@node9/proxy 2.33.1 → 2.34.0

package/dist/index.mjs

@@ -1173,6 +1173,120 @@ function expandPlainParam(p) {
   if (recorded !== void 0) return recorded;
   return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
 }
+function functionBodies(f) {
+  const out = /* @__PURE__ */ new Map();
+  syntax.Walk(f, (node) => {
+    const n = node;
+    if (n && syntax.NodeType(n) === "FuncDecl" && n.Name?.Value && n.Body) {
+      const list = out.get(n.Name.Value) ?? [];
+      list.push(n.Body);
+      out.set(n.Name.Value, list);
+    }
+    return true;
+  });
+  return out;
+}
+function rebindsPositionals(body) {
+  let found = false;
+  syntax.Walk(body, (node) => {
+    const n = node;
+    if (found || !n) return false;
+    if (syntax.NodeType(n) === "CallExpr") {
+      const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+      if (words[0] === "shift") found = true;
+      else if (words[0] === "set" && words.slice(1).some((w) => w === null || w === "--" || !/^[-+]/.test(w)))
+        found = true;
+    }
+    return !found;
+  });
+  return found;
+}
+function tableBindings() {
+  if (!assignmentTable) return "";
+  const out = [];
+  for (const [name, rec] of assignmentTable)
+    if (rec.at < currentStmtOffset) out.push(`${name}=${rec.value ?? "\0"}`);
+  return out.sort().join("
");
+}
+function walkWithCalls(f, visit) {
+  const bodies = functionBodies(f);
+  if (bodies.size === 0) {
+    syntax.Walk(f, visit);
+    return;
+  }
+  const seenCalls = /* @__PURE__ */ new Set();
+  const inline = (call) => {
+    const words = (call.Args || []).map((a) => resolveWordLiteral(a));
+    const list = words[0] ? bodies.get(words[0]) : void 0;
+    if (!list || callDepth >= MAX_CALL_DEPTH) return;
+    const args = words.slice(1);
+    const key = `${words[0]}\0${JSON.stringify(args)}\0${tableBindings()}`;
+    if (seenCalls.has(key)) return;
+    seenCalls.add(key);
+    const outerTable = assignmentTable;
+    const outerOffset = currentStmtOffset;
+    for (const body of list) {
+      if (callWalks >= MAX_CALL_WALKS) return;
+      callWalks++;
+      const table = /* @__PURE__ */ new Map();
+      for (const [name, rec] of outerTable ?? [])
+        if (rec.at < outerOffset) table.set(name, { value: rec.value, at: -1 });
+      for (const name of ["1", "2", "3", "4", "5", "6", "7", "8", "9", "@", "*", "#"])
+        table.delete(name);
+      if (!rebindsPositionals(body)) {
+        args.slice(0, 9).forEach((value, i) => table.set(String(i + 1), { value, at: -1 }));
+        if (args.length === 1) {
+          table.set("@", { value: args[0], at: -1 });
+          table.set("*", { value: args[0], at: -1 });
+        }
+        table.set("#", { value: String(args.length), at: -1 });
+      }
+      assignmentTable = table;
+      currentStmtOffset = Number.MAX_SAFE_INTEGER;
+      callDepth++;
+      try {
+        if (body.Cmd && syntax.NodeType(body.Cmd) === "Block") recordTopLevelAssignments(body.Cmd);
+        syntax.Walk(body, step);
+      } finally {
+        callDepth--;
+        assignmentTable = outerTable;
+        currentStmtOffset = outerOffset;
+      }
+    }
+  };
+  const step = (node) => {
+    if (!node) return false;
+    const go = visit(node);
+    if (go !== false && syntax.NodeType(node) === "CallExpr") inline(node);
+    return go;
+  };
+  syntax.Walk(f, step);
+}
+function withAssignments(f, body) {
+  const outerTable = assignmentTable;
+  const outerOffset = currentStmtOffset;
+  const outerWalks = callWalks;
+  callWalks = 0;
+  assignmentTable = new Map(
+    [...outerTable ?? []].map(([k, r]) => [k, { value: r.value, at: -1 }])
+  );
+  currentStmtOffset = Number.MAX_SAFE_INTEGER;
+  try {
+    recordTopLevelAssignments(f);
+    return body();
+  } finally {
+    assignmentTable = outerTable;
+    currentStmtOffset = outerOffset;
+    callWalks = outerWalks;
+  }
+}
+function trackStatement(n) {
+  try {
+    currentStmtOffset = n.Pos().Offset();
+  } catch {
+    currentStmtOffset = Number.MAX_SAFE_INTEGER;
+  }
+}
 function resolveWordLiteral(w) {
   const parts = w?.Parts || [];
   let s = "";
@@ -1293,27 +1407,31 @@ function extractShellDestinations(command) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   try {
-    syntax.Walk(f, (node) => {
-      if (!node) return false;
-      const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
-      const callArgs = n.Args || [];
-      if (callArgs.length === 0) return true;
-      const words = callArgs.map((a) => resolveWordLiteral(a));
-      const at = unwrapCommandHead(words);
-      const name = (words[at] || "").toLowerCase().split("/").pop() ?? "";
-      if (!NET_BINARIES.has(name)) return true;
-      const rest = words.slice(at + 1);
-      for (const raw of destTokensForBinary(name, rest)) {
-        const host2 = parseDestHost(raw);
-        if (!host2) continue;
-        const key = `${name}:${host2}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        out.push({ host: host2, binary: name, raw });
-      }
-      return true;
-    });
+    withAssignments(
+      f,
+      () => walkWithCalls(f, (node) => {
+        if (!node) return false;
+        const n = node;
+        if (syntax.NodeType(n) === "Stmt") trackStatement(n);
+        if (syntax.NodeType(n) !== "CallExpr") return true;
+        const callArgs = n.Args || [];
+        if (callArgs.length === 0) return true;
+        const words = callArgs.map((a) => resolveWordLiteral(a));
+        const at = unwrapCommandHead(words);
+        const name = (words[at] || "").toLowerCase().split("/").pop() ?? "";
+        if (!NET_BINARIES.has(name)) return true;
+        const rest = words.slice(at + 1);
+        for (const raw of destTokensForBinary(name, rest)) {
+          const host2 = parseDestHost(raw);
+          if (!host2) continue;
+          const key = `${name}:${host2}`;
+          if (seen.has(key)) continue;
+          seen.add(key);
+          out.push({ host: host2, binary: name, raw });
+        }
+        return true;
+      })
+    );
   } catch {
     return out;
   }
@@ -1325,39 +1443,45 @@ function extractShellDestTokens(command) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   try {
-    syntax.Walk(f, (node) => {
-      if (!node) return false;
-      const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
-      const callArgs = n.Args || [];
-      if (callArgs.length === 0) return true;
-      const name = (resolveWordLiteral(callArgs[0]) || "").toLowerCase();
-      if (!NET_BINARIES.has(name)) return true;
-      const rest = callArgs.slice(1).map((a) => resolveWordLiteral(a));
-      for (const raw of destTokensForBinary(name, rest)) {
-        if (!raw) continue;
-        let tok = raw.trim();
-        const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(tok);
-        const hasScheme = scheme !== null;
-        if (hasScheme) tok = tok.slice(scheme[0].length);
-        tok = tok.split(/[/?#]/)[0];
-        const at = tok.lastIndexOf("@");
-        if (at >= 0) tok = tok.slice(at + 1);
-        if (tok.startsWith("[")) {
-          const close = tok.indexOf("]");
-          if (close > 0) tok = tok.slice(0, close + 1);
-        } else {
-          tok = tok.split(":")[0];
+    withAssignments(
+      f,
+      () => walkWithCalls(f, (node) => {
+        if (!node) return false;
+        const n = node;
+        if (syntax.NodeType(n) === "Stmt") trackStatement(n);
+        if (syntax.NodeType(n) !== "CallExpr") return true;
+        const callArgs = n.Args || [];
+        if (callArgs.length === 0) return true;
+        const words = callArgs.map((a) => resolveWordLiteral(a));
+        const head = unwrapCommandHead(words);
+        const name = (words[head] || "").toLowerCase().split("/").pop() ?? "";
+        if (!NET_BINARIES.has(name)) return true;
+        const rest = words.slice(head + 1);
+        for (const raw of destTokensForBinary(name, rest)) {
+          if (!raw) continue;
+          let tok = raw.trim();
+          const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(tok);
+          const hasScheme = scheme !== null;
+          if (hasScheme) tok = tok.slice(scheme[0].length);
+          tok = tok.split(/[/?#]/)[0];
+          const at = tok.lastIndexOf("@");
+          if (at >= 0) tok = tok.slice(at + 1);
+          if (tok.startsWith("[")) {
+            const close = tok.indexOf("]");
+            if (close > 0) tok = tok.slice(0, close + 1);
+          } else {
+            tok = tok.split(":")[0];
+          }
+          if (!tok) continue;
+          if (!hasScheme && /^\d+$/.test(tok) && Number(tok) < 16777216) continue;
+          const key = `${name}:${tok}`;
+          if (seen.has(key)) continue;
+          seen.add(key);
+          out.push({ token: tok, binary: name });
         }
-        if (!tok) continue;
-        if (!hasScheme && /^\d+$/.test(tok) && Number(tok) < 16777216) continue;
-        const key = `${name}:${tok}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        out.push({ token: tok, binary: name });
-      }
-      return true;
-    });
+        return true;
+      })
+    );
   } catch {
     return out;
   }
@@ -1476,6 +1600,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
   if (depth === 0) {
     seenPayloads = /* @__PURE__ */ new Set();
     payloadBudget = PAYLOAD_BUDGET;
+    if (callDepth === 0) callWalks = 0;
   }
   assignmentTable = new Map(
     [...outerTable ?? []].map(([k, r]) => [k, { value: r.value, at: -1 }])
@@ -1483,7 +1608,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
   currentStmtOffset = Number.MAX_SAFE_INTEGER;
   try {
     recordTopLevelAssignments(f);
-    syntax.Walk(f, (node) => {
+    walkWithCalls(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
       const nodeType = syntax.NodeType(n);
@@ -2272,6 +2397,19 @@ function runnablePrefix(command) {
   }
   return null;
 }
+function uploadedFile(tool, flag, value) {
+  const v = value.value;
+  const file2 = (f) => f && f !== "-" && f !== "." ? { value: f } : null;
+  if (tool === "curl") {
+    if (["-d", "--data", "--data-ascii", "--data-binary", "--json"].includes(flag))
+      return v.startsWith("@") ? file2(v.slice(1)) : null;
+    if (flag === "--data-urlencode") return file2(/^[^=@]*@(.+)$/.exec(v)?.[1]);
+    if (flag === "-F" || flag === "--form") return file2(/^[^=]*=[@<]([^;]+)/.exec(v)?.[1]);
+    if (flag === "-T" || flag === "--upload-file") return file2(v);
+  }
+  if (tool === "wget" && ["--post-file", "--body-file"].includes(flag)) return file2(v);
+  return null;
+}
 function merge(a, b) {
   a.cwd = unique([...a.cwd, ...b.cwd]);
   for (const key of /* @__PURE__ */ new Set([...a.vars.keys(), ...b.vars.keys()])) {
@@ -2345,6 +2483,9 @@ function wordValues(word, state) {
 function collectShellFileAccesses(command, context = {}) {
   const out = [];
   let payloads = 256;
+  const functions = /* @__PURE__ */ new Map();
+  const seenCalls = /* @__PURE__ */ new Set();
+  let callWalks2 = MAX_CALL_WALKS2;
   const initial = {
     cwd: [context.cwd ?? ""],
     vars: /* @__PURE__ */ new Map([["HOME", [context.homeDirs?.[0] ?? "~"]]])
@@ -2602,8 +2743,98 @@ function collectShellFileAccesses(command, context = {}) {
       }
       return;
     }
+    if (name === "wget" || name === "curl" || name === "aria2c") {
+      downloadOutputs(name, args, state);
+      return;
+    }
+    if (["http", "https", "xh", "xhs"].includes(name)) {
+      for (const token of args) {
+        if (!token || token.dynamic || /^[a-z][a-z0-9+.-]*:\/\//i.test(token.value)) continue;
+        const m = /^(?:@|[^=:@\s]+@|[^=:@\s]*=@)(.+)$/.exec(token.value);
+        if (m && m[1] !== "-") add("read", { value: m[1] }, state, { upload: true });
+      }
+      return;
+    }
+    if (name === "scp" || name === "rsync") {
+      const operands2 = strings.filter((s) => s && !s.startsWith("-"));
+      const remote = operands2.slice(1).some((o) => /^[^/\s]+:/.test(o));
+      for (const p of copySourcePaths(words))
+        add("read", locate(p), state, remote ? { upload: true } : {});
+      return;
+    }
     for (const p of copySourcePaths(words)) add("read", locate(p), state);
   }
+  function downloadOutputs(name, args, state) {
+    const valueShort = DOWNLOAD_SHORT_VALUE[name];
+    const outputs = [];
+    const urls = [];
+    let dir2 = null;
+    let remoteName = false;
+    let document = false;
+    let serverNamed = false;
+    const take = (flag, value) => {
+      if (!value) return;
+      const sent = uploadedFile(name, flag, value);
+      if (sent) add("read", sent, state, { upload: true });
+      if (DOWNLOAD_OUTPUT_FLAGS[name].includes(flag)) {
+        if (["-O", "--output-document", "--out"].includes(flag) || name === "aria2c" && flag === "-o")
+          document = true;
+        if (value.value !== "-" || value.pattern || value.dynamic) outputs.push(value);
+      } else if (DOWNLOAD_DIR_FLAGS[name].includes(flag)) dir2 = value;
+      else if (name === "wget" && (flag === "-i" || flag === "--input-file")) serverNamed = true;
+    };
+    for (let i = 0; i < args.length; i++) {
+      const token = args[i];
+      if (!token) continue;
+      const v = token.value;
+      if (v.startsWith("--")) {
+        const eq = v.indexOf("=");
+        const flag = eq < 0 ? v : v.slice(0, eq);
+        if (["--remote-name", "--remote-name-all"].includes(flag)) remoteName = true;
+        if (["--remote-header-name", "--recursive", "--mirror", "--page-requisites"].includes(flag))
+          serverNamed = true;
+        if (DOWNLOAD_LONG_VALUE[name].includes(flag))
+          take(flag, eq < 0 ? args[++i] ?? null : { ...token, value: v.slice(eq + 1) });
+        continue;
+      }
+      if (v.startsWith("-") && v.length > 1 && !token.dynamic) {
+        for (let j = 1; j < v.length; j++) {
+          const c = v[j];
+          if (name === "wget" && c === "n") {
+            j++;
+            continue;
+          }
+          if (name === "curl" && c === "O") remoteName = true;
+          if (name === "curl" && c === "J") serverNamed = true;
+          if (name === "wget" && (c === "r" || c === "m" || c === "p")) serverNamed = true;
+          if (valueShort.includes(c)) {
+            const rest = v.slice(j + 1);
+            take(`-${c}`, rest ? { value: rest } : args[++i] ?? null);
+            break;
+          }
+        }
+        continue;
+      }
+      if (/^(?:https?|ftps?):\/\//i.test(v)) urls.push(v);
+    }
+    for (const out2 of outputs) {
+      const spelled = name === "aria2c" && dir2?.value && !out2.value.startsWith("/") ? { ...out2, value: `${dir2.value.replace(/\/+$/, "")}/${out2.value}` } : out2;
+      if (name === "curl" && /#\d/.test(spelled.value))
+        add("write", { value: "", pattern: spelled.value.replace(/#\d+/g, "*"), dot: true }, state);
+      else add("write", spelled, state);
+    }
+    const remote = name === "curl" ? remoteName || serverNamed : !document || serverNamed;
+    if (!remote) return;
+    const into = dir2?.value ? dir2.value.replace(/\/+$/, "") : ".";
+    if (serverNamed || urls.length === 0) {
+      add("write", { value: "", pattern: `${quoteGlob(into)}/*`, dot: true }, state);
+      return;
+    }
+    for (const url of urls) {
+      const file2 = url.replace(/[?#].*$/, "").replace(/^[a-z]+:\/\/[^/]*/i, "").split("/").pop();
+      add("write", { value: `${into}/${file2 || "index.html"}` }, state);
+    }
+  }
   function findActions2(tokens, words, head, state, nested, depth) {
     const starts = findStartPoints(words, head).starts;
     const roots = (starts.length ? starts : ["."]).slice(0, MAX_ALTERNATIVES);
@@ -2675,7 +2906,35 @@ function collectShellFileAccesses(command, context = {}) {
       const words = wordValues(node, state);
       alternatives = alternatives.flatMap((prefix) => (words.length ? words : [null]).map((w) => [...prefix, w])).slice(0, MAX_ALTERNATIVES);
     }
-    for (const tokens of alternatives) fromWords(tokens, state, nested, depth);
+    for (const tokens of alternatives) {
+      fromWords(tokens, state, nested, depth);
+      inlineCall(tokens, state, depth);
+    }
+  }
+  function inlineCall(tokens, state, depth) {
+    const head = tokens[0];
+    if (!head || head.dynamic || head.pattern) return;
+    const bodies = functions.get(head.value);
+    if (!bodies || (state.callDepth ?? 0) >= MAX_CALL_DEPTH2) return;
+    const args = tokens.slice(1).map((a) => a && !a.dynamic ? a.value : null);
+    const vars = JSON.stringify([...state.vars].sort(([a], [b]) => a < b ? -1 : 1));
+    const key = `${head.value}\0${JSON.stringify(args)}\0${state.cwd.join("
")}\0${vars}`;
+    if (seenCalls.has(key)) return;
+    seenCalls.add(key);
+    for (const body of bodies) {
+      if (callWalks2-- <= 0) return;
+      const local = clone(state);
+      local.callDepth = (state.callDepth ?? 0) + 1;
+      for (const name of POSITIONAL) local.vars.delete(name);
+      if (!rebindsPositionals(body)) {
+        args.slice(0, 9).forEach((v, i) => local.vars.set(String(i + 1), v === null ? null : [v]));
+        const all = args.every((v) => v !== null) && args.length ? unique(args) : null;
+        local.vars.set("@", all);
+        local.vars.set("*", all);
+        local.vars.set("#", [String(args.length)]);
+      }
+      statement(body, local, depth + 1);
+    }
   }
   function readsScriptFromStdin(stmt) {
     const cmd = stmt?.Cmd;
@@ -2712,11 +2971,13 @@ function collectShellFileAccesses(command, context = {}) {
     if (!stmt || depth > MAX_DEPTH) return;
     state.onSuccess = void 0;
     if (stmt.Background) state = clone(state);
+    const headWord = stmt.Cmd && syntax2.NodeType(stmt.Cmd) === "CallExpr" ? base(resolveWordLiteral(stmt.Cmd.Args?.[0])) : "";
+    const sends = SENDING_STDIN.has(headWord);
     for (const redir of stmt.Redirs ?? []) {
       substitutions(redir.Word, state, depth);
       for (const word of wordValues(redir.Word, state)) {
         if (WRITES.has(redir.Op)) add("write", word, state);
-        if (READS.has(redir.Op)) add("read", word, state);
+        if (READS.has(redir.Op)) add("read", word, state, sends ? { upload: true } : {});
         if (redir.Op === DUP_OUT && word.value && !/^\d+$/.test(word.value))
           add("write", word, state);
       }
@@ -2825,7 +3086,10 @@ function collectShellFileAccesses(command, context = {}) {
   }
   const parsed = parseShared(command);
   const program = typeof parsed !== "symbol" ? parsed : runnablePrefix(command);
-  if (program) statements(program.Stmts ?? [], initial, 0);
+  if (program) {
+    for (const [name, bodies] of functionBodies(program)) functions.set(name, bodies);
+    statements(program.Stmts ?? [], initial, 0);
+  }
   return out;
 }
 function isAgentInstructionPath(absPath, root) {
@@ -2941,6 +3205,33 @@ function hits(access, paths, directories, context) {
   }
   return false;
 }
+function hitsSystemDir(access, context, dirs = SYSTEM_DIRS) {
+  const home = context.homeDirs?.[0] ?? "~";
+  const candidates = access.candidates ?? [
+    normalizeFilePath(access.path, access.cwd ?? context.cwd, home)
+  ];
+  for (const p of candidates) {
+    if (dirs.some((d) => within(p, d)) && !exempt(p)) return true;
+    if (access.recursive && dirs.some((d) => within(d, p))) return true;
+  }
+  if (!access.glob) return false;
+  const pattern = normalizeFilePath(access.glob, access.cwd ?? context.cwd, home);
+  const magic = pattern.search(/[*?[{]/);
+  const literal = magic < 0 ? pattern : pattern.slice(0, pattern.lastIndexOf("/", magic) + 1);
+  if (literal && exempt(literal.replace(/\/$/, "") || "/")) return false;
+  const options = { dot: access.dotGlob === true, nonegate: true };
+  const components = pattern.split("/");
+  for (const root of dirs) {
+    const count = root.split("/").length;
+    if (components.length > count && picomatch(components.slice(0, count).join("/"), options)(root))
+      return true;
+    if (access.recursive && picomatch(pattern, options)(root)) return true;
+  }
+  return false;
+}
+function uploadDirs(context) {
+  return context.homeDirs?.[0] === "/root" ? UPLOAD_SYSTEM_DIRS.filter((d) => d !== "/root") : UPLOAD_SYSTEM_DIRS;
+}
 function evaluateProtectedFileAccess(accesses, context, settings) {
   const homes = [.../* @__PURE__ */ new Set([...context.homeDirs ?? ["~"], "/root"])];
   const startup = homes.flatMap(
@@ -2962,6 +3253,14 @@ function evaluateProtectedFileAccess(accesses, context, settings) {
         "files.shell-startup",
         "review-shell-startup-mutation",
         "Changing shell startup files requires approval"
+      ] : mutation && hitsSystemDir(access, context) ? [
+        "files.system-dirs",
+        "review-system-dir-mutation",
+        "Changing files in a system directory requires approval"
+      ] : !mutation && access.upload && hitsSystemDir(access, context, uploadDirs(context)) ? [
+        "files.system-dirs",
+        "review-system-file-upload",
+        "Uploading a system file requires approval"
       ] : !mutation && hits(access, PASSWORD_HASH_FILES, [], context) ? [
         "files.password-hashes",
         "review-password-hash-read",
@@ -3222,16 +3521,21 @@ function looksGenerated(value, minLength, minEntropy, lettersOnlyAllowed = false
   if (EMAIL_VALUE_RE.test(value)) return false;
   if (looksLikeJoinedWords(value) || hasSequentialRun(value)) return false;
   if (PATH_VALUE_RE.test(value) || DOTTED_REFERENCE_RE.test(value)) return false;
+  if (CONCATENATION_RE.test(value)) return false;
   if (rejectedByStructuredValidator(value)) return false;
   return shannonEntropy(value) >= minEntropy;
 }
 function nameHoldsCredential(name) {
   return !FIXTURE_NAME_RE.test(name) && !DERIVATIVE_NAME_RE.test(name);
 }
+function isOtpDocSecret(value) {
+  return OTP_DOC_SECRETS.has(value.replace(/=+$/, "").toUpperCase());
+}
 function validateQueryCredential(raw) {
   const value = capturedValue(raw, QUERY_CREDENTIAL_VALUE_RE);
   if (value === null) return false;
-  if (OTP_SECRET_RE.test(value)) return looksGenerated(value, 16, 3, true);
+  if (OTP_SECRET_RE.test(value))
+    return !isOtpDocSecret(value) && looksGenerated(value, 16, 3, true);
   if (!/[0-9]/.test(value) || !/[A-Za-z]/.test(value)) return false;
   return looksGenerated(value, 12, 3);
 }
@@ -3245,13 +3549,40 @@ function keywordEndsAPart(name) {
 }
 function validateAssignedSecret(raw, before = "") {
   const value = capturedValue(raw, ASSIGNED_SECRET_VALUE_RE);
-  const name = capturedValue(raw, ASSIGNED_SECRET_NAME_RE);
+  const name = capturedValue(raw, ASSIGNED_SECRET_NAME_RE)?.replace(/^_+/, "") ?? null;
   if (value === null || name === null) return false;
-  if (!keywordEndsAPart(name) || ARN_CONTEXT_RE.test(before)) return false;
-  const prefix = before.match(/[A-Za-z0-9_]*$/)?.[0] ?? "";
+  if (!keywordEndsAPart(name)) return false;
+  if (ARN_CONTEXT_RE.test(before)) return false;
+  const prefix = (before.match(/[A-Za-z0-9_]*$/)?.[0] ?? "") + (raw.startsWith("_") ? "_" : "");
   if (!nameHoldsCredential(prefix + name)) return false;
   return looksGenerated(value, 12, 3.5);
 }
+function validateBasicCredential(raw) {
+  const b64 = capturedValue(raw, BASIC_VALUE_RE);
+  if (b64 === null) return false;
+  const bare = b64.replace(/=+$/, "");
+  if (bare.length % 4 === 1) return false;
+  const bytes = Buffer.from(b64, "base64");
+  if (bytes.toString("base64").replace(/=+$/, "") !== bare) return false;
+  const text = bytes.toString("utf8");
+  if (!Buffer.from(text, "utf8").equals(bytes)) return false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c < 32 || c === 127) return false;
+  }
+  const pair = BASIC_PAIR_RE.exec(text);
+  if (!pair) return false;
+  const password = pair[2];
+  if (!/[0-9]/.test(password) || !/[A-Za-z]/.test(password)) return false;
+  const lower2 = password.toLowerCase();
+  if (DLP_STOPWORDS.some((sw) => lower2.includes(sw)) || hasSequentialRun(password)) return false;
+  return shannonEntropy(password) >= 3;
+}
+function validateOtpSecret(raw) {
+  const secret = capturedValue(raw, OTP_CAPTURE_RE);
+  if (secret === null || isOtpDocSecret(secret)) return false;
+  return looksGenerated(secret.replace(/=+$/, ""), 16, 3, true);
+}
 function matchSensitivePath2(resolvedPath, originalPath, options = {}) {
   const normalised = resolvedPath.replace(/\\/g, "/");
   if (!options.systemAccessHandled && isLegacySystemPath(normalised))
@@ -3522,6 +3853,156 @@ function parsePySpec(raw) {
   const exact = PY_EXACT_RE.exec(m[2].trim());
   return { name, version: exact ? exact[1] : void 0 };
 }
+function exactVersion(v) {
+  if (!v) return void 0;
+  const m = EXACT_VERSION_RE.exec(v.trim());
+  return m ? m[1] : void 0;
+}
+function push(out, ecosystem, manager, name, version, raw) {
+  out.push({ ecosystem, manager, name, ...version ? { version } : {}, raw });
+}
+function gemInstall(words, from, out) {
+  const dash = words.indexOf("--", from);
+  const own = dash < 0 ? words : words.slice(0, dash);
+  const pinned = exactVersion(flagValues(own, from, ["-v", "--version"])[0]);
+  for (const raw of operands(own, from, GEM_VALUE_FLAGS)) {
+    if (NON_REGISTRY_RE.test(raw) || /\.gem$/i.test(raw)) continue;
+    const colon = raw.indexOf(":");
+    const name = colon < 0 ? raw : raw.slice(0, colon);
+    if (!GEM_NAME_RE.test(name)) continue;
+    push(
+      out,
+      "RubyGems",
+      "gem",
+      name,
+      colon < 0 ? pinned : exactVersion(raw.slice(colon + 1)),
+      raw
+    );
+  }
+}
+function cargoCrates(words, from, manager, out) {
+  const flags = manager === "cargo add" ? CARGO_ADD_VALUE_FLAGS : CARGO_INSTALL_VALUE_FLAGS;
+  if (flagValues(words, from, ["--git", "--path", "--registry", "--index"]).length > 0) return;
+  if (words.some((w) => w === "--git" || w === "--path")) return;
+  const flagVersion = manager === "cargo install" ? exactVersion(flagValues(words, from, ["--version", "--vers"])[0]) : void 0;
+  for (const raw of operands(words, from, flags)) {
+    const at = raw.indexOf("@");
+    const name = at < 0 ? raw : raw.slice(0, at);
+    if (!CRATE_NAME_RE.test(name)) continue;
+    push(
+      out,
+      "crates.io",
+      manager,
+      name,
+      at < 0 ? flagVersion : exactVersion(raw.slice(at + 1)),
+      raw
+    );
+  }
+}
+function goModules(words, from, manager, out) {
+  let specs = operands(words, from, GO_VALUE_FLAGS);
+  if (manager === "go run") specs = specs.slice(0, 1).filter((s) => s.includes("@"));
+  for (const raw of specs) {
+    const at = raw.indexOf("@");
+    const pathPart = (at < 0 ? raw : raw.slice(0, at)).replace(/\/\.\.\.$/, "");
+    const ver = at < 0 ? void 0 : raw.slice(at + 1);
+    if (ver === "none") continue;
+    if (!GO_PATH_RE.test(pathPart) || /\.go$/i.test(pathPart)) continue;
+    const exact = ver && /^v\d/.test(ver) ? exactVersion(ver) : void 0;
+    push(out, "Go", manager, pathPart, exact, raw);
+  }
+}
+function dotnetAdd(words, from, out) {
+  let k = -1;
+  for (let i = from; i < Math.min(words.length, from + 2); i++) {
+    if (lower(words[i]) === "package") {
+      k = i;
+      break;
+    }
+  }
+  if (k < 0) return;
+  const name = operands(words, k + 1, DOTNET_ADD_VALUE_FLAGS)[0];
+  if (!name || !NUGET_NAME_RE.test(name)) return;
+  const version = exactVersion(flagValues(words, k + 1, ["-v", "--version"])[0]);
+  push(out, "NuGet", "dotnet add package", name, version, name);
+}
+function dotnetTool(words, from, out) {
+  const name = operands(words, from, DOTNET_TOOL_VALUE_FLAGS)[0];
+  if (!name || !NUGET_NAME_RE.test(name)) return;
+  const version = exactVersion(flagValues(words, from, ["--version"])[0]);
+  push(out, "NuGet", "dotnet tool", name, version, name);
+}
+function nugetInstall(words, from, out) {
+  const lowered = words.map((w) => w !== null && w.startsWith("-") ? w.toLowerCase() : w);
+  const name = operands(lowered, from, NUGET_VALUE_FLAGS)[0];
+  if (!name || !NUGET_NAME_RE.test(name) || /\.config$/i.test(name)) return;
+  const version = exactVersion(flagValues(lowered, from, ["-version"])[0]);
+  push(out, "NuGet", "nuget install", name, version, name);
+}
+function mavenGet(words, from, out) {
+  const goal = words.slice(from).some(
+    (w) => w !== null && /(?:^|:)dependency:get$|^org\.apache\.maven\.plugins:maven-dependency-plugin:(?:[\w.-]+:)?get$/.test(
+      w
+    )
+  );
+  if (!goal) return;
+  const prop = (key) => {
+    for (let i = from; i < words.length; i++) {
+      const w = words[i];
+      if (w === null) continue;
+      if (w.startsWith(`-D${key}=`)) return w.slice(key.length + 3);
+      if (w === "-D" && words[i + 1]?.startsWith(`${key}=`))
+        return words[i + 1].slice(key.length + 1);
+    }
+    return void 0;
+  };
+  const artifact = prop("artifact");
+  let coord;
+  let ver;
+  if (artifact) {
+    const parts = artifact.split(":");
+    if (parts.length < 2) return;
+    coord = `${parts[0]}:${parts[1]}`;
+    ver = parts[2];
+  } else {
+    const g = prop("groupId");
+    const a = prop("artifactId");
+    if (!g || !a) return;
+    coord = `${g}:${a}`;
+    ver = prop("version");
+  }
+  if (!MAVEN_COORD_RE.test(coord)) return;
+  const exact = ver && !/^(?:LATEST|RELEASE)$/i.test(ver) ? exactVersion(ver) : void 0;
+  push(out, "Maven", "mvn dependency:get", coord, exact, artifact ?? coord);
+}
+function composerPackages(words, from, manager, out) {
+  const ops = operands(words, from, COMPOSER_VALUE_FLAGS);
+  const specs = manager === "composer create-project" ? ops.slice(0, 1) : ops;
+  for (const raw of specs) {
+    const sep = raw.search(/[:=]/);
+    const name = sep < 0 ? raw : raw.slice(0, sep);
+    if (!COMPOSER_NAME_RE.test(name)) continue;
+    let ver = sep < 0 ? void 0 : raw.slice(sep + 1);
+    if (manager === "composer create-project" && ver === void 0) ver = ops[2] ?? void 0;
+    push(out, "Packagist", manager, name.toLowerCase(), exactVersion(ver), raw);
+  }
+}
+function editorExtensions(words, from, out) {
+  for (const raw of flagValues(words, from, ["--install-extension"])) {
+    if (/\.vsix$/i.test(raw) || NON_REGISTRY_RE.test(raw)) continue;
+    const at = raw.lastIndexOf("@");
+    const name = at <= 0 ? raw : raw.slice(0, at);
+    if (!EXTENSION_ID_RE.test(name)) continue;
+    push(
+      out,
+      "VSCode",
+      "code --install-extension",
+      name,
+      at <= 0 ? void 0 : exactVersion(raw.slice(at + 1)),
+      raw
+    );
+  }
+}
 function basename(w) {
   return (w ?? "").toLowerCase().split("/").pop() ?? "";
 }
@@ -3753,7 +4234,63 @@ function fromCall(words, out, depth) {
         pushPy(out, "pipenv", operands(words, v + 1, PIPENV_VALUE_FLAGS));
       return;
     }
+    case "gem": {
+      const v = verbIndex(words, start + 1, GEM_VALUE_FLAGS);
+      if (v >= 0 && ["install", "i"].includes(lower(words[v]))) gemInstall(words, v + 1, out);
+      return;
+    }
+    case "bundle": {
+      const v = verbIndex(words, start + 1, BUNDLE_VALUE_FLAGS);
+      if (v < 0 || lower(words[v]) !== "add") return;
+      if (flagValues(words, v + 1, ["--git", "--github", "--path"]).length > 0) return;
+      const version = exactVersion(flagValues(words, v + 1, ["-v", "--version"])[0]);
+      for (const raw of operands(words, v + 1, BUNDLE_VALUE_FLAGS))
+        if (GEM_NAME_RE.test(raw)) push(out, "RubyGems", "bundle add", raw, version, raw);
+      return;
+    }
+    case "cargo": {
+      const from = words[start + 1]?.startsWith("+") ? start + 2 : start + 1;
+      const v = verbIndex(words, from, CARGO_ADD_VALUE_FLAGS);
+      const verb = lower(words[v]);
+      if (verb === "add") cargoCrates(words, v + 1, "cargo add", out);
+      else if (verb === "install") cargoCrates(words, v + 1, "cargo install", out);
+      return;
+    }
+    case "go": {
+      const v = verbIndex(words, start + 1, GO_VALUE_FLAGS);
+      const verb = lower(words[v]);
+      if (verb === "get" || verb === "install" || verb === "run")
+        goModules(words, v + 1, `go ${verb}`, out);
+      return;
+    }
+    case "dotnet": {
+      const v = verbIndex(words, start + 1, DOTNET_ADD_VALUE_FLAGS);
+      const verb = lower(words[v]);
+      if (verb === "add") dotnetAdd(words, v + 1, out);
+      else if (verb === "tool" && ["install", "update"].includes(lower(words[v + 1])))
+        dotnetTool(words, v + 2, out);
+      return;
+    }
+    case "nuget": {
+      if (lower(words[start + 1]) === "install") nugetInstall(words, start + 2, out);
+      return;
+    }
+    case "mvn":
+    case "mvnw":
+      mavenGet(words, start + 1, out);
+      return;
+    case "composer": {
+      let v = verbIndex(words, start + 1, COMPOSER_VALUE_FLAGS);
+      if (v >= 0 && lower(words[v]) === "global") v = verbIndex(words, v + 1, COMPOSER_VALUE_FLAGS);
+      const verb = lower(words[v]);
+      if (verb === "require" || verb === "req" || verb === "r")
+        composerPackages(words, v + 1, "composer require", out);
+      else if (verb === "create-project")
+        composerPackages(words, v + 1, "composer create-project", out);
+      return;
+    }
     default:
+      if (EDITOR_HEADS.includes(family)) editorExtensions(words, start + 1, out);
       return;
   }
 }
@@ -5220,12 +5757,13 @@ function gitRepoPath(url) {
 function isDestructiveToolName(bareTool) {
   return DESTRUCTIVE_VERB_RE.test(bareTool);
 }
-function* validCardRuns(text, base2) {
+function* validCardRuns(text, base2, exemptFractions = true) {
   const re = new RegExp(base2.source, "g");
   let m;
   while ((m = re.exec(text)) !== null) {
     const digits = m[0].replace(/\D/g, "");
-    if (!isDecimalFraction(text, m.index, digits.length === m[0].length) && validateLuhn(digits)) {
+    const fraction = exemptFractions && isDecimalFraction(text, m.index, digits.length === m[0].length);
+    if (!fraction && validateLuhn(digits)) {
       yield { index: m.index, length: m[0].length, digits };
     } else {
       re.lastIndex = m.index + 1;
@@ -5238,12 +5776,12 @@ function hasValidCard(text) {
   }
   return false;
 }
-function replaceValidCards(text, replace) {
+function replaceValidCards(text, replace, { exemptFractions = true } = {}) {
   let out = text;
   for (const base2 of [PII_CC16_RE, PII_CC15_RE]) {
     let res = "";
     let last = 0;
-    for (const run of validCardRuns(out, base2)) {
+    for (const run of validCardRuns(out, base2, exemptFractions)) {
       res += out.slice(last, run.index) + replace(run.digits);
       last = run.index + run.length;
     }
@@ -5257,11 +5795,11 @@ function isDecimalFraction(text, index, unseparated) {
   const a = text[index - 2];
   if (sep === ".") {
     if (a !== void 0 && a >= "0" && a <= "9") return true;
-    return a === void 0 || NUMBER_LEAD_RE.test(a);
+    return a === void 0 || (a === "-" || a === "+") && index === 2;
   }
   if (sep === "," && a === "0") {
     const b = text[index - 3];
-    return b === void 0 || NUMBER_LEAD_RE.test(b);
+    return b === void 0 || b === ";";
   }
   return false;
 }
@@ -5397,6 +5935,9 @@ function normalizeTrustedEntry(raw) {
   return full === null ? null : trustedEntryOf(full);
 }
 function maskPersonalData(text) {
+  return maskText(text, false);
+}
+function maskText(text, exemptFractions) {
   if (!text) return text;
   try {
     let out = text;
@@ -5404,7 +5945,9 @@ function maskPersonalData(text) {
       const v = m.replace(/[ -]/g, "").toUpperCase();
       return validateIban(v) ? `${v.slice(0, 4)} **** **** ${v.slice(-4)}` : m;
     });
-    out = replaceValidCards(out, (digits) => `**** **** **** ${digits.slice(-4)}`);
+    out = replaceValidCards(out, (digits) => `**** **** **** ${digits.slice(-4)}`, {
+      exemptFractions
+    });
     out = out.replace(
       ACCOUNT_VALUE_RE,
       (m, v) => IBAN_LENGTH[v.slice(0, 2).toUpperCase()] === v.length ? `"****${v.slice(-4)}"` : m
@@ -5427,7 +5970,7 @@ function maskLeaf(value, key, depth) {
   if (depth > MAX_MASK_DEPTH) return "[REDACTED]";
   if (typeof value === "string") {
     try {
-      const json = `{${JSON.stringify(key)}:${JSON.stringify(value)}}`;
+      const json = `{${JSON.stringify(key)}:${JSON.stringify(maskPersonalData(value))}}`;
       return Object.values(JSON.parse(maskPersonalData(json)))[0];
     } catch {
       return "[REDACTED]";
@@ -5435,13 +5978,20 @@ function maskLeaf(value, key, depth) {
   }
   if (typeof value === "number") {
     const text = String(value);
-    const masked = maskPersonalData(text);
+    const masked = maskText(text, true);
     return masked === text ? value : masked;
   }
   if (Array.isArray(value)) return value.map((v) => maskLeaf(v, key, depth + 1));
   if (value && typeof value === "object") {
+    const used = /* @__PURE__ */ new Set();
     return Object.fromEntries(
-      Object.entries(value).map(([k, v]) => [maskPersonalData(k), maskLeaf(v, k, depth + 1)])
+      Object.entries(value).map(([k, v]) => {
+        const base2 = maskPersonalData(k);
+        let name = base2;
+        for (let n = 2; used.has(name); n++) name = `${base2}#${n}`;
+        used.add(name);
+        return [name, maskLeaf(v, k, depth + 1)];
+      })
     );
   }
   return value;
@@ -5923,7 +6473,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, SECRET_VIEW_LIMITS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, NUMBER_LEAD_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, SECRET_VIEW_LIMITS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -6724,6 +7274,11 @@ var init_dist = __esm({
         example: "cat /etc/shadow",
         advice: "Keep Review, or choose Block when agents must never read system password hashes."
       },
+      "files.system-dirs": {
+        plain: "The agent writes, creates or deletes a file in a system directory, or sends a system file in a request. /usr/local and a container working directory under /usr/src are ordinary project space and are not included.",
+        example: "wget -O /usr/bin/tool https://example.com/tool",
+        advice: "Keep Review on a workstation. A container image build that installs into /usr can set it to Log."
+      },
       // ── Commands ──────────────────────────────────────────────────────────────
       "commands.inline-exec": {
         plain: "The agent runs a small program written inside the command itself.",
@@ -6920,7 +7475,7 @@ var init_dist = __esm({
         advice: "Fixed at Block. A person accepts the change on the machine (node9 mcp pin update)."
       },
       "loading.malicious-package": {
-        plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago.",
+        plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only.",
         example: "npm install of a package flagged as malware",
         advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
       }
@@ -6958,6 +7513,15 @@ var init_dist = __esm({
         defaultValue: "review",
         legacy: ["review-password-hash-read"]
       },
+      {
+        id: "files.system-dirs",
+        group: "files",
+        title: "System directories",
+        catches: "Writes, new files and removals under /usr, /etc, /boot, /bin, /sbin, /lib and /var/log, and uploads of system files",
+        values: ALL,
+        defaultValue: "review",
+        legacy: ["review-system-dir-mutation", "review-system-file-upload"]
+      },
       // ── Commands ────────────────────────────────────────────────────────────
       {
         id: "commands.inline-exec",
@@ -8255,6 +8819,10 @@ var init_dist = __esm({
     AND_OP = probeBinOp("a && b");
     OR_OP = probeBinOp("a || b");
     AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
+    MAX_CALL_DEPTH = 4;
+    MAX_CALL_WALKS = 256;
+    callDepth = 0;
+    callWalks = 0;
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
     stripDotSlash = (p) => p.replace(/^\.\//, "");
@@ -8307,10 +8875,79 @@ var init_dist = __esm({
     MAX_ARGV_CHARACTERS = 262144;
     ({ syntax: syntax2 } = mvdanSh2);
     MAX_ALTERNATIVES = 64;
+    MAX_CALL_DEPTH2 = 4;
+    MAX_CALL_WALKS2 = 256;
+    POSITIONAL = ["1", "2", "3", "4", "5", "6", "7", "8", "9", "@", "*", "#"];
     MAX_DEPTH = 64;
     MAX_PAYLOAD_DEPTH = 24;
     unique = (a) => [...new Set(a)].slice(0, MAX_ALTERNATIVES);
-    clone = (s) => ({ cwd: [...s.cwd], vars: new Map(s.vars) });
+    clone = (s) => ({
+      cwd: [...s.cwd],
+      vars: new Map(s.vars),
+      ...s.callDepth ? { callDepth: s.callDepth } : {}
+    });
+    SENDING_STDIN = /* @__PURE__ */ new Set(["nc", "ncat", "netcat", "socat", "telnet", "curl", "wget"]);
+    DOWNLOAD_SHORT_VALUE = {
+      curl: "odDeEFHKmPrtTuUwxXyYzAbcCQ",
+      wget: "OoaPiBetTwQlARDXIUY",
+      aria2c: "odisx"
+    };
+    DOWNLOAD_LONG_VALUE = {
+      curl: [
+        "--output",
+        "--output-dir",
+        "--dump-header",
+        "--cookie-jar",
+        "--data",
+        "--data-binary",
+        "--data-raw",
+        "--data-ascii",
+        "--data-urlencode",
+        "--form",
+        "--header",
+        "--request",
+        "--user",
+        "--user-agent",
+        "--referer",
+        "--cookie",
+        "--config",
+        "--json",
+        "--upload-file",
+        "--max-time",
+        "--proxy",
+        "--write-out",
+        "--url"
+      ],
+      wget: [
+        "--output-document",
+        "--output-file",
+        "--append-output",
+        "--directory-prefix",
+        "--input-file",
+        "--post-data",
+        "--post-file",
+        "--body-data",
+        "--body-file",
+        "--method",
+        "--header",
+        "--user-agent",
+        "--user",
+        "--password",
+        "--tries",
+        "--timeout"
+      ],
+      aria2c: ["--out", "--dir", "--input-file"]
+    };
+    DOWNLOAD_OUTPUT_FLAGS = {
+      curl: ["-o", "--output", "-D", "--dump-header", "-c", "--cookie-jar"],
+      wget: ["-O", "--output-document", "-o", "--output-file", "-a", "--append-output"],
+      aria2c: ["-o", "--out"]
+    };
+    DOWNLOAD_DIR_FLAGS = {
+      curl: ["--output-dir"],
+      wget: ["-P", "--directory-prefix"],
+      aria2c: ["-d", "--dir"]
+    };
     base = (s) => (s ?? "").replace(/\/+$/, "").split("/").pop() ?? "";
     quoteGlob = (s) => s.replace(/[\\*?\[\]{}()!+@]/g, "\\$&");
     asWord = (p) => ({ value: p.value, ...p.glob ? { pattern: p.pattern } : {} });
@@ -8335,6 +8972,18 @@ var init_dist = __esm({
     SYSTEM_AUTH_DIRS = ["/etc/security", "/etc/pam.d", "/etc/sudoers.d"];
     PASSWORD_HASH_FILES = ["/etc/shadow", "/etc/gshadow"];
     STARTUP_NAMES = [".bashrc", ".zshrc", ".profile", ".bash_profile"];
+    SYSTEM_DIRS = [
+      "/usr",
+      "/etc",
+      "/boot",
+      "/bin",
+      "/sbin",
+      "/lib",
+      "/lib64",
+      "/var/log"
+    ];
+    SYSTEM_DIRS_EXEMPT = ["/usr/local", "/usr/src"];
+    UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
     AGENT_INSTRUCTION_FILES = [
       ".gitlab-ci.yml",
       "CLAUDE.md",
@@ -8352,6 +9001,7 @@ var init_dist = __esm({
       ".husky"
     ];
     LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
+    exempt = (p) => SYSTEM_DIRS_EXEMPT.some((d) => within(p, d));
     RANK = { allow: 0, review: 1, block: 2 };
     BIP39_ENGLISH = `abandon
 ability
@@ -10637,15 +11287,20 @@ zoo`.split("\n");
     IDENTIFIER_VALUE_RE = /^[A-Za-z_.-]+$/;
     PATH_VALUE_RE = /^(?:\/|\.{1,2}\/|~\/)/;
     DOTTED_REFERENCE_RE = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/;
+    CONCATENATION_RE = /^\+[A-Za-z_$][\w$]*\./;
     EMAIL_VALUE_RE = /^[^@\s]+@[^@\s]+\.[A-Za-z]{2,}$/;
     FIXTURE_NAME_RE = /(?:fake|dummy|example|sample|mock|stub|placeholder|test)/i;
-    DERIVATIVE_NAME_RE = /(?:hash|digest|id|type|name|url|uri|path|file|len|length|count|size|ttl|expires?|expiry|age|date|time|format|field|header|param)$/i;
+    DERIVATIVE_NAME_RE = /(?:hash|digest|fingerprint|thumbprint|checksum|id|type|name|url|uri|path|file|len|length|count|size|ttl|expires?|expiry|age|date|time|format|field|header|param)$/i;
     QUERY_CREDENTIAL_VALUE_RE = /=([A-Za-z0-9%+/_.~-]{8,512}={0,2})$/;
     OTP_SECRET_RE = /^[A-Z2-7]{16,}=*$/i;
-    ASSIGNED_SECRET_VALUE_RE = /(?::=|=>|[:=])[ \t]{0,8}["'`]?([A-Za-z0-9+/_.!@#$%^*~-]{12,512}={0,2})$/;
+    OTP_DOC_SECRETS = /* @__PURE__ */ new Set(["JBSWY3DPEHPK3PXP", "GEZDGNBVGY3TQOJQ"]);
+    ASSIGNED_SECRET_VALUE_RE = /(?::=|=>|[:=])[ \t]{0,8}\\?["'`]?([A-Za-z0-9+/_.!@#$%^*~-]{12,512}={0,2})$/;
     ASSIGNED_SECRET_NAME_RE = /^([A-Za-z0-9_]+)/;
-    NAME_KEYWORD_RE = /^(?:password|passphrase|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret)/i;
+    NAME_KEYWORD_RE = /^(?:password|passphrase|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret|consumer[_-]?key|app[_-]?key|signing[_-]?key|encryption[_-]?key|master[_-]?key|jsapi[_-]?ticket|pass)/i;
     ARN_CONTEXT_RE = /\barn:[A-Za-z0-9-]*:[^\s"'`]*$/i;
+    BASIC_VALUE_RE = /([A-Za-z0-9+/]{8,512}={0,2})$/;
+    BASIC_PAIR_RE = /^([^:\s]{1,128}):(\S{8,256})$/;
+    OTP_CAPTURE_RE = /["']([A-Z2-7]{16,128}=*)["']$/i;
     DLP_PATTERNS = [
       // ── AWS ───────────────────────────────────────────────────────────────────
       {
@@ -10983,6 +11638,22 @@ zoo`.split("\n");
         contextBoost: true,
         minEntropy: 3
       },
+      // ── HTTP Basic credential ─────────────────────────────────────────────────
+      // `Authorization: Basic <base64 of user:password>`, or the bare scheme in a
+      // config list. The validator decodes the value and accepts only a
+      // `user:password` whose password looks generated (letters and digits, 8+
+      // characters, the query-credential rule), so prose ("Basic authentication")
+      // and documentation pairs (`admin:changeme`, `user:pass1234`) stay allowed.
+      // review: the same weight as a bare Bearer token.
+      {
+        name: "HTTP Basic Credential",
+        regex: /\bBasic[ \t]{1,8}([A-Za-z0-9+/]{8,512}={0,2})/i,
+        severity: "review",
+        keywords: ["basic"],
+        validate: validateBasicCredential,
+        redactGroup: 1,
+        argumentsOnly: true
+      },
       // ── Resend ────────────────────────────────────────────────────────────────
       {
         name: "Resend API Key",
@@ -11124,6 +11795,19 @@ zoo`.split("\n");
         validate: validateQueryCredential,
         argumentsOnly: true
       },
+      // ── OTP secret in a constructor ───────────────────────────────────────────
+      // `ROTP::TOTP.new('<base32>')`, `pyotp.TOTP("<base32>")`, `new HOTP('...')`:
+      // the shared secret of a one-time-password generator written as a literal.
+      // The otpauth URI form is `Credential in URL Query`. review.
+      {
+        name: "OTP Secret",
+        regex: /\b(?:TOTP|HOTP|OTP)(?:\.new|\.create)?[ \t]{0,8}\(?[ \t]{0,8}["']([A-Z2-7]{16,128}=*)["']/i,
+        severity: "review",
+        keywords: ["otp"],
+        validate: validateOtpSecret,
+        redactGroup: 1,
+        argumentsOnly: true
+      },
       // ── Secret assigned to a telling name ─────────────────────────────────────
       // `password: ...`, `JWT_SECRET=...`, `api_key = "..."`. The name alone is
       // not a finding: most such lines hold a reference (`process.env.X`), a
@@ -11131,12 +11815,14 @@ zoo`.split("\n");
       // generated: 12+ characters, not an identifier, Shannon entropy of 3.5
       // bits per character or more. review, never block (node9Firewall#348,
       // item 4). Tuned on CredData's public split; its look-alike lines are the
-      // negative control.
+      // negative control. A quote may be escaped (`\"access_token\":\"...\"`):
+      // JSON written inside a string literal. The two optional quotes after the
+      // name are written out, not as a counted group, to keep star height 1.
       {
         name: "Assigned Secret",
-        regex: /(?:password|passphrase|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret)[A-Za-z0-9_]{0,40}["'\]]{0,2}[ \t]{0,8}(?::=|=>|[:=])[ \t]{0,8}["'`]?([A-Za-z0-9+/_.!@#$%^*~-]{12,512}={0,2})/i,
+        regex: /(?:password|passphrase|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret|consumer[_-]?key|app[_-]?key|signing[_-]?key|encryption[_-]?key|master[_-]?key|jsapi[_-]?ticket|\bpass(?![A-Za-z0-9])|_pass(?![A-Za-z0-9]))[A-Za-z0-9_]{0,40}\\?["'\]]?\\?["'\]]?[ \t]{0,8}(?::=|=>|[:=])[ \t]{0,8}\\?["'`]?([A-Za-z0-9+/_.!@#$%^*~-]{12,512}={0,2})/i,
         severity: "review",
-        keywords: ["password", "passphrase", "passwd", "pwd", "secret", "token", "key"],
+        keywords: ["pass", "pwd", "secret", "token", "key", "ticket"],
         validate: validateAssignedSecret,
         argumentsOnly: true
       }
@@ -11397,7 +12083,169 @@ zoo`.split("\n");
     ]);
     PY_SPEC_RE = /^([A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)(?:\[[^\]]*\])?\s*(.*)$/;
     PY_EXACT_RE = /^===?\s*v?(\d+(?:\.\d+)*(?:[a-zA-Z0-9.+!-]*))$/;
+    EXACT_VERSION_RE = /^=?v?(\d+(?:\.\d+)*(?:[-+][0-9A-Za-z][0-9A-Za-z.+-]*)?)$/;
+    GEM_NAME_RE = /^[\p{L}\p{N}][\p{L}\p{N}_.-]*$/u;
+    GEM_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-v",
+      "--version",
+      "-i",
+      "--install-dir",
+      "-n",
+      "--bindir",
+      "--document",
+      "--build-root",
+      "-P",
+      "--trust-policy",
+      "-s",
+      "--source",
+      "-p",
+      "--http-proxy",
+      "--platform",
+      "-g",
+      "--file",
+      "--without"
+    ]);
+    BUNDLE_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-v",
+      "--version",
+      "-g",
+      "--group",
+      "-s",
+      "--source",
+      "-r",
+      "--require",
+      "--path",
+      "--git",
+      "--github",
+      "--branch",
+      "--ref",
+      "--glob"
+    ]);
+    CRATE_NAME_RE = /^[\p{L}\p{N}][\p{L}\p{N}_-]*$/u;
+    CARGO_ADD_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-F",
+      "--features",
+      "--rename",
+      "--registry",
+      "--manifest-path",
+      "-p",
+      "--package",
+      "--git",
+      "--branch",
+      "--tag",
+      "--rev",
+      "--path",
+      "--base",
+      "--target",
+      "--color",
+      "--config",
+      "-Z",
+      "--lockfile-path"
+    ]);
+    CARGO_INSTALL_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "--version",
+      "--vers",
+      "--git",
+      "--branch",
+      "--tag",
+      "--rev",
+      "--path",
+      "--root",
+      "--index",
+      "--registry",
+      "-F",
+      "--features",
+      "--profile",
+      "--target",
+      "--target-dir",
+      "-j",
+      "--jobs",
+      "--bin",
+      "--example",
+      "--color",
+      "--config",
+      "-Z"
+    ]);
+    GO_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-C",
+      "-tags",
+      "-ldflags",
+      "-gcflags",
+      "-asmflags",
+      "-mod",
+      "-modfile",
+      "-o",
+      "-p",
+      "-pkgdir",
+      "-toolexec",
+      "-exec",
+      "-overlay",
+      "-pgo",
+      "-buildmode",
+      "-compiler",
+      "-gccgoflags",
+      "-installsuffix",
+      "-covermode",
+      "-coverpkg"
+    ]);
+    GO_PATH_RE = /^[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+(?:\/[\p{L}\p{N}_.~+-]+)*$/u;
+    NUGET_NAME_RE = /^[\p{L}\p{N}_][\p{L}\p{N}_.-]*$/u;
+    DOTNET_ADD_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-v",
+      "--version",
+      "-s",
+      "--source",
+      "-f",
+      "--framework",
+      "--package-directory"
+    ]);
+    DOTNET_TOOL_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "--version",
+      "--add-source",
+      "--configfile",
+      "--framework",
+      "--tool-path",
+      "-a",
+      "--arch",
+      "--tool-manifest",
+      "-v",
+      "--verbosity"
+    ]);
+    NUGET_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-version",
+      "-outputdirectory",
+      "-o",
+      "-source",
+      "-configfile",
+      "-fallbacksource",
+      "-framework",
+      "-packagesavemode",
+      "-dependencyversion",
+      "-solutiondirectory",
+      "-verbosity"
+    ]);
+    MAVEN_COORD_RE = /^[\p{L}\p{N}_.-]+:[\p{L}\p{N}_.-]+$/u;
+    COMPOSER_NAME_RE = /^[\p{L}\p{N}][\p{L}\p{N}_.-]*\/[\p{L}\p{N}][\p{L}\p{N}_.-]*$/u;
+    COMPOSER_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-d",
+      "--working-dir",
+      "--stability",
+      "--repository",
+      "--add-repository"
+    ]);
+    EDITOR_HEADS = ["code", "code-insiders", "codium", "vscodium", "cursor"];
+    EXTENSION_ID_RE = /^[\p{L}\p{N}][\p{L}\p{N}_-]*\.[\p{L}\p{N}][\p{L}\p{N}_.-]*$/u;
     MANAGER_HEADS = /* @__PURE__ */ new Set([
+      "gem",
+      "bundle",
+      "cargo",
+      "go",
+      "dotnet",
+      "nuget",
+      "mvn",
+      "mvnw",
+      "composer",
+      ...EDITOR_HEADS,
       "npm",
       "npx",
       "pnpm",
@@ -11476,6 +12324,7 @@ zoo`.split("\n");
     MAP_GOVERNED = /* @__PURE__ */ new Set([
       "files.shell-startup",
       "files.password-hashes",
+      "files.system-dirs",
       "commands.inline-exec",
       "commands.eval-dynamic",
       "commands.curl-pipe-shell",
@@ -11744,7 +12593,6 @@ zoo`.split("\n");
     PII_CC16_RE = /\b(?:4\d{3}|5[1-5]\d{2}|6\d{3})[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/;
     PII_CC15_RE = /\b3[47]\d{2}[-\s]?\d{6}[-\s]?\d{5}\b/;
     PII_IBAN_RE = /\b[A-Z]{2}\d{2}(?:[A-Z0-9]|[ -][A-Z0-9]){11,30}\b/;
-    NUMBER_LEAD_RE = /[\s:=;([{"'+-]/;
     REALTIME_PII_PATTERNS = ["SSN", "Credit Card", "IBAN"];
     MAX_PII_SCAN_BYTES = 1e5;
     MASKED_KINDS = /* @__PURE__ */ new Set(["email", "iban", "account"]);
@@ -14599,14 +15447,23 @@ async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityI
     clearTimeout(timer);
   }
 }
-async function waitForDaemonDecision(id, signal) {
+async function waitForDaemonDecision(id, signal, maxWaitMs = 12e4) {
   const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   const waitCtrl = new AbortController();
-  const waitTimer = setTimeout(() => waitCtrl.abort(), 12e4);
+  let capped = false;
+  const waitTimer = maxWaitMs > 0 ? setTimeout(() => {
+    capped = true;
+    waitCtrl.abort();
+  }, maxWaitMs) : void 0;
   const onAbort = () => waitCtrl.abort();
   if (signal) signal.addEventListener("abort", onAbort);
   try {
-    const waitRes = await fetch(`${base2}/wait/${id}`, { signal: waitCtrl.signal });
+    const waitRes = await fetch(`${base2}/wait/${id}`, { signal: waitCtrl.signal }).catch(
+      (err) => {
+        if (capped && !signal?.aborted) throw new Error("node9 daemon did not answer in time");
+        throw err;
+      }
+    );
     if (!waitRes.ok) return { decision: "deny" };
     const { decision, source, reason } = await waitRes.json();
     if (decision === "allow") return { decision: "allow", source };
@@ -15647,13 +16504,13 @@ function maskRiskMetadataForCloud(rm) {
   const r = rm;
   const dests = Array.isArray(r.exposureDestinations) ? r.exposureDestinations.filter((d) => typeof d === "string") : [];
   const swaps = dests.filter(isMaskedKind).map((d) => [destinationValue(d), destinationValue(maskDestination(d))]).filter(([full]) => full.length > 0).sort((a, b) => b[0].length - a[0].length);
-  const maskText = (text) => {
+  const maskText2 = (text) => {
     let out2 = text;
     for (const [full, masked] of swaps) out2 = out2.split(full).join(masked);
     return maskPersonalData(out2);
   };
   const out = {};
-  for (const [k, v] of Object.entries(r)) out[k] = typeof v === "string" ? maskText(v) : v;
+  for (const [k, v] of Object.entries(r)) out[k] = typeof v === "string" ? maskText2(v) : v;
   if (dests.length > 0) {
     out.exposureDestinations = dests.map(maskDestination);
     out.exposureDestinationHashes = dests.map((d) => isMaskedKind(d) ? hashDestination(d) : "");
@@ -15856,7 +16713,17 @@ function ecoDir(eco) {
   return path23.join(osvRoot(), eco);
 }
 function indexKey(eco, name) {
-  return eco === "PyPI" ? normalizePyPiName(name) : name.toLowerCase();
+  switch (eco) {
+    case "PyPI":
+      return normalizePyPiName(name);
+    case "crates.io":
+      return name.toLowerCase().replace(/_/g, "-");
+    case "Go":
+    case "Maven":
+      return name;
+    default:
+      return name.toLowerCase();
+  }
 }
 function shardOf(key) {
   return createHash4("sha1").update(key).digest("hex").slice(0, 2);
@@ -16067,8 +16934,11 @@ async function pypiInfo(name, version) {
     publishedAtMs: times.length > 0 ? Math.min(...times) : void 0
   };
 }
+var HAS_REGISTRY_CLIENT = /* @__PURE__ */ new Set(["npm", "PyPI"]);
 async function registryInfo(eco, name, version, freshWindowMs, raw) {
-  return eco === "npm" ? npmInfo(name, version, freshWindowMs, raw) : pypiInfo(name, version);
+  if (eco === "npm") return npmInfo(name, version, freshWindowMs, raw);
+  if (eco === "PyPI") return pypiInfo(name, version);
+  return null;
 }
 
 // src/supply-chain/local-resolve.ts
@@ -16107,26 +16977,51 @@ function commandOf(toolName, args) {
   const a = args;
   return typeof a.command === "string" ? a.command : typeof a.cmd === "string" ? a.cmd : null;
 }
+var KIND = {
+  npm: "npm package",
+  PyPI: "PyPI package",
+  RubyGems: "RubyGems package",
+  "crates.io": "crates.io package",
+  Go: "Go module",
+  NuGet: "NuGet package",
+  Maven: "Maven artifact",
+  Packagist: "Packagist package",
+  VSCode: "VS Code extension"
+};
 function label(p, version) {
-  return `${p.ecosystem === "npm" ? "npm" : "PyPI"} package "${p.name}${version ? `@${version}` : ""}"`;
+  return `${KIND[p.ecosystem]} "${p.name}${version ? `@${version}` : ""}"`;
+}
+function osvNames(p) {
+  if (p.ecosystem !== "Go") return [p.name];
+  const parts = p.name.split("/");
+  const out = [];
+  for (let n = parts.length; n >= 2 && out.length < 6; n--) out.push(parts.slice(0, n).join("/"));
+  return out;
 }
 async function maliciousFor(p, version, cfg, misses, networkCapped) {
-  const local = lookupIndex(p.ecosystem, p.name);
-  const entries = local.status === "hit" ? local.entries : null;
-  if (!entries && !(local.status === "clean" && local.fresh)) {
+  const names = osvNames(p);
+  const local = names.map((n) => lookupIndex(p.ecosystem, n));
+  const hits2 = local.flatMap((l) => l.status === "hit" ? l.entries : []);
+  const entries = hits2.length > 0 ? hits2 : null;
+  const freshClean = local.every((l) => l.status === "clean" && l.fresh);
+  const status = local.some((l) => l.status === "unavailable") ? "unavailable" : local[0].status;
+  if (!entries && !freshClean) {
     if (!cfg.onlineFallback || networkCapped) {
       misses.push(
-        `${label(p, version)}: local index ${local.status}, no online lookup (${networkCapped ? "over the per-command network cap" : "online fallback off"})`
+        `${label(p, version)}: local index ${status}, no online lookup (${networkCapped ? "over the per-command network cap" : "online fallback off"})`
       );
       return null;
     }
-    let ids = null;
+    let perName = null;
     try {
-      ids = await queryOsvMalicious([{ ecosystem: p.ecosystem, name: p.name, version }]);
+      perName = await queryOsvMalicious(
+        names.map((name) => ({ ecosystem: p.ecosystem, name, version }))
+      );
     } catch (err) {
       misses.push(`${label(p, version)}: OSV online ${err.message}`);
       return null;
     }
+    const ids = perName ? [[...new Set(perName.flat())]] : null;
     if (!ids) {
       misses.push(`${label(p, version)}: OSV online unavailable`);
       return null;
@@ -16196,7 +17091,7 @@ async function checkOne(p, cfg, misses, networkCapped, cwd) {
   }
   const findings = [];
   let info = null;
-  const wantsRegistry = cfg.newPackage !== "off" || cfg.installScript !== "off";
+  const wantsRegistry = (cfg.newPackage !== "off" || cfg.installScript !== "off") && HAS_REGISTRY_CLIENT.has(p.ecosystem);
   if (wantsRegistry && !networkCapped) {
     try {
       const windowMs = cfg.newPackage === "off" ? 0 : cfg.maxAgeHours * 36e5;
@@ -16277,6 +17172,36 @@ async function runPackageCheck(toolName, args, cfg, cwd) {
   }
 }
 
+// src/policy/negotiation.ts
+var BLOCKED_BY = " is blocked by ";
+var DASH_BLOCKED_BY = " \u2014 blocked by ";
+var SHIELD = " shield";
+function asApprovalRequest(description) {
+  const is = description.lastIndexOf(BLOCKED_BY);
+  if (is > 0) {
+    const by = description.slice(is + BLOCKED_BY.length).replace(/\.$/, "");
+    if (by.endsWith(SHIELD)) return `${description.slice(0, is)} needs your approval (${by})`;
+  }
+  const dash = description.lastIndexOf(DASH_BLOCKED_BY);
+  if (dash > 0) {
+    const by = description.slice(dash + DASH_BLOCKED_BY.length).replace(/\.$/, "");
+    if (by.endsWith(SHIELD)) return `${description.slice(0, dash)}. Needs your approval (${by})`;
+  }
+  return description;
+}
+
+// src/auth/decision-sources.ts
+var HUMAN_DECISION_SOURCES = /* @__PURE__ */ new Set([
+  "terminal",
+  "browser",
+  "native"
+]);
+var REDIRECT_SOURCE = "terminal-redirect";
+var DECISION_ROUTE_SOURCES = /* @__PURE__ */ new Set([
+  ...HUMAN_DECISION_SOURCES,
+  REDIRECT_SOURCE
+]);
+
 // src/auth/orchestrator.ts
 var SENSITIVE_PATH_PATTERN = sensitivePathMatch("").patternName;
 function isProtectedPathRule(ruleName) {
@@ -16404,6 +17329,10 @@ async function authorizeHeadless(toolName, args, meta, options) {
   }
   return _authorizeHeadlessCore(toolName, args, meta, options);
 }
+function daemonWaitCapMs(approvalTimeoutMs) {
+  if (approvalTimeoutMs === 0) return 0;
+  return Math.max(approvalTimeoutMs ?? 0, 12e4) + 5e3;
+}
 function approvalTimeoutReason(approvalTimeoutMs) {
   return `No human response within ${approvalTimeoutMs / 1e3}s \u2014 auto-denied by timeout policy. Approve from your phone next time: run \`node9 login\`.`;
 }
@@ -16439,6 +17368,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
   let statefulRecoveryCommand;
   let localSmartRuleMatched = false;
   let hardBlockDowngraded = false;
+  let downgradedBlock = null;
   let argScan;
   const argumentScan = () => argScan ??= scanArgumentSecrets(args);
   let fileAccess;
@@ -17058,6 +17988,16 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         humanApproverReachable,
         overridable: policyResult.overridable
       });
+      const blocked = {
+        approved: false,
+        reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
+        blockedBy: "local-config",
+        blockedByLabel: policyResult.blockedByLabel,
+        ruleHit: policyResult.ruleName,
+        ...policyResult.recoveryCommand && { recoveryCommand: policyResult.recoveryCommand },
+        ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription },
+        ...protectedPathFields(policyResult.ruleName, toolName, args, dlpReviewFlagged)
+      };
       const hardBlock = () => {
         if (!isManual)
           appendLocalAudit(
@@ -17068,17 +18008,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
             { ...meta, ruleName: policyResult.ruleName },
             hashAuditArgs
           );
-        return {
-          approved: false,
-          reason: policyResult.reason ?? "Action explicitly blocked by Smart Policy.",
-          blockedBy: "local-config",
-          blockedByLabel: policyResult.blockedByLabel,
-          ruleHit: policyResult.ruleName,
-          ...policyResult.recoveryCommand && { recoveryCommand: policyResult.recoveryCommand },
-          ...policyResult.ruleDescription && { ruleDescription: policyResult.ruleDescription },
-          ...protectedPathFields(policyResult.ruleName, toolName, args, dlpReviewFlagged)
-        };
+        return blocked;
       };
+      downgradedBlock = blocked;
       if (policyResult.dependsOnStatePredicates?.length) {
         const stateResults = await checkStatePredicates(policyResult.dependsOnStatePredicates);
         const predicatesMet = stateResults !== null && policyResult.dependsOnStatePredicates.every((p) => stateResults[p] === true);
@@ -17135,7 +18067,8 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       policyMatchedWord,
       policyResult.ruleName
     );
-    if (policyRuleDescription) riskMetadata.ruleDescription = policyRuleDescription.slice(0, 200);
+    if (policyRuleDescription)
+      riskMetadata.ruleDescription = (hardBlockDowngraded ? asApprovalRequest(policyRuleDescription) : policyRuleDescription).slice(0, 200);
     const persistent = policyResult.ruleName || policyResult.tier === 7 || hardBlockDowngraded ? null : getPersistentDecision(toolName);
     if (persistent === "allow" && !callSpecificReview()) {
       if (!isManual)
@@ -17299,7 +18232,7 @@ ${packageReview}`;
         }
       }
       if (initResult.pending) cloudRequestId = initResult.requestId || null;
-      if (!callSpecificReview()) explainableLabel = "Organization Policy (SaaS)";
+      if (!reviewDemanded()) explainableLabel = "Organization Policy (SaaS)";
     } catch {
     }
   }
@@ -17441,10 +18374,54 @@ ${packageReview}`;
           decision: daemonDecision,
           source: decisionSource,
           reason: daemonReason
-        } = await waitForDaemonDecision(daemonEntryId, signal);
+        } = await waitForDaemonDecision(
+          daemonEntryId,
+          signal,
+          daemonWaitCapMs(config.settings.approvalTimeoutMs)
+        );
         if (daemonDecision === "abandoned") throw new Error("Abandoned");
         const isApproved = daemonDecision === "allow";
-        const isRedirect = decisionSource === "terminal-redirect";
+        const isRedirect = decisionSource === REDIRECT_SOURCE;
+        if (!isApproved && !isRedirect && !(decisionSource && HUMAN_DECISION_SOURCES.has(decisionSource))) {
+          if (decisionSource === "cloud")
+            return {
+              approved: false,
+              reason: daemonReason || "Action rejected by organization administrator via Slack.",
+              blockedBy: "team-policy",
+              blockedByLabel: "Organization Policy (SaaS)",
+              decisionSource: "cloud"
+            };
+          const timedOut = decisionSource === "timeout";
+          if (downgradedBlock)
+            return {
+              ...downgradedBlock,
+              blockedBy: timedOut ? "timeout" : "local-config"
+            };
+          if (timedOut)
+            return {
+              approved: false,
+              reason: daemonReason || "No response: auto-denied after the approval timeout.",
+              blockedBy: "timeout",
+              blockedByLabel: "Approval Timeout"
+            };
+          if (decisionSource === "policy")
+            return {
+              approved: false,
+              reason: daemonReason || "Action blocked by policy.",
+              blockedBy: "local-config",
+              blockedByLabel: explainableLabel
+            };
+          return {
+            approved: false,
+            reason: daemonReason || "node9 could not get an approval decision for this call.",
+            blockedBy: "no-approval-mechanism",
+            blockedByLabel: "Approval Unavailable"
+          };
+        }
+        if (isApproved && decisionSource === "cloud")
+          return { approved: true, checkedBy: "cloud", decisionSource: "cloud" };
+        if (isApproved && decisionSource === "policy")
+          return { approved: true, checkedBy: "local-policy" };
         const via = "Terminal (node9 tail)";
         return {
           approved: isApproved,