@node9/proxy 2.36.0 → 2.37.0

package/dist/dashboard.mjs

@@ -2691,7 +2691,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, SYSTEM_DIRS, UPLOAD_SYSTEM_DIRS, LEGACY_SYSTEM_PATH_RE, BIP39_ENGLISH, indices, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, EDITOR_HEADS, MANAGER_HEADS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, MASKED_KINDS, ENTRY_RE, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var aws_default, bash_safe_default, docker_default, filesystem_default, finance_default, github_default, identity_default, k8s_default, mongodb_default, postgres_default, project_jail_default, publishing_default, redis_default, BUILTIN_SHIELDS, ACTION_SHIELD_NAMES, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, SYSTEM_DIRS, UPLOAD_SYSTEM_DIRS, LEGACY_SYSTEM_PATH_RE, BIP39_ENGLISH, indices, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, EDITOR_HEADS, MANAGER_HEADS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, MASKED_KINDS, ENTRY_RE, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -2996,6 +2996,77 @@ var init_dist = __esm({
       ],
       dangerousWords: ["wipefs"]
     };
+    finance_default = {
+      name: "finance",
+      description: "Asks before money moves through a payment or banking app (refunds, payouts, transfers, charges, invoices), whatever the request said. Reads are never asked about.",
+      aliases: ["payments", "money"],
+      smartRules: [
+        {
+          name: "shield:finance:review-refund",
+          tool: "{,mcp__*__}{create_refund,refund_payment,refund_charge,refund_order,issue_refund}",
+          conditions: [],
+          verdict: "review",
+          reason: "A refund returns money to a customer. node9 asks before money moves, whatever the request said (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-payout",
+          tool: "{,mcp__*__}{create_payout,send_payout,payout,create_payouts_batch}",
+          conditions: [],
+          verdict: "review",
+          reason: "A payout moves the balance to a bank account. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-transfer",
+          tool: "{,mcp__*__}{transfer_create,transfer_authorization_create,create_transfer,transfer_money,transfer_funds,send_money,wire_transfer,create_wire,schedule_transaction,update_scheduled_transaction,create_transaction}",
+          conditions: [],
+          verdict: "review",
+          reason: "A transfer moves money between accounts. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-charge",
+          tool: "{,mcp__*__}{create_payment_intent,confirm_payment_intent,capture_payment_intent,create_charge,create_payment,capture_payment,capture_order,create_order,authorize_order,create_checkout_session}",
+          conditions: [],
+          verdict: "review",
+          reason: "This charges a card or captures a payment. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-payment-link",
+          tool: "{,mcp__*__}{create_payment_link,create_invoice,finalize_invoice,send_invoice,pay_invoice,create_invoice_item}",
+          conditions: [],
+          verdict: "review",
+          reason: "This bills someone or creates a link that charges a card. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-subscription",
+          tool: "{,mcp__*__}{create_subscription,cancel_subscription,update_subscription,pause_subscription,resume_subscription}",
+          conditions: [],
+          verdict: "review",
+          reason: "A subscription starts or stops recurring charges. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-dispute",
+          tool: "{,mcp__*__}{update_dispute,accept_dispute,close_dispute}",
+          conditions: [],
+          verdict: "review",
+          reason: "This answers or concedes a chargeback. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-card",
+          tool: "{,mcp__*__}{issue_card,create_virtual_card,create_issuing_card,update_card_limit}",
+          conditions: [],
+          verdict: "review",
+          reason: "This issues a card or changes its limit. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-withdraw",
+          tool: "{,mcp__*__}{withdraw,withdraw_funds,create_withdrawal,request_withdrawal}",
+          conditions: [],
+          verdict: "review",
+          reason: "A withdrawal moves money out. node9 asks before money moves (Finance shield)."
+        }
+      ],
+      dangerousWords: []
+    };
     github_default = {
       name: "github",
       description: "Protects GitHub repositories from destructive AI operations",
@@ -3022,6 +3093,56 @@ var init_dist = __esm({
       ],
       dangerousWords: []
     };
+    identity_default = {
+      name: "identity",
+      description: "Asks before a password, a key, a token, a role or a user changes in an identity or admin app, whatever the request said. Reads are never asked about.",
+      aliases: ["access", "iam"],
+      smartRules: [
+        {
+          name: "shield:identity:review-password",
+          tool: "{,mcp__*__}{change_password,update_password,reset_password,set_password,expire_password,force_password_reset}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes or resets a password. node9 asks before credentials change, whatever the request said (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-key",
+          tool: "{,mcp__*__}{rotate_key,rotate_api_key,create_api_key,create_token,create_access_token,create_personal_access_token,regenerate_secret,rotate_secret,create_service_account_key,create_credential}",
+          conditions: [],
+          verdict: "review",
+          reason: "This creates or rotates a key, token or secret. node9 asks before credentials change (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-access",
+          tool: "{,mcp__*__}{grant_access,grant_permission,grant_role,revoke_access,revoke_permission,revoke_role,revoke_token,set_permission,set_permissions,set_role,assign_role,update_role,add_permission,remove_permission,attach_policy,detach_policy}",
+          conditions: [],
+          verdict: "review",
+          reason: "This grants or revokes access. node9 asks before access changes (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-membership",
+          tool: "{,mcp__*__}{add_member,remove_member,add_user_to_group,remove_user_from_group,add_collaborator,remove_collaborator,invite_user,invite_member,invite_user_to_slack,invite_users,add_org_member,remove_org_member,add_team_member,remove_team_member}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes who belongs where. node9 asks before membership changes (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-user",
+          tool: "{,mcp__*__}{create_user,delete_user,deactivate_user,suspend_user,activate_user,unlock_user,make_admin,promote_user,demote_user,update_user_role}",
+          conditions: [],
+          verdict: "review",
+          reason: "This creates, removes or promotes an account. node9 asks before accounts change (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-mfa",
+          tool: "{,mcp__*__}{reset_mfa,reset_factors,disable_mfa,enroll_factor,deactivate_factor}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes a second factor. node9 asks before credentials change (Identity shield)."
+        }
+      ],
+      dangerousWords: []
+    };
     k8s_default = {
       name: "k8s",
       description: "Protects Kubernetes clusters from destructive AI operations",
@@ -3354,6 +3475,175 @@ var init_dist = __esm({
       ],
       dangerousWords: []
     };
+    publishing_default = {
+      name: "publishing",
+      description: "Asks before something goes public or ships outside the organisation (a release, a package, a deploy, a post), whatever the request said. The same switch covers the shell commands that publish.",
+      aliases: ["release", "deploy"],
+      smartRules: [
+        {
+          name: "shield:publishing:review-release",
+          tool: "{,mcp__*__}{create_release,publish_release,create_tag_release,update_release,promote_release}",
+          conditions: [],
+          verdict: "review",
+          reason: "A release ships code to everyone who installs it. node9 asks before publishing, whatever the request said (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-package",
+          tool: "{,mcp__*__}{publish_package,npm_publish,pypi_upload,publish_version,publish_extension}",
+          conditions: [],
+          verdict: "review",
+          reason: "This publishes a package. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-deploy",
+          tool: "{,mcp__*__}{deploy,create_deployment,deploy_site,promote_deployment,trigger_deploy,deploy_to_production,rollout}",
+          conditions: [],
+          verdict: "review",
+          reason: "This deploys to an environment other people use. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-post",
+          tool: "{,mcp__*__}{post_tweet,create_tweet,post_webpage,publish_post,create_post,publish_page,send_announcement,post_announcement,create_linkedin_post,schedule_post}",
+          conditions: [],
+          verdict: "review",
+          reason: "This posts outside the organisation. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-visibility",
+          tool: "{,mcp__*__}{set_visibility,make_public,set_public,publish_repository,change_visibility,update_visibility}",
+          conditions: [],
+          verdict: "review",
+          reason: "This makes something public. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-npm-publish",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:npm|pnpm)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "npm publish ships the package to everyone who installs it. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-yarn-publish",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:yarn)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "yarn publish ships the package to everyone who installs it. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-twine-upload",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:twine)(?![\\w-])[^;&|]{0,200}?\\s(?:upload)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "twine upload publishes to PyPI. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-python-publish",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:poetry|uv|hatch|flit)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "This publishes the Python package to PyPI. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-release-tool-publish",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:lerna|changeset|vsce|ovsx)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "This publishes packages or an editor extension through a release tool. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-cargo-publish",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:cargo)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "cargo publish ships the crate. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-gem-push",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:gem)(?![\\w-])[^;&|]{0,200}?\\s(?:push)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "gem push publishes to RubyGems. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-docker-push",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:docker|podman)(?![\\w-])[^;&|]{0,200}?\\s(?:push|--push)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "docker push publishes the image to a registry. node9 asks before publishing (Publishing shield)."
+        },
+        {
+          name: "shield:publishing:review-gh-release",
+          tool: "bash",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(?:^|[^\\w-])(?:gh)(?![\\w-])[^;&|]{0,200}?\\srelease\\s+(?:create|upload|edit)(?![\\w-])",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "gh release ships a release on GitHub. node9 asks before publishing (Publishing shield)."
+        }
+      ],
+      dangerousWords: []
+    };
     redis_default = {
       name: "redis",
       description: "Protects Redis instances from destructive AI operations",
@@ -3438,13 +3728,25 @@ var init_dist = __esm({
       [bash_safe_default.name]: bash_safe_default,
       [docker_default.name]: docker_default,
       [filesystem_default.name]: filesystem_default,
+      // Dangerous actions as category shields (node9Firewall#385): an MCP app's
+      // money, credential and publishing tools, asked about whatever the request
+      // said. One glob per rule covers the bare name the gateway sends and the
+      // mcp__<server>__ name the agent hook sends.
+      [finance_default.name]: finance_default,
       [github_default.name]: github_default,
+      [identity_default.name]: identity_default,
       [k8s_default.name]: k8s_default,
       [mongodb_default.name]: mongodb_default,
       [postgres_default.name]: postgres_default,
       [project_jail_default.name]: project_jail_default,
+      [publishing_default.name]: publishing_default,
       [redis_default.name]: redis_default
     };
+    ACTION_SHIELD_NAMES = /* @__PURE__ */ new Set([
+      "finance",
+      "identity",
+      "publishing"
+    ]);
     assertBuiltinShieldRegexesAreSafe();
     SSRF_MAX_HOST = 253;
     METADATA_ADDRESSES = /* @__PURE__ */ new Set([
@@ -13230,7 +13532,7 @@ function loadShieldStatus() {
       cfg.policySource === "workspace" ? cfg.policy.appliedShields ?? [] : readActiveShields()
     );
     const active = all.filter((n) => activeSet.has(n));
-    const inactive = all.filter((n) => !activeSet.has(n));
+    const inactive = all.filter((n) => !activeSet.has(n) && !ACTION_SHIELD_NAMES.has(n));
     return { active, inactive };
   } catch {
     return { active: [], inactive: [] };
@@ -13601,6 +13903,7 @@ var init_data = __esm({
     init_blast();
     init_daemon();
     init_costSync();
+    init_dist();
     init_shields();
     init_config();
     init_decision();