names) && flagInfo(a.afterFlag).attached === null;
+  const w = a.afterFlag;
+  if (!w.startsWith("--") && valueLetters) {
+    const letters = w.slice(1);
+    for (let i = 0; i < letters.length; i++) {
+      if (!valueLetters.includes(letters[i])) continue;
+      return i === letters.length - 1 && names.includes(letters[i]);
+    }
+    return false;
+  }
+  if (w.startsWith("--") && !w.includes("=")) {
+    const longs = names.filter((n) => n.startsWith("--"));
+    if (longs.some((n) => n === w || w.length >= 3 && n.startsWith(w))) return true;
+  }
+  return flagIs(w, names) && flagInfo(w).attached === null;
 }
 function resolveCopyShape(words, h) {
   const verb = baseWord(words[h]);
@@ -1701,7 +1731,7 @@ function findStartPoints(words, h) {
   const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
   if (k < 0) return { k, starts: [] };
   const firstPredicate = words.findIndex(
-    (w, i) => i > h && w !== null && w.startsWith("-") && !FIND_OPTIONS.has(w)
+    (w, i) => i > h && w !== null && w !== "--" && w.startsWith("-") && !FIND_OPTIONS.has(w)
   );
   const end = firstPredicate > h ? firstPredicate : k;
   return { k, starts: positionalAfter(words, h + 1, end) };
@@ -1721,14 +1751,35 @@ function copySourcePaths(words) {
   const { shape, last } = r;
   const args = positionedArgs(words, last + 1);
   const tail = words.slice(last + 1);
-  const skipped = (a) => operandOf(a, shape.skipFlags);
-  const targetDir = shape.targetDirFlag === true && tail.some((w) => w !== null && w.startsWith("-") && flagIs(w, ["t", "--target-directory"]));
-  const targetOperand = (a) => targetDir && operandOf(a, ["t", "--target-directory"]);
+  const copyOptionsEnd = tail.findIndex((w) => w === "--");
+  const copyPastOptions = (a) => copyOptionsEnd >= 0 && a.argv > last + 1 + copyOptionsEnd;
+  const skipped = (a) => !copyPastOptions(a) && operandOf(a, shape.skipFlags, shape.valueLetters);
+  const firstValueLetter = (w) => {
+    const letters = w.slice(1);
+    for (let i = 0; i < letters.length; i++) {
+      if ((shape.valueLetters ?? []).includes(letters[i]))
+        return { letter: letters[i], last: i === letters.length - 1 };
+    }
+    return null;
+  };
+  const isTargetDirFlag = (w) => {
+    if (w.startsWith("--")) {
+      const name = w.includes("=") ? w.slice(0, w.indexOf("=")) : w;
+      return name.length >= 3 && "--target-directory".startsWith(name);
+    }
+    return firstValueLetter(w)?.letter === "t";
+  };
+  const targetDir = shape.targetDirFlag === true && tail.some((w) => w !== null && w.startsWith("-") && isTargetDirFlag(w));
+  const targetTakesNextWord = (w) => {
+    if (w.startsWith("--"))
+      return !w.includes("=") && w.length >= 3 && "--target-directory".startsWith(w);
+    const f = firstValueLetter(w);
+    return f !== null && f.letter === "t" && f.last;
+  };
+  const targetOperand = (a) => targetDir && a.afterFlag !== null && !copyPastOptions(a) && targetTakesNextWord(a.afterFlag);
   const lastOperand = [...tail].reverse().find((w) => w === null || !w.startsWith("-"));
   const dynamicDest = lastOperand === null;
   const destIsLastOperand = (shape.source === "allButLast" || shape.source === "first") && !targetDir && !dynamicDest;
-  if (destIsLastOperand && typeof lastOperand === "string" && matchSensitivePath2(lastOperand))
-    return [];
   let src;
   switch (shape.source) {
     case "all":
@@ -1738,11 +1789,17 @@ function copySourcePaths(words) {
       src = targetDir ? args : args.slice(0, 1);
       break;
     case "flagOperand": {
-      const inline = tail.filter((w) => w !== null && w.startsWith("--")).map((w) => flagInfo(w)).filter((f) => f.attached !== null && (shape.sourceFlags ?? []).includes(f.long ?? "")).map((f) => f.attached);
+      const namesSource = (f) => {
+        const names = shape.sourceFlags ?? [];
+        if (f.long !== null)
+          return names.some(
+            (n) => n.startsWith("--") && (n === f.long || f.long.length >= 3 && n.startsWith(f.long))
+          );
+        return f.letter !== null && names.includes(f.letter);
+      };
+      const inline = tail.filter((w) => w !== null && w.startsWith("-")).map((w) => flagInfo(w)).filter((f) => f.attached !== null && namesSource(f)).map((f) => f.attached);
       return [
-        ...args.filter(
-          (a) => flagIs(a.afterFlag, shape.sourceFlags ?? []) && flagInfo(a.afterFlag).attached === null
-        ).map((a) => a.value),
+        ...args.filter((a) => !copyPastOptions(a) && operandOf(a, shape.sourceFlags, shape.valueLetters)).map((a) => a.value),
         ...inline
       ];
     }
@@ -1753,7 +1810,14 @@ function copySourcePaths(words) {
       src = targetDir || dynamicDest ? args : args.slice(0, -1);
       break;
   }
-  return src.filter((a) => !skipped(a) && !targetOperand(a)).map((a) => a.value);
+  const sources = src.filter((a) => !skipped(a) && !targetOperand(a)).map((a) => a.value);
+  if (destIsLastOperand && typeof lastOperand === "string" && matchSensitivePath2(lastOperand)) {
+    const jailedSources = sources.filter((p) => matchSensitivePath2(p));
+    const dirOf = (p) => /[\\/]/.test(p) ? p.replace(/[\\/][^\\/]*$/, "") : "";
+    if (jailedSources.length === 0) return [];
+    if (jailedSources.every((p) => dirOf(p) === dirOf(lastOperand))) return [];
+  }
+  return sources;
 }
 function archiveInputs(kind, args, tail) {
   const first = args[0];
@@ -1765,13 +1829,17 @@ function archiveInputs(kind, args, tail) {
     const writing = /[cruA]/.test(bareKey ? first.value : "") || /(^|\s)-[a-zA-Z]*[cruA]|--create|--append|--update|--concatenate/.test(flagsText);
     if (extracting && !writing) return [];
     void mode;
-    let i = 0;
-    if (bareKey) {
-      i = 1;
-      const next = args[1];
-      if (first.value.includes("f") && next && next.afterFlag === null) i = 2;
-    }
-    return args.slice(i);
+    if (!bareKey) return args;
+    let i = 1;
+    const fromDirs = [];
+    for (const ch of first.value) {
+      if (!TAR_VALUE_LETTERS.includes(ch)) continue;
+      const operand = args[i];
+      if (!operand || operand.afterFlag !== null) break;
+      i += 1;
+      if (ch === "C") fromDirs.push(operand);
+    }
+    return [...fromDirs, ...args.slice(i)];
   }
   if (kind === "zip") return first && first.afterFlag === "-" ? args : args.slice(1);
   if (kind === "ar") return bareKey ? args.slice(2) : args.slice(1);
@@ -1798,6 +1866,138 @@ function matchSensitivePath2(p) {
 function baseWord(w) {
   return (w ?? "").split("/").pop()?.toLowerCase() ?? "";
 }
+function namesFlag(name, candidates2, known) {
+  if (candidates2.has(name)) return true;
+  if (!name.startsWith("--") || name.length < 3) return false;
+  if (known?.has(name)) return false;
+  for (const c of candidates2) if (c.startsWith(name)) return true;
+  return false;
+}
+function knownLongFlags(verb) {
+  const out = /* @__PURE__ */ new Set();
+  const shape = PATTERN_VERBS[verb];
+  if (shape) {
+    for (const set of [shape.takesValue, shape.noValue, shape.patternFlags, shape.noPatternFlags])
+      for (const f of set) if (f.startsWith("--")) out.add(f);
+  }
+  for (const f of FILE_OPERAND_FLAGS[verb] ?? []) if (f.startsWith("--")) out.add(f);
+  return out;
+}
+function flagNamesOf(token, shape) {
+  if (token.startsWith("--")) {
+    const eq = token.indexOf("=");
+    return [eq > 0 ? token.slice(0, eq) : token];
+  }
+  const out = [];
+  for (const c of token.slice(1)) {
+    const name = `-${c}`;
+    out.push(name);
+    if (shape?.takesValue.has(name)) break;
+  }
+  return out;
+}
+function flagEffect(token, shape, known) {
+  if (token === "--") return NONE;
+  if (/^-+$/.test(token)) return UNKNOWN;
+  if (/^-\d+$/.test(token)) return NONE;
+  if (token.startsWith("--")) {
+    if (token.includes("=")) return NONE;
+    const takes = namesFlag(token, shape.takesValue, known);
+    const none = namesFlag(token, shape.noValue, known);
+    if (takes && none) return UNKNOWN;
+    if (takes) return { kind: "takes", flag: token };
+    if (none) return NONE;
+    return UNKNOWN;
+  }
+  const letters = token.slice(1);
+  if (!letters) return NONE;
+  for (let i = 0; i < letters.length; i++) {
+    const name = `-${letters[i]}`;
+    if (shape.takesValue.has(name)) {
+      return i === letters.length - 1 ? { kind: "takes", flag: name } : NONE;
+    }
+    if (!shape.noValue.has(name)) return UNKNOWN;
+  }
+  return NONE;
+}
+function readTargets(verb, args, flags, words = [], from = 1) {
+  const shape = PATTERN_VERBS[verb];
+  if (!shape) return args.map((a) => a.value);
+  const known = knownLongFlags(verb);
+  const names = flags.flatMap((f) => flagNamesOf(f, shape));
+  const patternElsewhere = names.some(
+    (n) => namesFlag(n, shape.patternFlags, known) || namesFlag(n, shape.noPatternFlags, known)
+  );
+  const excused = /* @__PURE__ */ new Set();
+  const fileFlags = FILE_OPERAND_FLAGS[verb];
+  const optionsEnd = words.findIndex((w, i) => i >= from && w === "--");
+  const pastOptions = (a) => optionsEnd >= 0 && a.argv > optionsEnd;
+  for (const a of args) {
+    if (a.afterFlag === null || pastOptions(a)) continue;
+    const e = flagEffect(a.afterFlag, shape, known);
+    if (e.kind !== "takes") continue;
+    if (fileFlags && namesFlag(e.flag, fileFlags, known)) continue;
+    excused.add(a);
+  }
+  const patternArgv = (() => {
+    for (let i = from; i < words.length; i++) {
+      const w = words[i];
+      if (w === null) return -1;
+      if (w === "--") return i + 1;
+      if (w.startsWith("-")) {
+        const e = flagEffect(w, shape, known);
+        if (e.kind === "takes") i += 1;
+        else if (e.kind === "unknown") return -1;
+        continue;
+      }
+      return i;
+    }
+    return -1;
+  })();
+  if (!patternElsewhere && patternArgv >= 0) {
+    const a = args.find((x) => x.argv === patternArgv);
+    if (a) excused.add(a);
+  }
+  return args.filter((a) => !excused.has(a)).map((a) => a.value);
+}
+function flagOperandFiles(verb, words, from) {
+  const flags = FILE_OPERAND_FLAGS[verb];
+  if (!flags) return [];
+  const known = knownLongFlags(verb);
+  const out = [];
+  for (let i = from; i < words.length; i++) {
+    const w = words[i];
+    if (w === null || !w.startsWith("-") || w === "--") continue;
+    if (w.startsWith("--")) {
+      const eq = w.indexOf("=");
+      if (eq <= 0) continue;
+      const name = w.slice(0, eq);
+      const value = w.slice(eq + 1);
+      if (!value) continue;
+      if (namesFlag(name, flags, known)) {
+        out.push(value);
+        continue;
+      }
+      const shape2 = PATTERN_VERBS[verb];
+      if (!shape2) continue;
+      const recognised = namesFlag(name, shape2.takesValue, known) || namesFlag(name, shape2.noValue, known) || namesFlag(name, shape2.patternFlags, known) || namesFlag(name, shape2.noPatternFlags, known);
+      if (!recognised) out.push(value);
+      continue;
+    }
+    const shape = PATTERN_VERBS[verb];
+    const letters = w.slice(1);
+    for (let j = 0; j < letters.length; j++) {
+      const name = `-${letters[j]}`;
+      const isFileFlag = flags.has(name);
+      const argTaking = isFileFlag || (shape?.takesValue.has(name) ?? false) || (READER_VALUE_LETTERS[verb] ?? []).includes(letters[j]);
+      if (!argTaking) continue;
+      const attached = letters.slice(j + 1);
+      if (isFileFlag && attached) out.push(attached);
+      break;
+    }
+  }
+  return out;
+}
 function wrappedReadPaths(words, name) {
   if (name === "find") {
     const { k, starts } = findStartPoints(words, 0);
@@ -1805,7 +2005,14 @@ function wrappedReadPaths(words, name) {
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
-  return h > 0 && isReaderWord(words[h] ?? null) ? positionalAfter(words, h + 1) : null;
+  if (h <= 0 || !isReaderWord(words[h] ?? null)) return null;
+  const head = baseWord(words[h]);
+  const rest = words.slice(h + 1);
+  const restFlags = rest.filter((w) => w !== null && w.startsWith("-"));
+  return [
+    ...readTargets(head, positionedArgs(words, h + 1), restFlags, words, h + 1),
+    ...flagOperandFiles(head, words, h + 1)
+  ];
 }
 function literalShellPayload(words, name) {
   const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
@@ -2738,6 +2945,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
 function isIgnoredTool(toolName, config) {
   return matchesPattern(toolName, config.policy.ignoredTools);
 }
+function stripTerminalEscapes(s) {
+  return s.replace(TERMINAL_ESCAPE_RE, "");
+}
+function stripControlChars(s) {
+  return s.replace(CONTROL_CHAR_RE, "");
+}
+function safeMessage(value, max = 300) {
+  const raw = typeof value === "string" ? value : value instanceof Error ? value.message : String(value ?? "");
+  const s = stripTerminalEscapes(raw).replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -2955,7 +3173,10 @@ function computeSecurityScore(opts) {
 }
 function truncateBlastPath(full) {
   if (!full) return "";
-  const cleaned = full.replace(/[/\\]+$/, "");
+  if (full.length > MAX_BLAST_PATH) full = full.slice(-MAX_BLAST_PATH);
+  let end = full.length;
+  while (end > 0 && (full[end - 1] === "/" || full[end - 1] === "\\")) end--;
+  const cleaned = full.slice(0, end);
   const parts = cleaned.split(/[/\\]+/).filter((p) => p.length > 0);
   if (parts.length <= 2) {
     return cleaned.startsWith("~") && !cleaned.startsWith("~/") ? cleaned : cleaned.startsWith("~/") ? cleaned : parts.join("/");
@@ -3451,7 +3672,7 @@ function toScanFinding(c) {
 }
 function previewArgs(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
-  const s = String(cmd).replace(TERMINAL_ESCAPE_RE, "").replace(/\s+/g, " ").trim();
+  const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
   return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
 }
 function makeFinding(args) {
@@ -3491,7 +3712,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, SCP_VALUE_FLAGS, RSYNC_SKIP, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, DESTINATION_ARGS, VERDICT_RANK, SQL_DML_KEYWORDS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4227,7 +4448,345 @@ var init_dist = __esm({
       "nl",
       "dd"
     ]);
+    GREP_SHAPE = {
+      takesValue: /* @__PURE__ */ new Set([
+        "-A",
+        "-B",
+        "-C",
+        "-D",
+        "-d",
+        "-e",
+        "-f",
+        "-m",
+        "--after-context",
+        "--before-context",
+        "--binary-files",
+        "--context",
+        "--devices",
+        "--directories",
+        "--exclude",
+        "--exclude-dir",
+        "--exclude-from",
+        "--file",
+        "--include",
+        "--label",
+        "--max-count",
+        "--regexp"
+      ]),
+      noValue: /* @__PURE__ */ new Set([
+        "-E",
+        "-F",
+        "-G",
+        "-P",
+        "-i",
+        "-y",
+        "-v",
+        "-V",
+        "-w",
+        "-x",
+        "-c",
+        "-l",
+        "-L",
+        "-o",
+        "-q",
+        "-s",
+        "-b",
+        "-H",
+        "-h",
+        "-n",
+        "-T",
+        "-Z",
+        "-z",
+        "-R",
+        "-r",
+        "-U",
+        "-u",
+        "-I",
+        "-a",
+        "--basic-regexp",
+        "--binary",
+        "--byte-offset",
+        "--color",
+        "--colour",
+        "--count",
+        "--dereference-recursive",
+        "--extended-regexp",
+        "--files-with-matches",
+        "--files-without-match",
+        "--fixed-strings",
+        "--help",
+        "--ignore-case",
+        "--initial-tab",
+        "--invert-match",
+        "--line-buffered",
+        "--line-number",
+        "--line-regexp",
+        "--no-filename",
+        "--no-group-separator",
+        "--no-ignore-case",
+        "--no-messages",
+        "--null",
+        "--null-data",
+        "--only-matching",
+        "--perl-regexp",
+        "--quiet",
+        "--recursive",
+        "--silent",
+        "--text",
+        "--version",
+        "--with-filename",
+        "--word-regexp"
+      ]),
+      patternFlags: /* @__PURE__ */ new Set(["-e", "--regexp"]),
+      noPatternFlags: /* @__PURE__ */ new Set(["-f", "--file"])
+    };
+    PATTERN_VERBS = {
+      grep: GREP_SHAPE,
+      // /usr/bin/egrep and /usr/bin/fgrep are 41-byte shell wrappers that exec
+      // `grep -E` and `grep -F`. Read in full, not assumed.
+      egrep: GREP_SHAPE,
+      fgrep: GREP_SHAPE,
+      // ripgrep 14.1.1, complete from its own --help. An earlier comment here said rg
+      // was not installed on the measuring machine; it is, and that stale claim is why
+      // this table shipped incomplete for two rounds, blocking ordinary searches like
+      // `rg --sort-files .env src` (/code-review round 4).
+      rg: {
+        takesValue: /* @__PURE__ */ new Set([
+          "-A",
+          "-B",
+          "-C",
+          "-d",
+          "-E",
+          "-e",
+          "-f",
+          "-g",
+          "-j",
+          "-M",
+          "-m",
+          "-r",
+          "-t",
+          "-T",
+          "--after-context",
+          "--before-context",
+          "--color",
+          "--colors",
+          "--context",
+          "--context-separator",
+          "--dfa-size-limit",
+          "--encoding",
+          "--engine",
+          "--field-context-separator",
+          "--field-match-separator",
+          "--file",
+          "--generate",
+          "--glob",
+          "--hostname-bin",
+          "--hyperlink-format",
+          "--iglob",
+          "--ignore-file",
+          "--max-columns",
+          "--max-count",
+          "--max-depth",
+          // An ALIAS of --max-depth, and it takes a value. The round-5 extraction read
+          // alias lines as plain switches and swept it into noValue, which hard-blocked
+          // `rg --maxdepth 2 .env src` while `--max-depth 2` ran (/code-review round 7).
+          "--maxdepth",
+          "--max-filesize",
+          "--path-separator",
+          "--pre",
+          "--pre-glob",
+          "--regexp",
+          "--regex-size-limit",
+          "--replace",
+          "--sort",
+          "--sortr",
+          "--threads",
+          "--type",
+          "--type-add",
+          "--type-clear",
+          "--type-not"
+        ]),
+        noValue: /* @__PURE__ */ new Set([
+          "-.",
+          "-0",
+          "-a",
+          "-b",
+          "-c",
+          "-F",
+          "-h",
+          "-H",
+          "-i",
+          "-I",
+          "-l",
+          "-L",
+          "-n",
+          "-N",
+          "-o",
+          "-p",
+          "-P",
+          "-q",
+          "-s",
+          "-S",
+          "-u",
+          "-U",
+          "-v",
+          "-V",
+          "-w",
+          "-x",
+          "-z",
+          "--auto-hybrid-regex",
+          "--binary",
+          "--block-buffered",
+          "--byte-offset",
+          "--case-sensitive",
+          "--column",
+          "--count",
+          "--count-matches",
+          "--crlf",
+          "--debug",
+          "--files",
+          "--files-with-matches",
+          "--files-without-match",
+          "--fixed-strings",
+          "--follow",
+          "--glob-case-insensitive",
+          "--heading",
+          "--help",
+          "--hidden",
+          "--ignore-case",
+          "--ignore-file-case-insensitive",
+          "--include-zero",
+          "--invert-match",
+          "--json",
+          "--line-buffered",
+          "--line-number",
+          "--line-regexp",
+          "--max-columns-preview",
+          "--mmap",
+          "--multiline",
+          "--multiline-dotall",
+          "--no-column",
+          "--no-config",
+          "--no-context-separator",
+          "--no-encoding",
+          "--no-filename",
+          "--no-ignore",
+          "--no-ignore-dot",
+          "--no-ignore-exclude",
+          "--no-ignore-files",
+          "--no-ignore-global",
+          "--no-ignore-messages",
+          "--no-ignore-parent",
+          "--no-ignore-vcs",
+          "--no-line-number",
+          "--no-messages",
+          "--no-pcre2-unicode",
+          "--no-pre",
+          "--no-require-git",
+          "--no-unicode",
+          "--null",
+          "--null-data",
+          "--one-file-system",
+          "--only-matching",
+          "--passthru",
+          "--pcre2",
+          "--pcre2-version",
+          "--pretty",
+          "--print0",
+          "--quiet",
+          "--search-zip",
+          "--smart-case",
+          "--sort-files",
+          "--stats",
+          "--stop-on-nonmatch",
+          "--text",
+          "--trace",
+          "--trim",
+          "--type-list",
+          "--unrestricted",
+          "--version",
+          "--vimgrep",
+          "--with-filename",
+          "--word-regexp",
+          // The COMPLETE remainder of `rg --help`, added after /code-review round 5
+          // found 40 documented switches in neither set. The table is now the whole
+          // option list: `rg --help` yields 149 long options, 35 of them value-taking.
+          "--ignore",
+          "--ignore-dot",
+          "--ignore-exclude",
+          "--ignore-files",
+          "--ignore-global",
+          "--ignore-messages",
+          "--ignore-parent",
+          "--ignore-vcs",
+          "--messages",
+          "--no-auto-hybrid-regex",
+          "--no-binary",
+          "--no-block-buffered",
+          "--no-byte-offset",
+          "--no-crlf",
+          "--no-fixed-strings",
+          "--no-follow",
+          "--no-glob-case-insensitive",
+          "--no-heading",
+          "--no-hidden",
+          "--no-ignore-file-case-insensitive",
+          "--no-include-zero",
+          "--no-invert-match",
+          "--no-json",
+          "--no-line-buffered",
+          "--no-max-columns-preview",
+          "--no-mmap",
+          "--no-multiline",
+          "--no-multiline-dotall",
+          "--no-one-file-system",
+          "--no-pcre2",
+          "--no-search-zip",
+          "--no-sort-files",
+          "--no-stats",
+          "--no-text",
+          "--no-trim",
+          "--passthrough",
+          "--pcre2-unicode",
+          "--require-git",
+          "--unicode"
+        ]),
+        patternFlags: /* @__PURE__ */ new Set(["-e", "--regexp"]),
+        // `--files` and `--type-list` list or enumerate without a pattern. Founder
+        // decision 2026-09-13: `rg --files ~/.ssh` stays BLOCKED, which this achieves
+        // by leaving the directory in the judged list.
+        noPatternFlags: /* @__PURE__ */ new Set(["-f", "--file", "--files", "--type-list", "--pcre2-version"])
+      }
+    };
+    PATTERN_VERB_NAMES = Object.keys(PATTERN_VERBS);
+    GREP_FILE_OPERANDS = /* @__PURE__ */ new Set(["-f", "--file", "--exclude-from", "--include"]);
+    READER_VALUE_LETTERS = {
+      awk: ["F", "v", "f"],
+      gawk: ["F", "v", "f", "e", "E", "i", "l", "o", "p", "D"],
+      sed: ["e", "f", "i", "l"],
+      sort: ["C", "k", "o", "S", "t", "T"]
+    };
+    FILE_OPERAND_FLAGS = {
+      grep: GREP_FILE_OPERANDS,
+      egrep: GREP_FILE_OPERANDS,
+      fgrep: GREP_FILE_OPERANDS,
+      // rg and gawk are NOT installed on the measuring machine: these two rows are
+      // from the shipped documentation (ripgrep `-f/--file`, `--ignore-file`; gawk
+      // `-f/--file`) and are marked as such in the spec.
+      // `-g/--glob/--iglob` name which files ripgrep SEARCHES, so an operand naming
+      // a credential makes rg open it -- the same reason grep's `--include` is here.
+      // Measured (/code-review round 3): `rg --hidden -g .env AWS tree` opened .env
+      // and printed its contents.
+      rg: /* @__PURE__ */ new Set(["-f", "--file", "--ignore-file", "-g", "--glob", "--iglob"]),
+      sed: /* @__PURE__ */ new Set(["-f", "--file"]),
+      awk: /* @__PURE__ */ new Set(["-f", "--file"]),
+      gawk: /* @__PURE__ */ new Set(["-f", "--file"]),
+      sort: /* @__PURE__ */ new Set(["--files0-from"])
+    };
     SCP_VALUE_FLAGS = ["i", "F", "o", "c", "S", "P", "J", "D", "W", "l"];
+    TAR_VALUE_LETTERS = ["b", "C", "f", "F", "g", "H", "I", "K", "L", "N", "T", "V", "X"];
+    ZIP_VALUE_LETTERS = ["b", "n", "P", "t", "s", "O", "x", "i"];
+    RSYNC_VALUE_LETTERS = ["e", "f", "T", "B", "M"];
     RSYNC_SKIP = [
       "e",
       "--rsh",
@@ -4239,21 +4798,35 @@ var init_dist = __esm({
       "f",
       "--filter"
     ];
+    CP_VALUE_LETTERS = ["S", "t"];
+    INSTALL_VALUE_LETTERS = ["S", "t", "g", "m", "o"];
     COPY_VERBS = {
-      cp: { source: "allButLast", targetDirFlag: true },
-      mv: { source: "allButLast", targetDirFlag: true },
-      install: { source: "allButLast", targetDirFlag: true },
-      ln: { source: "first", targetDirFlag: true },
-      scp: { source: "allButLast", skipFlags: SCP_VALUE_FLAGS },
-      rsync: { source: "allButLast", skipFlags: RSYNC_SKIP },
+      cp: { source: "allButLast", targetDirFlag: true, valueLetters: CP_VALUE_LETTERS },
+      mv: { source: "allButLast", targetDirFlag: true, valueLetters: CP_VALUE_LETTERS },
+      install: { source: "allButLast", targetDirFlag: true, valueLetters: INSTALL_VALUE_LETTERS },
+      ln: { source: "first", targetDirFlag: true, valueLetters: CP_VALUE_LETTERS },
+      scp: { source: "allButLast", skipFlags: SCP_VALUE_FLAGS, valueLetters: SCP_VALUE_FLAGS },
+      rsync: { source: "allButLast", skipFlags: RSYNC_SKIP, valueLetters: RSYNC_VALUE_LETTERS },
       tar: {
         source: "archive",
         archive: "tar",
-        skipFlags: ["f", "X", "T", "--file", "--exclude", "--exclude-from", "--files-from"]
+        skipFlags: ["f", "X", "T", "--file", "--exclude", "--exclude-from", "--files-from"],
+        valueLetters: TAR_VALUE_LETTERS
+      },
+      zip: {
+        source: "archive",
+        archive: "zip",
+        skipFlags: ["x", "i", "--exclude", "--include"],
+        valueLetters: ZIP_VALUE_LETTERS
       },
-      zip: { source: "archive", archive: "zip", skipFlags: ["x", "i", "--exclude", "--include"] },
       ar: { source: "archive", archive: "ar" },
-      "7z": { source: "archive", archive: "7z", skipFlags: ["x", "--exclude"] },
+      // 7z switches are INLINE only (`-mx9`, `-px`, `-x!pat`), so no following word is
+      // ever a switch's operand -- which is why the short `x` is NOT a skipFlag here
+      // and valueLetters is empty. Keeping the short `x` made `7z a out.7z -mx KEY`
+      // drop the credential as an exclusion operand (/code-review round 8), and the
+      // derived "every skipped letter is a value letter" row in jail-copy.spec.ts is
+      // what keeps the two tables honest about it.
+      "7z": { source: "archive", archive: "7z", skipFlags: ["--exclude"], valueLetters: [] },
       gzip: { source: "all" },
       bzip2: { source: "all" },
       xz: { source: "all" },
@@ -4575,6 +5148,8 @@ var init_dist = __esm({
     };
     isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(baseWord(w));
     positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
+    NONE = { kind: "none" };
+    UNKNOWN = { kind: "unknown" };
     DEFAULT_EGRESS_ALLOWLIST = [
       // node9's own control plane (api, app, dev-api, staging and the apex).
       // Without it, turning egress on asks the user to approve node9 itself.
@@ -4764,6 +5339,8 @@ var init_dist = __esm({
       block: 2
     };
     SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
+    TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+    CONTROL_CHAR_RE = /[\x00-\x1F\x7F]/g;
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -5541,6 +6118,7 @@ var init_dist = __esm({
       longOutputRedactions: 1
     };
     LOOP_THRESHOLD_FOR_WASTE = 3;
+    MAX_BLAST_PATH = 4096;
     DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
     SENSITIVE_PATH_RE = /[\\/]\.aws(?:[\\/]|$)|^\.aws[\\/]|[\\/]\.ssh(?:[\\/]|$)|^\.ssh[\\/]|(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
     FILE_TOOLS = /* @__PURE__ */ new Set([
@@ -5619,10 +6197,8 @@ var init_dist = __esm({
       { view: "separators-stripped", decoder: "separators", stripped: true }
     ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v14";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v15";
     DEDUPE_PREVIEW_LEN = 120;
-    TERMINAL_ESCAPE_RE = // eslint-disable-next-line no-control-regex
-    /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     ENGINE_VERSION = "1.4.0";
   }
 });
@@ -8170,6 +8746,14 @@ var init_context_sniper = __esm({
   }
 });
 
+// src/utils/safe-text.ts
+var init_safe_text = __esm({
+  "src/utils/safe-text.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
 // src/ui/native.ts
 import { spawn } from "child_process";
 import path11 from "path";
@@ -8281,7 +8865,7 @@ function escapePango(text) {
 function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
-  const safeAgent = (agent ?? "AI Agent").replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80);
+  const safeAgent = safeMessage(agent ?? "AI Agent", 80);
   lines.push(`\u{1F916} ${safeAgent}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   if (ruleDescription) lines.push(`\u2139  ${ruleDescription}`);
@@ -8416,6 +9000,7 @@ var init_native = __esm({
   "src/ui/native.ts"() {
     "use strict";
     init_context_sniper();
+    init_safe_text();
     isTestEnv = () => {
       return process.env.NODE_ENV === "test" || process.env.VITEST === "true" || !!process.env.VITEST || process.env.CI === "true" || !!process.env.CI || process.env.NODE9_TESTING === "1";
     };
@@ -8805,14 +9390,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     if (!res.ok) {
       fs12.appendFileSync(
         HOOK_DEBUG_LOG,
-        `[resolve-cloud] PATCH ${resolveUrl} \u2192 HTTP ${res.status}
+        `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err2) {
     fs12.appendFileSync(
       HOOK_DEBUG_LOG,
-      `[resolve-cloud] PATCH failed for ${requestId}: ${err2.message}
+      `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err2)}
 `
     );
   }
@@ -8822,6 +9407,7 @@ var init_cloud = __esm({
   "src/auth/cloud.ts"() {
     "use strict";
     init_audit();
+    init_safe_text();
     DLP_SAMPLE_MAX_LEN = 200;
     DLP_PATTERN_MAX_LEN = 100;
     KNOWN_CHECKED_BY = /* @__PURE__ */ new Set([
@@ -8954,9 +9540,8 @@ async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = randomUUID2();
     const actTs = Date.now();
-    const stripAnsi2 = (s) => s.replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "");
-    const sanitizedAgent = meta?.agent ? stripAnsi2(meta.agent).slice(0, 80) : void 0;
-    const sanitizedMcpServer = meta?.mcpServer ? stripAnsi2(meta.mcpServer).slice(0, 40) : void 0;
+    const sanitizedAgent = meta?.agent ? safeMessage(meta.agent, 80) : void 0;
+    const sanitizedMcpServer = meta?.mcpServer ? safeMessage(meta.mcpServer, 40) : void 0;
     const socketOk = await notifyActivity({
       id: actId,
       ts: actTs,
@@ -9831,6 +10416,7 @@ var init_orchestrator = __esm({
     init_loop_detector();
     init_shields();
     init_jail();
+    init_safe_text();
     WRITE_TOOLS = /* @__PURE__ */ new Set([
       "write",
       "write_file",
@@ -14436,7 +15022,7 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         }
       }
     } catch (err2) {
-      fs26.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${err2.message}
+      fs26.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${safeMessage(err2)}
 `);
     }
   }
@@ -14475,6 +15061,7 @@ var init_costSync = __esm({
     init_cost_gemini();
     init_cost_copilot();
     init_session_files();
+    init_safe_text();
     SYNC_INTERVAL_MS = 10 * 60 * 1e3;
     claudeSource = {
       id: "claude",
@@ -15310,9 +15897,6 @@ function fmtTs(ts) {
     return ts.slice(0, 10);
   }
 }
-function stripTerminalEscapes(s) {
-  return s.replace(TERMINAL_ESCAPE_RE2, "");
-}
 function preview(input, max) {
   const cmd = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
   const s = stripTerminalEscapes(String(cmd)).replace(/\s+/g, " ").trim();
@@ -18027,7 +18611,7 @@ function registerScanCommand(program2) {
     }
   );
 }
-var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, TERMINAL_ESCAPE_RE2, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS, STUCK_TOOLS_MIN_WASTE, STUCK_TOOLS_LIMIT, RECURRING_SESSION_THRESHOLD, STALE_AGE_DAYS, classifyRuleSeverity2, narrativeRuleLabel2;
+var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS, STUCK_TOOLS_MIN_WASTE, STUCK_TOOLS_LIMIT, RECURRING_SESSION_THRESHOLD, STALE_AGE_DAYS, classifyRuleSeverity2, narrativeRuleLabel2;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
@@ -18053,6 +18637,7 @@ var init_scan = __esm({
     init_scan_json();
     init_session_files();
     init_scan_history();
+    init_safe_text();
     toolInspectionMap = DEFAULT_CONFIG.policy.toolInspection;
     CODE_EXTENSIONS = /* @__PURE__ */ new Set([
       ".ts",
@@ -18087,7 +18672,6 @@ var init_scan = __esm({
       /\bseverity:\s*['"](?:block|review|allow)['"]/,
       /NODE9 SECURITY ALERT/
     ];
-    TERMINAL_ESCAPE_RE2 = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     LOOP_TOOLS = /* @__PURE__ */ new Set([
       "bash",
       "execute_bash",
@@ -18578,7 +19162,7 @@ function atomicWriteSync2(filePath, data, options) {
 function redactArgs(value) {
   if (!value || typeof value !== "object") return value;
   if (Array.isArray(value)) return value.map(redactArgs);
-  const result = {};
+  const result = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(value)) {
     result[k] = SECRET_KEY_RE.test(k) ? "[REDACTED]" : redactArgs(v);
   }
@@ -22930,7 +23514,7 @@ data: ${JSON.stringify(item.data)}
     if (req.method === "GET" && pathname === "/state/check") {
       const predicatesParam = reqUrl.searchParams.get("predicates") ?? "";
       const predicates = predicatesParam.split(",").filter(Boolean);
-      const results = {};
+      const results = /* @__PURE__ */ Object.create(null);
       for (const p of predicates) {
         results[p] = sessionHistory.checkPredicate(p);
       }
@@ -50665,7 +51249,7 @@ async function startTail(options = {}) {
   req.on("error", (err2) => {
     const msg = err2.code === "ECONNREFUSED" ? "Daemon is not running. Start it with: node9 daemon start" : err2.message;
     console.error(chalk44.red(`
-\u274C ${msg}`));
+\u274C ${safeMessage(msg)}`));
     process.exit(1);
   });
 }
@@ -50676,6 +51260,7 @@ var init_tail = __esm({
     init_startup_log();
     init_daemon2();
     init_daemon();
+    init_safe_text();
     PID_FILE = path74.join(os66.homedir(), ".node9", "daemon.pid");
     ICONS = {
       bash: "\u{1F4BB}",
@@ -51322,9 +51907,7 @@ function shellInvocation(command) {
 }
 
 // src/proxy/index.ts
-function sanitize(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 async function runProxy(targetCommand) {
   const commandParts = parseCommandString(targetCommand);
   const cmd = commandParts[0];
@@ -51360,7 +51943,7 @@ async function runProxy(targetCommand) {
       try {
         const name = message.params?.name || message.params?.tool_name || "unknown";
         const toolArgs = message.params?.arguments || message.params?.tool_input || {};
-        const result = await authorizeHeadless(sanitize(name), toolArgs, {
+        const result = await authorizeHeadless(stripControlChars(name), toolArgs, {
           agent: "Proxy/MCP"
         });
         if (!result.approved) {
@@ -51608,17 +52191,27 @@ init_machine_id();
 
 // src/utils/open-browser.ts
 import { spawn as spawn4 } from "child_process";
+function isOpenableUrl(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:") return false;
+  return !/[\x00-\x20\x7F"'`]/.test(url);
+}
 function openBrowser(url) {
+  if (!isOpenableUrl(url)) return false;
   if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return false;
   if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
     return false;
   }
-  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
   try {
-    const child = spawn4(opener, [url], {
+    const child = spawn4(cmd, args, {
       stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32"
+      detached: true
     });
     child.on("error", () => {
     });
@@ -51679,6 +52272,7 @@ function postJson2(url, body, bearer) {
 }
 
 // src/auth/device-login.ts
+init_safe_text();
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function runDeviceLogin(opts = {}) {
   const startUrl = resolveCloudEndpoint("/device/start", opts.apiUrl);
@@ -51694,14 +52288,16 @@ async function runDeviceLogin(opts = {}) {
   } catch (e) {
     return {
       ok: false,
-      reason: `Could not reach the node9 cloud: ${e instanceof Error ? e.message : String(e)}`
+      reason: `Could not reach the node9 cloud: ${safeMessage(e)}`
     };
   }
   console.log("");
   console.log(`  Open this link to approve the connection:`);
-  console.log(`  ${chalk11.cyan.underline(start.verificationUrl)}`);
+  console.log(`  ${chalk11.cyan.underline(safeMessage(start.verificationUrl, 200))}`);
   console.log("");
-  console.log(`  Code: ${chalk11.bold(start.userCode)} ${chalk11.gray("(match it in the browser)")}`);
+  console.log(
+    `  Code: ${chalk11.bold(safeMessage(start.userCode, 40))} ${chalk11.gray("(match it in the browser)")}`
+  );
   console.log("");
   const opened = opts.noBrowser ? false : openBrowser(start.verificationUrl);
   console.log(
@@ -51747,6 +52343,7 @@ import * as fs50 from "fs";
 import * as os45 from "os";
 import * as path48 from "path";
 import chalk12 from "chalk";
+init_safe_text();
 async function revokeSelf(creds) {
   const url = creds.apiUrl.replace(/\/$/, "") + "/machines/self/disconnect";
   try {
@@ -51787,7 +52384,7 @@ function registerLogoutCommand(program2) {
     } else if (res.outcome === "already") {
       console.log(chalk12.gray("\u2713 Cloud: this machine was already disconnected."));
     } else {
-      console.log(chalk12.yellow(`\u26A0 Could not reach the cloud (${res.detail}).`));
+      console.log(chalk12.yellow(`\u26A0 Could not reach the cloud (${safeMessage(res.detail)}).`));
       console.log(
         chalk12.yellow("  The key was removed locally, but is still listed in the dashboard \u2014")
       );
@@ -52094,9 +52691,7 @@ function discardPendingReview(key, now = Date.now()) {
 
 // src/cli/commands/check.ts
 init_hook_payload();
-function sanitize2(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 function detectAiAgent(payload) {
   const meta = payload.meta;
   if (meta && typeof meta === "object") {
@@ -52342,10 +52937,13 @@ RAW: ${raw}
           const logPath = path51.join(os48.homedir(), ".node9", "hook-debug.log");
           if (!fs53.existsSync(path51.dirname(logPath)))
             fs53.mkdirSync(path51.dirname(logPath), { recursive: true });
-          fs53.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${raw}
-`);
+          fs53.appendFileSync(
+            logPath,
+            `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${JSON.stringify(raw)}
+`
+          );
         }
-        const rawToolName = sanitize2(extractToolName(payload));
+        const rawToolName = stripControlChars(extractToolName(payload));
         const toolName = canonicalToolName(rawToolName);
         const toolInput = canonicalToolInput(rawToolName, extractToolInput(payload));
         const agent = agentOverride ?? detectAiAgent(payload);
@@ -52735,6 +53333,7 @@ function containsShellMetachar(token) {
 
 // src/cli/commands/log.ts
 init_hook_payload();
+init_safe_text();
 var TEST_COMMAND_RE2 = /(?:^|\s)(npm\s+(?:run\s+)?test|npx\s+(?:vitest|jest|mocha)|yarn\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|vitest|jest|mocha|pytest|py\.test|cargo\s+test|go\s+test|bundle\s+exec\s+rspec|rspec|phpunit|dotnet\s+test)\b/i;
 function detectTestResult(command, output) {
   if (!TEST_COMMAND_RE2.test(command)) return null;
@@ -52753,9 +53352,6 @@ var CONFIDENCE_RANK = { low: 0, medium: 1, high: 2 };
 function atLeastConfidence(c, min) {
   return CONFIDENCE_RANK[c] >= CONFIDENCE_RANK[min];
 }
-function sanitize3(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
 function scanCoveredEverything(value, depth = 0) {
   if (value === null || value === void 0) return true;
   if (typeof value === "string") return value.length <= DLP_SCAN_LIMITS.maxStringBytes;
@@ -52794,7 +53390,7 @@ function registerLogCommand(program2) {
         if (!raw || raw.trim() === "") process.exit(0);
         const payload = JSON.parse(raw);
         if (payload.toolCall === null) process.exit(0);
-        const rawToolName = sanitize3(extractToolName(payload, "unknown"));
+        const rawToolName = stripControlChars(extractToolName(payload, "unknown"));
         const tool = canonicalToolName(rawToolName);
         const rawInput = canonicalToolInput(rawToolName, extractToolInput(payload));
         const metaTag = (() => {
@@ -55626,6 +56222,7 @@ import http5 from "http";
 import https8 from "https";
 import { URL as URL5 } from "url";
 import chalk22 from "chalk";
+init_safe_text();
 function resolveConnectUrl(apiUrl) {
   return resolveCloudEndpoint("/cli/connect", apiUrl);
 }
@@ -55684,7 +56281,7 @@ function registerConnectCommand(program2) {
     try {
       resp = await postConnect(resolveConnectUrl(options.apiUrl), token);
     } catch (e) {
-      console.error(chalk22.red(`\u2717 ${e instanceof Error ? e.message : "Connect failed."}`));
+      console.error(chalk22.red(`\u2717 ${safeMessage(e) || "Connect failed."}`));
       process.exitCode = 1;
       return;
     }
@@ -55771,9 +56368,7 @@ init_mcp_pin();
 init_mcp_cmd();
 init_mcp_tools();
 init_daemon();
-function sanitize4(value) {
-  return value.replace(/[\x00-\x1F\x7F]/g, "");
-}
+init_safe_text();
 var RPC_INVALID_REQUEST = -32600;
 var RPC_SERVER_ERROR = -32e3;
 function isValidId(id) {
@@ -55797,7 +56392,7 @@ function normalizeClientName(name) {
   if (lower.includes("gemini")) return "Gemini";
   if (lower.includes("cline")) return "Cline";
   if (lower.includes("continue")) return "Continue";
-  const sanitized = sanitize4(name).slice(0, 40);
+  const sanitized = stripControlChars(name).slice(0, 40);
   return sanitized.length > 0 ? sanitized : void 0;
 }
 function reportPinMismatchToCloud(serverKey, serverLabel, agent) {
@@ -55977,7 +56572,7 @@ async function runMcpGateway(upstreamCommand, configName) {
       if (!deferredStdinEnd) agentIn.pause();
       authPending = true;
       try {
-        const toolName = sanitize4(
+        const toolName = stripControlChars(
           String(message.params?.name ?? message.params?.tool_name ?? "unknown")
         );
         const toolArgs = message.params?.arguments ?? message.params?.tool_input ?? {};
@@ -61417,16 +62012,13 @@ Persistent decisions  (${entries.length})
 }
 
 // src/cli/commands/dlp.ts
+init_safe_text();
 import chalk42 from "chalk";
 import fs77 from "fs";
 import path72 from "path";
 import os64 from "os";
 var AUDIT_LOG = path72.join(os64.homedir(), ".node9", "audit.log");
 var RESOLVED_FILE = path72.join(os64.homedir(), ".node9", "dlp-resolved.json");
-var ANSI_RE = /\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g;
-function stripAnsi(s) {
-  return s.replace(ANSI_RE, "");
-}
 function loadResolved() {
   try {
     const raw = JSON.parse(fs77.readFileSync(RESOLVED_FILE, "utf-8"));
@@ -61520,10 +62112,10 @@ function registerDlpCommand(program2) {
         "  " + chalk42.red("\u25CF") + "  " + chalk42.white(e.dlpPattern ?? "Secret") + chalk42.dim("  " + fmtDate3(e.ts))
       );
       if (e.dlpSample) {
-        console.log("     " + chalk42.dim("Sample: ") + chalk42.yellow(stripAnsi(e.dlpSample)));
+        console.log("     " + chalk42.dim("Sample: ") + chalk42.yellow(safeMessage(e.dlpSample)));
       }
       if (e.project) {
-        console.log("     " + chalk42.dim("Project: ") + chalk42.dim(stripAnsi(e.project)));
+        console.log("     " + chalk42.dim("Project: ") + chalk42.dim(safeMessage(e.project)));
       }
       console.log("");
     }
@@ -61726,6 +62318,7 @@ function registerMaskCommand(program2) {
 
 // src/cli.ts
 init_blast();
+init_safe_text();
 var { version } = JSON.parse(
   fs81.readFileSync(path76.join(__dirname, "../package.json"), "utf-8")
 );
@@ -61758,7 +62351,7 @@ program.command("login").argument("[apiKey]", "Service/legacy key. Omit to log i
         cliVersion: version
       });
       if (!res.ok) {
-        console.error(chalk45.red(`\u2717 ${res.reason}`));
+        console.error(chalk45.red(`\u2717 ${safeMessage(res.reason)}`));
         process.exitCode = 1;
         return;
       }