@node9/proxy 2.22.0 → 2.23.0

package/dist/dashboard.mjs

@@ -741,9 +741,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path15) {
+function getNestedValue(obj, path17) {
   if (!obj || typeof obj !== "object") return null;
-  const segments2 = path15.split(".");
+  const segments2 = path17.split(".");
   for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -945,6 +945,7 @@ function normalizeCommandForPolicyImpl(command) {
         const source = command.slice(s, e);
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
+        if (/^[;&|()<>]+$/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
         const quoteOnly = source.replace(/['"]/g, "");
         if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
@@ -1138,23 +1139,147 @@ function extractLiteralArgs(callExpr) {
   const args = positionedArgs(words);
   return { name, flags, paths: args.map((a) => a.value), words, args };
 }
+function payloadKey(payload) {
+  if (!assignmentTable || assignmentTable.size === 0) return payload;
+  const bindings = [];
+  for (const [name, rec] of assignmentTable) {
+    if (rec.value !== null) bindings.push(`${name}=${rec.value}`);
+  }
+  return `${payload}\0${bindings.sort().join("
")}`;
+}
+function claimPayload(payload) {
+  if (!seenPayloads) return "ok";
+  const key = payloadKey(payload);
+  if (seenPayloads.has(key)) return "seen";
+  if (payloadBudget <= 0) return "exhausted";
+  payloadBudget--;
+  seenPayloads.add(key);
+  return "ok";
+}
+function recordTopLevelAssignments(f) {
+  const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+  for (const stmt of stmts) recordTopLevelStmt(stmt);
+}
+function probeBinOp(src) {
+  try {
+    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
+    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+  } catch {
+  }
+  return null;
+}
+function recordTopLevelStmt(stmt) {
+  if (!stmt || !stmt.Cmd) return false;
+  const t = syntax.NodeType(stmt.Cmd);
+  if (t === "BinaryCmd") {
+    if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
+    if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
+    if (stmt.Cmd.Op === AND_OP) return recordTopLevelStmt(stmt.Cmd.Y);
+    return true;
+  }
+  if (t !== "CallExpr" && t !== "DeclClause") return false;
+  let at = 0;
+  try {
+    at = stmt.Pos().Offset();
+  } catch {
+    at = 0;
+  }
+  recordAssignments(stmt.Cmd, at);
+  if (stmt.Negated) return false;
+  if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
+  return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
+}
+function recordAssignments(n, at) {
+  if (!assignmentTable) return;
+  const t = syntax.NodeType(n);
+  let assigns = [];
+  if (t === "CallExpr") {
+    if ((n.Args || []).length > 0) return;
+    assigns = n.Assigns || [];
+  } else if (t === "DeclClause") {
+    if (!ASSIGNMENT_HEADS.has(n.Variant?.Value ?? "")) return;
+    assigns = (n.Args || []).filter((a) => syntax.NodeType(a) === "Assign");
+  } else return;
+  for (const a of assigns) {
+    const name = a?.Name?.Value;
+    if (!name || !a.Value || a.Append) continue;
+    assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
+  }
+}
+function resolveTrivialSubst(part) {
+  if (syntax.NodeType(part) !== "CmdSubst") return void 0;
+  const stmts = part.Stmts || [];
+  if (stmts.length !== 1) return void 0;
+  const st = stmts[0];
+  if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
+  const cmd = st.Cmd;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return void 0;
+  if ((cmd.Assigns || []).length > 0) return void 0;
+  const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return void 0;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.slice(i).join(" ");
+  }
+  if (head === "printf") {
+    if (rest.length !== 2) return void 0;
+    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
+    return rest[1];
+  }
+  return void 0;
+}
+function recordedExpansion(name) {
+  if (!assignmentTable || !name) return void 0;
+  const rec = assignmentTable.get(name);
+  if (rec === void 0 || rec.at >= currentStmtOffset) return void 0;
+  return rec.value;
+}
+function isPlainParam(p) {
+  if (syntax.NodeType(p) !== "ParamExp") return false;
+  return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
+}
+function expandPlainParam(p) {
+  if (!assignmentTable) return void 0;
+  if (!isPlainParam(p)) return void 0;
+  const recorded = recordedExpansion(p.Param?.Value);
+  if (recorded !== void 0) return recorded;
+  return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
+}
 function resolveWordLiteral(w) {
   const parts = w?.Parts || [];
   let s = "";
   for (const p of parts) {
-    const t = syntax.NodeType(p);
-    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-    else if (t === "SglQuoted") s += p.Value ?? "";
-    else if (t === "DblQuoted") {
-      const inner = p.Parts || [];
-      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-      s += inner.map((ip) => ip.Value ?? "").join("");
-    } else {
-      return null;
-    }
+    const piece = resolvePart(p, false);
+    if (piece === void 0 || piece === null) return null;
+    s += piece;
   }
   return s;
 }
+function resolvePart(p, inQuotes) {
+  const t = syntax.NodeType(p);
+  if (t === "Lit") {
+    const raw = p.Value ?? "";
+    if (!inQuotes) return raw.replace(/\\(.)/g, "$1");
+    return assignmentTable ? raw.replace(/\\([$`"\\])/g, "$1") : raw;
+  }
+  if (t === "SglQuoted") return p.Value ?? "";
+  if (t === "ParamExp") return expandPlainParam(p);
+  if (t === "CmdSubst") return assignmentTable ? resolveTrivialSubst(p) : void 0;
+  if (t === "DblQuoted" && !inQuotes) {
+    const inner = p.Parts || [];
+    let out = "";
+    for (const ip of inner) {
+      const piece = resolvePart(ip, true);
+      if (piece === void 0 || piece === null) return piece;
+      out += piece;
+    }
+    return out;
+  }
+  return void 0;
+}
 function analyzeFsOperation(command) {
   const normalized = normalizeCommandForPolicy(command);
   if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
@@ -1190,17 +1315,35 @@ function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
+  const outerTable = assignmentTable;
+  const outerOffset = currentStmtOffset;
+  const outerSeen = seenPayloads;
+  const outerBudget = payloadBudget;
+  if (depth === 0) {
+    seenPayloads = /* @__PURE__ */ new Set();
+    payloadBudget = PAYLOAD_BUDGET;
+  }
+  assignmentTable = new Map(
+    [...outerTable ?? []].map(([k, r]) => [k, { value: r.value, at: -1 }])
+  );
+  currentStmtOffset = Number.MAX_SAFE_INTEGER;
   try {
+    recordTopLevelAssignments(f);
     syntax.Walk(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
       const nodeType = syntax.NodeType(n);
       if (nodeType === "Stmt") {
+        try {
+          currentStmtOffset = n.Pos().Offset();
+        } catch {
+          currentStmtOffset = Number.MAX_SAFE_INTEGER;
+        }
         result = stricter(result, jailedRedirectRead(n));
         return result?.verdict !== "block";
       }
       if (nodeType !== "CallExpr") return true;
-      const { name, flags, paths, words, args } = extractLiteralArgs(n);
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -1229,9 +1372,30 @@ function analyzeFsOperationImpl(command, depth = 0) {
           }
         }
       }
-      if (depth < 1) {
+      if (depth < 24 && name === "find") {
+        for (const action of findActions(words, 0)) {
+          const h = unwrapCommandHead(action);
+          const inner = literalShellPayload(action.slice(h), baseWord(action[h]));
+          if (inner === null) continue;
+          const claim = claimPayload(inner);
+          if (claim === "exhausted") {
+            result = stricter(result, UNANALYSABLE_NESTING);
+            continue;
+          }
+          if (claim === "seen") continue;
+          const v = analyzeFsOperationImpl(inner, depth + 1);
+          result = stricter(result, v);
+          if (result?.verdict === "block") return false;
+        }
+      }
+      if (depth < 24) {
         const payload = literalShellPayload(words, name);
-        if (payload !== null) {
+        const claim = payload === null ? "seen" : claimPayload(payload);
+        if (claim === "exhausted") {
+          result = stricter(result, UNANALYSABLE_NESTING);
+          return true;
+        }
+        if (payload !== null && claim === "ok") {
           const inner = analyzeFsOperationImpl(payload, depth + 1);
           if (inner) {
             result = inner;
@@ -1240,7 +1404,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
           return true;
         }
       }
-      const readPaths = FS_READ_TOOLS.has(name) ? [...readTargets(name, args, flags, words, 1), ...flagOperandFiles(name, words, 1)] : wrappedReadPaths(words, name);
+      const readPaths = FS_READ_TOOLS.has(name) ? readerPaths(words, 0) : wrappedReadPaths(words, name);
       if (readPaths) {
         for (const p of readPaths) {
           result = stricter(result, matchSensitivePath2(p));
@@ -1255,6 +1419,11 @@ function analyzeFsOperationImpl(command, depth = 0) {
     return result;
   } catch {
     return null;
+  } finally {
+    assignmentTable = outerTable;
+    currentStmtOffset = outerOffset;
+    seenPayloads = outerSeen;
+    if (depth === 0) payloadBudget = outerBudget;
   }
 }
 function stricter(a, b) {
@@ -1311,6 +1480,18 @@ function resolveCopyShape(words, h) {
   }
   return null;
 }
+function findAction(words, k) {
+  const end = words.findIndex((w, i) => i > k && (w === ";" || w === "+"));
+  return words.slice(k + 1, end < 0 ? words.length : end);
+}
+function findActions(words, h) {
+  const out = [];
+  for (let i = h + 1; i < words.length; i++) {
+    const w = words[i];
+    if (w !== null && FIND_EXEC_FLAGS.has(w)) out.push(findAction(words, i));
+  }
+  return out;
+}
 function findStartPoints(words, h) {
   const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
   if (k < 0) return { k, starts: [] };
@@ -1326,8 +1507,13 @@ function copySourcePaths(words) {
   if (fi >= 0) {
     const { k, starts } = findStartPoints(words, fi);
     if (k < 0) return [];
-    const action = unwrapCommandHead(words.slice(k + 1));
-    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+    const out = [];
+    for (const action of findActions(words, fi)) {
+      const h2 = unwrapCommandHead(action);
+      if (!resolveCopyShape(action, h2)) continue;
+      out.push(...starts, ...copySourcePaths(action));
+    }
+    return out;
   }
   if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
   const r = resolveCopyShape(words, h);
@@ -1504,6 +1690,15 @@ function flagEffect(token, shape, known) {
   }
   return NONE;
 }
+function readerPaths(words, h) {
+  const head = baseWord(words[h]);
+  const from = h + 1;
+  const flags = words.slice(from).filter((w) => w !== null && w.startsWith("-"));
+  return [
+    ...readTargets(head, positionedArgs(words, from), flags, words, from),
+    ...flagOperandFiles(head, words, from)
+  ];
+}
 function readTargets(verb, args, flags, words = [], from = 1) {
   const shape = PATTERN_VERBS[verb];
   if (!shape) return args.map((a) => a.value);
@@ -1585,18 +1780,21 @@ function flagOperandFiles(verb, words, from) {
 function wrappedReadPaths(words, name) {
   if (name === "find") {
     const { k, starts } = findStartPoints(words, 0);
-    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
+    if (k < 0) return null;
+    const paths = [];
+    let reads = false;
+    for (const action of findActions(words, 0)) {
+      const h2 = unwrapCommandHead(action);
+      if (!isReaderWord(action[h2] ?? null)) continue;
+      reads = true;
+      paths.push(...readerPaths(action, h2));
+    }
+    return reads ? [...starts, ...paths] : paths;
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
   if (h <= 0 || !isReaderWord(words[h] ?? null)) return null;
-  const head = baseWord(words[h]);
-  const rest = words.slice(h + 1);
-  const restFlags = rest.filter((w) => w !== null && w.startsWith("-"));
-  return [
-    ...readTargets(head, positionedArgs(words, h + 1), restFlags, words, h + 1),
-    ...flagOperandFiles(head, words, h + 1)
-  ];
+  return readerPaths(words, h);
 }
 function literalShellPayload(words, name) {
   const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
@@ -1944,7 +2142,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, SOURCE_COMMANDS, TERMINAL_ESCAPE_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, SOURCE_COMMANDS, TERMINAL_ESCAPE_RE, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3154,6 +3352,22 @@ var init_dist = __esm({
     ]);
     WRAPPER_TAKES_TARGET = /* @__PURE__ */ new Set(["chroot"]);
     FIND_EXEC_FLAGS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
+    HOME_VARIABLES = /* @__PURE__ */ new Set(["HOME", "USERPROFILE"]);
+    assignmentTable = null;
+    currentStmtOffset = Number.MAX_SAFE_INTEGER;
+    PAYLOAD_BUDGET = 256;
+    payloadBudget = 0;
+    seenPayloads = null;
+    UNANALYSABLE_NESTING = {
+      ruleName: "review-unanalysable-nesting",
+      verdict: "review",
+      reason: "This command nests more wrapped shell payloads than the policy engine will unwrap, so some of what it runs was not read.",
+      path: ""
+    };
+    ASSIGNMENT_HEADS = /* @__PURE__ */ new Set(["export", "declare", "local", "readonly", "typeset"]);
+    AND_OP = probeBinOp("a && b");
+    OR_OP = probeBinOp("a || b");
+    AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
     REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
@@ -4170,8 +4384,8 @@ var init_daemon = __esm({
 import { z } from "zod";
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path15 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path15}: ${issue.message}`;
+    const path17 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path17}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -4184,9 +4398,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path15 of ordered) {
+  for (const path17 of ordered) {
     let cur = root;
-    for (const key of path15.slice(0, -1)) {
+    for (const key of path17.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -4194,7 +4408,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path15[path15.length - 1];
+    const last = path17[path17.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -4230,7 +4444,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path15) => path15.length > 0);
+      }).filter((path17) => path17.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -5233,13 +5447,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path15 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path15) continue;
+            const path17 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path17) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path15, verdict, "org-managed jail")) {
+            for (const r of pathRules(path17, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path15, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path17, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -6693,19 +6907,129 @@ var init_scan_summary = __esm({
   }
 });
 
-// src/utils/platform-shell.ts
-var init_platform_shell = __esm({
-  "src/utils/platform-shell.ts"() {
+// src/agent-wiring.ts
+import fs10 from "fs";
+import path12 from "path";
+import * as yaml from "yaml";
+import { parse as parseToml } from "smol-toml";
+var exists, ck, lg, AGENT_SPECS;
+var init_agent_wiring = __esm({
+  "src/agent-wiring.ts"() {
     "use strict";
+    init_setup();
+    exists = (p) => {
+      try {
+        return fs10.existsSync(p);
+      } catch {
+        return false;
+      }
+    };
+    ck = (key) => ({ key, kind: "check" });
+    lg = (key) => ({ key, kind: "log" });
+    AGENT_SPECS = [
+      {
+        id: "claude",
+        label: "Claude Code",
+        setupCommand: "node9 agents add claude",
+        hookFile: (h) => path12.join(h, ".claude", "settings.json"),
+        hookFormat: "matcher",
+        // UserPromptSubmit is prompt DLP. setup.ts has written it for Claude since
+        // that shipped; the spec must name it too, or status/doctor never show the
+        // row and heal (which repairs via setupAgent) has no signal it is missing.
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => path12.join(h, ".claude.json"),
+        present: (h) => exists(path12.join(h, ".claude", "settings.json")) || exists(path12.join(h, ".claude.json"))
+      },
+      {
+        id: "gemini",
+        label: "Gemini CLI",
+        setupCommand: "node9 agents add gemini",
+        hookFile: (h) => path12.join(h, ".gemini", "settings.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("BeforeTool"), lg("AfterTool")],
+        mcpFile: (h) => path12.join(h, ".gemini", "settings.json"),
+        present: (h) => exists(path12.join(h, ".gemini", "settings.json"))
+      },
+      {
+        id: "codex",
+        label: "Codex",
+        setupCommand: "node9 agents add codex",
+        hookFile: (h) => path12.join(h, ".codex", "hooks.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("PreToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => path12.join(h, ".codex", "config.toml"),
+        mcpFormat: "toml",
+        present: (h) => exists(path12.join(h, ".codex"))
+      },
+      {
+        id: "antigravity",
+        label: "Antigravity",
+        setupCommand: "node9 agents add antigravity",
+        hookFile: (h) => path12.join(h, ".gemini", "config", "hooks.json"),
+        hookFormat: "matcher",
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse")],
+        mcpFile: (h) => path12.join(h, ".gemini", "config", "mcp_config.json"),
+        present: (h) => exists(path12.join(h, ".gemini", "config", "hooks.json")) || exists(path12.join(h, ".gemini", "antigravity-cli")) || exists(path12.join(h, ".gemini", "antigravity-ide"))
+      },
+      {
+        id: "copilot",
+        label: "GitHub Copilot",
+        setupCommand: "node9 agents add copilot",
+        hookFile: (h) => path12.join(h, ".copilot", "hooks", "node9.json"),
+        hookFormat: "flat",
+        hookEvents: [ck("PreToolUse"), lg("PostToolUse"), ck("UserPromptSubmit")],
+        mcpFile: (h) => path12.join(h, ".copilot", "mcp-config.json"),
+        present: (h) => exists(path12.join(h, ".copilot"))
+      },
+      {
+        id: "cursor",
+        label: "Cursor",
+        setupCommand: "node9 agents add cursor",
+        // MCP-only — no hook file (see note above).
+        hookFormat: "flat",
+        hookEvents: [],
+        mcpFile: (h) => path12.join(h, ".cursor", "mcp.json"),
+        present: (h) => exists(path12.join(h, ".cursor", "mcp.json"))
+      },
+      {
+        id: "hermes",
+        label: "Hermes Agent",
+        setupCommand: "node9 agents add hermes",
+        hookFile: (h) => hermesConfigPath(h),
+        hookFormat: "yaml",
+        hookEvents: [ck("pre_tool_call"), lg("post_tool_call")],
+        labelPad: 14,
+        // 'post_tool_call' is wider than the default
+        present: (h) => exists(hermesConfigPath(h))
+      },
+      {
+        // Plugin-shim agents — protected by a node9-authored plugin/extension file
+        // (no hooks, no MCP). hookFormat is unused for these (shimFile drives it).
+        id: "opencode",
+        label: "OpenCode",
+        setupCommand: "node9 agents add opencode",
+        hookFormat: "flat",
+        hookEvents: [],
+        shimFile: (h) => path12.join(opencodeConfigDir(h), "plugins", "node9.js"),
+        present: (h) => exists(opencodeConfigDir(h)) || exists(path12.join(opencodeConfigDir(h), "plugins", "node9.js"))
+      },
+      {
+        id: "pi",
+        label: "Pi",
+        setupCommand: "node9 agents add pi",
+        hookFormat: "flat",
+        hookEvents: [],
+        shimFile: (h) => path12.join(h, ".pi", "agent", "extensions", "node9.js"),
+        present: (h) => exists(path12.join(h, ".pi", "agent")) || exists(path12.join(h, ".pi", "agent", "extensions", "node9.js"))
+      }
+    ];
   }
 });
 
-// src/codex-trust.ts
-import { parse as parseToml } from "smol-toml";
-var init_codex_trust = __esm({
-  "src/codex-trust.ts"() {
+// src/mcp-cmd.ts
+var init_mcp_cmd = __esm({
+  "src/mcp-cmd.ts"() {
     "use strict";
-    init_platform_shell();
   }
 });
 
@@ -6716,15 +7040,43 @@ var init_mcp_pin = __esm({
   }
 });
 
+// src/mcp-wrap.ts
+import { parse as parseToml2, stringify as stringifyToml } from "smol-toml";
+var init_mcp_wrap = __esm({
+  "src/mcp-wrap.ts"() {
+    "use strict";
+    init_agent_wiring();
+    init_mcp_cmd();
+    init_mcp_pin();
+    init_mcp_cmd();
+  }
+});
+
+// src/utils/platform-shell.ts
+var init_platform_shell = __esm({
+  "src/utils/platform-shell.ts"() {
+    "use strict";
+  }
+});
+
+// src/codex-trust.ts
+import { parse as parseToml3 } from "smol-toml";
+var init_codex_trust = __esm({
+  "src/codex-trust.ts"() {
+    "use strict";
+    init_platform_shell();
+  }
+});
+
 // src/daemon/hook-baseline.ts
-import path12 from "path";
+import path13 from "path";
 import os11 from "os";
 var BASELINE_FILE, NOTIFIED_FILE;
 var init_hook_baseline = __esm({
   "src/daemon/hook-baseline.ts"() {
     "use strict";
-    BASELINE_FILE = path12.join(os11.homedir(), ".node9", "hooks-baseline.json");
-    NOTIFIED_FILE = path12.join(os11.homedir(), ".node9", "hook-heal-notified.json");
+    BASELINE_FILE = path13.join(os11.homedir(), ".node9", "hooks-baseline.json");
+    NOTIFIED_FILE = path13.join(os11.homedir(), ".node9", "hook-heal-notified.json");
   }
 });
 
@@ -6750,19 +7102,37 @@ var init_atomic_write = __esm({
 });
 
 // src/setup.ts
+import path14 from "path";
+import os12 from "os";
 import chalk3 from "chalk";
 import { confirm as rawConfirm } from "@inquirer/prompts";
-import { parse as parseToml2, stringify as stringifyToml } from "smol-toml";
-import * as yaml from "yaml";
+import { parse as parseToml4, stringify as stringifyToml2 } from "smol-toml";
+import * as yaml2 from "yaml";
+function opencodeConfigDir(home = os12.homedir()) {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg && path14.isAbsolute(xdg) ? xdg : path14.join(home, ".config");
+  return path14.join(base, "opencode");
+}
+function hermesHomeDir(homeDir = os12.homedir()) {
+  const env = process.env.HERMES_HOME?.trim();
+  if (env && path14.isAbsolute(env)) return env;
+  return path14.join(homeDir, ".hermes");
+}
+function hermesConfigPath(homeDir = os12.homedir()) {
+  return path14.join(hermesHomeDir(homeDir), HERMES_CONFIG_FILENAME);
+}
+var HERMES_CONFIG_FILENAME;
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
+    init_mcp_wrap();
     init_codex_trust();
     init_mcp_pin();
     init_hook_baseline();
     init_setup_opencode_shim();
     init_setup_pi_shim();
     init_atomic_write();
+    HERMES_CONFIG_FILENAME = "config.yaml";
   }
 });
 
@@ -6793,9 +7163,9 @@ var init_scan_history = __esm({
 
 // src/cli/commands/scan.ts
 import chalk5 from "chalk";
-import fs10 from "fs";
-import path13 from "path";
-import os12 from "os";
+import fs11 from "fs";
+import path15 from "path";
+import os13 from "os";
 import stringWidth2 from "string-width";
 function claudeModelPrice2(model) {
   const t = pricingFor(model);
@@ -7003,7 +7373,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   const session = { sessionId, costUSD: 0, toolCalls: 0 };
   let raw;
   try {
-    raw = fs10.readFileSync(path13.join(projPath, file), "utf-8");
+    raw = fs11.readFileSync(path15.join(projPath, file), "utf-8");
   } catch {
     return;
   }
@@ -7066,7 +7436,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
           if (block.type !== "tool_result") continue;
           const filePath = block.tool_use_id ? toolUseFilePaths.get(block.tool_use_id) : void 0;
           if (filePath) {
-            const ext = path13.extname(filePath).toLowerCase();
+            const ext = path15.extname(filePath).toLowerCase();
             if (CODE_EXTENSIONS.has(ext)) continue;
           }
           const resultText = typeof block.content === "string" ? block.content : Array.isArray(block.content) ? block.content.map((c) => c.text ?? "").join("\n") : null;
@@ -7136,7 +7506,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
       const rawCmd = String(input.command ?? "").trimStart();
       if (/^node9\s+(scan|explain|report|tail|dlp|status|sessions|audit)\b/.test(rawCmd)) continue;
       const inputFilePath = typeof input.file_path === "string" ? input.file_path : "";
-      const inputFileExt = inputFilePath ? path13.extname(inputFilePath).toLowerCase() : "";
+      const inputFileExt = inputFilePath ? path15.extname(inputFilePath).toLowerCase() : "";
       const canaryInInput = recordCanaries(
         input,
         toolName,
@@ -7245,13 +7615,13 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   result.perSession.push(session);
 }
 async function processClaudeProjectAsync(proj, projectsDir, ruleSources, startDate, result, dedup, canaryVals, onProgress, onLine) {
-  const projPath = path13.join(projectsDir, proj);
+  const projPath = path15.join(projectsDir, proj);
   try {
-    if (!fs10.statSync(projPath).isDirectory()) return;
+    if (!fs11.statSync(projPath).isDirectory()) return;
   } catch {
     return;
   }
-  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os12.homedir(), "~")).slice(
+  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os13.homedir(), "~")).slice(
     0,
     40
   );
@@ -7298,12 +7668,12 @@ function emptyClaudeScan() {
   };
 }
 async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
-  const projectsDir = path13.join(os12.homedir(), ".claude", "projects");
+  const projectsDir = path15.join(os13.homedir(), ".claude", "projects");
   const result = emptyClaudeScan();
-  if (!fs10.existsSync(projectsDir)) return result;
+  if (!fs11.existsSync(projectsDir)) return result;
   let projDirs;
   try {
-    projDirs = fs10.readdirSync(projectsDir);
+    projDirs = fs11.readdirSync(projectsDir);
   } catch {
     return result;
   }
@@ -7327,7 +7697,7 @@ async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
 }
 function scanGeminiHistory(startDate, onProgress, onLine) {
   const canaryVals = safeCanaryScanValues();
-  const tmpDir = path13.join(os12.homedir(), ".gemini", "tmp");
+  const tmpDir = path15.join(os13.homedir(), ".gemini", "tmp");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -7344,33 +7714,33 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     perSession: []
   };
   const dedup = emptyScanDedup();
-  if (!fs10.existsSync(tmpDir)) return result;
+  if (!fs11.existsSync(tmpDir)) return result;
   let slugDirs;
   try {
-    slugDirs = fs10.readdirSync(tmpDir);
+    slugDirs = fs11.readdirSync(tmpDir);
   } catch {
     return result;
   }
   const ruleSources = buildRuleSources();
   for (const slug2 of slugDirs) {
-    const slugPath = path13.join(tmpDir, slug2);
+    const slugPath = path15.join(tmpDir, slug2);
     try {
-      if (!fs10.statSync(slugPath).isDirectory()) continue;
+      if (!fs11.statSync(slugPath).isDirectory()) continue;
     } catch {
       continue;
     }
     let projLabel = stripTerminalEscapes(slug2).slice(0, 40);
     try {
       projLabel = stripTerminalEscapes(
-        fs10.readFileSync(path13.join(slugPath, ".project_root"), "utf-8").trim()
-      ).replace(os12.homedir(), "~").slice(0, 40);
+        fs11.readFileSync(path15.join(slugPath, ".project_root"), "utf-8").trim()
+      ).replace(os13.homedir(), "~").slice(0, 40);
     } catch {
     }
-    const chatsDir = path13.join(slugPath, "chats");
-    if (!fs10.existsSync(chatsDir)) continue;
+    const chatsDir = path15.join(slugPath, "chats");
+    if (!fs11.existsSync(chatsDir)) continue;
     let chatFiles;
     try {
-      chatFiles = fs10.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
+      chatFiles = fs11.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
     } catch {
       continue;
     }
@@ -7383,7 +7753,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
       onProgress?.(result.filesScanned);
       let raw;
       try {
-        raw = fs10.readFileSync(path13.join(chatsDir, chatFile), "utf-8");
+        raw = fs11.readFileSync(path15.join(chatsDir, chatFile), "utf-8");
       } catch {
         continue;
       }
@@ -7602,7 +7972,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     onProgress?.(result.filesScanned);
     let lines;
     try {
-      lines = fs10.readFileSync(filePath, "utf-8").split("\n");
+      lines = fs11.readFileSync(filePath, "utf-8").split("\n");
     } catch {
       continue;
     }
@@ -7625,7 +7995,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         sessionId = String(payload["id"] ?? filePath);
         startTime = String(payload["timestamp"] ?? "");
         const cwd = String(payload["cwd"] ?? "");
-        projLabel = stripTerminalEscapes(cwd.replace(os12.homedir(), "~")).slice(0, 40);
+        projLabel = stripTerminalEscapes(cwd.replace(os13.homedir(), "~")).slice(0, 40);
         continue;
       }
       if (entry.type === "event_msg" && payload["type"] === "user_message") {
@@ -7870,23 +8240,23 @@ var init_scan = __esm({
 });
 
 // src/tui/dashboard/data.ts
-import fs11 from "fs";
-import os13 from "os";
-import path14 from "path";
+import fs12 from "fs";
+import os14 from "os";
+import path16 from "path";
 import http from "http";
 function auditLogPath() {
-  return path14.join(os13.homedir(), ".node9", "audit.log");
+  return path16.join(os14.homedir(), ".node9", "audit.log");
 }
 function readAuditEntriesAsync(chunkSize = 1e3, customPath) {
   return new Promise((resolve) => {
     const p = customPath ?? auditLogPath();
-    if (!fs11.existsSync(p)) {
+    if (!fs12.existsSync(p)) {
       resolve([]);
       return;
     }
     let raw;
     try {
-      raw = fs11.readFileSync(p, "utf8");
+      raw = fs12.readFileSync(p, "utf8");
     } catch {
       resolve([]);
       return;
@@ -8018,13 +8388,13 @@ function loadBlast() {
   }
 }
 function shortenPath(p) {
-  const home = os13.homedir();
+  const home = os14.homedir();
   return p.startsWith(home) ? p.replace(home, "~") : p;
 }
 async function loadReportAuditAsync(period) {
-  const claudeProjectsDir = path14.join(os13.homedir(), ".claude", "projects");
+  const claudeProjectsDir = path16.join(os14.homedir(), ".claude", "projects");
   const codexSessionsDir2 = codexSessionsDir();
-  const geminiTmpDir = path14.join(os13.homedir(), ".gemini", "tmp");
+  const geminiTmpDir = path16.join(os14.homedir(), ".gemini", "tmp");
   const { start, end } = getDateRange(period, /* @__PURE__ */ new Date());
   const entries = await readAuditEntriesAsync();
   void ensurePricingLoaded();
@@ -9130,8 +9500,8 @@ import { Fragment as Fragment3, jsx as jsx4, jsxs as jsxs4 } from "react/jsx-run
 function TopToolsProjects({ audit }) {
   const data = audit?.data;
   const tools = data ? [...data.toolMap.entries()].sort(([, a], [, b]) => b.calls - a.calls).slice(0, ROW_LIMIT) : [];
-  const projects = data ? [...data.cost.byProject.entries()].map(([path15, r]) => ({
-    name: basenameOf(path15),
+  const projects = data ? [...data.cost.byProject.entries()].map(([path17, r]) => ({
+    name: basenameOf(path17),
     cost: r.cost,
     tokens: r.inputTokens + r.outputTokens
   })).sort((a, b) => b.cost - a.cost).slice(0, ROW_LIMIT) : [];
@@ -9568,8 +9938,8 @@ function pickTopLoopFile(loops) {
     map.set(k, (map.get(k) ?? 0) + (l.count ?? 0));
   }
   if (map.size === 0) return void 0;
-  const [path15, count] = [...map.entries()].sort((a, b) => b[1] - a[1])[0];
-  return { path: path15, count };
+  const [path17, count] = [...map.entries()].sort((a, b) => b[1] - a[1])[0];
+  return { path: path17, count };
 }
 var EMPTY_FILTERED_SCAN;
 var init_derive = __esm({