@node9/proxy 2.32.0 → 2.33.0

package/dist/cli.js

@@ -2168,32 +2168,109 @@ function evaluateSmartConditions(args, rule) {
 function isBashTool(tool) {
   return BASH_TOOL_NAMES.has(tool.toLowerCase());
 }
-function inspectionEntry(tool, inspection = {}) {
+function inspectionLayers(policy) {
+  return { trusted: policy.toolInspection, project: policy.projectToolInspection };
+}
+function isShellEntry(value) {
+  return typeof value === "object" && value !== null && value.kind === "shell" && typeof value.field === "string" && Object.keys(value).length === 2;
+}
+function isInspectionLayers(input) {
+  const trusted = input.trusted;
+  return typeof trusted === "object" && trusted !== null && !isShellEntry(trusted);
+}
+function layersOf(input) {
+  return isInspectionLayers(input) ? { trusted: input.trusted, project: input.project ?? {} } : { trusted: input, project: {} };
+}
+function entryOf(tool, inspection) {
   const pattern = Object.keys(inspection).find((p) => matchesPattern(tool, p));
   return pattern === void 0 ? void 0 : inspection[pattern];
 }
+function inspectionEntry(tool, inspection = {}) {
+  const { trusted, project } = layersOf(inspection);
+  return entryOf(tool, trusted) ?? entryOf(tool, project);
+}
+function executorName(tool) {
+  const name = tool.toLowerCase();
+  if (!name.startsWith("mcp__")) return name;
+  const at = name.lastIndexOf("__");
+  return at >= "mcp__".length ? name.slice(at + 2) : name;
+}
+function entryFields(entry) {
+  if (typeof entry === "object") return [entry.field];
+  return entry === "command" ? ["command"] : null;
+}
 function shellFields(tool, inspection) {
   if (isBashTool(tool)) return ["command"];
-  const entry = inspectionEntry(tool, inspection);
-  if (typeof entry === "object") return [entry.field];
-  if (entry !== void 0) return entry === "command" ? [entry] : null;
-  const name = tool.toLowerCase().replace(/^mcp__[a-z0-9_-]+?__/, "");
-  return MCP_EXECUTORS.has(name) ? ["command", "cmd", "script"] : null;
+  const { trusted, project } = layersOf(inspection);
+  const trustedEntry = entryOf(tool, trusted);
+  if (trustedEntry !== void 0) return entryFields(trustedEntry);
+  const builtin = MCP_EXECUTORS.has(executorName(tool)) ? BUILTIN_FIELDS : null;
+  const projectEntry = entryOf(tool, project);
+  if (projectEntry === void 0) return builtin;
+  const added = entryFields(projectEntry);
+  if (!builtin) return added;
+  if (!added) return builtin;
+  return [.../* @__PURE__ */ new Set([...builtin, ...added])];
 }
 function isShellShapedTool(tool, inspection = {}) {
   return shellFields(tool, inspection) !== null;
 }
+function shellWord(word) {
+  if (BARE_WORD.test(word)) return word;
+  return word === "" ? "''" : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function commandLine(args, fieldPath, value, native) {
+  const missing = { reason: "Shell command field is missing or is not a string" };
+  const unreadable = { reason: "Shell command arguments could not be read" };
+  if (typeof value !== "string" && (native || !Array.isArray(value))) return missing;
+  const dot = fieldPath.lastIndexOf(".");
+  const parent = dot === -1 ? args : getNestedValue(args, fieldPath.slice(0, dot));
+  const siblings = ARGV_FIELDS.map((key) => ({
+    key,
+    value: parent && typeof parent === "object" ? parent[key] : void 0
+  })).filter(({ value: value2 }) => value2 !== void 0 && value2 !== null);
+  let argv = siblings[0];
+  if (native) argv = siblings.find(({ value: v }) => isStringArray(v));
+  else if (siblings.length === 2 && JSON.stringify(siblings[0].value) !== JSON.stringify(siblings[1].value))
+    return { reason: "Shell command arguments disagree" };
+  let command;
+  let source = fieldPath;
+  if (Array.isArray(value)) {
+    if (argv || !value.length || !isStringArray(value)) return unreadable;
+    command = value.map(shellWord).join(" ");
+  } else if (!argv) {
+    return { command: value, fieldPath };
+  } else {
+    if (!isStringArray(argv.value)) return unreadable;
+    if (!argv.value.length) return { command: value, fieldPath };
+    command = `${value} ${argv.value.map(shellWord).join(" ")}`;
+    source = `${fieldPath}+${argv.key}`;
+  }
+  if (command.length > MAX_ARGV_CHARACTERS)
+    return { reason: "Shell command arguments exceed the inspectable size" };
+  return { command, fieldPath: source };
+}
 function resolveShellInput(tool, args, inspection = {}) {
   const fields = shellFields(tool, inspection);
   if (!fields) return { kind: "not-shell" };
   const values = fields.map((fieldPath) => ({ fieldPath, value: getNestedValue(args, fieldPath) })).filter(({ value }) => value !== void 0 && value !== null && value !== "");
-  if (!values.length || values.some(({ value }) => typeof value !== "string")) {
+  if (!values.length) {
     return { kind: "uninspectable", reason: "Shell command field is missing or is not a string" };
   }
-  if (new Set(values.map(({ value }) => value)).size !== 1) {
+  const native = isBashTool(tool);
+  const lines = values.map(({ fieldPath, value }) => commandLine(args, fieldPath, value, native));
+  const failed = lines.find((line) => "reason" in line);
+  if (failed) return { kind: "uninspectable", reason: failed.reason };
+  const commands = lines.filter(
+    (line) => "command" in line
+  );
+  if (new Set(commands.map(({ command }) => command)).size !== 1) {
     return { kind: "uninspectable", reason: "Multiple shell command fields disagree" };
   }
-  return { kind: "shell", command: values[0].value, fieldPath: values[0].fieldPath };
+  return { kind: "shell", ...commands[0] };
 }
 function shellRuleArgs(tool, args, ruleTool, inspection = {}) {
   if (!ruleTool || !matchesPattern("bash", ruleTool) || matchesPattern(tool, ruleTool)) return args;
@@ -2934,20 +3011,25 @@ function evaluateProtectedFileAccess(accesses, context, settings) {
   }
   return best;
 }
-function findMnemonic(text, budget = { candidates: 0, reasons: /* @__PURE__ */ new Set() }) {
-  const words = [...text.matchAll(/[a-zA-Z]+/g)];
+function findMnemonic(text, budget = { hashes: 0, reasons: /* @__PURE__ */ new Set() }) {
   let run = [];
+  let runIndex = [];
   let previousEnd = 0;
   const rejected = /* @__PURE__ */ new Set();
   const inspect = () => {
+    if (run.length < 12) return false;
+    const ascending = new Array(run.length).fill(0);
+    for (let i = 1; i < run.length; i++)
+      ascending[i] = ascending[i - 1] + (runIndex[i] > runIndex[i - 1] ? 1 : 0);
     for (let start = 0; start + 12 <= run.length; start++) {
       for (const count of lengths) {
         if (start + count > run.length) continue;
+        if (ascending[start + count - 1] - ascending[start] === count - 1) continue;
         const candidate = run.slice(start, start + count);
         const sentence2 = candidate.join(" ");
         if (rejected.has(sentence2)) continue;
-        if (++budget.candidates > 1024) {
-          budget.reasons.add("mnemonic-candidates");
+        if (++budget.hashes > MAX_MNEMONIC_HASHES) {
+          budget.reasons.add("mnemonic-budget");
           return false;
         }
         if (BIP39_PUBLIC_VECTORS.has(hash(sentence2).toString("hex"))) {
@@ -2965,13 +3047,18 @@ function findMnemonic(text, budget = { candidates: 0, reasons: /* @__PURE__ */ n
     }
     return false;
   };
-  for (const word of words) {
-    if (!indices.has(word[0]) || run.length && !/^\s+$/.test(text.slice(previousEnd, word.index))) {
+  for (const word of text.matchAll(/[a-zA-Z]+/g)) {
+    const index = indices.get(word[0]);
+    if (index === void 0 || run.length && !/^\s+$/.test(text.slice(previousEnd, word.index))) {
       if (inspect()) return true;
-      if (budget.reasons.has("mnemonic-candidates")) return false;
+      if (budget.reasons.has("mnemonic-budget")) return false;
       run = [];
+      runIndex = [];
+    }
+    if (index !== void 0) {
+      run.push(word[0]);
+      runIndex.push(index);
     }
-    if (indices.has(word[0])) run.push(word[0]);
     previousEnd = word.index + word[0].length;
   }
   return inspect();
@@ -3102,6 +3189,9 @@ function validateCask(raw) {
   const second = b64urlIndex(s[tsAt + 5]);
   return month <= 11 && day <= 30 && hour <= 23 && minute <= 59 && second <= 59;
 }
+function isInvisibleChar(char) {
+  return INVISIBLE_ONE.test(char);
+}
 function stripInvisible(text) {
   return text.replace(INVISIBLE_RE, "");
 }
@@ -3167,7 +3257,7 @@ function scanInjection(text, ctx = {}) {
     }
   }
   if (matched.length === 0) return null;
-  const untrusted = !!ctx.tool && UNTRUSTED_TOOLS.test(ctx.tool);
+  const untrusted = ctx.untrusted ?? (!!ctx.tool && UNTRUSTED_TOOLS.test(ctx.tool));
   const score = matched.length + (untrusted ? 1 : 0);
   const confidence = score >= 3 ? "high" : score === 2 ? "medium" : "low";
   return { signals: untrusted ? [...matched, "untrusted-origin"] : matched, confidence };
@@ -3355,6 +3445,45 @@ function matchArgumentText(text, fieldPath, budget) {
   }
   return best;
 }
+function matchArgumentBatch(fragments, fieldPath, budget) {
+  if (!fragments.length) return null;
+  const text = fragments.join(BATCH_SEPARATOR);
+  const lower2 = text.toLowerCase();
+  let best = null;
+  for (const pattern of DLP_PATTERNS) {
+    if (pattern.keywords && !pattern.keywords.some((kw) => lower2.includes(kw.toLowerCase())))
+      continue;
+    const flags = pattern.regex.flags.replace(/[gmy]/g, "");
+    if (!new RegExp(pattern.regex.source, flags + "m").test(text)) continue;
+    for (const fragment of fragments) {
+      if (firstAcceptedMatch(pattern, fragment) === null) continue;
+      const severity = pattern.contextBoost && isAssignmentContext(fragment) ? "block" : pattern.severity;
+      if (severity === "block")
+        return {
+          patternName: pattern.name,
+          fieldPath,
+          redactedSample: "[encoded secret]",
+          severity
+        };
+      best ??= {
+        patternName: pattern.name,
+        fieldPath,
+        redactedSample: "[encoded secret]",
+        severity
+      };
+      if (!pattern.contextBoost) break;
+    }
+  }
+  if (findMnemonic(text, budget)) {
+    return {
+      patternName: "BIP-39 Recovery Phrase",
+      fieldPath,
+      redactedSample: "[recovery phrase]",
+      severity: "block"
+    };
+  }
+  return best;
+}
 function scanArgs(args, depth = 0, fieldPath = "args") {
   if (depth > MAX_DEPTH2 || args === null || args === void 0) return null;
   if (Array.isArray(args)) {
@@ -4323,6 +4452,9 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
     return null;
   }
 }
+function newSecretViewBudget() {
+  return { hashes: 0, nestedBytes: 0, joinedLabelBytes: 0, reasons: /* @__PURE__ */ new Set() };
+}
 function textBytes(buf) {
   if (buf.length < 16) return null;
   const text = buf.toString("utf8");
@@ -4341,13 +4473,41 @@ function percentOnce(text) {
     }
   });
 }
+function* wrappedBase64(text) {
+  if (!text.includes("\n")) return;
+  const word = /^[A-Za-z0-9+/_-]+={0,2}$/;
+  let run = [];
+  let width = 0;
+  const flush = function* () {
+    if (run.length >= 2) yield run.join("");
+    run = [];
+    width = 0;
+  };
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    const full = line.length >= 16 && word.test(line) && !line.includes("=");
+    if (full && (!run.length || line.length === width)) {
+      run.push(line);
+      width = line.length;
+      continue;
+    }
+    if (run.length && word.test(line) && line.length >= 2 && line.length <= width) {
+      run.push(line);
+      yield* flush();
+      continue;
+    }
+    yield* flush();
+    if (full) {
+      run.push(line);
+      width = line.length;
+    }
+  }
+  yield* flush();
+}
 function* encodedRegions(text, budget) {
   yield [text, false];
+  for (const block of wrappedBase64(text)) yield [block, false];
   for (const match of text.matchAll(/(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,30}:\/\/[^\s<>"']+/gi)) {
-    if (++budget.candidates > SECRET_VIEW_LIMITS.maxCandidates) {
-      budget.reasons.add("decode-candidates");
-      return;
-    }
     try {
       new URL(match[0]);
     } catch {
@@ -4367,6 +4527,8 @@ function* encodedRegions(text, budget) {
     ];
     for (const region of regions) if (region) yield [region, false];
     const labels = host2.split(".");
+    if (host2.length > SECRET_VIEW_LIMITS.maxHostLength || labels.length > SECRET_VIEW_LIMITS.maxLabels || !labels.every((l) => l.length >= 1 && l.length <= SECRET_VIEW_LIMITS.maxLabelLength))
+      continue;
     for (let start = 0; start < labels.length; start++) {
       let joined = labels[start];
       for (let end = start + 1; end < Math.min(labels.length, start + 8); end++) {
@@ -4374,11 +4536,13 @@ function* encodedRegions(text, budget) {
         if (!run.every((s) => /^[a-f0-9]{2,}$/i.test(s)) && !run.every((s) => /^[A-Z2-7]{4,}$/i.test(s)))
           break;
         joined += labels[end];
-        if (++budget.candidates > SECRET_VIEW_LIMITS.maxCandidates) {
-          budget.reasons.add("decode-candidates");
+        if (joined.length < 16) continue;
+        budget.joinedLabelBytes += joined.length;
+        if (budget.joinedLabelBytes > SECRET_VIEW_LIMITS.maxJoinedLabelBytes) {
+          budget.reasons.add("decode-labels");
           return;
         }
-        if (joined.length >= 16 && joined.length <= 253) yield [joined, true];
+        yield [joined, true];
       }
     }
   }
@@ -4415,10 +4579,6 @@ function* decodedCandidates(text, budget) {
     if (joined) yield ["dns-labels", region];
     for (const [kind, re] of families) {
       for (const match of region.matchAll(re)) {
-        if (++budget.candidates > SECRET_VIEW_LIMITS.maxCandidates) {
-          budget.reasons.add("decode-candidates");
-          return;
-        }
         const raw = match[0];
         let buf;
         if (kind === "base64") {
@@ -4441,42 +4601,76 @@ function* decodedCandidates(text, budget) {
     }
   }
 }
-function* secretViews(text, budget) {
+function secretViews(text, budget) {
   const seen = /* @__PURE__ */ new Set([text]);
-  const queue = [{ text, transforms: [] }];
-  for (let i = 0; i < queue.length; i++) {
-    const view = queue[i];
-    yield view;
-    for (const [kind, decoded] of decodedCandidates(view.text, budget)) {
-      if (seen.has(decoded)) continue;
-      if (view.transforms.length >= SECRET_VIEW_LIMITS.maxDepth) {
-        budget.reasons.add("decode-depth");
-        continue;
-      }
-      const bytes = Buffer.byteLength(decoded);
-      if (queue.length >= SECRET_VIEW_LIMITS.maxViewsPerLeaf || budget.views >= SECRET_VIEW_LIMITS.maxViews || budget.bytes + bytes > SECRET_VIEW_LIMITS.maxDerivedBytes) {
-        budget.reasons.add("decode-budget");
-        return;
-      }
-      seen.add(decoded);
-      budget.views++;
-      budget.bytes += bytes;
-      queue.push({ text: decoded, transforms: [...view.transforms, kind] });
+  const out = [];
+  let frontier = [{ text, transforms: [] }];
+  for (let depth = 1; depth <= SECRET_VIEW_LIMITS.maxDepth; depth++) {
+    const next = [];
+    for (const parent of frontier) {
+      let perLeaf = 0;
+      for (const [kind, decoded] of decodedCandidates(parent.text, budget)) {
+        if (seen.has(decoded)) continue;
+        seen.add(decoded);
+        const normalizing = kind === "invisibles" || kind === "percent";
+        if (depth >= 2 && !normalizing) {
+          budget.nestedBytes += Buffer.byteLength(decoded);
+          if (++perLeaf > SECRET_VIEW_LIMITS.maxNestedViewsPerLeaf || budget.nestedBytes > SECRET_VIEW_LIMITS.maxNestedBytes) {
+            budget.reasons.add("decode-nested");
+            return out;
+          }
+        }
+        const view = { text: decoded, transforms: [...parent.transforms, kind] };
+        out.push(view);
+        next.push(view);
+      }
+    }
+    frontier = next;
+    if (!frontier.length) return out;
+  }
+  for (const view of frontier) {
+    if (!decodedCandidates(view.text, budget).next().done) {
+      budget.reasons.add("decode-nested");
+      break;
+    }
+  }
+  return out;
+}
+function batches(views) {
+  const out = [];
+  let current = [];
+  let size = 0;
+  for (const { text } of views) {
+    if (current.length && size + text.length > SECRET_VIEW_LIMITS.batchCharacters) {
+      out.push(current);
+      current = [];
+      size = 0;
     }
-    if (budget.candidates > SECRET_VIEW_LIMITS.maxCandidates) return;
+    current.push(text);
+    size += text.length;
   }
+  if (current.length) out.push(current);
+  return out;
 }
 function inspectArgumentSecrets(args) {
-  const budget = { views: 0, bytes: 0, candidates: 0, reasons: /* @__PURE__ */ new Set() };
+  const budget = newSecretViewBudget();
   const ancestors = /* @__PURE__ */ new Set();
   let nodes = 0;
   let sourceBytes = 0;
   let tailBytes = 0;
   let best = null;
+  const blocked = () => best?.severity === "block";
   const accept = (match) => {
     if (match && (!best || best.severity !== "block" && match.severity === "block")) best = match;
   };
+  const decodeSegment = (segment, fieldPath) => {
+    for (const batch of batches(secretViews(segment, budget))) {
+      accept(matchArgumentBatch(batch, fieldPath, budget));
+      if (blocked()) return;
+    }
+  };
   const visit2 = (value, depth, fieldPath) => {
+    if (blocked()) return;
     if (++nodes > ARGUMENT_SCAN_LIMITS.maxNodes) {
       budget.reasons.add("argument-nodes");
       return;
@@ -4518,14 +4712,11 @@ function inspectArgumentSecrets(args) {
     }
     sourceBytes += Math.min(bytes, Math.max(0, remaining));
     if (!text) return;
-    for (const view of secretViews(text, budget)) {
-      const hit = matchArgumentText(view.text, fieldPath, budget);
-      if (hit)
-        accept(view.transforms.length ? { ...hit, redactedSample: "[encoded secret]" } : hit);
-    }
+    accept(matchArgumentText(text, fieldPath, budget));
+    let scannedEnd = text.length;
     if (!truncated && value.length > window) {
-      budget.reasons.add("decode-window");
       for (let start = window - overlap; start < value.length; start += window - overlap) {
+        if (blocked()) return;
         const chunk2 = value.slice(start, start + window);
         const chunkBytes = Buffer.byteLength(chunk2);
         if (tailBytes + chunkBytes > ARGUMENT_SCAN_LIMITS.maxTailBytes) {
@@ -4534,9 +4725,16 @@ function inspectArgumentSecrets(args) {
         }
         tailBytes += chunkBytes;
         accept(matchArgumentText(chunk2, fieldPath, budget));
+        scannedEnd = start + chunk2.length;
         if (start + window >= value.length) break;
       }
     }
+    for (let start = 0; start < scannedEnd && !blocked(); ) {
+      let end = Math.min(start + window, scannedEnd);
+      while (end < scannedEnd && runChar(value, end - 1) && runChar(value, end)) end++;
+      decodeSegment(value.slice(start, end), fieldPath);
+      start = end;
+    }
     const trimmed = text.trim();
     if (value.length < ARGUMENT_SCAN_LIMITS.maxJsonCharacters && (trimmed.startsWith("{") || trimmed.startsWith("["))) {
       try {
@@ -4555,7 +4753,7 @@ function inspectArgumentSecrets(args) {
 function scanArgumentSecrets(args) {
   const result = inspectArgumentSecrets(args);
   if (result.match) return result.match;
-  return result.reasons.some((reason) => reason.startsWith("argument-")) ? {
+  return result.coverage === "incomplete" ? {
     patternName: "Argument inspection incomplete",
     fieldPath: "args",
     redactedSample: "[uninspected content]",
@@ -4583,18 +4781,13 @@ function tokenize2(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
 }
 function extractShellCommand(toolName, args, toolInspection) {
-  const patterns = Object.keys(toolInspection);
-  const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
-  if (!matchingPattern) return null;
-  const fieldPath = toolInspection[matchingPattern];
+  const fieldPath = inspectionEntry(toolName, toolInspection);
+  if (fieldPath === void 0) return null;
   const value = getNestedValue(args, typeof fieldPath === "string" ? fieldPath : fieldPath.field);
   return typeof value === "string" ? value : null;
 }
 function isSqlTool(toolName, toolInspection) {
-  const patterns = Object.keys(toolInspection);
-  const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
-  if (!matchingPattern) return false;
-  const fieldName = toolInspection[matchingPattern];
+  const fieldName = inspectionEntry(toolName, toolInspection);
   return fieldName === "sql" || fieldName === "query";
 }
 function pipeChainVerdict(command, isTrustedHost2, highAction = "review") {
@@ -4661,9 +4854,10 @@ function egressPolicyVerdict(eg) {
 }
 async function evaluatePolicy(config, toolName, args, context = {}, hooks = {}) {
   let protectedVerdict = null;
+  const layers = inspectionLayers(config.policy);
   if (context.agent !== "Terminal") {
     try {
-      const accesses = context.accesses ?? collectFileAccesses(toolName, args, context, config.policy.toolInspection);
+      const accesses = context.accesses ?? collectFileAccesses(toolName, args, context, layers);
       protectedVerdict = evaluateProtectedFileAccess(accesses, context, catalogSettings(config));
     } catch {
       protectedVerdict = incompleteFileVerdict();
@@ -4698,7 +4892,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     hooks
   );
   if (result.decision === "block") return result;
-  if (context.agent !== "Terminal" && resolveShellInput(toolName, args, config.policy.toolInspection).kind === "uninspectable") {
+  if (context.agent !== "Terminal" && resolveShellInput(toolName, args, layers).kind === "uninspectable") {
     return {
       decision: "review",
       ruleName: "shell-inspection-incomplete",
@@ -4714,13 +4908,14 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
   const { agent, cwd, activeEnvironment } = context;
   const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2 } = hooks;
   const settingsView = catalogSettings(config);
+  const layers = inspectionLayers(config.policy);
   const cv = (id) => checkValue(settingsView, id);
   let loggedFinding;
   const noteLogged = (v) => {
     if (v?.logged && !loggedFinding) loggedFinding = v;
   };
   const allowed = () => loggedFinding ?? { decision: "allow" };
-  const shellInput = resolveShellInput(toolName, args, config.policy.toolInspection);
+  const shellInput = resolveShellInput(toolName, args, layers);
   const wouldBeIgnored = matchesPattern(toolName, config.policy.ignoredTools);
   {
     const dest = ssrfDestinationFloor(toolName, args, {
@@ -4825,13 +5020,10 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       return { id, value: cv(id) };
     };
     const matches = config.policy.smartRules.filter((rule) => {
-      if (!toolMatchesRule(toolName, rule.tool, config.policy.toolInspection)) return false;
+      if (!toolMatchesRule(toolName, rule.tool, layers)) return false;
       if (astSuppressed(rule)) return false;
       if (rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") return false;
-      if (!evaluateSmartConditions(
-        shellRuleArgs(toolName, args, rule.tool, config.policy.toolInspection),
-        rule
-      ))
+      if (!evaluateSmartConditions(shellRuleArgs(toolName, args, rule.tool, layers), rule))
         return false;
       const check = ruleCheck(rule);
       if (check?.value === "off") return false;
@@ -4878,7 +5070,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
   let allTokens = [];
   let pathTokens = [];
   if (pendingToolEgress) return pendingToolEgress;
-  const shellCommand = shellInput.kind === "shell" ? shellInput.command : shellInput.kind === "not-shell" ? extractShellCommand(toolName, args, config.policy.toolInspection) : null;
+  const shellCommand = shellInput.kind === "shell" ? shellInput.command : shellInput.kind === "not-shell" ? extractShellCommand(toolName, args, layers) : null;
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
@@ -4955,7 +5147,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     if (["ssh", "scp", "rsync"].includes(firstToken)) {
       const rawTokens = shellCommand.trim().split(/\s+/);
       const sshHosts = extractAllSshHosts(rawTokens.slice(1));
-      allTokens.push(...sshHosts);
+      allTokens = allTokens.concat(sshHosts);
     }
     if (firstToken && firstToken.startsWith("/") && checkProvenance2) {
       const prov = checkProvenance2(firstToken, cwd);
@@ -4984,7 +5176,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
         };
       }
     }
-    if (isSqlTool(toolName, config.policy.toolInspection)) {
+    if (isSqlTool(toolName, layers)) {
       allTokens = allTokens.filter((t) => !SQL_DML_KEYWORDS.has(t.toLowerCase()));
     }
   } else {
@@ -4992,7 +5184,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     if (args && typeof args === "object") {
       const flattenedArgs = JSON.stringify(args).toLowerCase();
       const extraTokens = flattenedArgs.split(/[^a-zA-Z0-9]+/).filter((t) => t.length > 1);
-      allTokens.push(...extraTokens);
+      allTokens = allTokens.concat(extraTokens);
     }
   }
   const isManual = agent === "Terminal";
@@ -6287,7 +6479,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_picomatch, import_safe_regex2, import_picomatch2, import_mvdan_sh, import_safe_regex22, import_mvdan_sh2, import_safe_regex23, import_crypto2, import_crypto3, import_mvdan_sh3, import_mvdan_sh4, import_crypto4, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, CHECK_GROUPS, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, syntax2, MAX_ALTERNATIVES, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, INVISIBLE_RE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, SECRET_VIEW_LIMITS, ARGUMENT_SCAN_LIMITS, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
+var import_picomatch, import_safe_regex2, import_picomatch2, import_mvdan_sh, import_safe_regex22, import_mvdan_sh2, import_safe_regex23, import_crypto2, import_crypto3, import_mvdan_sh3, import_mvdan_sh4, import_crypto4, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, CHECK_GROUPS, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, SECRET_VIEW_LIMITS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -8672,7 +8864,23 @@ var init_dist = __esm({
       "shell",
       "exec_command"
     ]);
-    MCP_EXECUTORS = /* @__PURE__ */ new Set([...BASH_TOOL_NAMES, "exec", "run_command", "terminal"]);
+    MCP_EXECUTORS = /* @__PURE__ */ new Set([
+      ...BASH_TOOL_NAMES,
+      "exec",
+      "run_command",
+      "terminal",
+      "execute_command",
+      "execute_shell",
+      "execute_shell_command",
+      "shell_execute",
+      "run_shell",
+      "run_terminal_command",
+      "start_process"
+    ]);
+    BUILTIN_FIELDS = ["command", "cmd", "script"];
+    ARGV_FIELDS = ["args", "argv"];
+    BARE_WORD = /^[A-Za-z0-9_./+:@%,-]+$/;
+    MAX_ARGV_CHARACTERS = 262144;
     ({ syntax: syntax2 } = import_mvdan_sh2.default);
     MAX_ALTERNATIVES = 64;
     MAX_DEPTH = 64;
@@ -10798,6 +11006,7 @@ zoo`.split("\n");
     indices = new Map(BIP39_ENGLISH.map((word, i) => [word, i]));
     lengths = [24, 21, 18, 15, 12];
     hash = (value) => (0, import_crypto2.createHash)("sha256").update(value).digest();
+    MAX_MNEMONIC_HASHES = 25e3;
     IBAN_LENGTH = {
       AD: 24,
       AE: 23,
@@ -10905,6 +11114,7 @@ zoo`.split("\n");
     CASK_TWO_ZERO_SUFFIX = /* @__PURE__ */ new Set([..."AEIMQUYcgkosw048"]);
     CASK_FOUR_ZERO_SUFFIX = /* @__PURE__ */ new Set([..."AQgw"]);
     INVISIBLE_RE = /[­͏؜᠎​-‏‪-‮⁠-⁤-︀-️]|[\u{E0000}-\u{E007F}]/gu;
+    INVISIBLE_ONE = new RegExp(`^(?:${INVISIBLE_RE.source.split("|")[0]})$`, "u");
     HOMOGLYPHS = {
       // Cyrillic lowercase
       \u0430: "a",
@@ -11611,6 +11821,7 @@ zoo`.split("\n");
       /** Max nesting depth walked; anything deeper is NOT scanned. */
       maxDepth: MAX_DEPTH2
     };
+    BATCH_SEPARATOR = "\n";
     ({ syntax: syntax3 } = import_mvdan_sh3.default);
     NPM_INSTALL_VERBS = /* @__PURE__ */ new Set([
       "install",
@@ -12080,16 +12291,24 @@ zoo`.split("\n");
       ["browser_batch", ["actions[].input.url"]]
     ]);
     SECRET_VIEW_LIMITS = {
+      /** A decoded text that itself decodes is followed this many layers; a deeper layer is reviewed. */
       maxDepth: 4,
-      maxViewsPerLeaf: 64,
-      maxViews: 256,
-      maxDerivedBytes: 1048576,
-      maxCandidates: 4096
+      /** Nested views per parent view, and nested text per call; past either the call is reviewed. */
+      maxNestedViewsPerLeaf: 64,
+      maxNestedBytes: 1048576,
+      /** Joined hostname-label text per call; past it the call is reviewed. */
+      maxJoinedLabelBytes: 1048576,
+      /** Decoded fragments are matched in batches of about this many characters. */
+      batchCharacters: 65536,
+      /** Only a valid DNS name has its labels joined. */
+      maxHostLength: 253,
+      maxLabelLength: 63,
+      maxLabels: 127
     };
     ARGUMENT_SCAN_LIMITS = {
       maxDepth: 12,
       maxNodes: 16384,
-      /** Raw text is matched in windows of this size; decoding views use the first window. */
+      /** Text is matched and decoded in windows of this size. */
       maxStringCharacters: 1e5,
       /** Windows overlap by this much so a token on a window edge is still seen whole. */
       windowOverlap: 4096,
@@ -12099,6 +12318,11 @@ zoo`.split("\n");
       maxTailBytes: 4194304,
       maxJsonCharacters: 1e4
     };
+    RUN_CHAR = /[A-Za-z0-9+/=_%\\.-]/;
+    runChar = (value, index) => {
+      const char = value[index] ?? "";
+      return RUN_CHAR.test(char) || char !== "" && isInvisibleChar(char);
+    };
     VERDICT_RANK = {
       allow: 0,
       review: 1,
@@ -12358,7 +12582,7 @@ zoo`.split("\n");
       { view: "separators-stripped", decoder: "separators", stripped: true }
     ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v25";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v26";
     DEDUPE_PREVIEW_LEN = 120;
     ENGINE_VERSION = "1.4.0";
   }
@@ -12484,6 +12708,10 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     taintFromEid: meta.taintFromEid,
     ...meta.taintSource && { taintSource: meta.taintSource }
   } : {};
+  const exposureFields = {
+    ...meta?.exposure ? { exposure: meta.exposure } : {},
+    ...meta?.exposureFromEid ? { exposureFromEid: meta.exposureFromEid } : {}
+  };
   const eid = generateEventId();
   appendToLog(LOCAL_AUDIT_LOG, {
     // eid first: the outbox shipper dedups on it, and a fixed leading field
@@ -12506,6 +12734,7 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
     ...loopCountField,
     ...transcriptPathField,
     ...taintFields,
+    ...exposureFields,
     ...testRun,
     agent: meta?.agent,
     mcpServer: meta?.mcpServer,
@@ -12538,6 +12767,82 @@ var init_audit = __esm({
   }
 });
 
+// src/auth/trusted-recipients.ts
+function getTrustedRecipientsPath() {
+  return import_path2.default.join(import_os2.default.homedir(), ".node9", "trusted-recipients.json");
+}
+function readTrustedRecipients() {
+  try {
+    const raw = import_fs2.default.readFileSync(getTrustedRecipientsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed.entries) ? parsed.entries.filter((e) => e && typeof e.value === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function writeTrustedRecipients(entries) {
+  const filePath = getTrustedRecipientsPath();
+  import_fs2.default.mkdirSync(import_path2.default.dirname(filePath), { recursive: true });
+  const tmp = filePath + ".node9-tmp";
+  import_fs2.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
+  import_fs2.default.renameSync(tmp, filePath);
+}
+function normalizeRecipient(raw) {
+  const v = raw.trim();
+  if (!v) return null;
+  if (/^(email|host|iban):/i.test(v)) {
+    const i = v.indexOf(":");
+    const kind = v.slice(0, i).toLowerCase();
+    const inner = normalizeRecipient(v.slice(i + 1));
+    return inner && inner.startsWith(`${kind}:`) ? inner : null;
+  }
+  const found = extractArgDestinations({ to: v });
+  return found.length === 1 ? found[0] : null;
+}
+function addTrustedRecipient(raw, addedBy = "user") {
+  const value = normalizeRecipient(raw);
+  if (!value) return null;
+  const entries = readTrustedRecipients();
+  if (!entries.some((e) => e.value === value)) {
+    entries.push({ value, addedAt: Date.now(), addedBy });
+    writeTrustedRecipients(entries);
+  }
+  return value;
+}
+function removeTrustedRecipient(raw) {
+  const value = normalizeRecipient(raw) ?? raw.trim();
+  const entries = readTrustedRecipients();
+  const next = entries.filter((e) => e.value !== value);
+  if (next.length === entries.length) return false;
+  writeTrustedRecipients(next);
+  return true;
+}
+function mtimeOf() {
+  try {
+    return import_fs2.default.statSync(getTrustedRecipientsPath()).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function isTrustedRecipient(value) {
+  const mtime = mtimeOf();
+  if (!cache || cache.mtime !== mtime) {
+    cache = { mtime, values: new Set(readTrustedRecipients().map((e) => e.value)) };
+  }
+  return cache.values.has(value);
+}
+var import_fs2, import_path2, import_os2, cache;
+var init_trusted_recipients = __esm({
+  "src/auth/trusted-recipients.ts"() {
+    "use strict";
+    import_fs2 = __toESM(require("fs"));
+    import_path2 = __toESM(require("path"));
+    import_os2 = __toESM(require("os"));
+    init_dist();
+    cache = null;
+  }
+});
+
 // src/config-schema.ts
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
@@ -12815,7 +13120,7 @@ function loadUserShields() {
   const result = {};
   let entries;
   try {
-    entries = import_fs2.default.readdirSync(USER_SHIELDS_DIR).filter((f) => f.endsWith(".json"));
+    entries = import_fs3.default.readdirSync(USER_SHIELDS_DIR).filter((f) => f.endsWith(".json"));
   } catch (err2) {
     if (err2.code !== "ENOENT") {
       process.stderr.write(
@@ -12826,9 +13131,9 @@ function loadUserShields() {
     return result;
   }
   for (const file2 of entries) {
-    const filePath = import_path2.default.join(USER_SHIELDS_DIR, file2);
+    const filePath = import_path3.default.join(USER_SHIELDS_DIR, file2);
     try {
-      const raw = JSON.parse(import_fs2.default.readFileSync(filePath, "utf-8"));
+      const raw = JSON.parse(import_fs3.default.readFileSync(filePath, "utf-8"));
       const v = validateShieldDefinition(raw);
       if ("error" in v) {
         process.stderr.write(`[node9] ${v.error}: ${filePath}
@@ -12863,7 +13168,7 @@ function listShields() {
 }
 function readShieldsFile() {
   try {
-    const raw = import_fs2.default.readFileSync(SHIELDS_STATE_FILE, "utf-8");
+    const raw = import_fs3.default.readFileSync(SHIELDS_STATE_FILE, "utf-8");
     if (!raw.trim()) return { active: [] };
     const parsed = JSON.parse(raw);
     const active = Array.isArray(parsed.active) ? parsed.active.filter(
@@ -12884,12 +13189,12 @@ function readShieldsFile() {
   }
 }
 function writeShieldsFile(data) {
-  import_fs2.default.mkdirSync(import_path2.default.dirname(SHIELDS_STATE_FILE), { recursive: true });
+  import_fs3.default.mkdirSync(import_path3.default.dirname(SHIELDS_STATE_FILE), { recursive: true });
   const tmp = `${SHIELDS_STATE_FILE}.${import_crypto6.default.randomBytes(6).toString("hex")}.tmp`;
   const toWrite = { active: data.active };
   if (data.overrides && Object.keys(data.overrides).length > 0) toWrite.overrides = data.overrides;
-  import_fs2.default.writeFileSync(tmp, JSON.stringify(toWrite, null, 2), { mode: 384 });
-  import_fs2.default.renameSync(tmp, SHIELDS_STATE_FILE);
+  import_fs3.default.writeFileSync(tmp, JSON.stringify(toWrite, null, 2), { mode: 384 });
+  import_fs3.default.renameSync(tmp, SHIELDS_STATE_FILE);
 }
 function readActiveShields() {
   return readShieldsFile().active;
@@ -12973,25 +13278,25 @@ function installShield(name, shieldJson) {
   if (v.ok.name !== name) {
     throw new Error(`Shield name mismatch: file declares '${v.ok.name}' but expected '${name}'`);
   }
-  import_fs2.default.mkdirSync(USER_SHIELDS_DIR, { recursive: true });
-  const filePath = import_path2.default.join(USER_SHIELDS_DIR, `${name}.json`);
+  import_fs3.default.mkdirSync(USER_SHIELDS_DIR, { recursive: true });
+  const filePath = import_path3.default.join(USER_SHIELDS_DIR, `${name}.json`);
   const tmp = `${filePath}.${import_crypto6.default.randomBytes(6).toString("hex")}.tmp`;
-  import_fs2.default.writeFileSync(tmp, JSON.stringify(shieldJson, null, 2), { mode: 384 });
-  import_fs2.default.renameSync(tmp, filePath);
+  import_fs3.default.writeFileSync(tmp, JSON.stringify(shieldJson, null, 2), { mode: 384 });
+  import_fs3.default.renameSync(tmp, filePath);
 }
-var import_fs2, import_path2, import_os2, import_crypto6, USER_SHIELDS_DIR, SHIELDS, SHIELDS_STATE_FILE, RULE_KEY_MIGRATIONS, USER_SHIELDS_DIR_PATH;
+var import_fs3, import_path3, import_os3, import_crypto6, USER_SHIELDS_DIR, SHIELDS, SHIELDS_STATE_FILE, RULE_KEY_MIGRATIONS, USER_SHIELDS_DIR_PATH;
 var init_shields = __esm({
   "src/shields.ts"() {
     "use strict";
-    import_fs2 = __toESM(require("fs"));
-    import_path2 = __toESM(require("path"));
-    import_os2 = __toESM(require("os"));
+    import_fs3 = __toESM(require("fs"));
+    import_path3 = __toESM(require("path"));
+    import_os3 = __toESM(require("os"));
     import_crypto6 = __toESM(require("crypto"));
     init_dist();
     init_dist();
-    USER_SHIELDS_DIR = import_path2.default.join(import_os2.default.homedir(), ".node9", "shields");
+    USER_SHIELDS_DIR = import_path3.default.join(import_os3.default.homedir(), ".node9", "shields");
     SHIELDS = buildSHIELDS();
-    SHIELDS_STATE_FILE = import_path2.default.join(import_os2.default.homedir(), ".node9", "shields.json");
+    SHIELDS_STATE_FILE = import_path3.default.join(import_os3.default.homedir(), ".node9", "shields.json");
     RULE_KEY_MIGRATIONS = [
       // 2026-05-21 — project-jail .env reads promoted review → block. Renamed
       // so the key honestly describes the verdict. Credential-file rules
@@ -13226,11 +13531,11 @@ var init_build = __esm({
 
 // src/auth/trusted-hosts.ts
 function getTrustedHostsPath() {
-  return import_path3.default.join(import_os3.default.homedir(), ".node9", "trusted-hosts.json");
+  return import_path4.default.join(import_os4.default.homedir(), ".node9", "trusted-hosts.json");
 }
 function readTrustedHosts() {
   try {
-    const raw = import_fs3.default.readFileSync(getTrustedHostsPath(), "utf8");
+    const raw = import_fs4.default.readFileSync(getTrustedHostsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.hosts) ? parsed.hosts : [];
   } catch {
@@ -13239,7 +13544,7 @@ function readTrustedHosts() {
 }
 function getFileMtime() {
   try {
-    return import_fs3.default.statSync(getTrustedHostsPath()).mtimeMs;
+    return import_fs4.default.statSync(getTrustedHostsPath()).mtimeMs;
   } catch {
     return 0;
   }
@@ -13256,10 +13561,10 @@ function getCachedHosts() {
 }
 function writeTrustedHosts(hosts) {
   const filePath = getTrustedHostsPath();
-  import_fs3.default.mkdirSync(import_path3.default.dirname(filePath), { recursive: true });
+  import_fs4.default.mkdirSync(import_path4.default.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
-  import_fs3.default.writeFileSync(tmp, JSON.stringify({ hosts }, null, 2), { mode: 384 });
-  import_fs3.default.renameSync(tmp, filePath);
+  import_fs4.default.writeFileSync(tmp, JSON.stringify({ hosts }, null, 2), { mode: 384 });
+  import_fs4.default.renameSync(tmp, filePath);
   _cache = { hosts, expiry: Date.now() + CACHE_TTL_MS, mtime: getFileMtime() };
 }
 function addTrustedHost(host2) {
@@ -13304,13 +13609,13 @@ function isTrustedHost(host2) {
     getCachedHosts().map((entry) => entry.host)
   );
 }
-var import_fs3, import_path3, import_os3, _cache, CACHE_TTL_MS;
+var import_fs4, import_path4, import_os4, _cache, CACHE_TTL_MS;
 var init_trusted_hosts = __esm({
   "src/auth/trusted-hosts.ts"() {
     "use strict";
-    import_fs3 = __toESM(require("fs"));
-    import_path3 = __toESM(require("path"));
-    import_os3 = __toESM(require("os"));
+    import_fs4 = __toESM(require("fs"));
+    import_path4 = __toESM(require("path"));
+    import_os4 = __toESM(require("os"));
     _cache = null;
     CACHE_TTL_MS = 5e3;
   }
@@ -13589,9 +13894,9 @@ function _resetConfigCache() {
 }
 function getGlobalSettings() {
   try {
-    const globalConfigPath2 = import_path4.default.join(import_os4.default.homedir(), ".node9", "config.json");
-    if (import_fs4.default.existsSync(globalConfigPath2)) {
-      const raw = JSON.parse(import_fs4.default.readFileSync(globalConfigPath2, "utf-8"));
+    const globalConfigPath2 = import_path5.default.join(import_os5.default.homedir(), ".node9", "config.json");
+    if (import_fs5.default.existsSync(globalConfigPath2)) {
+      const raw = JSON.parse(import_fs5.default.readFileSync(globalConfigPath2, "utf-8"));
       const parsed = isV2File(raw) ? v2ToLegacy(raw).legacy : raw;
       const settings = parsed.settings || {};
       return {
@@ -13620,8 +13925,8 @@ function noteRejectedApiUrl(raw) {
   if (rejectedApiUrlsSeen.has(key)) return;
   rejectedApiUrlsSeen.add(key);
   try {
-    import_fs4.default.appendFileSync(
-      import_path4.default.join(import_os4.default.homedir(), ".node9", "hook-debug.log"),
+    import_fs5.default.appendFileSync(
+      import_path5.default.join(import_os5.default.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] REFUSED apiUrl, using the default instead: ${String(raw).slice(0, 200).replace(/[\r\n]+/g, " ")}
 `
     );
@@ -13638,9 +13943,9 @@ function getCredentials() {
     };
   }
   try {
-    const credPath = import_path4.default.join(import_os4.default.homedir(), ".node9", "credentials.json");
-    if (import_fs4.default.existsSync(credPath)) {
-      const creds = JSON.parse(import_fs4.default.readFileSync(credPath, "utf-8"));
+    const credPath = import_path5.default.join(import_os5.default.homedir(), ".node9", "credentials.json");
+    if (import_fs5.default.existsSync(credPath)) {
+      const creds = JSON.parse(import_fs5.default.readFileSync(credPath, "utf-8"));
       const profileName = process.env.NODE9_PROFILE || "default";
       const profile = creds[profileName];
       if (typeof profile?.apiKey === "string" && profile.apiKey.length > 0) {
@@ -13672,7 +13977,7 @@ function readRulesCacheResilient(cacheFile) {
   for (let attempt = 0; attempt < 3; attempt++) {
     let content;
     try {
-      content = import_fs4.default.readFileSync(cacheFile, "utf-8");
+      content = import_fs5.default.readFileSync(cacheFile, "utf-8");
       existed = true;
     } catch (err2) {
       if (err2.code === "ENOENT") return {};
@@ -13687,10 +13992,10 @@ function readRulesCacheResilient(cacheFile) {
     }
   }
   if (existed || sawReadError) {
-    const backup = import_path4.default.join(import_path4.default.dirname(cacheFile), "rules-cache.last-good.json");
+    const backup = import_path5.default.join(import_path5.default.dirname(cacheFile), "rules-cache.last-good.json");
     if (backup !== cacheFile) {
       try {
-        const raw = JSON.parse(import_fs4.default.readFileSync(backup, "utf-8"));
+        const raw = JSON.parse(import_fs5.default.readFileSync(backup, "utf-8"));
         logCacheReadIssue(cacheFile, "RULES_CACHE_CORRUPT_USED_BACKUP");
         lastParsedRulesCache = raw;
         return raw;
@@ -13710,8 +14015,8 @@ function logCacheReadIssue(cacheFile, kind) {
   if (now - cacheReadLastLoggedAt < CACHE_LOG_REARM_MS) return;
   cacheReadLastLoggedAt = now;
   try {
-    import_fs4.default.appendFileSync(
-      import_path4.default.join(import_os4.default.homedir(), ".node9", "hook-debug.log"),
+    import_fs5.default.appendFileSync(
+      import_path5.default.join(import_os5.default.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] ${kind} ${cacheFile}
 `
     );
@@ -13723,8 +14028,8 @@ function catalogSettingsFrom(settings, policy) {
 }
 function getConfig(cwd) {
   if (!cwd && cachedConfig) return cachedConfig;
-  const globalPath = import_path4.default.join(import_os4.default.homedir(), ".node9", "config.json");
-  const projectPath = import_path4.default.join(cwd ?? process.cwd(), "node9.config.json");
+  const globalPath = import_path5.default.join(import_os5.default.homedir(), ".node9", "config.json");
+  const projectPath = import_path5.default.join(cwd ?? process.cwd(), "node9.config.json");
   const globalConfig = tryLoadConfig(globalPath);
   const projectConfig = tryLoadConfig(projectPath, { project: true });
   const mergedSettings = {
@@ -13737,6 +14042,7 @@ function getConfig(cwd) {
     dangerousWords: [...DEFAULT_CONFIG.policy.dangerousWords],
     ignoredTools: [...DEFAULT_CONFIG.policy.ignoredTools],
     toolInspection: { ...DEFAULT_CONFIG.policy.toolInspection },
+    projectToolInspection: {},
     // Shipped rules carry `builtin`: the catalog's per-check value governs
     // them and only them (a user rule that reuses a name keeps its verdict).
     smartRules: DEFAULT_CONFIG.policy.smartRules.map((r) => ({ ...r, builtin: true })),
@@ -13763,7 +14069,8 @@ function getConfig(cwd) {
     untrustedContent: {
       ...DEFAULT_CONFIG.policy.untrustedContent,
       orgDomains: [...DEFAULT_CONFIG.policy.untrustedContent.orgDomains],
-      roles: {}
+      roles: {},
+      trustedRecipients: []
     },
     // Left empty on purpose: the local file is read fresh at policy-eval time
     // (getCachedHosts via isTrustedHost), NOT snapshotted into the frozen config
@@ -13809,8 +14116,14 @@ function getConfig(cwd) {
     if (p.sandboxPaths) mergedPolicy.sandboxPaths.push(...p.sandboxPaths);
     if (p.ignoredTools) mergedPolicy.ignoredTools.push(...p.ignoredTools);
     if (p.dangerousWords) mergedPolicy.dangerousWords = [...p.dangerousWords];
-    if (p.toolInspection)
-      mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
+    if (p.toolInspection) {
+      if (isProject)
+        mergedPolicy.projectToolInspection = {
+          ...mergedPolicy.projectToolInspection,
+          ...p.toolInspection
+        };
+      else mergedPolicy.toolInspection = { ...mergedPolicy.toolInspection, ...p.toolInspection };
+    }
     if (p.smartRules) {
       const defaultBlocks = mergedPolicy.smartRules.filter((r) => r.verdict === "block");
       const defaultNonBlocks = mergedPolicy.smartRules.filter((r) => r.verdict !== "block");
@@ -13958,7 +14271,7 @@ function getConfig(cwd) {
   let cloudMandatesEnforcement = false;
   let cloudMandatesAppPerm = false;
   {
-    const cacheFile = import_path4.default.join(import_os4.default.homedir(), ".node9", "rules-cache.json");
+    const cacheFile = import_path5.default.join(import_os5.default.homedir(), ".node9", "rules-cache.json");
     try {
       const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
@@ -14351,10 +14664,10 @@ function getConfig(cwd) {
 }
 function tryLoadConfig(filePath, options = {}) {
   v2ChecksByPath.delete(filePath);
-  if (!import_fs4.default.existsSync(filePath)) return null;
+  if (!import_fs5.default.existsSync(filePath)) return null;
   let raw;
   try {
-    raw = JSON.parse(import_fs4.default.readFileSync(filePath, "utf-8"));
+    raw = JSON.parse(import_fs5.default.readFileSync(filePath, "utf-8"));
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
     process.stderr.write(
@@ -14429,6 +14742,13 @@ function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false
     if (replaceLists) cur.orgDomains = domains;
     else for (const d of domains) if (!cur.orgDomains.includes(d)) cur.orgDomains.push(d);
   }
+  if (replaceLists && Array.isArray(uc.trustedRecipients)) {
+    cur.trustedRecipients = [
+      ...new Set(
+        uc.trustedRecipients.filter((v) => typeof v === "string").map((v) => normalizeRecipient(v)).filter((v) => v !== null)
+      )
+    ].slice(0, 200);
+  }
   if (uc.roles && typeof uc.roles === "object" && !Array.isArray(uc.roles)) {
     const next = replaceLists ? {} : cur.roles;
     for (const [server, tools] of Object.entries(uc.roles)) {
@@ -14445,13 +14765,14 @@ function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false
     cur.roles = next;
   }
 }
-var import_fs4, import_path4, import_os4, DANGEROUS_WORDS, RUNTIME_ONLY_CONFIG_KEYS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, rejectedApiUrlsSeen, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt, v2ChecksByPath, KNOB_TO_CHECK;
+var import_fs5, import_path5, import_os5, DANGEROUS_WORDS, RUNTIME_ONLY_CONFIG_KEYS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, rejectedApiUrlsSeen, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt, v2ChecksByPath, KNOB_TO_CHECK;
 var init_config = __esm({
   "src/config/index.ts"() {
     "use strict";
-    import_fs4 = __toESM(require("fs"));
-    import_path4 = __toESM(require("path"));
-    import_os4 = __toESM(require("os"));
+    init_trusted_recipients();
+    import_fs5 = __toESM(require("fs"));
+    import_path5 = __toESM(require("path"));
+    import_os5 = __toESM(require("os"));
     init_config_schema();
     init_shields();
     init_managed();
@@ -14706,7 +15027,8 @@ var init_config = __esm({
           spotlight: true,
           afterExposure: "ask-once",
           orgDomains: [],
-          roles: {}
+          roles: {},
+          trustedRecipients: []
         },
         trustedHosts: [],
         trustedHostsManaged: false,
@@ -14803,24 +15125,24 @@ function scanFilePath(filePath, cwd = process.cwd(), options = {}) {
   if (!filePath) return null;
   let resolved;
   try {
-    const absolute = import_path5.default.resolve(cwd, filePath);
-    resolved = import_fs5.default.realpathSync.native(absolute);
+    const absolute = import_path6.default.resolve(cwd, filePath);
+    resolved = import_fs6.default.realpathSync.native(absolute);
   } catch (err2) {
     const code2 = err2.code;
     if (code2 === "ENOENT" || code2 === "ENOTDIR") {
-      resolved = import_path5.default.resolve(cwd, filePath);
+      resolved = import_path6.default.resolve(cwd, filePath);
     } else {
       return sensitivePathMatch(filePath);
     }
   }
   return matchSensitivePath2(resolved, filePath, options);
 }
-var import_fs5, import_path5;
+var import_fs6, import_path6;
 var init_dlp = __esm({
   "src/dlp.ts"() {
     "use strict";
-    import_fs5 = __toESM(require("fs"));
-    import_path5 = __toESM(require("path"));
+    import_fs6 = __toESM(require("fs"));
+    import_path6 = __toESM(require("path"));
     init_dist();
     init_dist();
   }
@@ -14829,24 +15151,24 @@ var init_dlp = __esm({
 // src/policy/file-access.ts
 function absoluteSpelling(p, cwd, home) {
   if (p === "~" || p.startsWith("~/")) p = home + p.slice(1);
-  return import_path6.default.isAbsolute(p) ? p : `${cwd}/${p}`;
+  return import_path7.default.isAbsolute(p) ? p : `${cwd}/${p}`;
 }
 function physical(p, followFinal, links = 0) {
   if (links > 40) throw new Error("Too many symbolic links");
   if (!followFinal) {
-    const parent = physical(import_path6.default.dirname(p), true, links);
-    return { path: `${parent.path}/${import_path6.default.basename(p)}`, missing: parent.missing };
+    const parent = physical(import_path7.default.dirname(p), true, links);
+    return { path: `${parent.path}/${import_path7.default.basename(p)}`, missing: parent.missing };
   }
   try {
-    return { path: import_fs6.default.realpathSync.native(p), missing: false };
+    return { path: import_fs7.default.realpathSync.native(p), missing: false };
   } catch (error) {
     const code2 = error.code;
     if (!["ENOENT", "ENOTDIR"].includes(code2 ?? "")) throw error;
     try {
-      if (import_fs6.default.lstatSync(p).isSymbolicLink()) {
-        const target = import_fs6.default.readlinkSync(p);
+      if (import_fs7.default.lstatSync(p).isSymbolicLink()) {
+        const target = import_fs7.default.readlinkSync(p);
         return physical(
-          import_path6.default.isAbsolute(target) ? target : `${import_path6.default.dirname(p)}/${target}`,
+          import_path7.default.isAbsolute(target) ? target : `${import_path7.default.dirname(p)}/${target}`,
           true,
           links + 1
         );
@@ -14855,13 +15177,13 @@ function physical(p, followFinal, links = 0) {
       if (!["ENOENT", "ENOTDIR"].includes(linkError.code ?? ""))
         throw linkError;
     }
-    const parent = import_path6.default.dirname(p);
+    const parent = import_path7.default.dirname(p);
     if (parent === p) return { path: p, missing: true };
     const resolved = physical(parent, true, links);
-    return { path: `${resolved.path}/${import_path6.default.basename(p)}`, missing: true };
+    return { path: `${resolved.path}/${import_path7.default.basename(p)}`, missing: true };
   }
 }
-function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, home = import_os5.default.homedir()) {
+function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, home = import_os6.default.homedir()) {
   const context = { cwd, homeDirs: [home, "/root"] };
   const accesses = collectFileAccesses(tool, args, context, inspection);
   const handledPaths = /* @__PURE__ */ new Set();
@@ -14884,14 +15206,14 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
     const raw = absoluteSpelling(access.path, access.cwd ?? cwd, home);
     if (access.directoryTarget) {
       try {
-        if (!import_fs6.default.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
+        if (!import_fs7.default.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
           continue;
       } catch {
       }
     }
     if (access.operation === "create") {
       try {
-        import_fs6.default.statSync(raw);
+        import_fs7.default.statSync(raw);
         continue;
       } catch {
       }
@@ -14938,26 +15260,26 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
   }
   return { ...context, accesses: prepared, handledPaths };
 }
-var import_fs6, import_os5, import_path6;
+var import_fs7, import_os6, import_path7;
 var init_file_access = __esm({
   "src/policy/file-access.ts"() {
     "use strict";
-    import_fs6 = __toESM(require("fs"));
-    import_os5 = __toESM(require("os"));
-    import_path6 = __toESM(require("path"));
+    import_fs7 = __toESM(require("fs"));
+    import_os6 = __toESM(require("os"));
+    import_path7 = __toESM(require("path"));
     init_dist();
   }
 });
 
 // src/utils/provenance.ts
 function findInPath(cmd) {
-  if (import_path7.default.posix.isAbsolute(cmd)) return cmd;
+  if (import_path8.default.posix.isAbsolute(cmd)) return cmd;
   const pathEnv = process.env.PATH ?? "";
-  for (const dir2 of pathEnv.split(import_path7.default.delimiter)) {
+  for (const dir2 of pathEnv.split(import_path8.default.delimiter)) {
     if (!dir2) continue;
-    const full = import_path7.default.join(dir2, cmd);
+    const full = import_path8.default.join(dir2, cmd);
     try {
-      import_fs7.default.accessSync(full, import_fs7.default.constants.X_OK);
+      import_fs8.default.accessSync(full, import_fs8.default.constants.X_OK);
       return full;
     } catch {
     }
@@ -14968,7 +15290,7 @@ function _classifyPath(resolved, cwd) {
   if (cwd && resolved.startsWith(cwd + "/")) {
     return { trustLevel: "user", reason: "binary in project directory" };
   }
-  const osTmp = import_os6.default.tmpdir();
+  const osTmp = import_os7.default.tmpdir();
   const allSuspect = osTmp ? [...SUSPECT_PREFIXES, osTmp] : SUSPECT_PREFIXES;
   if (allSuspect.some((p) => resolved === p || resolved.startsWith(p + "/"))) {
     return { trustLevel: "suspect", reason: `binary in temp directory: ${resolved}` };
@@ -14986,7 +15308,7 @@ function _classifyPath(resolved, cwd) {
 }
 function checkProvenance(cmd, cwd) {
   const bare = cmd.startsWith("./") ? cmd.slice(2) : cmd;
-  if (import_path7.default.posix.isAbsolute(bare)) {
+  if (import_path8.default.posix.isAbsolute(bare)) {
     const early = _classifyPath(bare, cwd);
     if (early.trustLevel === "suspect") {
       return { resolvedPath: bare, ...early };
@@ -15002,7 +15324,7 @@ function checkProvenance(cmd, cwd) {
         reason: "binary not found in PATH"
       };
     }
-    resolved = import_fs7.default.realpathSync(found);
+    resolved = import_fs8.default.realpathSync(found);
   } catch {
     return {
       resolvedPath: cmd,
@@ -15011,7 +15333,7 @@ function checkProvenance(cmd, cwd) {
     };
   }
   try {
-    const stat = import_fs7.default.statSync(resolved);
+    const stat = import_fs8.default.statSync(resolved);
     if (stat.mode & 2) {
       return {
         resolvedPath: resolved,
@@ -15029,21 +15351,21 @@ function checkProvenance(cmd, cwd) {
   const classify = _classifyPath(resolved, cwd);
   return { resolvedPath: resolved, ...classify };
 }
-var import_fs7, import_path7, import_os6, SYSTEM_PREFIXES, MANAGED_PREFIXES, USER_PREFIXES, SUSPECT_PREFIXES;
+var import_fs8, import_path8, import_os7, SYSTEM_PREFIXES, MANAGED_PREFIXES, USER_PREFIXES, SUSPECT_PREFIXES;
 var init_provenance = __esm({
   "src/utils/provenance.ts"() {
     "use strict";
-    import_fs7 = __toESM(require("fs"));
-    import_path7 = __toESM(require("path"));
-    import_os6 = __toESM(require("os"));
+    import_fs8 = __toESM(require("fs"));
+    import_path8 = __toESM(require("path"));
+    import_os7 = __toESM(require("os"));
     SYSTEM_PREFIXES = ["/usr/bin", "/usr/sbin", "/bin", "/sbin"];
     MANAGED_PREFIXES = ["/usr/local/bin", "/opt/homebrew", "/home/linuxbrew", "/nix/store"];
     USER_PREFIXES = [
-      import_path7.default.join(import_os6.default.homedir(), "bin"),
-      import_path7.default.join(import_os6.default.homedir(), ".local", "bin"),
-      import_path7.default.join(import_os6.default.homedir(), ".cargo", "bin"),
-      import_path7.default.join(import_os6.default.homedir(), ".npm-global", "bin"),
-      import_path7.default.join(import_os6.default.homedir(), ".volta", "bin")
+      import_path8.default.join(import_os7.default.homedir(), "bin"),
+      import_path8.default.join(import_os7.default.homedir(), ".local", "bin"),
+      import_path8.default.join(import_os7.default.homedir(), ".cargo", "bin"),
+      import_path8.default.join(import_os7.default.homedir(), ".npm-global", "bin"),
+      import_path8.default.join(import_os7.default.homedir(), ".volta", "bin")
     ];
     SUSPECT_PREFIXES = ["/tmp", "/var/tmp", "/dev/shm"];
   }
@@ -15052,7 +15374,7 @@ var init_provenance = __esm({
 // src/policy/index.ts
 async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
   const config = opts?.config ?? getConfig(cwd);
-  const prepared = opts?.fileAccess ?? prepareFileAccesses(toolName, args, cwd, config.policy.toolInspection);
+  const prepared = opts?.fileAccess ?? prepareFileAccesses(toolName, args, cwd, inspectionLayers(config.policy));
   const activeEnvironment = getActiveEnvironment(config) ?? void 0;
   return evaluatePolicy(
     config,
@@ -15084,8 +15406,11 @@ function tokenize3(toolName) {
 }
 function explainExtractShellCommand(toolName, args, toolInspection) {
   const shell = resolveShellInput(toolName, args, toolInspection);
-  const matchingPattern = Object.keys(toolInspection).find((p) => matchesPattern(toolName, p));
-  const entry = matchingPattern === void 0 ? void 0 : toolInspection[matchingPattern];
+  const matchingPattern = [
+    ...Object.keys(toolInspection.trusted),
+    ...Object.keys(toolInspection.project ?? {})
+  ].find((p) => matchesPattern(toolName, p));
+  const entry = inspectionEntry(toolName, toolInspection);
   const legacyValue = shell.kind === "not-shell" && typeof entry === "string" ? getNestedValue(args, entry) : null;
   return {
     command: shell.kind === "shell" ? shell.command : typeof legacyValue === "string" ? legacyValue : null,
@@ -15094,15 +15419,17 @@ function explainExtractShellCommand(toolName, args, toolInspection) {
   };
 }
 function explainIsSqlTool(toolName, toolInspection) {
-  const patterns = Object.keys(toolInspection);
-  const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
-  if (!matchingPattern) return false;
-  const fieldName = toolInspection[matchingPattern];
+  const fieldName = inspectionEntry(toolName, toolInspection);
   return fieldName === "sql" || fieldName === "query";
 }
 async function explainPolicy(toolName, args, agent = EXPLAIN_AGENT) {
   const config = getConfig();
-  const prepared = prepareFileAccesses(toolName, args, process.cwd(), config.policy.toolInspection);
+  const prepared = prepareFileAccesses(
+    toolName,
+    args,
+    process.cwd(),
+    inspectionLayers(config.policy)
+  );
   const derived = await deriveExplainTrace(toolName, args, prepared);
   const engine = await evaluatePolicy2(toolName, args, agent, prepared.cwd, {
     fileAccess: prepared,
@@ -15131,10 +15458,11 @@ async function explainPolicy(toolName, args, agent = EXPLAIN_AGENT) {
 }
 async function deriveExplainTrace(toolName, args, prepared) {
   const steps = [];
-  const globalPath = import_path8.default.join(import_os7.default.homedir(), ".node9", "config.json");
-  const projectPath = import_path8.default.join(process.cwd(), "node9.config.json");
-  const credsPath = import_path8.default.join(import_os7.default.homedir(), ".node9", "credentials.json");
+  const globalPath = import_path9.default.join(import_os8.default.homedir(), ".node9", "config.json");
+  const projectPath = import_path9.default.join(process.cwd(), "node9.config.json");
+  const credsPath = import_path9.default.join(import_os8.default.homedir(), ".node9", "credentials.json");
   const config = getConfig();
+  const layers = inspectionLayers(config.policy);
   const wsGoverned = config.policySource === "workspace";
   const waterfall = [
     {
@@ -15146,22 +15474,22 @@ async function deriveExplainTrace(toolName, args, prepared) {
     {
       tier: 2,
       label: wsGoverned ? "Workspace config" : "Cloud policy",
-      status: import_fs8.default.existsSync(credsPath) ? "active" : "missing",
-      note: import_fs8.default.existsSync(credsPath) ? wsGoverned ? "authoritative \u2014 this machine follows the workspace configuration (app.node9.ai)" : "credentials found (not evaluated in explain mode)" : "not connected \u2014 run: node9 login"
+      status: import_fs9.default.existsSync(credsPath) ? "active" : "missing",
+      note: import_fs9.default.existsSync(credsPath) ? wsGoverned ? "authoritative \u2014 this machine follows the workspace configuration (app.node9.ai)" : "credentials found (not evaluated in explain mode)" : "not connected \u2014 run: node9 login"
     },
     {
       tier: 3,
       label: "Project config",
-      status: import_fs8.default.existsSync(projectPath) ? "active" : "missing",
+      status: import_fs9.default.existsSync(projectPath) ? "active" : "missing",
       path: projectPath,
-      ...wsGoverned && import_fs8.default.existsSync(projectPath) ? { note: "present \u2014 ignored (workspace config governs policy)" } : {}
+      ...wsGoverned && import_fs9.default.existsSync(projectPath) ? { note: "present \u2014 ignored (workspace config governs policy)" } : {}
     },
     {
       tier: 4,
       label: "Global config",
-      status: import_fs8.default.existsSync(globalPath) ? "active" : "missing",
+      status: import_fs9.default.existsSync(globalPath) ? "active" : "missing",
       path: globalPath,
-      ...wsGoverned && import_fs8.default.existsSync(globalPath) ? { note: "present \u2014 ignored (workspace config governs policy)" } : {}
+      ...wsGoverned && import_fs9.default.existsSync(globalPath) ? { note: "present \u2014 ignored (workspace config governs policy)" } : {}
     },
     {
       tier: 5,
@@ -15212,10 +15540,7 @@ async function deriveExplainTrace(toolName, args, prepared) {
   });
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(
-      (rule) => toolMatchesRule(toolName, rule.tool, config.policy.toolInspection) && evaluateSmartConditions(
-        shellRuleArgs(toolName, args, rule.tool, config.policy.toolInspection),
-        rule
-      )
+      (rule) => toolMatchesRule(toolName, rule.tool, layers) && evaluateSmartConditions(shellRuleArgs(toolName, args, rule.tool, layers), rule)
     );
     if (matchedRule) {
       const label3 = `Smart Rule: ${matchedRule.name ?? matchedRule.tool}`;
@@ -15257,7 +15582,7 @@ async function deriveExplainTrace(toolName, args, prepared) {
     command: shellCommand,
     matchingPattern,
     fieldName
-  } = explainExtractShellCommand(toolName, args, config.policy.toolInspection);
+  } = explainExtractShellCommand(toolName, args, layers);
   if (shellCommand) {
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
@@ -15308,7 +15633,7 @@ async function deriveExplainTrace(toolName, args, prepared) {
       outcome: "checked",
       detail: "No dangerous eval detected"
     });
-    if (explainIsSqlTool(toolName, config.policy.toolInspection)) {
+    if (explainIsSqlTool(toolName, layers)) {
       allTokens = allTokens.filter((t) => !SQL_DML_KEYWORDS2.has(t.toLowerCase()));
       steps.push({
         name: "SQL token stripping",
@@ -15419,13 +15744,13 @@ async function deriveExplainTrace(toolName, args, prepared) {
   });
   return { tool: toolName, args, waterfall, steps, decision: "allow" };
 }
-var import_fs8, import_path8, import_os7, SQL_DML_KEYWORDS2, EXPLAIN_AGENT;
+var import_fs9, import_path9, import_os8, SQL_DML_KEYWORDS2, EXPLAIN_AGENT;
 var init_policy = __esm({
   "src/policy/index.ts"() {
     "use strict";
-    import_fs8 = __toESM(require("fs"));
-    import_path8 = __toESM(require("path"));
-    import_os7 = __toESM(require("os"));
+    import_fs9 = __toESM(require("fs"));
+    import_path9 = __toESM(require("path"));
+    import_os8 = __toESM(require("os"));
     init_dlp();
     init_file_access();
     init_config();
@@ -15441,34 +15766,34 @@ var init_policy = __esm({
 
 // src/utils/atomic-write.ts
 function atomicWriteSync(filePath, data, options) {
-  const dir2 = import_path9.default.dirname(filePath);
-  if (!import_fs9.default.existsSync(dir2)) import_fs9.default.mkdirSync(dir2, { recursive: true });
+  const dir2 = import_path10.default.dirname(filePath);
+  if (!import_fs10.default.existsSync(dir2)) import_fs10.default.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${filePath}.${(0, import_crypto7.randomUUID)()}.tmp`;
   try {
-    import_fs9.default.writeFileSync(tmpPath, data, options);
+    import_fs10.default.writeFileSync(tmpPath, data, options);
   } catch (err2) {
     try {
-      import_fs9.default.unlinkSync(tmpPath);
+      import_fs10.default.unlinkSync(tmpPath);
     } catch {
     }
     throw err2;
   }
   try {
-    import_fs9.default.renameSync(tmpPath, filePath);
+    import_fs10.default.renameSync(tmpPath, filePath);
   } catch (err2) {
     try {
-      import_fs9.default.unlinkSync(tmpPath);
+      import_fs10.default.unlinkSync(tmpPath);
     } catch {
     }
     throw err2;
   }
 }
-var import_fs9, import_path9, import_crypto7;
+var import_fs10, import_path10, import_crypto7;
 var init_atomic_write = __esm({
   "src/utils/atomic-write.ts"() {
     "use strict";
-    import_fs9 = __toESM(require("fs"));
-    import_path9 = __toESM(require("path"));
+    import_fs10 = __toESM(require("fs"));
+    import_path10 = __toESM(require("path"));
     import_crypto7 = require("crypto");
   }
 });
@@ -15485,11 +15810,11 @@ function extractCommandPattern(toolName, args) {
 }
 function checkPause() {
   try {
-    if (!import_fs10.default.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(import_fs10.default.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!import_fs11.default.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(import_fs11.default.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        import_fs10.default.unlinkSync(PAUSED_FILE);
+        import_fs11.default.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -15505,14 +15830,14 @@ function pauseNode9(durationMs, durationStr) {
 }
 function resumeNode9() {
   try {
-    if (import_fs10.default.existsSync(PAUSED_FILE)) import_fs10.default.unlinkSync(PAUSED_FILE);
+    if (import_fs11.default.existsSync(PAUSED_FILE)) import_fs11.default.unlinkSync(PAUSED_FILE);
   } catch {
   }
 }
 function getActiveTrustSession(toolName, args) {
   try {
-    if (!import_fs10.default.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(import_fs10.default.readFileSync(TRUST_FILE, "utf-8"));
+    if (!import_fs11.default.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(import_fs11.default.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
@@ -15535,8 +15860,8 @@ function writeTrustSession(toolName, durationMs, args) {
   try {
     let trust = { entries: [] };
     try {
-      if (import_fs10.default.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(import_fs10.default.readFileSync(TRUST_FILE, "utf-8"));
+      if (import_fs11.default.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(import_fs11.default.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -15558,26 +15883,26 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = import_path10.default.join(import_os8.default.homedir(), ".node9", "decisions.json");
-    if (!import_fs10.default.existsSync(file2)) return null;
-    const decisions = JSON.parse(import_fs10.default.readFileSync(file2, "utf-8"));
+    const file2 = import_path11.default.join(import_os9.default.homedir(), ".node9", "decisions.json");
+    if (!import_fs11.default.existsSync(file2)) return null;
+    const decisions = JSON.parse(import_fs11.default.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
   }
   return null;
 }
-var import_fs10, import_path10, import_os8, PAUSED_FILE, TRUST_FILE;
+var import_fs11, import_path11, import_os9, PAUSED_FILE, TRUST_FILE;
 var init_state = __esm({
   "src/auth/state.ts"() {
     "use strict";
-    import_fs10 = __toESM(require("fs"));
-    import_path10 = __toESM(require("path"));
-    import_os8 = __toESM(require("os"));
+    import_fs11 = __toESM(require("fs"));
+    import_path11 = __toESM(require("path"));
+    import_os9 = __toESM(require("os"));
     init_policy();
     init_atomic_write();
-    PAUSED_FILE = import_path10.default.join(import_os8.default.homedir(), ".node9", "PAUSED");
-    TRUST_FILE = import_path10.default.join(import_os8.default.homedir(), ".node9", "trust.json");
+    PAUSED_FILE = import_path11.default.join(import_os9.default.homedir(), ".node9", "PAUSED");
+    TRUST_FILE = import_path11.default.join(import_os9.default.homedir(), ".node9", "trust.json");
   }
 });
 
@@ -15620,9 +15945,9 @@ function resolveDaemonPort(env = process.env) {
 }
 function getInternalToken() {
   try {
-    const pidFile = import_path11.default.join(import_os9.default.homedir(), ".node9", "daemon.pid");
-    if (!import_fs11.default.existsSync(pidFile)) return null;
-    const data = JSON.parse(import_fs11.default.readFileSync(pidFile, "utf-8"));
+    const pidFile = import_path12.default.join(import_os10.default.homedir(), ".node9", "daemon.pid");
+    if (!import_fs12.default.existsSync(pidFile)) return null;
+    const data = JSON.parse(import_fs12.default.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -15630,12 +15955,12 @@ function getInternalToken() {
   }
 }
 function isDaemonRunning() {
-  const pidFile = import_path11.default.join(import_os9.default.homedir(), ".node9", "daemon.pid");
-  if (import_fs11.default.existsSync(pidFile)) {
+  const pidFile = import_path12.default.join(import_os10.default.homedir(), ".node9", "daemon.pid");
+  if (import_fs12.default.existsSync(pidFile)) {
     let pid;
     let port;
     try {
-      const data = JSON.parse(import_fs11.default.readFileSync(pidFile, "utf-8"));
+      const data = JSON.parse(import_fs12.default.readFileSync(pidFile, "utf-8"));
       pid = data.pid;
       port = data.port;
     } catch {
@@ -15653,7 +15978,7 @@ function isDaemonRunning() {
     } catch (err2) {
       if (err2 instanceof Error && "code" in err2 && err2.code === "ESRCH") {
         try {
-          import_fs11.default.unlinkSync(pidFile);
+          import_fs12.default.unlinkSync(pidFile);
         } catch {
         }
       }
@@ -15967,15 +16292,15 @@ async function resolveViaDaemon(id, decision, internalToken, source) {
     signal: AbortSignal.timeout(3e3)
   });
 }
-var import_fs11, import_net, import_path11, import_os9, ACTIVITY_SOCKET_PATH, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
+var import_fs12, import_net, import_path12, import_os10, ACTIVITY_SOCKET_PATH, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
-    import_fs11 = __toESM(require("fs"));
+    import_fs12 = __toESM(require("fs"));
     import_net = __toESM(require("net"));
-    import_path11 = __toESM(require("path"));
-    import_os9 = __toESM(require("os"));
-    ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path11.default.join(import_os9.default.tmpdir(), "node9-activity.sock");
+    import_path12 = __toESM(require("path"));
+    import_os10 = __toESM(require("os"));
+    ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path12.default.join(import_os10.default.tmpdir(), "node9-activity.sock");
     DEFAULT_DAEMON_PORT = 7391;
     DAEMON_PORT = resolveDaemonPort();
     DAEMON_HOST = "127.0.0.1";
@@ -16034,7 +16359,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = import_path12.default.basename(editFilePath);
+        editFileName = import_path13.default.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -16066,11 +16391,11 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
     ...ruleName && { ruleName }
   };
 }
-var import_path12, CODE_KEYS;
+var import_path13, CODE_KEYS;
 var init_context_sniper = __esm({
   "src/context-sniper.ts"() {
     "use strict";
-    import_path12 = __toESM(require("path"));
+    import_path13 = __toESM(require("path"));
     CODE_KEYS = [
       "command",
       "cmd",
@@ -16126,7 +16451,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file2 = obj.file_path ? import_path13.default.basename(String(obj.file_path)) : "file";
+      const file2 = obj.file_path ? import_path14.default.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -16343,12 +16668,12 @@ end run`;
     }
   });
 }
-var import_child_process, import_path13, isTestEnv, MIN_INTERACTION_MS;
+var import_child_process, import_path14, isTestEnv, MIN_INTERACTION_MS;
 var init_native = __esm({
   "src/ui/native.ts"() {
     "use strict";
     import_child_process = require("child_process");
-    import_path13 = __toESM(require("path"));
+    import_path14 = __toESM(require("path"));
     init_context_sniper();
     init_safe_text();
     isTestEnv = () => {
@@ -16360,12 +16685,12 @@ var init_native = __esm({
 
 // src/shields/jail.ts
 function jailStorePath() {
-  return import_path14.default.join(import_os10.default.homedir(), ".node9", "jail-paths.json");
+  return import_path15.default.join(import_os11.default.homedir(), ".node9", "jail-paths.json");
 }
 function readJailPaths() {
   let text;
   try {
-    text = import_fs12.default.readFileSync(jailStorePath(), "utf8");
+    text = import_fs13.default.readFileSync(jailStorePath(), "utf8");
   } catch (err2) {
     if (err2.code === "ENOENT") return [];
     throw err2;
@@ -16383,8 +16708,8 @@ function readJailPaths() {
 }
 function writeJailPaths(paths) {
   const p = jailStorePath();
-  import_fs12.default.mkdirSync(import_path14.default.dirname(p), { recursive: true });
-  import_fs12.default.writeFileSync(p, JSON.stringify({ paths }, null, 2) + "\n", { mode: 384 });
+  import_fs13.default.mkdirSync(import_path15.default.dirname(p), { recursive: true });
+  import_fs13.default.writeFileSync(p, JSON.stringify({ paths }, null, 2) + "\n", { mode: 384 });
 }
 function addJailPath(rawPath, verdict) {
   const norm = rawPath.trim();
@@ -16423,14 +16748,14 @@ function removeJailPath(rawPath) {
   return { removed, paths: after };
 }
 function regenerateUserJail(paths) {
-  const file2 = import_path14.default.join(USER_SHIELDS_DIR_PATH, `${USER_JAIL_SHIELD}.json`);
+  const file2 = import_path15.default.join(USER_SHIELDS_DIR_PATH, `${USER_JAIL_SHIELD}.json`);
   if (paths.length === 0) {
     const active2 = readActiveShields();
     if (active2.includes(USER_JAIL_SHIELD)) {
       writeActiveShields(active2.filter((s) => s !== USER_JAIL_SHIELD));
     }
     try {
-      import_fs12.default.rmSync(file2, { force: true });
+      import_fs13.default.rmSync(file2, { force: true });
     } catch {
     }
     return;
@@ -16445,13 +16770,13 @@ function regenerateUserJail(paths) {
   const active = readActiveShields();
   if (!active.includes(USER_JAIL_SHIELD)) writeActiveShields([...active, USER_JAIL_SHIELD]);
 }
-var import_fs12, import_os10, import_path14, USER_JAIL_SHIELD;
+var import_fs13, import_os11, import_path15, USER_JAIL_SHIELD;
 var init_jail = __esm({
   "src/shields/jail.ts"() {
     "use strict";
-    import_fs12 = __toESM(require("fs"));
-    import_os10 = __toESM(require("os"));
-    import_path14 = __toESM(require("path"));
+    import_fs13 = __toESM(require("fs"));
+    import_os11 = __toESM(require("os"));
+    import_path15 = __toESM(require("path"));
     init_build();
     init_dist();
     init_shields();
@@ -16461,7 +16786,7 @@ var init_jail = __esm({
 
 // src/canary/registry.ts
 function canaryStorePath() {
-  return import_path15.default.join(import_os11.default.homedir(), ".node9", "canaries.json");
+  return import_path16.default.join(import_os12.default.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -16472,7 +16797,7 @@ function loadCanaries(opts) {
   const p = canaryStorePath();
   let raw;
   try {
-    raw = import_fs13.default.readFileSync(p, "utf-8");
+    raw = import_fs14.default.readFileSync(p, "utf-8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -16494,19 +16819,19 @@ function saveCanaries(records) {
   const p = canaryStorePath();
   const paths = addJailPath(p, "block");
   regenerateUserJail(paths);
-  import_fs13.default.mkdirSync(import_path15.default.dirname(p), { recursive: true });
+  import_fs14.default.mkdirSync(import_path16.default.dirname(p), { recursive: true });
   const tmp = `${p}.${(0, import_crypto8.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    import_fs13.default.writeFileSync(tmp, JSON.stringify({ version: 1, records }, null, 2) + "\n", {
+    import_fs14.default.writeFileSync(tmp, JSON.stringify({ version: 1, records }, null, 2) + "\n", {
       mode: 384,
       flag: "wx"
     });
-    import_fs13.default.chmodSync(tmp, 384);
-    import_fs13.default.renameSync(tmp, p);
+    import_fs14.default.chmodSync(tmp, 384);
+    import_fs14.default.renameSync(tmp, p);
   } finally {
-    if (import_fs13.default.existsSync(tmp)) {
+    if (import_fs14.default.existsSync(tmp)) {
       try {
-        import_fs13.default.unlinkSync(tmp);
+        import_fs14.default.unlinkSync(tmp);
       } catch {
       }
     }
@@ -16545,13 +16870,13 @@ function canaryCtxValues() {
     path: r.path
   }));
 }
-var import_fs13, import_os11, import_path15, import_crypto8, sha256Hex;
+var import_fs14, import_os12, import_path16, import_crypto8, sha256Hex;
 var init_registry = __esm({
   "src/canary/registry.ts"() {
     "use strict";
-    import_fs13 = __toESM(require("fs"));
-    import_os11 = __toESM(require("os"));
-    import_path15 = __toESM(require("path"));
+    import_fs14 = __toESM(require("fs"));
+    import_os12 = __toESM(require("os"));
+    import_path16 = __toESM(require("path"));
     import_crypto8 = require("crypto");
     init_dist();
     init_jail();
@@ -16563,16 +16888,16 @@ var init_registry = __esm({
 function readSmallFile(p, max) {
   let fd;
   try {
-    fd = import_fs14.default.openSync(p, import_fs14.default.constants.O_RDONLY | (import_fs14.default.constants.O_NOFOLLOW ?? 0));
-    const st = import_fs14.default.fstatSync(fd);
+    fd = import_fs15.default.openSync(p, import_fs15.default.constants.O_RDONLY | (import_fs15.default.constants.O_NOFOLLOW ?? 0));
+    const st = import_fs15.default.fstatSync(fd);
     if (!st.isFile() || st.size > max) return null;
     const buf = Buffer.alloc(st.size);
-    const n = import_fs14.default.readSync(fd, buf, 0, st.size, 0);
+    const n = import_fs15.default.readSync(fd, buf, 0, st.size, 0);
     return buf.subarray(0, n).toString("utf8");
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) import_fs14.default.closeSync(fd);
+    if (fd !== void 0) import_fs15.default.closeSync(fd);
   }
 }
 function gitRemoteHost(url) {
@@ -16591,20 +16916,20 @@ function gitRemoteHost(url) {
   return null;
 }
 function findGitConfig(dir2, walkUp = true) {
-  let cur = import_path16.default.resolve(dir2);
+  let cur = import_path17.default.resolve(dir2);
   for (let i = 0; i < (walkUp ? 64 : 1); i++) {
-    const dotGit = import_path16.default.join(cur, ".git");
-    const direct = readSmallFile(import_path16.default.join(dotGit, "config"), 1e6);
+    const dotGit = import_path17.default.join(cur, ".git");
+    const direct = readSmallFile(import_path17.default.join(dotGit, "config"), 1e6);
     if (direct !== null) return direct;
     const pointer = readSmallFile(dotGit, 4096);
     const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
     if (m) {
-      let gitDir = import_path16.default.resolve(cur, m[1]);
-      const common = readSmallFile(import_path16.default.join(gitDir, "commondir"), 4096);
-      if (common !== null) gitDir = import_path16.default.resolve(gitDir, common.trim());
-      return readSmallFile(import_path16.default.join(gitDir, "config"), 1e6);
+      let gitDir = import_path17.default.resolve(cur, m[1]);
+      const common = readSmallFile(import_path17.default.join(gitDir, "commondir"), 4096);
+      if (common !== null) gitDir = import_path17.default.resolve(gitDir, common.trim());
+      return readSmallFile(import_path17.default.join(gitDir, "config"), 1e6);
     }
-    const parent = import_path16.default.dirname(cur);
+    const parent = import_path17.default.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -16613,12 +16938,12 @@ function findGitConfig(dir2, walkUp = true) {
 function readGitRemotes(dir2, opts = {}) {
   if (!dir2) return [];
   const walkUp = opts.walkUp !== false;
-  const key = `${walkUp ? "up" : "at"}:${import_path16.default.resolve(dir2)}`;
-  const hit = cache.get(key);
+  const key = `${walkUp ? "up" : "at"}:${import_path17.default.resolve(dir2)}`;
+  const hit = cache2.get(key);
   if (hit) return hit;
   const out = [];
   try {
-    const cfg = findGitConfig(import_path16.default.resolve(dir2), walkUp);
+    const cfg = findGitConfig(import_path17.default.resolve(dir2), walkUp);
     if (cfg !== null) {
       let current = null;
       for (const line of cfg.split(/\r?\n/)) {
@@ -16640,31 +16965,31 @@ function readGitRemotes(dir2, opts = {}) {
     }
   } catch {
   }
-  cache.set(key, out);
+  cache2.set(key, out);
   return out;
 }
-var import_fs14, import_path16, cache;
+var import_fs15, import_path17, cache2;
 var init_git_remotes = __esm({
   "src/utils/git-remotes.ts"() {
     "use strict";
-    import_fs14 = __toESM(require("fs"));
-    import_path16 = __toESM(require("path"));
+    import_fs15 = __toESM(require("fs"));
+    import_path17 = __toESM(require("path"));
     init_dist();
-    cache = /* @__PURE__ */ new Map();
+    cache2 = /* @__PURE__ */ new Map();
   }
 });
 
 // src/exposure/known-hosts.ts
 function manifestRoot(dir2) {
-  let cur = import_path17.default.resolve(dir2);
+  let cur = import_path18.default.resolve(dir2);
   for (let i = 0; i < 64; i++) {
     for (const [m] of ECOSYSTEMS) {
       try {
-        if (import_fs15.default.existsSync(import_path17.default.join(cur, m))) return cur;
+        if (import_fs16.default.existsSync(import_path18.default.join(cur, m))) return cur;
       } catch {
       }
     }
-    const parent = import_path17.default.dirname(cur);
+    const parent = import_path18.default.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -16673,8 +16998,8 @@ function manifestRoot(dir2) {
 function knownProjectHosts(dir2) {
   const empty = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
   if (!dir2) return empty;
-  const key = import_path17.default.resolve(dir2);
-  const hit = cache2.get(key);
+  const key = import_path18.default.resolve(dir2);
+  const hit = cache3.get(key);
   if (hit) return hit;
   const out = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
   try {
@@ -16686,25 +17011,25 @@ function knownProjectHosts(dir2) {
     const root = manifestRoot(key);
     if (root !== null) {
       for (const [m, registry] of ECOSYSTEMS) {
-        if (import_fs15.default.existsSync(import_path17.default.join(root, m))) out.hosts.add(registry);
+        if (import_fs16.default.existsSync(import_path18.default.join(root, m))) out.hosts.add(registry);
       }
       try {
-        if (import_fs15.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
+        if (import_fs16.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
           out.hosts.add("host:rubygems.org");
       } catch {
       }
     }
   } catch {
   }
-  cache2.set(key, out);
+  cache3.set(key, out);
   return out;
 }
-var import_fs15, import_path17, ECOSYSTEMS, cache2;
+var import_fs16, import_path18, ECOSYSTEMS, cache3;
 var init_known_hosts = __esm({
   "src/exposure/known-hosts.ts"() {
     "use strict";
-    import_fs15 = __toESM(require("fs"));
-    import_path17 = __toESM(require("path"));
+    import_fs16 = __toESM(require("fs"));
+    import_path18 = __toESM(require("path"));
     init_git_remotes();
     ECOSYSTEMS = [
       ["package.json", "host:registry.npmjs.org"],
@@ -16713,7 +17038,7 @@ var init_known_hosts = __esm({
       ["Cargo.toml", "host:crates.io"],
       ["Gemfile", "host:rubygems.org"]
     ];
-    cache2 = /* @__PURE__ */ new Map();
+    cache3 = /* @__PURE__ */ new Map();
   }
 });
 
@@ -16744,7 +17069,7 @@ function packageScriptsTouched(args, absPath, shellCommand) {
   if (typeof a.content === "string") {
     try {
       const next = JSON.parse(a.content);
-      const prev = JSON.parse(import_fs16.default.readFileSync(absPath, "utf8"));
+      const prev = JSON.parse(import_fs17.default.readFileSync(absPath, "utf8"));
       return JSON.stringify(next.scripts ?? null) !== JSON.stringify(prev.scripts ?? null);
     } catch {
       return LIFECYCLE_RE.test(a.content);
@@ -16754,8 +17079,8 @@ function packageScriptsTouched(args, absPath, shellCommand) {
 }
 function judgeWritesAfterExposure(opts) {
   const holds = [];
-  const home = opts.home ?? import_os12.default.homedir();
-  const tmp = normalizeFilePath(import_os12.default.tmpdir());
+  const home = opts.home ?? import_os13.default.homedir();
+  const tmp = normalizeFilePath(import_os13.default.tmpdir());
   const root = opts.cwd ? normalizeFilePath(opts.cwd, "", home) : null;
   const seen = /* @__PURE__ */ new Set();
   for (const access of opts.accesses) {
@@ -16765,7 +17090,7 @@ function judgeWritesAfterExposure(opts) {
     seen.add(p);
     if (p === "/dev" || p.startsWith("/dev/")) continue;
     if (root !== null && isInside(root, p)) {
-      if (isAgentInstructionPath(p, root) && (import_path18.default.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
+      if (isAgentInstructionPath(p, root) && (import_path19.default.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
         holds.push({ path: p, why: "agent-instruction" });
       continue;
     }
@@ -16784,13 +17109,13 @@ function judgeWritesAfterExposure(opts) {
   }
   return holds;
 }
-var import_fs16, import_os12, import_path18, WRITE_OPS, LIFECYCLE_RE;
+var import_fs17, import_os13, import_path19, WRITE_OPS, LIFECYCLE_RE;
 var init_writes = __esm({
   "src/exposure/writes.ts"() {
     "use strict";
-    import_fs16 = __toESM(require("fs"));
-    import_os12 = __toESM(require("os"));
-    import_path18 = __toESM(require("path"));
+    import_fs17 = __toESM(require("fs"));
+    import_os13 = __toESM(require("os"));
+    import_path19 = __toESM(require("path"));
     init_dist();
     WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "remove"]);
     LIFECYCLE_RE = /"(scripts|preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack|publish|postpublish)"\s*:/;
@@ -16868,6 +17193,7 @@ var init_exposure_store = __esm({
           tool: source.tool,
           server: source.server,
           ...source.word ? { word: source.word } : {},
+          ...source.eid ? { eid: source.eid } : {},
           at: source.at || Date.now()
         });
         if (e.sources.length > MAX_SOURCES) e.sources.splice(0, e.sources.length - MAX_SOURCES);
@@ -16915,29 +17241,29 @@ var init_exposure_store = __esm({
 
 // src/exposure/marker.ts
 function dir() {
-  return import_path19.default.join(import_os13.default.homedir(), ".node9", "exposure-sessions");
+  return import_path20.default.join(import_os14.default.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = import_crypto9.default.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return import_path19.default.join(dir(), id);
+  return import_path20.default.join(dir(), id);
 }
 function markSessionExposed(sessionId) {
   if (!sessionId) return;
   try {
-    import_fs17.default.mkdirSync(dir(), { recursive: true, mode: 448 });
+    import_fs18.default.mkdirSync(dir(), { recursive: true, mode: 448 });
     const f = file(sessionId);
     const now = /* @__PURE__ */ new Date();
     try {
-      import_fs17.default.utimesSync(f, now, now);
+      import_fs18.default.utimesSync(f, now, now);
     } catch {
-      import_fs17.default.writeFileSync(f, "", { mode: 384 });
+      import_fs18.default.writeFileSync(f, "", { mode: 384 });
     }
     if (Math.random() < 0.05) {
       const cutoff = Date.now() - 24 * 60 * 60 * 1e3;
-      for (const name of import_fs17.default.readdirSync(dir())) {
+      for (const name of import_fs18.default.readdirSync(dir())) {
         try {
-          const p = import_path19.default.join(dir(), name);
-          if (import_fs17.default.statSync(p).mtimeMs < cutoff) import_fs17.default.unlinkSync(p);
+          const p = import_path20.default.join(dir(), name);
+          if (import_fs18.default.statSync(p).mtimeMs < cutoff) import_fs18.default.unlinkSync(p);
         } catch {
         }
       }
@@ -16948,7 +17274,7 @@ function markSessionExposed(sessionId) {
 function maybeSessionExposed(sessionId) {
   if (!sessionId) return false;
   try {
-    const st = import_fs17.default.statSync(file(sessionId));
+    const st = import_fs18.default.statSync(file(sessionId));
     return Date.now() - st.mtimeMs < SESSION_EXPOSURE_TTL_MS;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -16956,19 +17282,19 @@ function maybeSessionExposed(sessionId) {
 }
 function clearSessionMarkers(sessionId) {
   try {
-    if (sessionId) import_fs17.default.unlinkSync(file(sessionId));
-    else import_fs17.default.rmSync(dir(), { recursive: true, force: true });
+    if (sessionId) import_fs18.default.unlinkSync(file(sessionId));
+    else import_fs18.default.rmSync(dir(), { recursive: true, force: true });
   } catch {
   }
 }
-var import_crypto9, import_fs17, import_os13, import_path19;
+var import_crypto9, import_fs18, import_os14, import_path20;
 var init_marker = __esm({
   "src/exposure/marker.ts"() {
     "use strict";
     import_crypto9 = __toESM(require("crypto"));
-    import_fs17 = __toESM(require("fs"));
-    import_os13 = __toESM(require("os"));
-    import_path19 = __toESM(require("path"));
+    import_fs18 = __toESM(require("fs"));
+    import_os14 = __toESM(require("os"));
+    import_path20 = __toESM(require("path"));
     init_exposure_store();
   }
 });
@@ -17050,13 +17376,13 @@ function deriveServerName(cmd) {
   return strip(base2) || "MCP Server";
 }
 function getMcpToolsFile() {
-  return import_path20.default.join(import_os14.default.homedir(), ".node9", "mcp-tools.json");
+  return import_path21.default.join(import_os15.default.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
     const file2 = getMcpToolsFile();
-    if (!import_fs18.default.existsSync(file2)) return {};
-    const raw = import_fs18.default.readFileSync(file2, "utf-8");
+    if (!import_fs19.default.existsSync(file2)) return {};
+    const raw = import_fs19.default.readFileSync(file2, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -17065,11 +17391,11 @@ function readMcpToolsConfig() {
 function writeMcpToolsConfig(config) {
   try {
     const file2 = getMcpToolsFile();
-    const dir2 = import_path20.default.dirname(file2);
-    if (!import_fs18.default.existsSync(dir2)) import_fs18.default.mkdirSync(dir2, { recursive: true });
-    const tmpPath = `${file2}.${import_os14.default.hostname()}.${process.pid}.tmp`;
-    import_fs18.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2));
-    import_fs18.default.renameSync(tmpPath, file2);
+    const dir2 = import_path21.default.dirname(file2);
+    if (!import_fs19.default.existsSync(dir2)) import_fs19.default.mkdirSync(dir2, { recursive: true });
+    const tmpPath = `${file2}.${import_os15.default.hostname()}.${process.pid}.tmp`;
+    import_fs19.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2));
+    import_fs19.default.renameSync(tmpPath, file2);
   } catch (e) {
     console.error("Failed to write mcp-tools.json", e);
   }
@@ -17124,13 +17450,13 @@ function approveServer(serverKey, disabledTools) {
     writeMcpToolsConfig(config);
   }
 }
-var import_fs18, import_path20, import_os14;
+var import_fs19, import_path21, import_os15;
 var init_mcp_tools = __esm({
   "src/daemon/mcp-tools.ts"() {
     "use strict";
-    import_fs18 = __toESM(require("fs"));
-    import_path20 = __toESM(require("path"));
-    import_os14 = __toESM(require("os"));
+    import_fs19 = __toESM(require("fs"));
+    import_path21 = __toESM(require("path"));
+    import_os15 = __toESM(require("os"));
     init_mcp_cmd();
   }
 });
@@ -17141,7 +17467,7 @@ function foldServerName(name) {
 }
 function inventoryFileStamp() {
   try {
-    const st = import_fs19.default.statSync(getMcpToolsFile());
+    const st = import_fs20.default.statSync(getMcpToolsFile());
     return `${st.mtimeMs}:${st.size}`;
   } catch {
     return "";
@@ -17205,11 +17531,11 @@ function sourceWord(toolName) {
   if (BUILTIN_SOURCES.has(bare) || /browser|web|http|search/.test(server)) return "web page";
   return "tool result";
 }
-var import_fs19, EXPOSURE_LABEL, AGENT_INTERNAL_PREFIXES, inventoryCache, inventoryStamp, BUILTIN_SOURCES, MCP_RE;
+var import_fs20, EXPOSURE_LABEL, AGENT_INTERNAL_PREFIXES, inventoryCache, inventoryStamp, BUILTIN_SOURCES, MCP_RE;
 var init_roles = __esm({
   "src/exposure/roles.ts"() {
     "use strict";
-    import_fs19 = __toESM(require("fs"));
+    import_fs20 = __toESM(require("fs"));
     init_mcp_tools();
     EXPOSURE_LABEL = "\u{1F6E1}\uFE0F Node9 Exposure";
     AGENT_INTERNAL_PREFIXES = ["ccd_", "visualize"];
@@ -17237,82 +17563,6 @@ var init_roles = __esm({
   }
 });
 
-// src/auth/trusted-recipients.ts
-function getTrustedRecipientsPath() {
-  return import_path21.default.join(import_os15.default.homedir(), ".node9", "trusted-recipients.json");
-}
-function readTrustedRecipients() {
-  try {
-    const raw = import_fs20.default.readFileSync(getTrustedRecipientsPath(), "utf8");
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed.entries) ? parsed.entries.filter((e) => e && typeof e.value === "string") : [];
-  } catch {
-    return [];
-  }
-}
-function writeTrustedRecipients(entries) {
-  const filePath = getTrustedRecipientsPath();
-  import_fs20.default.mkdirSync(import_path21.default.dirname(filePath), { recursive: true });
-  const tmp = filePath + ".node9-tmp";
-  import_fs20.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
-  import_fs20.default.renameSync(tmp, filePath);
-}
-function normalizeRecipient(raw) {
-  const v = raw.trim();
-  if (!v) return null;
-  if (/^(email|host|iban):/i.test(v)) {
-    const i = v.indexOf(":");
-    const kind = v.slice(0, i).toLowerCase();
-    const inner = normalizeRecipient(v.slice(i + 1));
-    return inner && inner.startsWith(`${kind}:`) ? inner : null;
-  }
-  const found = extractArgDestinations({ to: v });
-  return found.length === 1 ? found[0] : null;
-}
-function addTrustedRecipient(raw, addedBy = "user") {
-  const value = normalizeRecipient(raw);
-  if (!value) return null;
-  const entries = readTrustedRecipients();
-  if (!entries.some((e) => e.value === value)) {
-    entries.push({ value, addedAt: Date.now(), addedBy });
-    writeTrustedRecipients(entries);
-  }
-  return value;
-}
-function removeTrustedRecipient(raw) {
-  const value = normalizeRecipient(raw) ?? raw.trim();
-  const entries = readTrustedRecipients();
-  const next = entries.filter((e) => e.value !== value);
-  if (next.length === entries.length) return false;
-  writeTrustedRecipients(next);
-  return true;
-}
-function mtimeOf() {
-  try {
-    return import_fs20.default.statSync(getTrustedRecipientsPath()).mtimeMs;
-  } catch {
-    return 0;
-  }
-}
-function isTrustedRecipient(value) {
-  const mtime = mtimeOf();
-  if (!cache3 || cache3.mtime !== mtime) {
-    cache3 = { mtime, values: new Set(readTrustedRecipients().map((e) => e.value)) };
-  }
-  return cache3.values.has(value);
-}
-var import_fs20, import_path21, import_os15, cache3;
-var init_trusted_recipients = __esm({
-  "src/auth/trusted-recipients.ts"() {
-    "use strict";
-    import_fs20 = __toESM(require("fs"));
-    import_path21 = __toESM(require("path"));
-    import_os15 = __toESM(require("os"));
-    init_dist();
-    cache3 = null;
-  }
-});
-
 // src/utils/read-capped.ts
 function readCapped(file2, maxBytes) {
   if (maxBytes < 0) return null;
@@ -17378,7 +17628,8 @@ function auditLocalAllow(toolName, args, checkedBy, creds, meta, dlpInfo, contai
   const safeCheckedBy = KNOWN_CHECKED_BY.has(checkedBy) ? checkedBy : "unknown";
   const cleanedRiskMetadata = riskMetadata ? Object.fromEntries(
     Object.entries(riskMetadata).filter(
-      ([, v]) => typeof v === "string" && v.length > 0 || typeof v === "number" && Number.isFinite(v)
+      ([k, v]) => typeof v === "string" && v.length > 0 || typeof v === "number" && Number.isFinite(v) || // fw#318 2b: the one array the SaaS schema declares.
+      k === "exposureDestinations" && Array.isArray(v) && v.length > 0
     )
   ) : void 0;
   const hasRiskMetadata = cleanedRiskMetadata && Object.keys(cleanedRiskMetadata).length > 0;
@@ -17458,11 +17709,15 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
           cwd: process.cwd(),
           platform: import_os16.default.platform()
         },
-        // Local-only fields (fw#318 exposureDestinations) stay off the wire:
-        // the SaaS validates riskMetadata strictly and would drop it whole.
+        // The SaaS validates riskMetadata strictly and would drop it whole on
+        // an unknown key, so only fields its schema declares go on the wire.
+        // exposureDestinations ships since the dashboard's 2b contract
+        // (fw#318): "Approve and trust" needs them.
         ...riskMetadata && {
           riskMetadata: Object.fromEntries(
-            Object.entries(riskMetadata).filter(([, v]) => !Array.isArray(v))
+            Object.entries(riskMetadata).filter(
+              ([k, v]) => !Array.isArray(v) || k === "exposureDestinations"
+            )
           )
         },
         ...ciContext && { ciContext },
@@ -18324,7 +18579,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   let fileAccess;
   let fileFinding;
   try {
-    fileAccess = prepareFileAccesses(toolName, args, options?.cwd, config.policy.toolInspection);
+    fileAccess = prepareFileAccesses(toolName, args, options?.cwd, inspectionLayers(config.policy));
     fileFinding = isManual ? null : evaluateProtectedFileAccess(
       fileAccess.accesses,
       fileAccess,
@@ -18343,7 +18598,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     fileAccess = { cwd: options?.cwd, homeDirs: [], accesses: [], handledPaths: /* @__PURE__ */ new Set() };
     fileFinding = isManual ? null : incompleteFileVerdict();
   }
-  const shellInput = resolveShellInput(toolName, args, config.policy.toolInspection);
+  const shellInput = resolveShellInput(toolName, args, inspectionLayers(config.policy));
   const networkShell = shellInput.kind === "shell" && NETWORK_COMMAND_RE.test(shellInput.command);
   const shellReview = !isManual && shellInput.kind === "uninspectable";
   if (shellReview) {
@@ -18453,6 +18708,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   let exposureReview = null;
   let exposureKeys = [];
   let exposureDestinations = [];
+  let exposureFromEid;
   const ucPolicy = config.policy.untrustedContent;
   if (ucPolicy?.enabled && !taintWarning && meta?.sessionId && !isManual) {
     const role = toolRole(toolName, ucPolicy);
@@ -18460,7 +18716,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const shellExp = shellInput.kind === "shell" ? classifyShellExposure(shellInput.command) : null;
     const bareName = splitMcpToolName(toolName)?.bare;
     const mcpFileWrite = bareName !== void 0 && fileToolOperation(bareName, args) === "write";
-    const writes = (mcpFileWrite ? prepareFileAccesses(bareName, args, options?.cwd, config.policy.toolInspection).accesses : fileAccess.accesses).filter((a) => ["write", "create", "remove"].includes(a.operation));
+    const writes = (mcpFileWrite ? prepareFileAccesses(bareName, args, options?.cwd, inspectionLayers(config.policy)).accesses : fileAccess.accesses).filter((a) => ["write", "create", "remove"].includes(a.operation));
     const sendsSomething = acts && !mcpFileWrite || !!shellExp?.sends;
     const mayBeExposed = daemonSaysExposed ?? (maybeSessionExposed(meta.sessionId) || writes.length > 0 && judgeWritesAfterExposure({
       accesses: writes,
@@ -18504,7 +18760,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         const isKnown = (d) => {
           const domain = destinationDomain(d);
           const value = destinationValue(d);
-          return domain !== null && ucPolicy.orgDomains.includes(domain) || mentioned.has(d) || isTrustedRecipient(d) || destinationKind(d) === "host" && (isLoopbackHost(value) || isTrustedHost(value) || config.policy.trustedHostsManaged && matchesTrustedHost(value, config.policy.trustedHosts) || config.policy.egress.allow.some((pat) => hostMatches(value, pat)) || writeProjectHosts.hosts.has(d));
+          return domain !== null && ucPolicy.orgDomains.includes(domain) || mentioned.has(d) || isTrustedRecipient(d) || ucPolicy.trustedRecipients.includes(d) || destinationKind(d) === "host" && (isLoopbackHost(value) || isTrustedHost(value) || config.policy.trustedHostsManaged && matchesTrustedHost(value, config.policy.trustedHosts) || config.policy.egress.allow.some((pat) => hostMatches(value, pat)) || writeProjectHosts.hosts.has(d));
         };
         const approvedOnce = (key) => ucPolicy.afterExposure === "ask-once" && approved.has(key);
         const repos = (shellExp?.sends ? shellExp.repos : []).filter(
@@ -18568,6 +18824,8 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
             );
           }
           exposureReview = `\u{1F6E1}\uFE0F Node9: this session read ${read2}. This call ${parts.join("; and ")}.`;
+          exposureFromEid = last?.eid;
+          if (exposureFromEid) meta = { ...meta, exposureFromEid };
           exposureKeys = [
             ...held.filter((h) => h.dest || h.why === "unresolved" || h.why === "repository").map(
               (h) => h.why === "repository" ? `${toolName}|repo:${h.repo}` : `${toolName}|${h.dest || "unresolved"}`
@@ -18581,6 +18839,11 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
             exposureReview += ` To trust ${exposureDestinations.length === 1 ? "this address" : "these addresses"} for good, the user runs: ` + exposureDestinations.map((d) => `node9 trust recipient add ${destinationValue(d)}`).join("; ") + ".";
           }
         } else if (held.length > 0 || writeHolds.length > 0 || logged.length > 0) {
+          meta = {
+            ...meta,
+            exposure: { kind: "logged", destinations: logged.length },
+            ...last?.eid ? { exposureFromEid: last.eid } : {}
+          };
           appendToLog(HOOK_DEBUG_LOG, {
             ts: (/* @__PURE__ */ new Date()).toISOString(),
             event: "exposure-logged",
@@ -19134,6 +19397,7 @@ ${packageReview}`;
       // deferReview and serverKey never co-occur in production — see above.)
       reason: taintWarning || packageReview || exposureReview || explainableLabel || "Node9 flagged this action for review.",
       ...exposureReview && exposureKeys.length > 0 ? { exposureKeys } : {},
+      ...exposureReview && exposureFromEid ? { exposureFromEid } : {},
       ruleDescription: policyRuleDescription,
       blockedByLabel: explainableLabel
     };
@@ -30909,7 +31173,7 @@ var init_ship = __esm({
 });
 
 // src/policy-snapshot/build.ts
-function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, statusEntries = [], syncHealth, identity) {
+function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, statusEntries = [], syncHealth, identity, trustedRecipients = []) {
   const p = config.policy;
   const statusByKey = /* @__PURE__ */ new Map();
   for (const s of statusEntries) {
@@ -30919,7 +31183,7 @@ function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, st
   const connectedRows = Object.entries(mcpTools).slice(0, MAX_MCP_SERVERS).map(([key, cfg]) => ({
     key,
     ...cfg.name && { name: cfg.name },
-    tools: cfg.tools.map((t) => t.name).slice(0, MAX_MCP_TOOLS),
+    tools: cfg.tools.slice(0, MAX_MCP_TOOLS).map((t) => ({ name: t.name, ...t.annotations ? { annotations: t.annotations } : {} })),
     toolCount: cfg.tools.length,
     status: cfg.status,
     // In mcp-tools.json ⇒ it launched ⇒ connected, unless the resolver says stale.
@@ -30969,6 +31233,15 @@ function buildPolicySnapshot(config, activeShields, overrides, mcpTools = {}, st
     engineVersion: ENGINE_VERSION,
     // Connected rows first so they win the cap; non-connected SEE rows fill the rest.
     mcpServers: [...connectedRows, ...extraRows].slice(0, MAX_MCP_SERVERS),
+    // fw#318 2b: the developer's personal trusted recipients (A1: read-only
+    // on the dashboard). Omitted when empty, so an old SaaS sees no change.
+    ...trustedRecipients.length > 0 && {
+      trustedRecipients: trustedRecipients.slice(0, 200).map((e) => ({
+        value: e.value,
+        addedBy: e.addedBy,
+        ...e.addedAt ? { addedAt: e.addedAt } : {}
+      }))
+    },
     // fleet-ship Step 2: ship the proxy's own sync health so the dashboard can
     // derive a "sync failing" badge. Only included when the caller passes it.
     ...syncHealth && {
@@ -31486,6 +31759,10 @@ function extractManagedConfig(body) {
       out3.afterExposure = u.afterExposure;
     if (Array.isArray(u.orgDomains))
       out3.orgDomains = u.orgDomains.filter((x) => typeof x === "string");
+    if (Array.isArray(u.trustedRecipients))
+      out3.trustedRecipients = u.trustedRecipients.filter(
+        (x) => typeof x === "string"
+      );
     if (u.roles && typeof u.roles === "object" && !Array.isArray(u.roles)) {
       const roles = {};
       for (const [server, tools] of Object.entries(u.roles)) {
@@ -31662,6 +31939,17 @@ async function pushPostureSnapshot(creds) {
   } catch {
   }
 }
+function personalTrustedRecipients() {
+  try {
+    return readTrustedRecipients().map((e) => ({
+      value: e.value,
+      addedBy: e.addedBy === "approval" ? "approval" : "user",
+      ...Number.isFinite(e.addedAt) ? { addedAt: new Date(e.addedAt).toISOString() } : {}
+    }));
+  } catch {
+    return [];
+  }
+}
 async function pushPolicySnapshot(creds) {
   try {
     const cfg = getConfig();
@@ -31684,7 +31972,9 @@ async function pushPolicySnapshot(creds) {
       readSyncHealth(),
       // Machine identity — heals legacy machineId-less keys on the SaaS side
       // (login-v2 duplicate-key fix). getMachineId mints on first need.
-      { machineId: getMachineId(), platform: process.platform }
+      { machineId: getMachineId(), platform: process.platform },
+      // fw#318 2b: the developer's personal trusted recipients.
+      personalTrustedRecipients()
     );
     await shipPolicySnapshot(body, creds);
   } catch {
@@ -31715,7 +32005,9 @@ async function runPolicyPush() {
       // (daemon here, user shell in runPolicyPush); see the P2 design's two-env note.
       resolveMcpStatus(),
       readSyncHealth(),
-      { machineId: getMachineId(), platform: process.platform }
+      { machineId: getMachineId(), platform: process.platform },
+      // fw#318 2b: the developer's personal trusted recipients.
+      personalTrustedRecipients()
     );
     const sent = await shipPolicySnapshot(body, creds);
     return sent ? { ok: true } : { ok: false, reason: "Push failed (network or server error)" };
@@ -31897,6 +32189,7 @@ var init_sync = __esm({
     init_ship();
     init_build2();
     init_mcp_tools();
+    init_trusted_recipients();
     init_state2();
     init_mcp_status();
     init_ship2();
@@ -31949,6 +32242,13 @@ __export(audit_shipper_exports, {
   startAuditShipper: () => startAuditShipper,
   writeWatermark: () => writeWatermark
 });
+function exposureOf(v) {
+  if (!v || typeof v !== "object") return null;
+  const o = v;
+  if (o.kind !== "source" && o.kind !== "logged") return null;
+  const n = typeof o.destinations === "number" && Number.isFinite(o.destinations) ? o.destinations : 0;
+  return { kind: o.kind, destinations: Math.max(0, Math.min(1e3, Math.floor(n))) };
+}
 function fileSignature(filePath) {
   const fd = import_fs53.default.openSync(filePath, "r");
   try {
@@ -32024,7 +32324,9 @@ function buildWireRows(chunk2) {
       ...typeof parsed.loopCount === "number" ? { loopCount: parsed.loopCount } : {},
       ...typeof parsed.transcriptPath === "string" ? { transcriptPath: parsed.transcriptPath } : {},
       ...typeof parsed.taintFromEid === "string" ? { taintFromEid: parsed.taintFromEid } : {},
-      ...typeof parsed.taintSource === "string" ? { taintSource: parsed.taintSource } : {}
+      ...typeof parsed.taintSource === "string" ? { taintSource: parsed.taintSource } : {},
+      ...exposureOf(parsed.exposure) ? { exposure: exposureOf(parsed.exposure) } : {},
+      ...typeof parsed.exposureFromEid === "string" ? { exposureFromEid: parsed.exposureFromEid } : {}
     });
   }
   return { rows, consumed: lastNl + 1 };
@@ -34481,6 +34783,7 @@ data: ${JSON.stringify(item.data)}
               tool: body.source.tool.slice(0, 200),
               server: typeof body.source.server === "string" ? body.source.server.slice(0, 80) : void 0,
               word: typeof body.source.word === "string" ? body.source.word.slice(0, 40) : void 0,
+              eid: typeof body.source.eid === "string" ? body.source.eid.slice(0, 64) : void 0,
               at: Date.now()
             },
             strings(body.destinations)
@@ -64321,7 +64624,8 @@ RAW: ${raw}
                 sessionId: sid,
                 ts: Date.now(),
                 label: result2.blockedByLabel,
-                ...result2.exposureKeys?.length ? { exposureKeys: result2.exposureKeys } : {}
+                ...result2.exposureKeys?.length ? { exposureKeys: result2.exposureKeys } : {},
+                ...result2.exposureFromEid ? { exposureFromEid: result2.exposureFromEid } : {}
               });
             }
           } catch {
@@ -64784,9 +65088,14 @@ function buildArgsField(rawInput) {
     const hit = scanArgs(rawInput);
     if (hit) return { ...hashed, dlpPattern: hit.patternName, dlpSample: hit.redactedSample };
     if (!scanCoveredEverything(rawInput)) return { ...hashed, argsUnscanned: true };
-    const gateHit = inspectArgumentSecrets(rawInput).match;
-    if (gateHit)
-      return { ...hashed, dlpPattern: gateHit.patternName, dlpSample: gateHit.redactedSample };
+    const inspected = inspectArgumentSecrets(rawInput);
+    if (inspected.match)
+      return {
+        ...hashed,
+        dlpPattern: inspected.match.patternName,
+        dlpSample: inspected.match.redactedSample
+      };
+    if (inspected.coverage === "incomplete") return { ...hashed, argsUnscanned: true };
     return { args: JSON.parse(redactSecrets(JSON.stringify(rawInput))) };
   } catch {
     return hashed;
@@ -64897,6 +65206,7 @@ function registerLogCommand(program2) {
               {
                 agent,
                 ruleName: reviewLabel,
+                ...resolvedReview.exposureFromEid ? { exposureFromEid: resolvedReview.exposureFromEid } : {},
                 ...rawToolName !== tool ? { agentToolName: rawToolName } : {},
                 ...typeof payloadSessionId === "string" ? { sessionId: payloadSessionId } : {},
                 ...safeCwd ? { workingDir: safeCwd } : {}
@@ -64934,17 +65244,21 @@ function registerLogCommand(program2) {
             if (redactOutputMode) {
               const { result, found } = redactText(toolOutput);
               let out = result;
+              const ucA = config.policy.untrustedContent;
+              const shellA = ucA?.enabled ? shellFetch(tool, rawInput) : null;
+              const sourceA = !!ucA?.enabled && (toolRole(tool, ucA).source || !!shellA?.fetches);
               let injection = null;
               if (injectionOn) {
-                const m = scanInjection(result, { tool: rawToolName });
+                const m = scanInjection(result, {
+                  tool: rawToolName,
+                  ...sourceA ? { untrusted: true } : {}
+                });
                 if (m && atLeastConfidence(m.confidence, inj.minConfidence)) {
                   injection = m;
                   out = frameUntrusted(result);
                 }
               }
-              const ucA = config.policy.untrustedContent;
-              const shellA = ucA?.enabled ? shellFetch(tool, rawInput) : null;
-              if (ucA?.enabled && (toolRole(tool, ucA).source || shellA?.fetches)) {
+              if (sourceA) {
                 const wordA = shellA?.fetches ? shellSourceWord(shellA.fetchKinds) : sourceWord(tool);
                 markSessionExposed(payloadSessionId ?? "");
                 await notifySessionExposure(
@@ -64986,15 +65300,16 @@ function registerLogCommand(program2) {
                 );
               }
               if (injectionOn) {
-                const m = scanInjection(toolOutput, { tool: rawToolName });
+                const injCtx = { tool: rawToolName, ...sourceRead ? { untrusted: true } : {} };
+                const m = scanInjection(toolOutput, injCtx);
                 if (m && atLeastConfidence(m.confidence, inj.minConfidence)) {
                   if (spotlightApplies) {
-                    injectedLeaf = (leaf) => scanInjection(leaf, { tool: rawToolName }) !== null;
+                    injectedLeaf = (leaf) => scanInjection(leaf, injCtx) !== null;
                   }
                   if (agent === "Claude Code" && !spotlightApplies) {
                     updatedToolOutput = frameToolOutputLeaves(
                       updatedToolOutput ?? payload.tool_response,
-                      (leaf) => scanInjection(leaf, { tool: rawToolName }) !== null,
+                      (leaf) => scanInjection(leaf, injCtx) !== null,
                       newUntrustedFrame,
                       neutralizeMarkers
                     );
@@ -65011,22 +65326,29 @@ function registerLogCommand(program2) {
               if (sourceRead) {
                 const destinations = extractContentDestinations(toolOutput);
                 markSessionExposed(payloadSessionId ?? "");
+                const sourceEid = appendLocalAudit(
+                  tool,
+                  rawInput,
+                  "allow",
+                  "exposure-source",
+                  {
+                    agent,
+                    ...payloadSessionId ? { sessionId: payloadSessionId } : {},
+                    ...rawToolName !== tool ? { agentToolName: rawToolName } : {},
+                    exposure: { kind: "source", destinations: destinations.length }
+                  },
+                  config.settings.auditHashArgs === true
+                );
                 await notifySessionExposure(
                   payloadSessionId ?? "",
                   {
                     tool,
                     server: splitMcpToolName(tool)?.server,
-                    ...shellExposure?.fetches ? { word: shellSourceWord(shellExposure.fetchKinds) } : {}
+                    ...shellExposure?.fetches ? { word: shellSourceWord(shellExposure.fetchKinds) } : {},
+                    eid: sourceEid
                   },
                   destinations
                 );
-                appendToLog(LOCAL_AUDIT_LOG, {
-                  ts: (/* @__PURE__ */ new Date()).toISOString(),
-                  tool,
-                  source: "exposure-source",
-                  destinations: destinations.length,
-                  ...payloadSessionId ? { sessionId: payloadSessionId } : {}
-                });
                 if (spotlightApplies) {
                   const word = shellExposure?.fetches ? shellSourceWord(shellExposure.fetchKinds) : sourceWord(tool);
                   if (agent === "Claude Code") {
@@ -66556,7 +66878,9 @@ function dimensionOfBlock(checkedBy, ruleName) {
   if (checkedBy.includes("egress")) return "network";
   if (ruleName.startsWith("ssrf:")) return "network";
   if (checkedBy.includes("pii") || checkedBy.includes("dlp")) return "data";
-  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection"))
+  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection") || // fw#318: a send held after the session read outside content, and the
+  // read rows themselves. Mirrors node9Firewall canon-taxonomy.ts.
+  ruleName.startsWith("exposure") || checkedBy.startsWith("exposure"))
     return "detection";
   if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "apps";
   if (ruleName.startsWith("shield:project-jail")) return "files";
@@ -67880,7 +68204,10 @@ function scanToolResult(line, parsed, tool, cfg) {
   let injection = null;
   const inj = cfg.injection;
   if (inj.enabled && !inj.allow.includes(tool) && texts.length > 0) {
-    const m = scanInjection(texts.join("\n"), { tool });
+    const m = scanInjection(texts.join("\n"), {
+      tool,
+      ...cfg.untrusted ? { untrusted: true } : {}
+    });
     if (m && CONFIDENCE_RANK2[m.confidence] >= CONFIDENCE_RANK2[inj.minConfidence]) {
       injection = m;
       mutated = true;
@@ -68396,7 +68723,8 @@ async function runMcpGateway(upstreamCommand, configName) {
             const scan = scanToolResult(line, parsed, exec.toolName, {
               dlpEnabled: cfg.policy.dlp.enabled,
               injection: cfg.policy.injectionScan,
-              spotlight: isSource && uc.spotlight ? sourceWord(nsName) : void 0
+              spotlight: isSource && uc.spotlight ? sourceWord(nsName) : void 0,
+              untrusted: isSource
             });
             if (scan.changed) outLine = scan.line;
             if (isSource) {