@node9/proxy 2.37.1 → 2.38.0

package/dist/index.js

@@ -71,6 +71,93 @@ var init_hasher = __esm({
 });
 
 // packages/policy-engine/dist/index.mjs
+function validateRegex(pattern) {
+  if (!pattern) return "Pattern is required";
+  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return `Invalid regex syntax: ${e.message}`;
+  }
+  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
+  if (!(0, import_safe_regex2.default)(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
+  return null;
+}
+function getCompiledRegex(pattern, flags = "") {
+  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
+  const key = `${pattern}\0${flags}`;
+  if (regexCache.has(key)) {
+    const cached = regexCache.get(key);
+    regexCache.delete(key);
+    regexCache.set(key, cached);
+    return cached;
+  }
+  if (validateRegex(pattern) !== null) return null;
+  try {
+    const re = new RegExp(pattern, flags);
+    if (regexCache.size >= REGEX_CACHE_MAX) {
+      const oldest = regexCache.keys().next().value;
+      if (oldest) regexCache.delete(oldest);
+    }
+    regexCache.set(key, re);
+    return re;
+  } catch {
+    return null;
+  }
+}
+function isToolRule(rule) {
+  return rule.tool.startsWith("{,mcp__*__}");
+}
+function actionPart(ruleName) {
+  const m = /^shield:[^:]+:(.+)$/.exec(ruleName ?? "");
+  return m ? m[1] : ruleName ?? "rule";
+}
+function ownReason(reason, owner) {
+  if (!reason) return reason;
+  return reason.replace(/\((?:Finance|Identity|Publishing) shield\)\.?$/, `(${owner}).`);
+}
+function buildAppShield(spec) {
+  const owner = spec.label;
+  const toolRules = ACTION_TEMPLATES[spec.template].filter(isToolRule).map((rule) => ({
+    ...rule,
+    name: `shield:${spec.name}:${actionPart(rule.name)}`,
+    server: spec.server,
+    reason: ownReason(rule.reason, owner)
+  }));
+  const ownTools = (spec.mcpTools ?? []).map((rule) => ({
+    ...rule,
+    server: spec.server
+  }));
+  return {
+    name: spec.name,
+    description: spec.description,
+    aliases: [],
+    smartRules: [...toolRules, ...ownTools, ...spec.doors],
+    dangerousWords: []
+  };
+}
+function buildGeneralRules() {
+  const out = [];
+  for (const name of Object.keys(ACTION_TEMPLATES)) {
+    const { slug: slug2, label: label2 } = ACTION_CHECKS[name];
+    for (const rule of ACTION_TEMPLATES[name].filter(isToolRule)) {
+      const part = actionPart(rule.name).replace(/^review-/, "");
+      out.push({
+        ...rule,
+        name: `review-action-${slug2}-${part}`,
+        notServer: APP_SERVER_GLOB,
+        reason: ownReason(rule.reason, label2)
+      });
+    }
+  }
+  return out;
+}
+function generalActionRuleNames(template) {
+  const { slug: slug2 } = ACTION_CHECKS[template];
+  return GENERAL_ACTION_RULES.filter((r) => r.name?.startsWith(`review-action-${slug2}-`)).map(
+    (r) => r.name
+  );
+}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -108,16 +195,25 @@ function validateOverrides(raw) {
   return { overrides: result, warnings };
 }
 function assertBuiltinShieldRegexesAreSafe() {
-  for (const shield of Object.values(BUILTIN_SHIELDS)) {
+  const sets = [
+    ...Object.values(BUILTIN_SHIELDS).map((sh) => ({
+      name: sh.name,
+      smartRules: sh.smartRules
+    })),
+    ...Object.entries(ACTION_TEMPLATES).map(([name, smartRules]) => ({ name, smartRules })),
+    { name: "general-action-checks", smartRules: GENERAL_ACTION_RULES }
+  ];
+  for (const shield of sets) {
     for (const rule of shield.smartRules) {
       const conditions = rule.conditions ?? [];
       for (const cond of conditions) {
         if (cond.op !== "matches" && cond.op !== "notMatches") continue;
         const pattern = cond.value;
         if (!pattern) continue;
-        if (!(0, import_safe_regex2.default)(pattern)) {
+        const problem = validateRegex(pattern);
+        if (problem) {
           throw new Error(
-            `[node9 engine] Shield '${shield.name}' rule '${rule.name ?? rule.tool}' has unsafe regex: ${pattern}`
+            `[node9 engine] Shield '${shield.name}' rule '${rule.name ?? rule.tool}' has a regex the runtime refuses (${problem}): ${pattern}`
           );
         }
       }
@@ -403,7 +499,7 @@ function isLockedCheck(def) {
 function ssrfCheckId(tier) {
   return isStrictGatedTier(tier) ? "network.internal-addresses" : "network.metadata";
 }
-function unwrapRuleLabel(s) {
+function ruleNameInLabel(s) {
   let rest = s;
   const override = rest.lastIndexOf(OVERRIDE_PREFIX);
   if (override >= 0) rest = rest.slice(override + OVERRIDE_PREFIX.length).trimStart();
@@ -419,7 +515,7 @@ function checkIdForRule(nameOrLabel) {
   const s = nameOrLabel.trim();
   const exact = LEGACY_TO_ID.get(s);
   if (exact) return exact;
-  const unwrapped = unwrapRuleLabel(s);
+  const unwrapped = ruleNameInLabel(s);
   if (unwrapped !== void 0) return checkIdForRule(unwrapped);
   if (s.startsWith("shield:project-jail:")) {
     return PROJECT_JAIL_BLOCK_READ.test(s) ? "data.credential-files" : "data.credential-files-other";
@@ -507,9 +603,9 @@ function resolveCheck(settings, id) {
     const on = settings.appliedShields?.includes(def.pack) ?? false;
     return { id, value: on ? def.defaultValue : "off", source: "default" };
   }
-  const read = LEGACY_READERS[id]?.(settings);
-  if (read === void 0) return { id, value: def.defaultValue, source: "default" };
-  const value = CHECK_VERDICT_RANK[read] < floor ? def.floor : read;
+  const read2 = LEGACY_READERS[id]?.(settings);
+  if (read2 === void 0) return { id, value: def.defaultValue, source: "default" };
+  const value = CHECK_VERDICT_RANK[read2] < floor ? def.floor : read2;
   return { id, value, source: value === def.defaultValue ? "default" : "configured" };
 }
 function checkValue(settings, id) {
@@ -577,6 +673,102 @@ function scanViews(text) {
   }
   return views;
 }
+function isAgentInstructionPath(absPath, root) {
+  const r = root.replace(/\/$/, "");
+  if (!(absPath === r || absPath.startsWith(r + "/"))) return false;
+  const rel = absPath.slice(r.length + 1);
+  if (AGENT_INSTRUCTION_FILES.includes(rel)) return true;
+  return AGENT_INSTRUCTION_DIRS.some((d) => rel === d || rel.startsWith(d + "/"));
+}
+function isInside(root, p) {
+  const r = root.replace(/\/$/, "") || "/";
+  return p === r || p.startsWith(r === "/" ? "/" : r + "/");
+}
+function isPasswordHashPath(p) {
+  return PASSWORD_HASH_FILES.includes(p);
+}
+function isLegacySystemPath(p) {
+  return LEGACY_SYSTEM_PATH_RE.test(p);
+}
+function normalizeFilePath(p, cwd = "", home = "~") {
+  if (!p.startsWith("/") && !p.startsWith("~") && cwd) p = `${cwd}/${p}`;
+  if (p === "~" || p.startsWith("~/")) p = home + p.slice(1);
+  const rooted = p.startsWith("/");
+  const parts = [];
+  for (const part of p.split("/")) {
+    if (!part || part === ".") continue;
+    if (part === ".." && parts.length && parts.at(-1) !== "..") parts.pop();
+    else if (part !== ".." || !rooted) parts.push(part);
+  }
+  return (rooted ? "/" : "") + parts.join("/");
+}
+function inlineLanguageOf(interp) {
+  const i = interp.toLowerCase();
+  if (/^python[\d.]*$/.test(i)) return "python";
+  if (/^(?:node|tsx|ts-node|deno|bun)$/.test(i)) return "node";
+  if (i === "perl") return "perl";
+  if (i === "ruby" || i === "irb") return "ruby";
+  if (i === "php") return "php";
+  return null;
+}
+function resolvePythonAliases(code) {
+  const aliases = [...code.matchAll(/\bimport\s+([\w.]+)\s+as\s+(\w+)/g)].slice(0, 32);
+  let out = code;
+  for (const [, mod, alias] of aliases) {
+    if (alias === mod) continue;
+    out = out.replace(new RegExp(String.raw`(?<![\w.])${alias}\b`, "g"), mod);
+  }
+  return out;
+}
+function protectedLiteral(code, isProtected) {
+  let n = 0;
+  for (const m of code.matchAll(STRING_LITERAL)) {
+    if (++n > 2048) break;
+    const value = m[2].trim();
+    if (value && isProtected(value)) return value;
+  }
+  return null;
+}
+function amplifies(language, code) {
+  const loop = language === "python" ? /\bwhile\s+(?:True|1)\s*:/ : language === "node" ? /\bwhile\s*\(\s*(?:true|1)\s*\)|\bfor\s*\(\s*;\s*;\s*\)|\bsetInterval\s*\(/ : /\bwhile\s*\(?\s*(?:1|true)\s*\)?|\bloop\s+do\b|\bfor\s*\(\s*;\s*;\s*\)/;
+  const m = loop.exec(code);
+  if (!m) return null;
+  const body = code.slice(m.index);
+  return /\.write\s*\(|\.(?:append|write)File(?:Sync)?\s*\(|\bopen\s*\(|\bprint\s*\(\s*[^)\n]*\bfile\s*=|\.send(?:all|to)?\s*\(|\bfwrite\s*\(|\bfile_put_contents\s*\(|\bsyswrite\b/.test(
+    body
+  ) ? m[0] : null;
+}
+function judgeInlineCode(language, code, isProtected) {
+  if (code.length > MAX_INLINE_CODE) {
+    return { outcome: "unreadable", what: "is too long for node9 to read" };
+  }
+  const text = language === "python" ? resolvePythonAliases(code) : code;
+  for (const [category, re] of TABLES[language]) {
+    const m = re.exec(text);
+    if (!m) continue;
+    const evidence = m[0].trim().replace(/\s+/g, " ").slice(0, 60);
+    return {
+      outcome: category === "builds-code" ? "unreadable" : "dangerous",
+      what: WHAT[category],
+      evidence,
+      category
+    };
+  }
+  const path28 = protectedLiteral(text, isProtected);
+  if (path28) {
+    return {
+      outcome: "dangerous",
+      what: WHAT["reads-protected"],
+      evidence: path28.slice(0, 60),
+      category: "reads-protected"
+    };
+  }
+  const loop = amplifies(language, text);
+  if (loop) {
+    return { outcome: "dangerous", what: WHAT.amplifies, evidence: loop, category: "amplifies" };
+  }
+  return null;
+}
 function isCatHeredocOrLit(part) {
   if (!part) return false;
   const t = syntax.NodeType(part);
@@ -645,6 +837,55 @@ function cachedNormalize(command, compute) {
 function normalizeCommandForPolicy(command) {
   return commandReadingsImpl(command).posix;
 }
+function fileAccessView(command) {
+  const hit = accessViewCache.get(command);
+  if (hit !== void 0) return hit;
+  const view = fileAccessViewImpl(command);
+  if (accessViewCache.size >= ACCESS_VIEW_CACHE_MAX) {
+    const oldest = accessViewCache.keys().next().value;
+    if (oldest !== void 0) accessViewCache.delete(oldest);
+  }
+  accessViewCache.set(command, view);
+  return view;
+}
+function fileAccessViewImpl(command) {
+  const text = command.replace(INTERPRETER_LINE, "");
+  const f = parseShared(text);
+  if (f === PARSE_FAIL) return text;
+  const toCharIndex = byteOffsetToCharIndex(text);
+  const at = (byteOffset) => toCharIndex === null ? byteOffset : toCharIndex(byteOffset);
+  const edits = [];
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const words = args.map((a) => resolveWordLiteral(a));
+      const head = unwrapCommandHead(words);
+      for (const i of /* @__PURE__ */ new Set([0, head])) {
+        const word = words[i];
+        if (i >= args.length || word === null || word === void 0 || !/[\\/]/.test(word)) {
+          continue;
+        }
+        if (!PROGRAM_DIR.test(word)) continue;
+        const name = word.split(/[\\/]/).pop() ?? "";
+        if (!name) continue;
+        const s = at(args[i].Pos().Offset());
+        const e = at(args[i].End().Offset());
+        if (s < 0 || e < 0) continue;
+        edits.push([s, e, name]);
+      }
+      return true;
+    });
+  } catch {
+    return text;
+  }
+  edits.sort((a, b) => b[0] - a[0]);
+  let out = text;
+  for (const [s, e, rep] of edits) out = out.slice(0, s) + rep + out.slice(e);
+  return out;
+}
 function commandReadings(command) {
   const r = commandReadingsImpl(command);
   const out = /* @__PURE__ */ new Set([r.posix, r.separator, r.folded]);
@@ -1100,53 +1341,119 @@ function unwrapCommandHead(words, stopAtFind = false, stopAtDynamic = false) {
   }
   return i;
 }
-function inlineExecStmt(stmt, pipeFed) {
+function heredocText(word) {
+  const parts = word?.Parts ?? [];
+  let out = "";
+  for (const p of parts) {
+    if (syntax.NodeType(p) !== "Lit") return null;
+    out += p.Value ?? "";
+  }
+  return out;
+}
+function stdinCodeOf(redirs) {
+  const heredoc = /* @__PURE__ */ new Set([deriveRedirOp("cat <<X\nX"), deriveRedirOp("cat <<-X\nX")]);
+  const herestring = deriveRedirOp("cat <<< x");
+  for (const r of redirs) {
+    if (!r || !redirStdinOps().has(r.Op)) continue;
+    if (heredoc.has(r.Op)) {
+      const text = heredocText(r.Hdoc);
+      return text === null ? { code: null, source: "variable" } : { code: text };
+    }
+    if (r.Op === herestring) {
+      const text = resolveWordLiteral(r.Word);
+      return text === null ? { code: null, source: "variable" } : { code: text };
+    }
+    return { code: null, source: "file" };
+  }
+  return { code: null, source: "file" };
+}
+function attachedCode(interp, flag) {
+  const eq = flag.indexOf("=");
+  if (flag.startsWith("--")) return eq >= 0 ? flag.slice(eq + 1) : null;
+  if (/^(pwsh|powershell)/.test(interp)) return null;
+  const letters = /^(perl|ruby|lua|bun|osascript|rscript|irb)$/.test(interp) ? "e" : /^(node|tsx|ts-node)$/.test(interp) ? "ep" : interp === "php" ? "r" : "c";
+  const body = flag.slice(1);
+  const at = [...body].findIndex((ch) => letters.includes(ch.toLowerCase()));
+  if (at < 0) return null;
+  let rest = body.slice(at + 1);
+  if (letters === "ep" && /^[ep]*$/i.test(rest)) rest = "";
+  return rest === "" ? null : rest;
+}
+function inlineExecCall(stmt, pipeFed) {
   const cmd = stmt?.Cmd;
-  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return false;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return null;
   const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
-  if (words.length === 0) return false;
+  if (words.length === 0) return null;
   const headIdx = unwrapCommandHead(words);
   const rawHead = words[headIdx];
-  if (rawHead == null) return false;
+  if (rawHead == null) return null;
   const interp = (rawHead.split("/").pop() ?? "").toLowerCase();
-  if (!INLINE_INTERPRETER.test(interp)) return false;
+  if (!INLINE_INTERPRETER.test(interp)) return null;
   let args = words.slice(headIdx + 1);
-  if (interp === "deno" && (args[0] ?? "").toLowerCase() === "eval") return true;
+  if (interp === "deno" && (args[0] ?? "").toLowerCase() === "eval") {
+    const code = args[1] ?? null;
+    return { interp, code: [code], source: code === null ? "variable" : void 0 };
+  }
   if (INTERP_LEADING_TARGET.has(interp)) {
     const firstFlag = args.findIndex((a) => a == null || a.startsWith("-"));
     args = firstFlag >= 0 ? args.slice(firstFlag) : [];
   }
+  const redirs = stmt.Redirs || cmd.Redirs || [];
+  const stdinFed = redirs.some((r) => r && redirStdinOps().has(r.Op));
+  const fromStdin = () => {
+    if (stdinFed) {
+      const { code, source } = stdinCodeOf(redirs);
+      return { interp, code: [code], source };
+    }
+    return { interp, code: [null], source: "pipe" };
+  };
   let positionals2 = 0;
   let selectedProgram = false;
+  const codes = [];
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
     if (a == null) {
+      if (codes.length > 0) break;
       positionals2++;
       selectedProgram = true;
       continue;
     }
     if (!selectedProgram && isInlineCodeFlag(interp, a)) {
-      if (!/^(bash|sh|zsh|dash|ksh)$/.test(interp)) return true;
-      const payload = args[i + 1];
-      if (payload == null) return true;
-      return shellPayloadNeedsReview(payload);
+      if (/^(bash|sh|zsh|dash|ksh)$/.test(interp)) {
+        const payload = args[i + 1];
+        if (payload == null) return { interp, code: [null], source: "variable" };
+        return shellPayloadNeedsReview(payload) ? { interp, code: [null], source: "payload" } : null;
+      }
+      const attached = attachedCode(interp, a);
+      if (attached !== null) {
+        codes.push(attached);
+      } else {
+        codes.push(args[i + 1] ?? null);
+        i++;
+      }
+      continue;
+    }
+    if (codes.length > 0) {
+      if (a.startsWith("-")) continue;
+      break;
     }
     if (a === "-m") {
       selectedProgram = true;
       continue;
     }
-    if (a === "-" && !selectedProgram) return true;
+    if (a === "-" && !selectedProgram) return fromStdin();
     if (!a.startsWith("-")) {
       positionals2++;
       selectedProgram = true;
     }
   }
-  const redirs = stmt.Redirs || cmd.Redirs || [];
-  const stdinFed = redirs.some((r) => r && redirStdinOps().has(r.Op));
+  if (codes.length > 0) {
+    return { interp, code: codes, source: codes.includes(null) ? "variable" : void 0 };
+  }
   if (positionals2 === 0 && (stdinFed || pipeFed)) {
-    if (!/^(bash|sh|zsh)$/i.test(interp)) return true;
+    if (!/^(bash|sh|zsh)$/i.test(interp)) return fromStdin();
   }
-  return false;
+  return null;
 }
 function shellPayloadNeedsReview(payload) {
   if (payloadNesting >= MAX_PAYLOAD_NESTING) return true;
@@ -1179,7 +1486,7 @@ function shellPayloadNeedsReview(payload) {
       payload
     ))
       review = true;
-    if (!review && detectInlineExec(payload)) review = true;
+    if (!review && inlineExecReview(payload) !== null) review = true;
   } catch {
     review = true;
   } finally {
@@ -1187,35 +1494,77 @@ function shellPayloadNeedsReview(payload) {
   }
   return review;
 }
-function detectInlineExec(command) {
+function inlineExecCalls(command) {
   const f = parseShared(command);
-  if (f === PARSE_FAIL) {
-    return /(^|[|;&]|&&)\s*(?:[\w./-]*\/)?(python[\d.]*|perl|ruby|node|php|lua|deno|bun|pwsh|osascript|rscript|bash|sh|zsh)\s+-{1,2}[a-z]*[ceEr]/i.test(
-      command
-    );
-  }
-  let found = false;
+  if (f === PARSE_FAIL) return PARSE_FAIL;
+  const calls = [];
   try {
     syntax.Walk(f, (node) => {
-      if (!node || found) return false;
+      if (!node || calls.length >= MAX_INLINE_CALLS) return false;
       const n = node;
       const t = syntax.NodeType(n);
       if (t === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
-        if (inlineExecStmt(n.Y, true)) {
-          found = true;
-          return false;
-        }
+        const call = inlineExecCall(n.Y, true);
+        if (call) calls.push(call);
       }
-      if (t === "Stmt" && inlineExecStmt(n, false)) {
-        found = true;
-        return false;
+      if (t === "Stmt") {
+        const call = inlineExecCall(n, false);
+        if (call) calls.push(call);
       }
       return true;
     });
   } catch {
-    return found;
   }
-  return found;
+  return calls;
+}
+function detectInlineExec(command) {
+  const calls = inlineExecCalls(command);
+  if (calls === PARSE_FAIL) return INLINE_EXEC_FALLBACK.test(command);
+  return calls.length > 0;
+}
+function isProtectedCodePath(p) {
+  if (matchSensitivePath(p) !== null) return true;
+  return SYSTEM_AUTH_FILES.includes(p) || SYSTEM_AUTH_DIRS.some((d) => p === d || p.startsWith(d + "/"));
+}
+function inlineExecDescription(r) {
+  const lead = r ? `The AI is running code directly from the command line: ${inlineExecReason(r).replace(/^This/, "this")}.` : "The AI is running code directly from the command line.";
+  return `${lead} Review the full script below before allowing it to execute.`;
+}
+function inlineExecReason(r) {
+  const who = r.interp ? `This inline ${r.interp} code` : "This inline code";
+  return r.evidence ? `${who} ${r.what} (${r.evidence})` : `${who} ${r.what}`;
+}
+function inlineExecReview(command) {
+  const calls = inlineExecCalls(command);
+  if (calls === PARSE_FAIL) {
+    return INLINE_EXEC_FALLBACK.test(command) ? { outcome: "unreadable", interp: "", what: "could not be parsed" } : null;
+  }
+  let unreadable = calls.length >= MAX_INLINE_CALLS ? { outcome: "unreadable", interp: "", what: "runs more inline programs than node9 reads" } : null;
+  for (const call of calls) {
+    const language = inlineLanguageOf(call.interp);
+    for (const code of call.code) {
+      let finding = null;
+      if (code === null) {
+        finding = {
+          outcome: "unreadable",
+          interp: call.interp,
+          what: UNREADABLE_SOURCE[call.source ?? "variable"]
+        };
+      } else if (language === null) {
+        finding = {
+          outcome: "unreadable",
+          interp: call.interp,
+          what: `is ${call.interp} code, which node9 does not read`
+        };
+      } else {
+        const judged = judgeInlineCode(language, code, isProtectedCodePath);
+        if (judged) finding = { ...judged, interp: call.interp };
+      }
+      if (finding?.outcome === "dangerous") return finding;
+      if (finding && !unreadable) unreadable = finding;
+    }
+  }
+  return unreadable;
 }
 function analyzeChmod777(command) {
   if (!/chmod/i.test(command.replace(/[\\'"]/g, ""))) return null;
@@ -2464,40 +2813,6 @@ function analyzeShellCommand(command) {
   }
   return { actions, paths, allTokens };
 }
-function validateRegex(pattern) {
-  if (!pattern) return "Pattern is required";
-  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
-  try {
-    new RegExp(pattern);
-  } catch (e) {
-    return `Invalid regex syntax: ${e.message}`;
-  }
-  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
-  if (!(0, import_safe_regex22.default)(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
-  return null;
-}
-function getCompiledRegex(pattern, flags = "") {
-  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
-  const key = `${pattern}\0${flags}`;
-  if (regexCache.has(key)) {
-    const cached = regexCache.get(key);
-    regexCache.delete(key);
-    regexCache.set(key, cached);
-    return cached;
-  }
-  if (validateRegex(pattern) !== null) return null;
-  try {
-    const re = new RegExp(pattern, flags);
-    if (regexCache.size >= REGEX_CACHE_MAX) {
-      const oldest = regexCache.keys().next().value;
-      if (oldest) regexCache.delete(oldest);
-    }
-    regexCache.set(key, re);
-    return re;
-  } catch {
-    return null;
-  }
-}
 function matchesPattern(text, patterns) {
   const p = Array.isArray(patterns) ? patterns : [patterns];
   if (p.length === 0) return false;
@@ -2508,9 +2823,21 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path27) {
+function mcpServerFromToolName(toolName) {
+  const match = toolName.match(/^mcp__([^_](?:[^_]|_(?!_))*?)__/i);
+  return match?.[1];
+}
+function ruleServerMatches(rule, serverLabel) {
+  const label2 = typeof serverLabel === "string" ? serverLabel.trim().replace(/[\\/]/g, "-") || void 0 : void 0;
+  if (rule.server) {
+    if (!label2 || !matchesPattern(label2, rule.server)) return false;
+  }
+  if (rule.notServer && label2 && matchesPattern(label2, rule.notServer)) return false;
+  return true;
+}
+function getNestedValue(obj, path28) {
   if (!obj || typeof obj !== "object") return null;
-  const segments2 = path27.split(".");
+  const segments2 = path28.split(".");
   for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -2530,23 +2857,26 @@ function evaluateSmartConditions(args, rule) {
     return val;
   };
   const readingsCache = /* @__PURE__ */ new Map();
-  const resolveFieldReadings = (field) => {
-    const cached = readingsCache.get(field);
+  const resolveFieldReadings = (field, reading) => {
+    const access = reading === "access" && field === "command";
+    const key = access ? `${field}\0access` : field;
+    const cached = readingsCache.get(key);
     if (cached) return cached;
     const primary = resolveField(field);
     if (primary === null) {
-      readingsCache.set(field, []);
+      readingsCache.set(key, []);
       return [];
     }
     let out = [primary];
     if (field === "command") {
       const raw = getNestedValue(args, field);
       if (typeof raw === "string") {
-        const collapsed = commandReadings(raw).map((r) => r.replace(/\s+/g, " ").trim());
-        out = [.../* @__PURE__ */ new Set([primary, ...collapsed])];
+        const text = access ? fileAccessView(raw) : raw;
+        const collapsed = commandReadings(text).map((r) => r.replace(/\s+/g, " ").trim());
+        out = access ? [...new Set(collapsed)] : [.../* @__PURE__ */ new Set([primary, ...collapsed])];
       }
     }
-    readingsCache.set(field, out);
+    readingsCache.set(key, out);
     return out;
   };
   const results = rule.conditions.map((cond) => {
@@ -2564,14 +2894,14 @@ function evaluateSmartConditions(args, rule) {
         if (val === null || !cond.value) return false;
         const reM = getCompiledRegex(cond.value, cond.flags ?? "");
         if (!reM) return false;
-        return resolveFieldReadings(cond.field).some((v) => reM.test(v));
+        return resolveFieldReadings(cond.field, cond.reading).some((v) => reM.test(v));
       }
       case "notMatches": {
         if (!cond.value) return false;
         if (val === null) return true;
         const reN = getCompiledRegex(cond.value, cond.flags ?? "");
         if (!reN) return false;
-        return !resolveFieldReadings(cond.field).some((v) => reN.test(v));
+        return !resolveFieldReadings(cond.field, cond.reading).some((v) => reN.test(v));
       }
       case "matchesGlob":
         return val !== null && cond.value ? import_picomatch2.default.isMatch(val, cond.value) : false;
@@ -3413,35 +3743,6 @@ function collectShellFileAccesses(command, context = {}) {
   }
   return out;
 }
-function isAgentInstructionPath(absPath, root) {
-  const r = root.replace(/\/$/, "");
-  if (!(absPath === r || absPath.startsWith(r + "/"))) return false;
-  const rel = absPath.slice(r.length + 1);
-  if (AGENT_INSTRUCTION_FILES.includes(rel)) return true;
-  return AGENT_INSTRUCTION_DIRS.some((d) => rel === d || rel.startsWith(d + "/"));
-}
-function isInside(root, p) {
-  const r = root.replace(/\/$/, "") || "/";
-  return p === r || p.startsWith(r === "/" ? "/" : r + "/");
-}
-function isPasswordHashPath(p) {
-  return PASSWORD_HASH_FILES.includes(p);
-}
-function isLegacySystemPath(p) {
-  return LEGACY_SYSTEM_PATH_RE.test(p);
-}
-function normalizeFilePath(p, cwd = "", home = "~") {
-  if (!p.startsWith("/") && !p.startsWith("~") && cwd) p = `${cwd}/${p}`;
-  if (p === "~" || p.startsWith("~/")) p = home + p.slice(1);
-  const rooted = p.startsWith("/");
-  const parts = [];
-  for (const part of p.split("/")) {
-    if (!part || part === ".") continue;
-    if (part === ".." && parts.length && parts.at(-1) !== "..") parts.pop();
-    else if (part !== ".." || !rooted) parts.push(part);
-  }
-  return (rooted ? "/" : "") + parts.join("/");
-}
 function incompleteFileVerdict(operation = "write") {
   return {
     decision: "review",
@@ -3493,8 +3794,8 @@ function collectFileAccesses(tool, args, context = {}, inspection = {}) {
   }
   return out;
 }
-function within(path27, root) {
-  return path27 === root || path27.startsWith(root === "/" ? "/" : root + "/");
+function within(path28, root) {
+  return path28 === root || path28.startsWith(root === "/" ? "/" : root + "/");
 }
 function hits(access, paths, directories, context) {
   const home = context.homeDirs?.[0] ?? "~";
@@ -4302,14 +4603,14 @@ function sensitivePathMatch(originalPath) {
 }
 function assertBuiltinPatternsAreSafe() {
   for (const p of DLP_PATTERNS) {
-    if (!(0, import_safe_regex23.default)(p.regex.source)) {
+    if (!(0, import_safe_regex22.default)(p.regex.source)) {
       throw new Error(
         `[node9 engine] Builtin DLP pattern '${p.name}' is vulnerable to ReDoS: ${p.regex.source}`
       );
     }
   }
   for (const re of SENSITIVE_PATH_PATTERNS) {
-    if (!(0, import_safe_regex23.default)(re.source)) {
+    if (!(0, import_safe_regex22.default)(re.source)) {
       throw new Error(
         `[node9 engine] Builtin sensitive-path pattern is vulnerable to ReDoS: ${re.source}`
       );
@@ -5433,9 +5734,9 @@ function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
 }
-function valuesAt(args, path27) {
+function valuesAt(args, path28) {
   let cursors = [args];
-  for (const rawSegment of path27.split(".")) {
+  for (const rawSegment of path28.split(".")) {
     const isArray = rawSegment.endsWith("[]");
     const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
     const next = [];
@@ -5466,8 +5767,8 @@ function extractToolDestinations(toolName, args) {
   try {
     const out = [];
     const paths = DESTINATION_ARGS.get(bareToolName(toolName)) ?? [];
-    for (const path27 of paths) {
-      for (const value of valuesAt(args, path27)) {
+    for (const path28 of paths) {
+      for (const value of valuesAt(args, path28)) {
         const host2 = hostOf(value);
         if (host2) out.push({ host: host2, binary: toolName, raw: value });
       }
@@ -5493,8 +5794,8 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    for (const path27 of paths) {
-      for (const value of valuesAt(args, path27)) {
+    for (const path28 of paths) {
+      for (const value of valuesAt(args, path28)) {
         const host2 = hostOf(value);
         if (!host2) continue;
         const m = classifySsrf(host2);
@@ -5503,7 +5804,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const decision = ssrfFloorDecision(m, written, opts);
         if (decision === null) continue;
         const reason = decision === "review" ? ssrfDisguisedReason(m, written) : ssrfReason(m, host2);
-        return { ...m, argPath: path27, host: host2, reason, decision };
+        return { ...m, argPath: path28, host: host2, reason, decision };
       }
     }
     return null;
@@ -5883,11 +6184,15 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
     };
     const ruleCheck = (rule) => {
       if (rule.verdict === "allow") return void 0;
-      if (!rule.builtin || rule.pinned) return void 0;
+      if (!rule.builtin) return void 0;
       const id = checkIdForRule(rule.name);
       if (!id) return void 0;
       const def = getCheck(id);
       if (!def) return void 0;
+      if (rule.pinned) {
+        const explicit = config.policy.checks?.[id];
+        return def.pack && config.policy.checkSources?.[id] === "workspace" && isVerdict(explicit) ? { id, value: explicit } : void 0;
+      }
       if (rule.name?.startsWith("shield:") && !def.pack) return void 0;
       if (def.pack) {
         const explicit = config.policy.checks?.[id];
@@ -5895,8 +6200,10 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       }
       return { id, value: cv(id) };
     };
+    const serverLabel = context.mcpServer ?? mcpServerFromToolName(toolName);
     const matches = config.policy.smartRules.filter((rule) => {
       if (!toolMatchesRule(toolName, rule.tool, layers)) return false;
+      if (!ruleServerMatches(rule, serverLabel)) return false;
       if (astSuppressed(rule)) return false;
       if (rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") return false;
       if (!evaluateSmartConditions(shellRuleArgs(toolName, args, rule.tool, layers), rule))
@@ -5973,11 +6280,13 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       if (v?.logged) noteLogged(v);
       else if (v) candidates.push(v);
     };
-    if (detectInlineExec(shellCommand)) {
+    const inline = config.settings.mode === "strict" ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
+    if (inline !== null) {
       consider("commands.inline-exec", {
         decision: "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
-        ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
+        ...inline ? { reason: inlineExecReason(inline) } : {},
+        ruleDescription: inlineExecDescription(inline),
         tier: 3,
         checkId: "commands.inline-exec"
       });
@@ -7067,7 +7376,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var import_picomatch, import_safe_regex2, import_picomatch2, import_mvdan_sh, import_safe_regex22, import_mvdan_sh2, import_safe_regex23, import_crypto2, import_crypto3, import_mvdan_sh3, import_crypto4, import_mvdan_sh4, import_crypto5, aws_default, bash_safe_default, docker_default, filesystem_default, finance_default, github_default, identity_default, k8s_default, mongodb_default, postgres_default, project_jail_default, publishing_default, redis_default, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, MAX, UNTRUSTED_TOOLS, SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var import_picomatch, import_safe_regex2, import_picomatch2, import_mvdan_sh, import_mvdan_sh2, import_safe_regex22, import_crypto2, import_crypto3, import_mvdan_sh3, import_crypto4, import_mvdan_sh4, import_crypto5, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, MAX, UNTRUSTED_TOOLS, SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, syntax3, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS, MAX_NESTING, SHELL_VALUE_FLAGS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax4, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS2, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -7075,15 +7384,17 @@ var init_dist = __esm({
     import_safe_regex2 = __toESM(require("safe-regex2"), 1);
     import_picomatch2 = __toESM(require("picomatch"), 1);
     import_mvdan_sh = __toESM(require("mvdan-sh"), 1);
-    import_safe_regex22 = __toESM(require("safe-regex2"), 1);
     import_mvdan_sh2 = __toESM(require("mvdan-sh"), 1);
-    import_safe_regex23 = __toESM(require("safe-regex2"), 1);
+    import_safe_regex22 = __toESM(require("safe-regex2"), 1);
     import_crypto2 = require("crypto");
     import_crypto3 = require("crypto");
     import_mvdan_sh3 = __toESM(require("mvdan-sh"), 1);
     import_crypto4 = require("crypto");
     import_mvdan_sh4 = __toESM(require("mvdan-sh"), 1);
     import_crypto5 = __toESM(require("crypto"), 1);
+    MAX_REGEX_LENGTH = 256;
+    REGEX_CACHE_MAX = 500;
+    regexCache = /* @__PURE__ */ new Map();
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -7385,81 +7696,10 @@ var init_dist = __esm({
       ],
       dangerousWords: ["wipefs"]
     };
-    finance_default = {
-      name: "finance",
-      description: "Asks before money moves through a payment or banking app (refunds, payouts, transfers, charges, invoices), whatever the request said. Reads are never asked about.",
-      aliases: ["payments", "money"],
-      smartRules: [
-        {
-          name: "shield:finance:review-refund",
-          tool: "{,mcp__*__}{create_refund,refund_payment,refund_charge,refund_order,issue_refund}",
-          conditions: [],
-          verdict: "review",
-          reason: "A refund returns money to a customer. node9 asks before money moves, whatever the request said (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-payout",
-          tool: "{,mcp__*__}{create_payout,send_payout,payout,create_payouts_batch}",
-          conditions: [],
-          verdict: "review",
-          reason: "A payout moves the balance to a bank account. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-transfer",
-          tool: "{,mcp__*__}{transfer_create,transfer_authorization_create,create_transfer,transfer_money,transfer_funds,send_money,wire_transfer,create_wire,schedule_transaction,update_scheduled_transaction,create_transaction}",
-          conditions: [],
-          verdict: "review",
-          reason: "A transfer moves money between accounts. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-charge",
-          tool: "{,mcp__*__}{create_payment_intent,confirm_payment_intent,capture_payment_intent,create_charge,create_payment,capture_payment,capture_order,create_order,authorize_order,create_checkout_session}",
-          conditions: [],
-          verdict: "review",
-          reason: "This charges a card or captures a payment. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-payment-link",
-          tool: "{,mcp__*__}{create_payment_link,create_invoice,finalize_invoice,send_invoice,pay_invoice,create_invoice_item}",
-          conditions: [],
-          verdict: "review",
-          reason: "This bills someone or creates a link that charges a card. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-subscription",
-          tool: "{,mcp__*__}{create_subscription,cancel_subscription,update_subscription,pause_subscription,resume_subscription}",
-          conditions: [],
-          verdict: "review",
-          reason: "A subscription starts or stops recurring charges. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-dispute",
-          tool: "{,mcp__*__}{update_dispute,accept_dispute,close_dispute}",
-          conditions: [],
-          verdict: "review",
-          reason: "This answers or concedes a chargeback. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-card",
-          tool: "{,mcp__*__}{issue_card,create_virtual_card,create_issuing_card,update_card_limit}",
-          conditions: [],
-          verdict: "review",
-          reason: "This issues a card or changes its limit. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-withdraw",
-          tool: "{,mcp__*__}{withdraw,withdraw_funds,create_withdrawal,request_withdrawal}",
-          conditions: [],
-          verdict: "review",
-          reason: "A withdrawal moves money out. node9 asks before money moves (Finance shield)."
-        }
-      ],
-      dangerousWords: []
-    };
-    github_default = {
-      name: "github",
-      description: "Protects GitHub repositories from destructive AI operations",
-      aliases: ["git"],
+    github_default = {
+      name: "github",
+      description: "Protects GitHub repositories from destructive AI operations",
+      aliases: ["git"],
       smartRules: [
         {
           name: "shield:github:review-delete-branch-remote",
@@ -7482,56 +7722,6 @@ var init_dist = __esm({
       ],
       dangerousWords: []
     };
-    identity_default = {
-      name: "identity",
-      description: "Asks before a password, a key, a token, a role or a user changes in an identity or admin app, whatever the request said. Reads are never asked about.",
-      aliases: ["access", "iam"],
-      smartRules: [
-        {
-          name: "shield:identity:review-password",
-          tool: "{,mcp__*__}{change_password,update_password,reset_password,set_password,expire_password,force_password_reset}",
-          conditions: [],
-          verdict: "review",
-          reason: "This changes or resets a password. node9 asks before credentials change, whatever the request said (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-key",
-          tool: "{,mcp__*__}{rotate_key,rotate_api_key,create_api_key,create_token,create_access_token,create_personal_access_token,regenerate_secret,rotate_secret,create_service_account_key,create_credential}",
-          conditions: [],
-          verdict: "review",
-          reason: "This creates or rotates a key, token or secret. node9 asks before credentials change (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-access",
-          tool: "{,mcp__*__}{grant_access,grant_permission,grant_role,revoke_access,revoke_permission,revoke_role,revoke_token,set_permission,set_permissions,set_role,assign_role,update_role,add_permission,remove_permission,attach_policy,detach_policy}",
-          conditions: [],
-          verdict: "review",
-          reason: "This grants or revokes access. node9 asks before access changes (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-membership",
-          tool: "{,mcp__*__}{add_member,remove_member,add_user_to_group,remove_user_from_group,add_collaborator,remove_collaborator,invite_user,invite_member,invite_user_to_slack,invite_users,add_org_member,remove_org_member,add_team_member,remove_team_member}",
-          conditions: [],
-          verdict: "review",
-          reason: "This changes who belongs where. node9 asks before membership changes (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-user",
-          tool: "{,mcp__*__}{create_user,delete_user,deactivate_user,suspend_user,activate_user,unlock_user,make_admin,promote_user,demote_user,update_user_role}",
-          conditions: [],
-          verdict: "review",
-          reason: "This creates, removes or promotes an account. node9 asks before accounts change (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-mfa",
-          tool: "{,mcp__*__}{reset_mfa,reset_factors,disable_mfa,enroll_factor,deactivate_factor}",
-          conditions: [],
-          verdict: "review",
-          reason: "This changes a second factor. node9 asks before credentials change (Identity shield)."
-        }
-      ],
-      dangerousWords: []
-    };
     k8s_default = {
       name: "k8s",
       description: "Protects Kubernetes clusters from destructive AI operations",
@@ -7784,7 +7974,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+              value: "(cat|less|head|tail|bat|more|open|print|nano|vim?|emacs|code|type|[ef]?grep|rg|ag|ack|g?awk|sed|cut|tr|[jy]q|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development)){0,2}(?=[\\s;&|>)<]|$)",
               flags: "i"
             }
           ],
@@ -7798,7 +7988,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+              value: "(cat|less|head|tail|bat|more|open|print|nano|vim?|emacs|code|type|[ef]?grep|rg|ag|ack|g?awk|sed|cut|tr|[jy]q|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
               flags: "i"
             }
           ],
@@ -7848,18 +8038,218 @@ var init_dist = __esm({
           reason: "Reading .env files is blocked by project-jail shield"
         },
         {
-          name: "shield:project-jail:review-read-credentials-any-tool",
-          tool: "*",
-          conditions: [
-            {
-              field: "file_path",
-              op: "matches",
-              value: ".*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials|\\.kube[\\/\\\\]config)",
-              flags: "i"
-            }
-          ],
+          name: "shield:project-jail:review-read-credentials-any-tool",
+          tool: "*",
+          conditions: [
+            {
+              field: "file_path",
+              op: "matches",
+              value: ".*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials|\\.kube[\\/\\\\]config)",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "Reading credential files requires approval (project-jail shield)"
+        }
+      ],
+      dangerousWords: []
+    };
+    redis_default = {
+      name: "redis",
+      description: "Protects Redis instances from destructive AI operations",
+      aliases: [],
+      _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
+      smartRules: [
+        {
+          name: "shield:redis:block-flushall",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
+              flags: "i"
+            }
+          ],
+          verdict: "block",
+          reason: "FLUSHALL deletes every key in every database \u2014 blocked by Redis shield"
+        },
+        {
+          name: "shield:redis:block-flushdb",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
+              flags: "i"
+            }
+          ],
+          verdict: "block",
+          reason: "FLUSHDB deletes all keys in the current database \u2014 blocked by Redis shield"
+        },
+        {
+          name: "shield:redis:block-config-resetstat",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
+              flags: "i"
+            }
+          ],
+          verdict: "block",
+          reason: "CONFIG RESETSTAT resets server statistics irreversibly \u2014 blocked by Redis shield"
+        },
+        {
+          name: "shield:redis:review-config-set",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
+        },
+        {
+          name: "shield:redis:review-del-wildcard",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "Wildcard key deletion requires human approval (Redis shield)"
+        }
+      ],
+      dangerousWords: ["FLUSHALL", "FLUSHDB"]
+    };
+    finance_default = {
+      name: "finance",
+      description: "Asks before money moves through a payment or banking app (refunds, payouts, transfers, charges, invoices), whatever the request said. Reads are never asked about.",
+      aliases: ["payments", "money"],
+      smartRules: [
+        {
+          name: "shield:finance:review-refund",
+          tool: "{,mcp__*__}{create_refund,refund_payment,refund_charge,refund_order,issue_refund}",
+          conditions: [],
+          verdict: "review",
+          reason: "A refund returns money to a customer. node9 asks before money moves, whatever the request said (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-payout",
+          tool: "{,mcp__*__}{create_payout,send_payout,payout,create_payouts_batch}",
+          conditions: [],
+          verdict: "review",
+          reason: "A payout moves the balance to a bank account. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-transfer",
+          tool: "{,mcp__*__}{transfer_create,transfer_authorization_create,create_transfer,transfer_money,transfer_funds,send_money,wire_transfer,create_wire,schedule_transaction,update_scheduled_transaction}",
+          conditions: [],
+          verdict: "review",
+          reason: "A transfer moves money between accounts. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-charge",
+          tool: "{,mcp__*__}{create_payment_intent,confirm_payment_intent,capture_payment_intent,create_charge,create_payment,capture_payment,capture_order,create_order,authorize_order,create_checkout_session}",
+          conditions: [],
+          verdict: "review",
+          reason: "This charges a card or captures a payment. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-payment-link",
+          tool: "{,mcp__*__}{create_payment_link,create_invoice,finalize_invoice,send_invoice,pay_invoice,create_invoice_item}",
+          conditions: [],
+          verdict: "review",
+          reason: "This bills someone or creates a link that charges a card. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-subscription",
+          tool: "{,mcp__*__}{create_subscription,cancel_subscription,update_subscription,pause_subscription,resume_subscription}",
+          conditions: [],
+          verdict: "review",
+          reason: "A subscription starts or stops recurring charges. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-dispute",
+          tool: "{,mcp__*__}{update_dispute,accept_dispute,close_dispute}",
+          conditions: [],
+          verdict: "review",
+          reason: "This answers or concedes a chargeback. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-card",
+          tool: "{,mcp__*__}{issue_card,create_virtual_card,create_issuing_card,update_card_limit}",
+          conditions: [],
+          verdict: "review",
+          reason: "This issues a card or changes its limit. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-withdraw",
+          tool: "{,mcp__*__}{withdraw,withdraw_funds,create_withdrawal,request_withdrawal}",
+          conditions: [],
+          verdict: "review",
+          reason: "A withdrawal moves money out. node9 asks before money moves (Finance shield)."
+        }
+      ],
+      dangerousWords: []
+    };
+    identity_default = {
+      name: "identity",
+      description: "Asks before a password, a key, a token, a role or a user changes in an identity or admin app, whatever the request said. Reads are never asked about.",
+      aliases: ["access", "iam"],
+      smartRules: [
+        {
+          name: "shield:identity:review-password",
+          tool: "{,mcp__*__}{change_password,update_password,reset_password,set_password,expire_password,force_password_reset}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes or resets a password. node9 asks before credentials change, whatever the request said (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-key",
+          tool: "{,mcp__*__}{rotate_key,rotate_api_key,create_api_key,create_token,create_access_token,create_personal_access_token,regenerate_secret,rotate_secret,create_service_account_key,create_credential}",
+          conditions: [],
+          verdict: "review",
+          reason: "This creates or rotates a key, token or secret. node9 asks before credentials change (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-access",
+          tool: "{,mcp__*__}{grant_access,grant_permission,grant_role,revoke_access,revoke_permission,revoke_role,revoke_token,set_permission,set_permissions,set_role,assign_role,update_role,add_permission,remove_permission,attach_policy,detach_policy,share_file}",
+          conditions: [],
+          verdict: "review",
+          reason: "This grants or revokes access. node9 asks before access changes (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-membership",
+          tool: "{,mcp__*__}{add_member,remove_member,add_user_to_group,remove_user_from_group,add_collaborator,remove_collaborator,invite_user,invite_member,invite_user_to_slack,invite_users,add_org_member,remove_org_member,add_team_member,remove_team_member,add_user_to_channel,remove_user_from_slack}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes who belongs where. node9 asks before membership changes (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-user",
+          tool: "{,mcp__*__}{create_user,delete_user,delete_deactivated_user,deactivate_user,suspend_user,activate_user,unlock_user,make_admin,promote_user,demote_user,update_user_role}",
+          conditions: [],
           verdict: "review",
-          reason: "Reading credential files requires approval (project-jail shield)"
+          reason: "This creates, removes or promotes an account. node9 asks before accounts change (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-mfa",
+          tool: "{,mcp__*__}{reset_mfa,reset_factors,disable_mfa,enroll_factor,deactivate_factor}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes a second factor. node9 asks before credentials change (Identity shield)."
         }
       ],
       dangerousWords: []
@@ -8033,103 +8423,510 @@ var init_dist = __esm({
       ],
       dangerousWords: []
     };
-    redis_default = {
-      name: "redis",
-      description: "Protects Redis instances from destructive AI operations",
-      aliases: [],
-      _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
-      smartRules: [
-        {
-          name: "shield:redis:block-flushall",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
-              flags: "i"
-            }
-          ],
-          verdict: "block",
-          reason: "FLUSHALL deletes every key in every database \u2014 blocked by Redis shield"
-        },
-        {
-          name: "shield:redis:block-flushdb",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
-              flags: "i"
-            }
-          ],
-          verdict: "block",
-          reason: "FLUSHDB deletes all keys in the current database \u2014 blocked by Redis shield"
-        },
-        {
-          name: "shield:redis:block-config-resetstat",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
-              flags: "i"
-            }
-          ],
-          verdict: "block",
-          reason: "CONFIG RESETSTAT resets server statistics irreversibly \u2014 blocked by Redis shield"
-        },
-        {
-          name: "shield:redis:review-config-set",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
-              flags: "i"
-            }
-          ],
-          verdict: "review",
-          reason: "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
-        },
-        {
-          name: "shield:redis:review-del-wildcard",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
-              flags: "i"
-            }
-          ],
-          verdict: "review",
-          reason: "Wildcard key deletion requires human approval (Redis shield)"
-        }
-      ],
-      dangerousWords: ["FLUSHALL", "FLUSHDB"]
+    ACTION_TEMPLATES = {
+      finance: finance_default.smartRules,
+      identity: identity_default.smartRules,
+      publishing: publishing_default.smartRules
+    };
+    ACTION_CHECKS = {
+      finance: { checkId: "actions.money", slug: "money", label: "Money check" },
+      identity: { checkId: "actions.access", slug: "access", label: "Accounts and access check" },
+      publishing: { checkId: "actions.publish", slug: "publish", label: "Publishing check" }
+    };
+    GAP = "[^;&|]{0,200}?";
+    prog = (alt) => `(?:^|[^\\w-])(?:${alt})(?![\\w-])`;
+    httpTo = (host2) => prog("curl|wget|http|https|xh") + "[^;&|]{0,400}?" + host2;
+    httpWrite = (methods) => ({
+      field: "command",
+      op: "matches",
+      value: `-X\\s*(?:${methods})|--(?:request|method)[=\\s]+(?:${methods})|--post-(?:data|file)|\\s(?:${methods}|${methods.toLowerCase()})\\s|^(?!.*\\s(?:-[a-zA-Z]*G|--get)(?![\\w-])).*(?:\\s-d[\\s'"@]|\\s--data|\\s--json\\s|\\s-F\\s|\\s--form\\s)`
+    });
+    HTTP_WRITE = httpWrite("POST|DELETE");
+    HTTP_WRITE_ANY = httpWrite("POST|PUT|PATCH|DELETE");
+    NOT_STRIPE_TEST = {
+      field: "command",
+      op: "notMatches",
+      value: "\\b[sr]k_test_"
     };
+    postTo = (host2) => `\\.post\\(\\s*["'\`][^"'\`]{0,80}${host2}`;
+    STRIPE_OBJECTS = "refunds|payouts|charges|transfers|payment_intents|payment_links|invoices|subscriptions|topups";
+    APP_SHIELD_SPECS = [
+      {
+        name: "stripe",
+        label: "Stripe",
+        description: "Asks before money moves in Stripe (refunds, payouts, charges, invoices, subscriptions), whether the agent uses the Stripe MCP server, the stripe CLI, the API or the Stripe library in a script. Reads are never asked about.",
+        template: "finance",
+        server: "*stripe*",
+        doors: [
+          {
+            name: "shield:stripe:review-cli",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: prog("stripe") + GAP + `\\s(?:${STRIPE_OBJECTS})\\s+(?:create|cancel|capture|confirm|update|pay|finalize_invoice|send_invoice|void_invoice)(?![\\w-])`,
+                flags: "i"
+              },
+              {
+                field: "command",
+                op: "matches",
+                // The stripe CLI works in test mode unless told otherwise.
+                value: "\\s--live(?![\\w-])|\\b[sr]k_live_"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "The stripe CLI is about to move money. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-cli-request",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: prog("stripe") + GAP + `\\s(?:post|delete)\\s+/?v1/(?:${STRIPE_OBJECTS})(?![\\w-])`,
+                flags: "i"
+              },
+              {
+                field: "command",
+                op: "matches",
+                // The stripe CLI works in test mode unless told otherwise.
+                value: "\\s--live(?![\\w-])|\\b[sr]k_live_"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A raw stripe CLI request is about to move money. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: httpTo(`api\\.stripe\\.com/v1/(?:${STRIPE_OBJECTS})(?![\\w-])`),
+                flags: "i"
+              },
+              HTTP_WRITE,
+              NOT_STRIPE_TEST
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the Stripe API is about to move money. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // Python: stripe.Refund.create(...)
+                value: "\\bstripe\\.(?:Refund|Payout|Transfer|Charge|PaymentIntent|PaymentLink|Invoice|Subscription|Topup)\\.(?:create|cancel|capture|confirm|modify|pay|finalize_invoice|send_invoice|void_invoice)\\b"
+              },
+              NOT_STRIPE_TEST
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code moves money through the Stripe library. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-code-node",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // Node: stripe.refunds.create(...)
+                value: "\\bstripe\\.(?:refunds|payouts|transfers|charges|paymentIntents|paymentLinks|invoices|subscriptions|topups)\\.(?:create|cancel|capture|confirm|update|pay|finalizeInvoice|sendInvoice|voidInvoice)\\s*\\("
+              },
+              NOT_STRIPE_TEST
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code moves money through the Stripe library. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-code-http",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // requests.post("https://api.stripe.com/v1/refunds", ...)
+                value: `\\.post\\(\\s*["'\`][^"'\`]{0,80}api\\.stripe\\.com/v1/(?:${STRIPE_OBJECTS})`
+              },
+              NOT_STRIPE_TEST
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code posts to the Stripe API. node9 asks before money moves (Stripe)."
+          }
+        ]
+      },
+      {
+        name: "paypal",
+        label: "PayPal",
+        description: "Asks before money moves in PayPal (refunds, payouts, captured orders, invoices, subscriptions), whether the agent uses a PayPal MCP server, the API or the PayPal SDK in a script. The sandbox is never asked about, and neither are reads.",
+        template: "finance",
+        server: "*paypal*",
+        doors: [
+          {
+            name: "shield:paypal:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The live hosts only: api.paypal.com and api-m.paypal.com. The
+                // sandbox (api-m.sandbox.paypal.com) moves no money.
+                value: httpTo("api(?:-m)?\\.paypal\\.com/v[12]/"),
+                flags: "i"
+              },
+              {
+                field: "command",
+                op: "matches",
+                // The endpoints that move money.
+                value: "\\.paypal\\.com/v[12]/(?:payments/(?:captures|authorizations|sale|payouts|payment|referenced-payouts)|checkout/orders/[^\\s/]{1,64}/(?:capture|authorize)|invoicing/invoices|billing/subscriptions)",
+                flags: "i"
+              },
+              HTTP_WRITE
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the PayPal API is about to move money. node9 asks before money moves (PayPal)."
+          },
+          {
+            name: "shield:paypal:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Node SDKs (checkout-server-sdk, paypal-server-sdk) and the
+                // Python paypalrestsdk.
+                value: "\\b(?:CapturesRefundRequest|OrdersCaptureRequest|AuthorizationsCaptureRequest|PayoutsPostRequest)\\b|\\b(?:captureOrder|refundCapturedPayment|captureAuthorizedPayment|createBatchPayout)\\s*\\(|\\bpaypalrestsdk\\.(?:Payout|Sale|Capture|Invoice|BillingAgreement)\\b"
+              }
+            ],
+            verdict: "review",
+            reason: "This code moves money through PayPal. node9 asks before money moves (PayPal)."
+          },
+          {
+            name: "shield:paypal:review-code-http",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The endpoints that move money; the token call every script
+                // starts with (/v1/oauth2/token) is not one.
+                value: postTo(
+                  "api(?:-m)?\\.paypal\\.com/v[12]/(?:payments/(?:captures|authorizations|sale|payouts|payment|referenced-payouts)|checkout/orders/[^\\s/\"'`]{1,64}/(?:capture|authorize)|invoicing/invoices|billing/subscriptions)"
+                )
+              }
+            ],
+            verdict: "review",
+            reason: "This code posts to the PayPal API. node9 asks before money moves (PayPal)."
+          }
+        ]
+      },
+      {
+        name: "square",
+        label: "Square",
+        description: "Asks before money moves in Square (refunds, payments, paid orders, invoices, subscriptions), whether the agent uses a Square MCP server, the API or the Square SDK in a script. The sandbox host is never asked about, and neither are reads.",
+        template: "finance",
+        // Square's servers, never Squarespace (a website builder).
+        server: "{*square,*square[-_]*,*squareup*}",
+        mcpTools: [
+          {
+            // Square's official MCP server has one tool for every API call; the
+            // service and method name what it does.
+            name: "shield:square:review-mcp-request",
+            tool: "{,mcp__*__}make_api_request",
+            conditions: [
+              {
+                field: "service",
+                op: "matches",
+                value: "^(?:refunds|payments|orders|invoices|subscriptions|disputes|gift_cards|gift_card_activities|checkout|terminal)$",
+                flags: "i"
+              },
+              {
+                field: "method",
+                op: "notMatches",
+                value: "^(?:list|get|retrieve|search|batch_?retrieve|calculate)",
+                flags: "i"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request through the Square MCP server is about to move money. node9 asks before money moves (Square)."
+          }
+        ],
+        doors: [
+          {
+            name: "shield:square:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The live host only; the sandbox is connect.squareupsandbox.com.
+                value: httpTo(
+                  "connect\\.squareup\\.com/v2/(?:refunds|payments|orders/[^\\s/?]{1,64}/pay|invoices|subscriptions|disputes|gift-cards/activities)(?![\\w-]|/search)"
+                ),
+                flags: "i"
+              },
+              HTTP_WRITE_ANY
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the Square API is about to move money. node9 asks before money moves (Square)."
+          },
+          {
+            name: "shield:square:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Square SDK in the script: Node (`square`) or Python (`square`, `squareup`).
+                value: `\\bSquareClient\\b|\\bsquare\\.client\\b|from\\s+square[.\\s]|from\\s+["']square["']|require\\(\\s*["']square["']`
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\.refunds(?:Api)?\\.refund(?:Payment|_payment)\\s*\\(|\\.payments(?:Api)?\\.(?:create|complete)(?:Payment|_payment)?\\s*\\(|\\.orders(?:Api)?\\.pay(?:Order|_order)?\\s*\\(|\\.invoices(?:Api)?\\.publish(?:Invoice|_invoice)?\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code moves money through the Square SDK. node9 asks before money moves (Square)."
+          },
+          {
+            name: "shield:square:review-code-http",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: postTo(
+                  "connect\\.squareup\\.com/v2/(?:refunds|payments|orders/[^\\s/?\"'`]{1,64}/pay|invoices|subscriptions|disputes|gift-cards/activities)(?![\\w-]|/search)"
+                )
+              }
+            ],
+            verdict: "review",
+            reason: "This code posts to the Square API. node9 asks before money moves (Square)."
+          }
+        ]
+      },
+      {
+        name: "plaid",
+        label: "Plaid",
+        description: "Asks before money moves through Plaid (transfers, transfer authorizations, payment initiation), whether the agent uses a Plaid MCP server, the API or the Plaid SDK in a script. The sandbox host is never asked about, and neither are reads such as balances or transactions.",
+        template: "finance",
+        server: "*plaid*",
+        doors: [
+          {
+            name: "shield:plaid:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // Every Plaid endpoint is a POST, so the path is what tells a
+                // write; the live host only, never sandbox.plaid.com. A script
+                // that posts to the URL meets this door too.
+                value: httpTo(
+                  "production\\.plaid\\.com/(?:transfer/(?:create|authorization/create|recurring/create)|payment_initiation/payment/create|bank_transfer/create)(?![\\w-])"
+                ),
+                flags: "i"
+              }
+            ],
+            verdict: "review",
+            reason: "A request to the Plaid API is about to move money. node9 asks before money moves (Plaid)."
+          },
+          {
+            name: "shield:plaid:review-code",
+            tool: "bash",
+            conditions: [
+              { field: "command", op: "matches", value: "\\bplaid", flags: "i" },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\b(?:transfer(?:Authorization|Recurring)?Create|paymentInitiationPaymentCreate|bankTransferCreate|transfer_(?:authorization_|recurring_)?create|payment_initiation_payment_create|bank_transfer_create)\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code moves money through Plaid. node9 asks before money moves (Plaid)."
+          }
+        ]
+      },
+      {
+        name: "okta",
+        label: "Okta",
+        description: "Asks before a user, a group member, a role, a password or a key changes in Okta, whether the agent uses an Okta MCP server, the API or the Okta SDK in a script. Reads and signing in are never asked about.",
+        template: "identity",
+        server: "*okta*",
+        doors: [
+          {
+            name: "shield:okta:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The management API only: sign-in (/api/v1/authn, /sessions,
+                // /oauth2) is not under these paths.
+                value: httpTo(
+                  "[\\w-]+\\.okta(?:-emea)?\\.com/api/v1/(?:users|groups|apps|iam|api-tokens|idps|authorizationServers|policies)(?![\\w-])"
+                ),
+                flags: "i"
+              },
+              HTTP_WRITE_ANY
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the Okta API is about to change who has access. node9 asks before access changes (Okta)."
+          },
+          {
+            name: "shield:okta:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Okta SDK in the script: a method named createUser alone is
+                // in half the applications ever written.
+                value: "@okta/okta-sdk|\\bokta\\.Client\\b|from\\s+okta[.\\s]|\\bimport\\s+okta\\b"
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\b(?:(?:create|delete|deactivate|suspend|unlock|activate)User|(?:reset|expire)Password|resetFactors|(?:assign|unassign)User(?:To|From)Group|assignRoleTo(?:User|Group))\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code changes who has access in Okta. node9 asks before access changes (Okta)."
+          },
+          {
+            name: "shield:okta:review-code-py",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "@okta/okta-sdk|\\bokta\\.Client\\b|from\\s+okta[.\\s]|\\bimport\\s+okta\\b"
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\b(?:(?:create|delete|deactivate|deactivate_or_delete|suspend|unlock|activate)_user|(?:reset|expire)_password|reset_factors|(?:add|remove)_user_(?:to|from)_group|assign_role_to_(?:user|group))\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code changes who has access in Okta. node9 asks before access changes (Okta)."
+          }
+        ]
+      },
+      {
+        name: "auth0",
+        label: "Auth0",
+        description: "Asks before a user, a role, an application or its permissions change in Auth0, whether the agent uses an Auth0 MCP server, the auth0 CLI, the Management API or the Auth0 SDK in a script. Reads and signing in are never asked about.",
+        template: "identity",
+        server: "*auth0*",
+        mcpTools: [
+          {
+            // Auth0's official MCP server: applications (their secrets and
+            // callbacks), APIs and their scopes, and Actions (code that runs at
+            // every sign-in).
+            name: "shield:auth0:review-tenant-config",
+            tool: "{,mcp__*__}{auth0_create_application,auth0_update_application,auth0_create_resource_server,auth0_update_resource_server,auth0_create_action,auth0_update_action,auth0_deploy_action}",
+            conditions: [],
+            verdict: "review",
+            reason: "This changes an Auth0 application, API or sign-in Action. node9 asks before access changes (Auth0)."
+          }
+        ],
+        doors: [
+          {
+            name: "shield:auth0:review-cli",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: prog("auth0") + GAP + "\\s(?:(?:users|roles|apps|orgs)\\s+(?:create|update|delete|rm)|users\\s+roles\\s+(?:assign|add|remove|rm)|roles\\s+permissions\\s+(?:add|remove|rm)|users\\s+blocks\\s+unblock|api\\s+(?:post|put|patch|delete))(?![\\w-])",
+                flags: "i"
+              }
+            ],
+            verdict: "review",
+            reason: "The auth0 CLI is about to change who has access. node9 asks before access changes (Auth0)."
+          },
+          {
+            name: "shield:auth0:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Management API only; /oauth/token is signing in.
+                value: httpTo(
+                  "\\.auth0\\.com/api/v2/(?:users|roles|clients|grants|client-grants|organizations|tickets|jobs/users-imports|device-credentials)(?![\\w-])"
+                ),
+                flags: "i"
+              },
+              HTTP_WRITE_ANY
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the Auth0 Management API is about to change who has access. node9 asks before access changes (Auth0)."
+          },
+          {
+            name: "shield:auth0:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Auth0 SDK in the script (Node `auth0`, Python `auth0`).
+                value: `\\bManagementClient\\b|from\\s+auth0[.\\s]|from\\s+["']auth0["']|require\\(\\s*["']auth0["']`
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\.(?:users|roles|organizations|clients)\\.(?:create|delete|update|assignRoles|deleteRoles|assignUsers|addPermissions|deletePermissions|addMembers|deleteMembers|add_roles|remove_roles|add_users|add_permissions|remove_permissions)\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code changes who has access in Auth0. node9 asks before access changes (Auth0)."
+          }
+        ]
+      }
+    ];
+    APP_SHIELDS = APP_SHIELD_SPECS.map(buildAppShield);
+    APP_SHIELD_NAMES = new Set(APP_SHIELD_SPECS.map((s) => s.name));
+    APP_SERVER_GLOB = `{${APP_SHIELD_SPECS.map((s) => s.server).join(",")}}`;
+    GENERAL_ACTION_RULES = buildGeneralRules();
     BUILTIN_SHIELDS = {
       [aws_default.name]: aws_default,
       [bash_safe_default.name]: bash_safe_default,
       [docker_default.name]: docker_default,
       [filesystem_default.name]: filesystem_default,
-      // Dangerous actions as category shields (node9Firewall#385): an MCP app's
-      // money, credential and publishing tools, asked about whatever the request
-      // said. One glob per rule covers the bare name the gateway sends and the
-      // mcp__<server>__ name the agent hook sends.
-      [finance_default.name]: finance_default,
       [github_default.name]: github_default,
-      [identity_default.name]: identity_default,
       [k8s_default.name]: k8s_default,
       [mongodb_default.name]: mongodb_default,
       [postgres_default.name]: postgres_default,
       [project_jail_default.name]: project_jail_default,
-      [publishing_default.name]: publishing_default,
-      [redis_default.name]: redis_default
+      [redis_default.name]: redis_default,
+      // App shields generated from the action templates (node9Firewall#390): one
+      // per app, every door (MCP server, CLI, API, library), off by default.
+      ...Object.fromEntries(APP_SHIELDS.map((s) => [s.name, s]))
     };
     assertBuiltinShieldRegexesAreSafe();
     SSRF_MAX_HOST = 253;
@@ -8185,9 +8982,9 @@ var init_dist = __esm({
       },
       // ── Commands ──────────────────────────────────────────────────────────────
       "commands.inline-exec": {
-        plain: "The agent runs a small program written inside the command itself.",
+        plain: "The agent runs a small program written inside the command itself, and node9 reads it: ordinary code runs, code that deletes, sends data out, runs other commands or reads protected files is held, and so is code node9 cannot read.",
         example: `node -e "require('fs').rmSync('dist', {recursive: true})"`,
-        advice: "Agents do this often for harmless tasks. Set Log if your team finds the review prompts noisy; keep Review if agents work near production."
+        advice: "Keep Review. Strict mode reviews every inline call, harmless or not; Log or Off only if inline code never reaches anything that matters."
       },
       "commands.eval-dynamic": {
         plain: "The agent runs code whose content is built at run time, so node9 cannot read it in advance.",
@@ -8219,6 +9016,21 @@ var init_dist = __esm({
         example: "chmod 777 deploy.sh",
         advice: "Keep Review. A narrower permission (755, 644) almost always does the job."
       },
+      "actions.money": {
+        plain: "The agent moves money (a refund, a payout, a transfer, a charge) through an app node9 has no protection for, such as an internal billing server.",
+        example: "refund_order on a server called acme-billing",
+        advice: "Keep Review. When the app is Stripe or PayPal, turn on its own protection instead: it covers the CLI, the API and scripts too, and a call from it no longer comes here."
+      },
+      "actions.access": {
+        plain: "The agent changes a password, a key, a role or who belongs to a team, through an app node9 has no protection for.",
+        example: "invite_user or grant_role on a company admin server",
+        advice: "Keep Review. Set Log on a sandbox workspace where agents manage test users all day."
+      },
+      "actions.publish": {
+        plain: "The agent publishes something outside the organisation (a release, a package, a deploy, a public post) through an app node9 has no protection for.",
+        example: "create_release or deploy_to_production on a company MCP server",
+        advice: "Keep Review. Set Log on a release machine whose pipeline publishes on purpose, never on a developer laptop."
+      },
       "commands.sudo": {
         plain: "The agent runs a command as the administrator (root).",
         example: "sudo apt-get install -y nginx",
@@ -8379,7 +9191,7 @@ var init_dist = __esm({
         advice: "Fixed at Block. A person accepts the change on the machine (node9 mcp pin update)."
       },
       "loading.malicious-package": {
-        plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only.",
+        plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only. A new release built from the same repository as the one before it (registry provenance) and an install script the package has always run do not stop; a release that lost the provenance its previous release had does.",
         example: "npm install of a package flagged as malware",
         advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
       }
@@ -8431,7 +9243,7 @@ var init_dist = __esm({
         id: "commands.inline-exec",
         group: "commands",
         title: "Inline code execution",
-        catches: "node -e, python -c, bash -c, a heredoc into an interpreter",
+        catches: "inline code (python -c, node -e, a heredoc into an interpreter) that deletes, sends, opens a socket, runs commands, reads protected files or decodes and runs; unreadable inline code",
         values: ALL,
         defaultValue: "review",
         legacy: ["Node9 Standard (Inline Execution)"]
@@ -8788,6 +9600,38 @@ var init_dist = __esm({
         values: ALL,
         defaultValue: "block",
         legacy: ["\u{1F4E6} Node9 Package Check (Malicious)", "\u{1F4E6} Node9 Package Check (Review)"]
+      },
+      // ── Actions in apps (node9Firewall#390) ──────────────────────────────────
+      // The safety net under the app shields: an action that moves money, changes
+      // access or publishes, on an MCP server no app shield claims (an internal
+      // billing server, a vendor with no shield, Zapier). Review by default; the
+      // rules come from the action templates (shields/apps.ts).
+      {
+        id: "actions.money",
+        group: "actions",
+        title: "Money moves",
+        catches: "a refund, payout, transfer, charge or withdrawal through an app with no protection of its own",
+        values: ALL,
+        defaultValue: "review",
+        legacy: generalActionRuleNames("finance")
+      },
+      {
+        id: "actions.access",
+        group: "actions",
+        title: "Accounts and access change",
+        catches: "a password, key, role, permission or user changed through an app with no protection of its own",
+        values: ALL,
+        defaultValue: "review",
+        legacy: generalActionRuleNames("identity")
+      },
+      {
+        id: "actions.publish",
+        group: "actions",
+        title: "Something is published",
+        catches: "a release, package, deploy or public post through an app with no protection of its own",
+        values: ALL,
+        defaultValue: "review",
+        legacy: generalActionRuleNames("publishing")
       }
     ];
     SHIELD_RULE_NAME = /^shield:([^:]+):(block|review|allow)-(.+)$/;
@@ -8910,12 +9754,223 @@ var init_dist = __esm({
       \u03A5: "Y",
       \u03A7: "X"
     };
-    HOMOGLYPH_RE = new RegExp(`[${Object.keys(HOMOGLYPHS).join("")}]`, "g");
-    MAX_BLOBS = 32;
-    MIN_DECODED = 16;
-    BASE64_RUN_RE = /[A-Za-z0-9+/]{32,}={0,2}|[A-Za-z0-9_-]{32,}/g;
-    HEX_RUN_RE = /\b(?:[0-9a-fA-F]{2}){24,}\b/g;
-    HEX_ESCAPE_RUN_RE = /(?:\\x[0-9a-fA-F]{2}){16,}/g;
+    HOMOGLYPH_RE = new RegExp(`[${Object.keys(HOMOGLYPHS).join("")}]`, "g");
+    MAX_BLOBS = 32;
+    MIN_DECODED = 16;
+    BASE64_RUN_RE = /[A-Za-z0-9+/]{32,}={0,2}|[A-Za-z0-9_-]{32,}/g;
+    HEX_RUN_RE = /\b(?:[0-9a-fA-F]{2}){24,}\b/g;
+    HEX_ESCAPE_RUN_RE = /(?:\\x[0-9a-fA-F]{2}){16,}/g;
+    SYSTEM_AUTH_FILES = [
+      "/etc/passwd",
+      "/etc/shadow",
+      "/etc/group",
+      "/etc/gshadow",
+      "/etc/sudoers"
+    ];
+    SYSTEM_AUTH_DIRS = ["/etc/security", "/etc/pam.d", "/etc/sudoers.d"];
+    PASSWORD_HASH_FILES = ["/etc/shadow", "/etc/gshadow"];
+    STARTUP_NAMES = [".bashrc", ".zshrc", ".profile", ".bash_profile"];
+    SYSTEM_DIRS = [
+      "/usr",
+      "/etc",
+      "/boot",
+      "/bin",
+      "/sbin",
+      "/lib",
+      "/lib64",
+      "/var/log"
+    ];
+    SYSTEM_DIRS_EXEMPT = ["/usr/local", "/usr/src"];
+    UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
+    AGENT_INSTRUCTION_FILES = [
+      ".gitlab-ci.yml",
+      "CLAUDE.md",
+      "AGENTS.md",
+      ".cursorrules",
+      ".mcp.json",
+      ".vscode/settings.json",
+      "package.json"
+    ];
+    AGENT_INSTRUCTION_DIRS = [
+      ".github/workflows",
+      ".claude",
+      ".cursor",
+      ".git/hooks",
+      ".husky"
+    ];
+    LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
+    MAX_INLINE_CODE = 64 * 1024;
+    WHAT = {
+      deletes: "deletes files",
+      "writes-outside": "writes a file outside the project",
+      sends: "sends data over the network",
+      listens: "opens a listening socket or a shell",
+      "runs-commands": "runs other commands or processes",
+      "reads-protected": "reads a protected file",
+      "builds-code": "runs code it builds at run time",
+      permissions: "changes permissions or ownership",
+      monitors: "captures the screen, the clipboard or the keyboard",
+      amplifies: "writes or sends in an endless loop"
+    };
+    OUTSIDE = String.raw`(?:~|\.\.[\\/]|/(?!(?:tmp|var/tmp)/(?![^'"\n]*\.\.)|dev/(?:null|stdout|stderr)\b))`;
+    pyImport = (mods) => new RegExp(String.raw`\b(?:import\s+(?:[\w.]+(?:\s+as\s+\w+)?\s*,\s*)*|from\s+)(?:${mods})\b`);
+    either = (...res) => new RegExp(res.map((r) => `(?:${r.source})`).join("|"), "m");
+    PYTHON = [
+      [
+        "deletes",
+        /\bos\.(?:remove|unlink|rmdir|removedirs)\s*\(|\bshutil\.rmtree\s*\(|\.(?:unlink|rmdir)\s*\(|\bfrom\s+(?:os|shutil)\s+import\s+[^\n]*\b(?:remove|unlink|rmdir|removedirs|rmtree)\b/
+      ],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`\bopen\s*\(\s*[rRbBuU]?['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*(?:mode\s*=\s*)?[rRbB]?['"][^'"\n]*[wax+]|\bPath\s*\(\s*[rR]?['"]${OUTSIDE}[^'"\n]*['"]\s*\)\s*\.(?:write_text|write_bytes|touch|mkdir|symlink_to)\s*\(|\bshutil\.(?:copy\w*|move)\s*\([^)\n]*['"]${OUTSIDE}|\bos\.(?:rename|replace|symlink|link|truncate|makedirs|mkdir)\s*\([^)\n]*['"]${OUTSIDE}`
+        )
+      ],
+      [
+        "sends",
+        either(
+          pyImport(
+            String.raw`socket|requests|urllib2|urllib3|http\.client|httplib|smtplib|ftplib|paramiko|telnetlib|aiohttp|httpx|websockets?|xmlrpc|poplib|imaplib|pycurl|scapy`
+          ),
+          /\burllib\.request\b|\burlopen\s*\(|\bfrom\s+urllib\s+import\s+[^\n;]*\brequest\b|\basyncio\.open_connection\s*\(/
+        )
+      ],
+      [
+        "listens",
+        either(
+          pyImport(String.raw`pty|socketserver|http\.server`),
+          /\bpty\.spawn\s*\(|\.bind\s*\(\s*\(|\basyncio\.start_server\s*\(/
+        )
+      ],
+      [
+        "runs-commands",
+        either(
+          pyImport("subprocess|pexpect|commands|psutil"),
+          /\bos\.(?:system|popen|exec\w*|spawn\w*|posix_spawn\w*|fork|forkpty|kill|killpg)\s*\(|\bfrom\s+os\s+import\s+[^\n;]*\b(?:system|popen|exec\w*|spawn\w*|fork|kill)\b|\bfrom\s+(?:os|shutil|pty|ctypes)\s+import\s+\*/
+        )
+      ],
+      [
+        "builds-code",
+        /(?<![\w.])(?:exec|eval|compile|execfile)\s*\(|\b__import__\s*\(|\bimportlib\b|\b(?:c?pickle|dill|marshal|shelve)\.loads?\s*\(|\byaml\.(?:unsafe_)?load\s*\((?![^)\n]*SafeLoader)|\bctypes\b|\b(?:getattr|vars)\s*\(\s*(?:os|subprocess|shutil|socket|sys|pty|builtins|__builtins__)\b|\b(?:os|subprocess|shutil|socket|sys|pty|builtins)\.__dict__\b|\b__builtins__\b|\bsys\.modules\b|\bglobals\s*\(\s*\)\s*\[/
+      ],
+      [
+        // Spyware shapes: a screenshot, the clipboard, a key logger.
+        "monitors",
+        either(
+          pyImport(String.raw`pyperclip|pynput|keyboard|pyautogui|pyscreenshot|mss|clipboard`),
+          /\bImageGrab\b|\bpyautogui\.screenshot\b|\bscreencapture\b/
+        )
+      ],
+      [
+        "permissions",
+        /\bos\.(?:chmod|lchmod|fchmod|chown|lchown|fchown|setuid|setgid|seteuid|setegid|setreuid|setregid|setresuid)\s*\(|\.chmod\s*\(|\bshutil\.chown\s*\(/
+      ]
+    ];
+    NODE = [
+      [
+        "deletes",
+        /\.(?:rm|rmSync|rmdir|rmdirSync|unlink|unlinkSync)\s*\(|\brimraf\b|\bDeno\.remove(?:Sync)?\s*\(/
+      ],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`(?:\.(?:writeFile|writeFileSync|appendFile|appendFileSync|createWriteStream|copyFile|copyFileSync|cp|cpSync|rename|renameSync|truncate|truncateSync|symlink|symlinkSync|mkdir|mkdirSync)|\bDeno\.(?:writeTextFile|writeFile|rename|mkdir)(?:Sync)?|\bBun\.write)\s*\(\s*['"\x60]${OUTSIDE}`
+        )
+      ],
+      [
+        "sends",
+        /\bfetch\s*\(|(?:\brequire\s*\(\s*|\bfrom\s+|\bimport\s+)['"\x60](?:node:)?(?:http|https|http2|net|dgram|tls|axios|node-fetch|ws|request|got|undici|nodemailer)['"\x60]|\bnew\s+WebSocket\b|\bXMLHttpRequest\b|\b(?:Deno|Bun)\.connect\w*\s*\(/
+      ],
+      ["listens", /\bcreateServer\s*\(|\b(?:Deno\.(?:listen\w*|serve)|Bun\.(?:listen|serve))\s*\(/],
+      [
+        "runs-commands",
+        /\bchild_process\b|\bprocess\.(?:binding|dlopen|kill)\s*\(|\bDeno\.(?:run|Command)\b|\bBun\.(?:spawn|spawnSync|\$)\b|\bexecSync\s*\(|\bspawnSync\s*\(/
+      ],
+      [
+        "builds-code",
+        /(?<![\w.])eval\s*\(|\bnew\s+Function\s*\(|(?<![\w.])Function\s*\(|(?:\brequire\s*\(\s*|\bfrom\s+)['"\x60](?:node:)?vm['"\x60]|\bvm\.\w+|\brequire\s*\(\s*[^'"\x60\s)]|\bimport\s*\(\s*[^'"\x60\s)]/
+      ],
+      [
+        "permissions",
+        /\.(?:chmod|chmodSync|chown|chownSync|lchown|lchownSync|fchmod|fchmodSync|fchown|fchownSync)\s*\(|\bprocess\.set(?:e)?[ug]id\s*\(|\bDeno\.(?:chmod|chown)(?:Sync)?\s*\(/
+      ]
+    ];
+    PERL = [
+      ["deletes", /\b(?:unlink|rmdir|rmtree|remove_tree)\b/],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`['"]\s*(?:\+?>>?|\+<)\s*['"]?\s*,?\s*['"]?${OUTSIDE}|\b(?:rename|symlink|link|copy|move)\s*\(?[^;\n]*['"]${OUTSIDE}`
+        )
+      ],
+      [
+        "sends",
+        /\b(?:IO::Socket|Socket|LWP|HTTP::Tiny|Net::\w+|Mojo::UserAgent|WWW::Mechanize|IO::Socket::INET)\b/
+      ],
+      [
+        "runs-commands",
+        /\b(?:system|exec|fork|kill|syscall)\b|`[^`]*`|\bqx\s*[{([/|!'"]|\bopen\s*\(?[^;\n]*(?:['"]\s*\||\|\s*['"]|['"]-\|['"])/
+      ],
+      ["builds-code", /\beval\b|\bStorable::thaw\b|\bdo\s+['"]/],
+      ["permissions", /\b(?:chmod|chown)\b/]
+    ];
+    RUBY = [
+      [
+        "deletes",
+        /\bFile\.(?:delete|unlink)\b|\bFileUtils\.(?:rm\w*|remove\w*)\b|\bDir\.(?:rmdir|delete|unlink)\b|\.(?:rmtree|delete_all)\b/
+      ],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`\bFile\.(?:write|binwrite|symlink|rename)\s*\(?\s*['"]${OUTSIDE}|\bFile\.open\s*\(?\s*['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*['"][wa+]|\bFileUtils\.(?:cp\w*|mv|install|ln\w*|mkdir_p|touch)\s*\(?[^\n]*['"]${OUTSIDE}`
+        )
+      ],
+      [
+        "sends",
+        /\bNet::\w+|\b(?:TCPSocket|UDPSocket|UNIXSocket|Socket)\b|\bopen-uri\b|\bURI\.open\b|\b(?:HTTParty|Faraday|RestClient|Excon|Typhoeus)\b|\brequire\s+['"](?:socket|net\/\w+|open-uri)['"]/
+      ],
+      ["listens", /\b(?:TCPServer|UNIXServer|WEBrick|PTY)\b/],
+      [
+        "runs-commands",
+        /(?<![\w.])(?:system|exec|spawn|fork)\b|`[^`]*`|%x[{([|!]|(?<![\w.])open\s*\(?\s*['"]\||\bIO\.popen\b|\bOpen3\b|\bProcess\.(?:spawn|kill|exec)\b|\bKernel\.(?:system|exec|spawn|open)\b/
+      ],
+      [
+        "builds-code",
+        /(?<![\w.])eval\b|\b(?:instance|class|module)_eval\b|\b(?:send|public_send)\s*\(?\s*:?['"]?(?:system|eval|exec|spawn)\b|\bMarshal\.load\b|\bYAML\.(?:unsafe_)?load\b|\bconst_get\b/
+      ],
+      ["permissions", /\b(?:File|FileUtils)\.(?:chmod|chown|lchmod|lchown)\w*\b/]
+    ];
+    PHP = [
+      ["deletes", /\b(?:unlink|rmdir)\s*\(/],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`\b(?:file_put_contents|symlink|link|copy|rename|mkdir|touch)\s*\([^)\n]*['"]${OUTSIDE}|\bfopen\s*\(\s*['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*['"][waxc+]`
+        )
+      ],
+      [
+        "sends",
+        /\b(?:curl_exec|curl_init|fsockopen|pfsockopen|stream_socket_client|socket_create|socket_connect|mail|ftp_connect)\s*\(|\b(?:file_get_contents|fopen|file|readfile)\s*\(\s*['"](?:https?|ftp):/
+      ],
+      ["listens", /\b(?:stream_socket_server|socket_bind|socket_listen)\s*\(/],
+      [
+        "runs-commands",
+        /\b(?:system|exec|shell_exec|passthru|proc_open|popen|pcntl_exec|pcntl_fork|posix_kill)\s*\(|`[^`]*`/
+      ],
+      [
+        "builds-code",
+        /\b(?:eval|assert|create_function|unserialize|call_user_func(?:_array)?)\s*\(|\bbase64_decode\b/
+      ],
+      ["permissions", /\b(?:chmod|chown|chgrp|lchown|lchgrp)\s*\(/]
+    ];
+    TABLES = {
+      python: PYTHON,
+      node: NODE,
+      perl: PERL,
+      ruby: RUBY,
+      php: PHP
+    };
+    STRING_LITERAL = /(['"`])((?:\\.|(?!\1)[^\\\n]){1,4096})\1/g;
     ({ syntax } = import_mvdan_sh.default);
     sharedParser = syntax.NewParser();
     MESSAGE_FLAGS = /* @__PURE__ */ new Set([
@@ -8953,6 +10008,10 @@ var init_dist = __esm({
     AST_CACHE_MAX = 5e3;
     astCache = /* @__PURE__ */ new Map();
     PARSE_FAIL = /* @__PURE__ */ Symbol("parse-fail");
+    INTERPRETER_LINE = /^#![ \t]*[\w./+-]+(?:[ \t]+[\w./+=:-]+)*[ \t]*\r?(?=\n|$)/;
+    PROGRAM_DIR = /^(?:\/usr(?:\/local)?|\/opt\/homebrew|\/home\/linuxbrew\/\.linuxbrew)?\/s?bin\/[^/]+$|^\/snap\/bin\/[^/]+$|^(?![/~\\]|[A-Za-z]:|.*\.\.)/;
+    ACCESS_VIEW_CACHE_MAX = 1e3;
+    accessViewCache = /* @__PURE__ */ new Map();
     MAX_READING_PAYLOADS = 8;
     defaultExpansionOps = null;
     VARIABLE_READERS = /* @__PURE__ */ new Set([
@@ -9662,6 +10721,14 @@ var init_dist = __esm({
     INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
     MAX_PAYLOAD_NESTING = 8;
     payloadNesting = 0;
+    MAX_INLINE_CALLS = 16;
+    INLINE_EXEC_FALLBACK = /(^|[|;&]|&&)\s*(?:[\w./-]*\/)?(python[\d.]*|perl|ruby|node|php|lua|deno|bun|pwsh|osascript|rscript|bash|sh|zsh)\s+-{1,2}[a-z]*[ceEr]/i;
+    UNREADABLE_SOURCE = {
+      pipe: "reads its code from another program through a pipe",
+      file: "reads its code from a file on stdin",
+      variable: "runs code the shell fills in at run time",
+      payload: "runs a shell payload that evaluates, sources or runs further code"
+    };
     SCRIPT_RUNNERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "ksh", "source", "."]);
     SCRIPT_RUNNER_VALUE_FLAGS = /* @__PURE__ */ new Set(["-o", "+o", "-O", "+O", "--rcfile", "--init-file"]);
     MAX_SCRIPT_OPERANDS = 8;
@@ -9861,9 +10928,6 @@ var init_dist = __esm({
     positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
     NONE = { kind: "none" };
     UNKNOWN = { kind: "unknown" };
-    MAX_REGEX_LENGTH = 256;
-    REGEX_CACHE_MAX = 500;
-    regexCache = /* @__PURE__ */ new Map();
     FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
     BASH_TOOL_NAMES = /* @__PURE__ */ new Set([
       "bash",
@@ -9978,45 +11042,6 @@ var init_dist = __esm({
         (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
       )
     );
-    SYSTEM_AUTH_FILES = [
-      "/etc/passwd",
-      "/etc/shadow",
-      "/etc/group",
-      "/etc/gshadow",
-      "/etc/sudoers"
-    ];
-    SYSTEM_AUTH_DIRS = ["/etc/security", "/etc/pam.d", "/etc/sudoers.d"];
-    PASSWORD_HASH_FILES = ["/etc/shadow", "/etc/gshadow"];
-    STARTUP_NAMES = [".bashrc", ".zshrc", ".profile", ".bash_profile"];
-    SYSTEM_DIRS = [
-      "/usr",
-      "/etc",
-      "/boot",
-      "/bin",
-      "/sbin",
-      "/lib",
-      "/lib64",
-      "/var/log"
-    ];
-    SYSTEM_DIRS_EXEMPT = ["/usr/local", "/usr/src"];
-    UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
-    AGENT_INSTRUCTION_FILES = [
-      ".gitlab-ci.yml",
-      "CLAUDE.md",
-      "AGENTS.md",
-      ".cursorrules",
-      ".mcp.json",
-      ".vscode/settings.json",
-      "package.json"
-    ];
-    AGENT_INSTRUCTION_DIRS = [
-      ".github/workflows",
-      ".claude",
-      ".cursor",
-      ".git/hooks",
-      ".husky"
-    ];
-    LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
     exempt = (p) => SYSTEM_DIRS_EXEMPT.some((d) => within(p, d));
     RANK = { allow: 0, review: 1, block: 2 };
     BIP39_ENGLISH = `abandon
@@ -13509,7 +14534,11 @@ zoo`.split("\n");
       "commands.disk-destroy",
       "commands.dangerous-word",
       "commands.node9-disarm",
-      "data.pipe-chain"
+      "data.pipe-chain",
+      // The general action checks (node9Firewall#390): smart rules the map governs.
+      "actions.money",
+      "actions.access",
+      "actions.publish"
     ]);
     KNOB_GOVERNED = {
       "data.secrets": ["off", "block"],
@@ -14224,7 +15253,8 @@ var SmartConditionSchema = import_zod.z.object({
     }
   ),
   value: import_zod.z.string().optional(),
-  flags: import_zod.z.string().optional()
+  flags: import_zod.z.string().optional(),
+  reading: import_zod.z.enum(["access"]).optional()
 }).refine(
   (c) => {
     if (c.op === "matchesGlob" || c.op === "notMatchesGlob") return c.value !== void 0;
@@ -14235,6 +15265,9 @@ var SmartConditionSchema = import_zod.z.object({
 var SmartRuleSchema = import_zod.z.object({
   name: import_zod.z.string().optional(),
   tool: import_zod.z.string().min(1, "Smart rule tool must not be empty"),
+  // Scope to an MCP server label (glob), or keep off one (node9Firewall#390).
+  server: import_zod.z.string().min(1).optional(),
+  notServer: import_zod.z.string().min(1).optional(),
   conditions: import_zod.z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
   conditionMode: import_zod.z.enum(["all", "any"]).optional(),
   verdict: import_zod.z.enum(["allow", "review", "block"], {
@@ -14384,8 +15417,8 @@ var ConfigFileSchema = import_zod.z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path27 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path27}: ${issue.message}`;
+    const path28 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path28}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -14398,9 +15431,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path27 of ordered) {
+  for (const path28 of ordered) {
     let cur = root;
-    for (const key of path27.slice(0, -1)) {
+    for (const key of path28.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -14408,7 +15441,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path27[path27.length - 1];
+    const last = path28[path28.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -14444,7 +15477,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path27) => path27.length > 0);
+      }).filter((path28) => path28.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -14470,6 +15503,85 @@ var import_fs2 = __toESM(require("fs"));
 var import_path2 = __toESM(require("path"));
 var import_os2 = __toESM(require("os"));
 init_dist();
+
+// src/shields/build.ts
+init_dist();
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function slug(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "rule";
+}
+var B = "[\\s/\\\\]";
+var SEP = "[/\\\\]";
+function pathToRegexFragment(rawPath) {
+  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
+  const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
+  if (segments2.length === 0) return "";
+  return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
+}
+function pathMatchesFragment(candidate, rawPath) {
+  const value = pathToRegexFragment(rawPath);
+  if (!value || !candidate) return false;
+  const re = getCompiledRegex(value);
+  if (!re) return false;
+  return re.test(candidate);
+}
+function pathRules(rawPath, verdict, reason) {
+  const value = pathToRegexFragment(rawPath);
+  if (!value) return [];
+  const why = reason ?? `Accessing ${rawPath} is restricted by this shield`;
+  const s = slug(rawPath);
+  return [
+    // `reading: 'access'`: a script's interpreter line and the program a
+    // command runs are not reads of the jailed path (node9Firewall#385).
+    {
+      name: `${verdict}-path-${s}-bash`,
+      tool: "bash",
+      conditions: [{ field: "command", op: "matches", value, reading: "access" }],
+      verdict,
+      reason: why
+    },
+    // Keep the historical `-anytool` name for the file_path rule: the
+    // rule→shield attribution maps (Report SHIELDS panel) key on rule names.
+    {
+      name: `${verdict}-path-${s}-anytool`,
+      tool: "*",
+      conditions: [{ field: "file_path", op: "matches", value }],
+      verdict,
+      reason: why
+    },
+    {
+      name: `${verdict}-path-${s}-anytool-path`,
+      tool: "*",
+      conditions: [{ field: "path", op: "matches", value }],
+      verdict,
+      reason: why
+    },
+    {
+      name: `${verdict}-path-${s}-anytool-pattern`,
+      tool: "*",
+      conditions: [{ field: "pattern", op: "matches", value }],
+      verdict,
+      reason: why
+    }
+  ];
+}
+var LEGACY_BASH_PATH_RULE = /^(?:block|review)-path-.+-bash$/;
+function withAccessReading(def) {
+  let changed = false;
+  const smartRules = def.smartRules.map((r) => {
+    const [c, ...rest] = r.conditions ?? [];
+    if (rest.length > 0 || !c || r.tool !== "bash" || !LEGACY_BASH_PATH_RULE.test(r.name ?? "") || c.field !== "command" || c.op !== "matches" || c.reading !== void 0) {
+      return r;
+    }
+    changed = true;
+    return { ...r, conditions: [{ ...c, reading: "access" }] };
+  });
+  return changed ? { ...def, smartRules } : def;
+}
+
+// src/shields.ts
 init_dist();
 var USER_SHIELDS_DIR = import_path2.default.join(import_os2.default.homedir(), ".node9", "shields");
 function loadUserShields() {
@@ -14496,7 +15608,7 @@ function loadUserShields() {
 `);
         continue;
       }
-      result[v.ok.name] = v.ok;
+      result[v.ok.name] = withAccessReading(v.ok);
     } catch (err) {
       process.stderr.write(`[node9] Failed to load user shield ${file2}: ${String(err)}
 `);
@@ -14648,90 +15760,28 @@ var CLASS_B_COMMAND_CHECKS = /* @__PURE__ */ new Set([
   "evalDynamic",
   "pipeChainHigh"
 ]);
-function applyManagedCommandChecks(local, managed, locked) {
-  const next = { ...local };
-  for (const key of COMMAND_CHECK_KEYS) {
-    const m = managed[key];
-    if (typeof m !== "string") continue;
-    const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
-    const resolved = floorValue(COMMAND_CHECK_ORDER, local[key], m, {
-      locked: locked.includes(lockKey)
-    });
-    if (CLASS_B_COMMAND_CHECKS.has(key) && resolved === "off") continue;
-    next[key] = resolved;
-  }
-  return next;
-}
-function applyManagedApprovers(local, managed) {
-  return {
-    ...local,
-    native: typeof managed.native === "boolean" ? managed.native : local.native,
-    browser: typeof managed.browser === "boolean" ? managed.browser : local.browser,
-    cloud: typeof managed.cloud === "boolean" ? managed.cloud : local.cloud,
-    terminal: typeof managed.terminal === "boolean" ? managed.terminal : local.terminal
-  };
-}
-
-// src/shields/build.ts
-init_dist();
-function escapeRegex(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function slug(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "rule";
-}
-var B = "[\\s/\\\\]";
-var SEP = "[/\\\\]";
-function pathToRegexFragment(rawPath) {
-  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
-  const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
-  if (segments2.length === 0) return "";
-  return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
-}
-function pathMatchesFragment(candidate, rawPath) {
-  const value = pathToRegexFragment(rawPath);
-  if (!value || !candidate) return false;
-  const re = getCompiledRegex(value);
-  if (!re) return false;
-  return re.test(candidate);
-}
-function pathRules(rawPath, verdict, reason) {
-  const value = pathToRegexFragment(rawPath);
-  if (!value) return [];
-  const why = reason ?? `Accessing ${rawPath} is restricted by this shield`;
-  const s = slug(rawPath);
-  return [
-    {
-      name: `${verdict}-path-${s}-bash`,
-      tool: "bash",
-      conditions: [{ field: "command", op: "matches", value }],
-      verdict,
-      reason: why
-    },
-    // Keep the historical `-anytool` name for the file_path rule: the
-    // rule→shield attribution maps (Report SHIELDS panel) key on rule names.
-    {
-      name: `${verdict}-path-${s}-anytool`,
-      tool: "*",
-      conditions: [{ field: "file_path", op: "matches", value }],
-      verdict,
-      reason: why
-    },
-    {
-      name: `${verdict}-path-${s}-anytool-path`,
-      tool: "*",
-      conditions: [{ field: "path", op: "matches", value }],
-      verdict,
-      reason: why
-    },
-    {
-      name: `${verdict}-path-${s}-anytool-pattern`,
-      tool: "*",
-      conditions: [{ field: "pattern", op: "matches", value }],
-      verdict,
-      reason: why
-    }
-  ];
+function applyManagedCommandChecks(local, managed, locked) {
+  const next = { ...local };
+  for (const key of COMMAND_CHECK_KEYS) {
+    const m = managed[key];
+    if (typeof m !== "string") continue;
+    const lockKey = `commandChecks${key[0].toUpperCase()}${key.slice(1)}`;
+    const resolved = floorValue(COMMAND_CHECK_ORDER, local[key], m, {
+      locked: locked.includes(lockKey)
+    });
+    if (CLASS_B_COMMAND_CHECKS.has(key) && resolved === "off") continue;
+    next[key] = resolved;
+  }
+  return next;
+}
+function applyManagedApprovers(local, managed) {
+  return {
+    ...local,
+    native: typeof managed.native === "boolean" ? managed.native : local.native,
+    browser: typeof managed.browser === "boolean" ? managed.browser : local.browser,
+    cloud: typeof managed.cloud === "boolean" ? managed.cloud : local.cloud,
+    terminal: typeof managed.terminal === "boolean" ? managed.terminal : local.terminal
+  };
 }
 
 // src/auth/trusted-hosts.ts
@@ -14792,6 +15842,7 @@ function isTrustedHost(host2) {
 
 // src/config/index.ts
 init_dist();
+init_dist();
 
 // src/config/v2.ts
 init_dist();
@@ -15104,7 +16155,9 @@ var DEFAULT_CONFIG = {
             op: "matches",
             // Single spaces on purpose: a nested `\\s+` inside the alternation
             // fails the engine's ReDoS check and the rule would be dropped.
-            value: "(^|&&|\\|\\||;)\\s*(npx )?node9 (session-(exposure|taint) clear|trust (add|recipient add)|pause|shield (disable|set)|egress allow|approver set)\\b",
+            // `apps`: turning an app off, allowing one of its actions, or
+            // linking a server to an app (the general checks leave it).
+            value: "(^|&&|\\|\\||;)\\s*(npx )?node9 (session-(exposure|taint) clear|trust (add|recipient add)|pause|shield (disable|set)|apps (link|[a-z0-9-]{1,32} (off|[a-z]{1,32} allow))|egress allow|approver set)\\b",
             flags: "i"
           }
         ],
@@ -15190,7 +16243,12 @@ var DEFAULT_CONFIG = {
         verdict: "block",
         reason: "Piping remote script into a shell is a supply-chain attack vector",
         description: "The AI wants to download a script from the internet and run it immediately, without you seeing what it contains. This is one of the most common ways malware gets installed."
-      }
+      },
+      // ── Actions in apps (node9Firewall#390) ───────────────────────────────
+      // actions.money / actions.access / actions.publish: the action templates
+      // on every MCP server no app shield claims, plus the shell publishing
+      // rules. Review by default; the check value governs them.
+      ...GENERAL_ACTION_RULES
     ],
     dlp: { enabled: true, scanIgnoredTools: true, pii: "block" },
     egress: {
@@ -15227,6 +16285,7 @@ var DEFAULT_CONFIG = {
     trustedHosts: [],
     trustedHostsManaged: false,
     appPermissions: {},
+    appLinks: {},
     managedJailPaths: []
   },
   environments: {}
@@ -15461,6 +16520,7 @@ function getConfig(cwd) {
     trustedHosts: [],
     trustedHostsManaged: false,
     appPermissions: {},
+    appLinks: {},
     managedJailPaths: []
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
@@ -15845,19 +16905,26 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path27 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path27) continue;
+            const path28 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path28) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path27, verdict, "org-managed jail")) {
+            for (const r of pathRules(path28, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path27, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path28, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
           mergedPolicy.trustedHostsManaged = true;
           mergedPolicy.trustedHosts = mc.trustedHosts.filter((h) => typeof h === "string").map((h) => normalizeHost2(h));
         }
+        if (mc.appLinks && typeof mc.appLinks === "object" && !Array.isArray(mc.appLinks)) {
+          const links = {};
+          for (const [key, slug2] of Object.entries(mc.appLinks)) {
+            if (typeof slug2 === "string" && /^[a-z0-9-]{1,40}$/.test(slug2)) links[key] = slug2;
+          }
+          mergedPolicy.appLinks = links;
+        }
         if (mc.appPermissions && typeof mc.appPermissions === "object" && !Array.isArray(mc.appPermissions)) {
           const coerced = {};
           for (const [srv, tools] of Object.entries(mc.appPermissions)) {
@@ -16403,7 +17470,8 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
       cwd: prepared.cwd,
       activeEnvironment,
       skipIgnoredFastPath: opts?.skipIgnoredFastPath,
-      argumentScan: opts?.argumentScan
+      argumentScan: opts?.argumentScan,
+      mcpServer: opts?.mcpServer
     },
     {
       checkProvenance,
@@ -17071,14 +18139,272 @@ async function resolveViaDaemon(id, decision, internalToken, source, record) {
 
 // src/auth/orchestrator.ts
 var import_crypto10 = require("crypto");
-var import_os19 = __toESM(require("os"));
+
+// src/apps/state.ts
+var import_fs12 = __toESM(require("fs"));
+var import_os10 = __toESM(require("os"));
+var import_path12 = __toESM(require("path"));
+
+// src/apps/catalog.ts
+var APP_CATALOG = [
+  {
+    slug: "redis",
+    label: "Redis",
+    shield: "redis",
+    servers: ["redis", "valkey"],
+    commands: ["redis-cli", "valkey-cli"],
+    packages: ["redis", "ioredis", "valkey"],
+    envPrefixes: ["REDIS_"]
+  },
+  {
+    slug: "postgres",
+    label: "PostgreSQL",
+    shield: "postgres",
+    servers: ["postgres", "pgsql"],
+    commands: ["psql", "pg_dump", "pg_restore", "pgcli"],
+    packages: ["pg", "postgres", "psycopg", "psycopg2", "psycopg2-binary", "asyncpg"],
+    envPrefixes: ["PGHOST", "PGDATABASE", "POSTGRES_"]
+  },
+  {
+    slug: "mongodb",
+    label: "MongoDB",
+    shield: "mongodb",
+    servers: ["mongo"],
+    commands: ["mongosh", "mongo", "mongodump", "mongorestore"],
+    packages: ["mongodb", "mongoose", "pymongo", "motor"],
+    envPrefixes: ["MONGO"]
+  },
+  {
+    slug: "github",
+    label: "GitHub",
+    shield: "github",
+    servers: ["github"],
+    commands: ["gh"],
+    packages: ["@octokit/", "octokit", "pygithub"],
+    envPrefixes: ["GITHUB_TOKEN", "GH_TOKEN"]
+  },
+  {
+    slug: "aws",
+    label: "AWS",
+    shield: "aws",
+    servers: ["aws"],
+    commands: ["aws", "sam", "cdk"],
+    packages: ["aws-sdk", "@aws-sdk/", "boto3", "aws-cdk-lib"],
+    envPrefixes: ["AWS_ACCESS_KEY_ID", "AWS_PROFILE"]
+  },
+  {
+    slug: "k8s",
+    label: "Kubernetes",
+    shield: "k8s",
+    servers: ["kubernetes", "k8s", "kubectl"],
+    commands: ["kubectl", "helm", "k9s"],
+    packages: ["@kubernetes/client-node", "kubernetes"],
+    envPrefixes: ["KUBECONFIG"]
+  },
+  {
+    slug: "docker",
+    label: "Docker",
+    shield: "docker",
+    servers: ["docker"],
+    commands: ["docker", "docker-compose", "podman"],
+    packages: ["dockerode", "docker"],
+    envPrefixes: ["DOCKER_HOST"]
+  },
+  {
+    slug: "stripe",
+    label: "Stripe",
+    shield: "stripe",
+    servers: ["stripe"],
+    commands: ["stripe"],
+    packages: ["stripe", "@stripe/"],
+    envPrefixes: ["STRIPE_"]
+  },
+  {
+    slug: "paypal",
+    label: "PayPal",
+    shield: "paypal",
+    servers: ["paypal"],
+    commands: [],
+    packages: ["@paypal/", "paypalrestsdk", "paypal-checkout-serversdk", "paypal-server-sdk"],
+    envPrefixes: ["PAYPAL_"]
+  },
+  {
+    slug: "square",
+    label: "Square",
+    shield: "square",
+    servers: ["square"],
+    // Squarespace is a website builder. SQUARE_ already misses SQUARESPACE_.
+    notServers: ["squarespace"],
+    commands: [],
+    packages: ["square", "squareup"],
+    envPrefixes: ["SQUARE_"]
+  },
+  {
+    slug: "plaid",
+    label: "Plaid",
+    shield: "plaid",
+    servers: ["plaid"],
+    commands: [],
+    packages: ["plaid", "plaid-python"],
+    envPrefixes: ["PLAID_"]
+  },
+  {
+    slug: "okta",
+    label: "Okta",
+    shield: "okta",
+    servers: ["okta"],
+    commands: ["okta"],
+    packages: ["@okta/", "okta"],
+    envPrefixes: ["OKTA_"]
+  },
+  {
+    slug: "auth0",
+    label: "Auth0",
+    shield: "auth0",
+    servers: ["auth0"],
+    commands: ["auth0"],
+    packages: ["auth0", "@auth0/"],
+    envPrefixes: ["AUTH0_"]
+  }
+];
+var APP_BY_SLUG = new Map(
+  APP_CATALOG.map((a) => [a.slug, a])
+);
+
+// src/apps/state.ts
+init_audit();
+
+// src/daemon/mcp-tools.ts
+var import_fs11 = __toESM(require("fs"));
+var import_path11 = __toESM(require("path"));
+var import_os9 = __toESM(require("os"));
+function getMcpToolsFile() {
+  return import_path11.default.join(import_os9.default.homedir(), ".node9", "mcp-tools.json");
+}
+function readMcpToolsConfig() {
+  try {
+    const file2 = getMcpToolsFile();
+    if (!import_fs11.default.existsSync(file2)) return {};
+    const raw = import_fs11.default.readFileSync(file2, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+
+// src/apps/state.ts
+function appsFilePath(home = import_os10.default.homedir()) {
+  return import_path12.default.join(home, ".node9", "apps.json");
+}
+var SIGNAL_KINDS = /* @__PURE__ */ new Set(["mcp-server", "command", "package", "env-name"]);
+function emptyFile() {
+  return { version: 1, apps: /* @__PURE__ */ Object.create(null), links: /* @__PURE__ */ Object.create(null) };
+}
+function ownString(map, key) {
+  if (!Object.prototype.hasOwnProperty.call(map, key)) return void 0;
+  const v = map[key];
+  return typeof v === "string" ? v : void 0;
+}
+function readSignals(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const x of raw) {
+    if (!x || typeof x.kind !== "string" || typeof x.value !== "string") continue;
+    if (!SIGNAL_KINDS.has(x.kind)) continue;
+    out.push({
+      kind: x.kind,
+      value: x.value.slice(0, 256),
+      ...typeof x.project === "string" ? { project: x.project } : {}
+    });
+  }
+  return out;
+}
+function parseAppsFile(text) {
+  const raw = JSON.parse(text);
+  const file2 = emptyFile();
+  for (const [slug2, r] of Object.entries(raw.apps ?? {})) {
+    if (!APP_BY_SLUG.has(slug2) || !r || r.state !== "on" && r.state !== "off") continue;
+    file2.apps[slug2] = {
+      state: r.state,
+      by: r.by === "user" || r.by === "workspace" ? r.by : "detected",
+      at: typeof r.at === "string" ? r.at : "",
+      signals: readSignals(r.signals)
+    };
+  }
+  for (const [server, slug2] of Object.entries(raw.links ?? {})) {
+    if (typeof slug2 === "string" && APP_BY_SLUG.has(slug2)) file2.links[server.toLowerCase()] = slug2;
+  }
+  return file2;
+}
+function readAppsFile(home) {
+  return readAppsFileStrict(home) ?? emptyFile();
+}
+function readAppsFileStrict(home) {
+  let text;
+  try {
+    text = import_fs12.default.readFileSync(appsFilePath(home), "utf8");
+  } catch (e) {
+    return e.code === "ENOENT" ? emptyFile() : null;
+  }
+  try {
+    return parseAppsFile(text);
+  } catch {
+    return null;
+  }
+}
+var linkCache = null;
+var NO_LINKS = /* @__PURE__ */ Object.create(null);
+function localLinks() {
+  const file2 = appsFilePath();
+  try {
+    const mtimeMs = import_fs12.default.statSync(file2).mtimeMs;
+    if (!linkCache || linkCache.file !== file2 || linkCache.mtimeMs !== mtimeMs) {
+      linkCache = { mtimeMs, file: file2, links: readAppsFile().links };
+    }
+    return linkCache.links;
+  } catch {
+    return NO_LINKS;
+  }
+}
+function resolveLinkedServer(label2, opts = {}) {
+  if (typeof label2 !== "string" || !label2) return label2;
+  const applied = new Set(opts.appliedShields ?? []);
+  const live = (slug2) => {
+    const app = slug2 ? APP_BY_SLUG.get(slug2) : void 0;
+    return app && applied.has(app.shield) ? slug2 : void 0;
+  };
+  const lower2 = label2.toLowerCase();
+  if (!opts.workspaceGoverned) {
+    const local = live(ownString(localLinks(), lower2));
+    if (local) return local;
+  }
+  const managed = opts.managedLinks ?? {};
+  if (opts.serverKey) {
+    const byKey = live(ownString(managed, opts.serverKey));
+    if (byKey) return byKey;
+  }
+  const keys = Object.keys(managed);
+  if (keys.length === 0) return label2;
+  const tools = readMcpToolsConfig();
+  for (const key of keys) {
+    const name = key.startsWith("cfg:") ? key.split(":").slice(2).join(":") : Object.prototype.hasOwnProperty.call(tools, key) ? tools[key]?.name : void 0;
+    if (typeof name === "string" && name.toLowerCase() === lower2) {
+      const linked = live(ownString(managed, key));
+      if (linked) return linked;
+    }
+  }
+  return label2;
+}
+
+// src/auth/orchestrator.ts
+var import_os20 = __toESM(require("os"));
 
 // src/ui/native.ts
 var import_child_process = require("child_process");
-var import_path12 = __toESM(require("path"));
+var import_path14 = __toESM(require("path"));
 
 // src/context-sniper.ts
-var import_path11 = __toESM(require("path"));
+var import_path13 = __toESM(require("path"));
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -17146,7 +18472,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = import_path11.default.basename(editFilePath);
+        editFileName = import_path13.default.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -17214,7 +18540,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file2 = obj.file_path ? import_path12.default.basename(String(obj.file_path)) : "file";
+      const file2 = obj.file_path ? import_path14.default.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -17417,24 +18743,24 @@ end run`;
 }
 
 // src/canary/registry.ts
-var import_fs12 = __toESM(require("fs"));
-var import_os10 = __toESM(require("os"));
-var import_path14 = __toESM(require("path"));
+var import_fs14 = __toESM(require("fs"));
+var import_os12 = __toESM(require("os"));
+var import_path16 = __toESM(require("path"));
 init_dist();
 
 // src/shields/jail.ts
-var import_fs11 = __toESM(require("fs"));
-var import_os9 = __toESM(require("os"));
-var import_path13 = __toESM(require("path"));
+var import_fs13 = __toESM(require("fs"));
+var import_os11 = __toESM(require("os"));
+var import_path15 = __toESM(require("path"));
 init_dist();
 var USER_JAIL_SHIELD = "user-jail";
 function jailStorePath() {
-  return import_path13.default.join(import_os9.default.homedir(), ".node9", "jail-paths.json");
+  return import_path15.default.join(import_os11.default.homedir(), ".node9", "jail-paths.json");
 }
 function readJailPaths() {
   let text;
   try {
-    text = import_fs11.default.readFileSync(jailStorePath(), "utf8");
+    text = import_fs13.default.readFileSync(jailStorePath(), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -17463,7 +18789,7 @@ function findJailedPathIn(candidate, paths) {
 
 // src/canary/registry.ts
 function canaryStorePath() {
-  return import_path14.default.join(import_os10.default.homedir(), ".node9", "canaries.json");
+  return import_path16.default.join(import_os12.default.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -17474,7 +18800,7 @@ function loadCanaries(opts) {
   const p = canaryStorePath();
   let raw;
   try {
-    raw = import_fs12.default.readFileSync(p, "utf-8");
+    raw = import_fs14.default.readFileSync(p, "utf-8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -17500,22 +18826,22 @@ function canaryValues() {
 init_dist();
 
 // src/auth/session-script.ts
-var import_fs13 = __toESM(require("fs"));
-var import_os11 = __toESM(require("os"));
-var import_path15 = __toESM(require("path"));
+var import_fs15 = __toESM(require("fs"));
+var import_os13 = __toESM(require("os"));
+var import_path17 = __toESM(require("path"));
 init_dist();
 var MAX_SCRIPT_BYTES = 64 * 1024;
 var MAX_RECORDED_WRITES = 32;
 function readScriptFile(resolved) {
   let fd;
   try {
-    fd = import_fs13.default.openSync(resolved, import_fs13.default.constants.O_RDONLY | (import_fs13.default.constants.O_NONBLOCK ?? 0));
-    const st = import_fs13.default.fstatSync(fd);
+    fd = import_fs15.default.openSync(resolved, import_fs15.default.constants.O_RDONLY | (import_fs15.default.constants.O_NONBLOCK ?? 0));
+    const st = import_fs15.default.fstatSync(fd);
     if (!st.isFile() || st.size > MAX_SCRIPT_BYTES) return null;
     const buf = Buffer.alloc(MAX_SCRIPT_BYTES + 1);
     let n = 0;
     while (n < buf.length) {
-      const got = import_fs13.default.readSync(fd, buf, n, buf.length - n, n);
+      const got = import_fs15.default.readSync(fd, buf, n, buf.length - n, n);
       if (got === 0) break;
       n += got;
     }
@@ -17526,7 +18852,7 @@ function readScriptFile(resolved) {
   } finally {
     if (fd !== void 0) {
       try {
-        import_fs13.default.closeSync(fd);
+        import_fs15.default.closeSync(fd);
       } catch {
       }
     }
@@ -17534,9 +18860,9 @@ function readScriptFile(resolved) {
 }
 function absolute(p, cwd, home) {
   const spelled = p === "~" || p.startsWith("~/") ? home + p.slice(1) : p;
-  return import_path15.default.resolve(cwd, spelled);
+  return import_path17.default.resolve(cwd, spelled);
 }
-async function resolveSessionScript(toolName, args, cwd, layers, deps, home = import_os11.default.homedir()) {
+async function resolveSessionScript(toolName, args, cwd, layers, deps, home = import_os13.default.homedir()) {
   try {
     const d = deps ?? { checkWritten, readScript: readScriptFile };
     const shell = resolveShellInput(toolName, args, layers);
@@ -17565,7 +18891,7 @@ async function resolveSessionScript(toolName, args, cwd, layers, deps, home = im
     return null;
   }
 }
-function sessionWriteTargets(toolName, args, fileAccess, cwd, home = import_os11.default.homedir()) {
+function sessionWriteTargets(toolName, args, fileAccess, cwd, home = import_os13.default.homedir()) {
   const base2 = cwd ?? process.cwd();
   const out = /* @__PURE__ */ new Set();
   const argsObj = args && typeof args === "object" ? args : {};
@@ -17595,26 +18921,26 @@ init_audit();
 init_dist();
 
 // src/exposure/known-hosts.ts
-var import_fs15 = __toESM(require("fs"));
-var import_path17 = __toESM(require("path"));
+var import_fs17 = __toESM(require("fs"));
+var import_path19 = __toESM(require("path"));
 
 // src/utils/git-remotes.ts
-var import_fs14 = __toESM(require("fs"));
-var import_path16 = __toESM(require("path"));
+var import_fs16 = __toESM(require("fs"));
+var import_path18 = __toESM(require("path"));
 init_dist();
 function readSmallFile(p, max) {
   let fd;
   try {
-    fd = import_fs14.default.openSync(p, import_fs14.default.constants.O_RDONLY | (import_fs14.default.constants.O_NOFOLLOW ?? 0));
-    const st = import_fs14.default.fstatSync(fd);
+    fd = import_fs16.default.openSync(p, import_fs16.default.constants.O_RDONLY | (import_fs16.default.constants.O_NOFOLLOW ?? 0));
+    const st = import_fs16.default.fstatSync(fd);
     if (!st.isFile() || st.size > max) return null;
     const buf = Buffer.alloc(st.size);
-    const n = import_fs14.default.readSync(fd, buf, 0, st.size, 0);
+    const n = import_fs16.default.readSync(fd, buf, 0, st.size, 0);
     return buf.subarray(0, n).toString("utf8");
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) import_fs14.default.closeSync(fd);
+    if (fd !== void 0) import_fs16.default.closeSync(fd);
   }
 }
 function gitRemoteHost(url) {
@@ -17633,20 +18959,20 @@ function gitRemoteHost(url) {
   return null;
 }
 function findGitConfig(dir2, walkUp = true) {
-  let cur = import_path16.default.resolve(dir2);
+  let cur = import_path18.default.resolve(dir2);
   for (let i = 0; i < (walkUp ? 64 : 1); i++) {
-    const dotGit = import_path16.default.join(cur, ".git");
-    const direct = readSmallFile(import_path16.default.join(dotGit, "config"), 1e6);
+    const dotGit = import_path18.default.join(cur, ".git");
+    const direct = readSmallFile(import_path18.default.join(dotGit, "config"), 1e6);
     if (direct !== null) return direct;
     const pointer = readSmallFile(dotGit, 4096);
     const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
     if (m) {
-      let gitDir = import_path16.default.resolve(cur, m[1]);
-      const common = readSmallFile(import_path16.default.join(gitDir, "commondir"), 4096);
-      if (common !== null) gitDir = import_path16.default.resolve(gitDir, common.trim());
-      return readSmallFile(import_path16.default.join(gitDir, "config"), 1e6);
+      let gitDir = import_path18.default.resolve(cur, m[1]);
+      const common = readSmallFile(import_path18.default.join(gitDir, "commondir"), 4096);
+      if (common !== null) gitDir = import_path18.default.resolve(gitDir, common.trim());
+      return readSmallFile(import_path18.default.join(gitDir, "config"), 1e6);
     }
-    const parent = import_path16.default.dirname(cur);
+    const parent = import_path18.default.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -17656,12 +18982,12 @@ var cache = /* @__PURE__ */ new Map();
 function readGitRemotes(dir2, opts = {}) {
   if (!dir2) return [];
   const walkUp = opts.walkUp !== false;
-  const key = `${walkUp ? "up" : "at"}:${import_path16.default.resolve(dir2)}`;
+  const key = `${walkUp ? "up" : "at"}:${import_path18.default.resolve(dir2)}`;
   const hit = cache.get(key);
   if (hit) return hit;
   const out = [];
   try {
-    const cfg = findGitConfig(import_path16.default.resolve(dir2), walkUp);
+    const cfg = findGitConfig(import_path18.default.resolve(dir2), walkUp);
     if (cfg !== null) {
       let current = null;
       for (const line of cfg.split(/\r?\n/)) {
@@ -17697,15 +19023,15 @@ var ECOSYSTEMS = [
 ];
 var cache2 = /* @__PURE__ */ new Map();
 function manifestRoot(dir2) {
-  let cur = import_path17.default.resolve(dir2);
+  let cur = import_path19.default.resolve(dir2);
   for (let i = 0; i < 64; i++) {
     for (const [m] of ECOSYSTEMS) {
       try {
-        if (import_fs15.default.existsSync(import_path17.default.join(cur, m))) return cur;
+        if (import_fs17.default.existsSync(import_path19.default.join(cur, m))) return cur;
       } catch {
       }
     }
-    const parent = import_path17.default.dirname(cur);
+    const parent = import_path19.default.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -17714,7 +19040,7 @@ function manifestRoot(dir2) {
 function knownProjectHosts(dir2) {
   const empty = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
   if (!dir2) return empty;
-  const key = import_path17.default.resolve(dir2);
+  const key = import_path19.default.resolve(dir2);
   const hit = cache2.get(key);
   if (hit) return hit;
   const out = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
@@ -17727,10 +19053,10 @@ function knownProjectHosts(dir2) {
     const root = manifestRoot(key);
     if (root !== null) {
       for (const [m, registry] of ECOSYSTEMS) {
-        if (import_fs15.default.existsSync(import_path17.default.join(root, m))) out.hosts.add(registry);
+        if (import_fs17.default.existsSync(import_path19.default.join(root, m))) out.hosts.add(registry);
       }
       try {
-        if (import_fs15.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
+        if (import_fs17.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
           out.hosts.add("host:rubygems.org");
       } catch {
       }
@@ -17742,9 +19068,9 @@ function knownProjectHosts(dir2) {
 }
 
 // src/exposure/writes.ts
-var import_fs16 = __toESM(require("fs"));
-var import_os12 = __toESM(require("os"));
-var import_path18 = __toESM(require("path"));
+var import_fs18 = __toESM(require("fs"));
+var import_os14 = __toESM(require("os"));
+var import_path20 = __toESM(require("path"));
 init_dist();
 var WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "remove"]);
 var LIFECYCLE_RE = /"(scripts|preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack|publish|postpublish)"\s*:/;
@@ -17774,7 +19100,7 @@ function packageScriptsTouched(args, absPath, shellCommand) {
   if (typeof a.content === "string") {
     try {
       const next = JSON.parse(a.content);
-      const prev = JSON.parse(import_fs16.default.readFileSync(absPath, "utf8"));
+      const prev = JSON.parse(import_fs18.default.readFileSync(absPath, "utf8"));
       return JSON.stringify(next.scripts ?? null) !== JSON.stringify(prev.scripts ?? null);
     } catch {
       return LIFECYCLE_RE.test(a.content);
@@ -17784,8 +19110,8 @@ function packageScriptsTouched(args, absPath, shellCommand) {
 }
 function judgeWritesAfterExposure(opts) {
   const holds = [];
-  const home = opts.home ?? import_os12.default.homedir();
-  const tmp = normalizeFilePath(import_os12.default.tmpdir());
+  const home = opts.home ?? import_os14.default.homedir();
+  const tmp = normalizeFilePath(import_os14.default.tmpdir());
   const root = opts.cwd ? normalizeFilePath(opts.cwd, "", home) : null;
   const seen = /* @__PURE__ */ new Set();
   for (const access of opts.accesses) {
@@ -17795,7 +19121,7 @@ function judgeWritesAfterExposure(opts) {
     seen.add(p);
     if (p === "/dev" || p.startsWith("/dev/")) continue;
     if (root !== null && isInside(root, p)) {
-      if (isAgentInstructionPath(p, root) && (import_path18.default.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
+      if (isAgentInstructionPath(p, root) && (import_path20.default.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
         holds.push({ path: p, why: "agent-instruction" });
       continue;
     }
@@ -17817,25 +19143,25 @@ function judgeWritesAfterExposure(opts) {
 
 // src/exposure/marker.ts
 var import_crypto8 = __toESM(require("crypto"));
-var import_fs17 = __toESM(require("fs"));
-var import_os13 = __toESM(require("os"));
-var import_path19 = __toESM(require("path"));
+var import_fs19 = __toESM(require("fs"));
+var import_os15 = __toESM(require("os"));
+var import_path21 = __toESM(require("path"));
 
 // src/daemon/exposure-store.ts
 var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
 
 // src/exposure/marker.ts
 function dir() {
-  return import_path19.default.join(import_os13.default.homedir(), ".node9", "exposure-sessions");
+  return import_path21.default.join(import_os15.default.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = import_crypto8.default.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return import_path19.default.join(dir(), id);
+  return import_path21.default.join(dir(), id);
 }
 function maybeSessionExposed(sessionId) {
   if (!sessionId) return false;
   try {
-    const st = import_fs17.default.statSync(file(sessionId));
+    const st = import_fs19.default.statSync(file(sessionId));
     return Date.now() - st.mtimeMs < SESSION_EXPOSURE_TTL_MS;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -17843,27 +19169,7 @@ function maybeSessionExposed(sessionId) {
 }
 
 // src/exposure/roles.ts
-var import_fs19 = __toESM(require("fs"));
-
-// src/daemon/mcp-tools.ts
-var import_fs18 = __toESM(require("fs"));
-var import_path20 = __toESM(require("path"));
-var import_os14 = __toESM(require("os"));
-function getMcpToolsFile() {
-  return import_path20.default.join(import_os14.default.homedir(), ".node9", "mcp-tools.json");
-}
-function readMcpToolsConfig() {
-  try {
-    const file2 = getMcpToolsFile();
-    if (!import_fs18.default.existsSync(file2)) return {};
-    const raw = import_fs18.default.readFileSync(file2, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return {};
-  }
-}
-
-// src/exposure/roles.ts
+var import_fs20 = __toESM(require("fs"));
 var EXPOSURE_LABEL = "\u{1F6E1}\uFE0F Node9 Exposure";
 var AGENT_INTERNAL_PREFIXES = ["ccd_", "visualize"];
 function foldServerName(name) {
@@ -17873,7 +19179,7 @@ var inventoryCache = null;
 var inventoryStamp = null;
 function inventoryFileStamp() {
   try {
-    const st = import_fs19.default.statSync(getMcpToolsFile());
+    const st = import_fs20.default.statSync(getMcpToolsFile());
     return `${st.mtimeMs}:${st.size}`;
   } catch {
     return "";
@@ -17957,16 +19263,16 @@ function sourceWord(toolName) {
 }
 
 // src/auth/trusted-recipients.ts
-var import_fs20 = __toESM(require("fs"));
-var import_path21 = __toESM(require("path"));
-var import_os15 = __toESM(require("os"));
+var import_fs21 = __toESM(require("fs"));
+var import_path22 = __toESM(require("path"));
+var import_os16 = __toESM(require("os"));
 init_dist();
 function getTrustedRecipientsPath() {
-  return import_path21.default.join(import_os15.default.homedir(), ".node9", "trusted-recipients.json");
+  return import_path22.default.join(import_os16.default.homedir(), ".node9", "trusted-recipients.json");
 }
 function readTrustedRecipients() {
   try {
-    const raw = import_fs20.default.readFileSync(getTrustedRecipientsPath(), "utf8");
+    const raw = import_fs21.default.readFileSync(getTrustedRecipientsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.entries) ? parsed.entries.filter((e) => e && typeof e.value === "string") : [];
   } catch {
@@ -17975,10 +19281,10 @@ function readTrustedRecipients() {
 }
 function writeTrustedRecipients(entries) {
   const filePath = getTrustedRecipientsPath();
-  import_fs20.default.mkdirSync(import_path21.default.dirname(filePath), { recursive: true });
+  import_fs21.default.mkdirSync(import_path22.default.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
-  import_fs20.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
-  import_fs20.default.renameSync(tmp, filePath);
+  import_fs21.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
+  import_fs21.default.renameSync(tmp, filePath);
 }
 function addTrustedRecipient(raw, addedBy = "user") {
   const value = normalizeRecipient(raw);
@@ -17993,7 +19299,7 @@ function addTrustedRecipient(raw, addedBy = "user") {
 var cache3 = null;
 function mtimeOf() {
   try {
-    return import_fs20.default.statSync(getTrustedRecipientsPath()).mtimeMs;
+    return import_fs21.default.statSync(getTrustedRecipientsPath()).mtimeMs;
   } catch {
     return 0;
   }
@@ -18007,41 +19313,41 @@ function isTrustedRecipient(value) {
 }
 
 // src/auth/cloud.ts
-var import_fs22 = __toESM(require("fs"));
-var import_os16 = __toESM(require("os"));
-var import_path22 = __toESM(require("path"));
+var import_fs23 = __toESM(require("fs"));
+var import_os17 = __toESM(require("os"));
+var import_path23 = __toESM(require("path"));
 init_audit();
 
 // src/utils/read-capped.ts
-var import_fs21 = __toESM(require("fs"));
+var import_fs22 = __toESM(require("fs"));
 function readCapped(file2, maxBytes) {
   if (maxBytes < 0) return null;
   let fd;
   try {
-    fd = import_fs21.default.openSync(file2, "r");
+    fd = import_fs22.default.openSync(file2, "r");
   } catch {
     return null;
   }
   try {
-    const st = import_fs21.default.fstatSync(fd);
+    const st = import_fs22.default.fstatSync(fd);
     if (!st.isFile()) return null;
     const want = Math.min(st.size, maxBytes + 1);
     const buf = Buffer.alloc(want);
-    let read = 0;
-    while (read < want) {
-      const n = import_fs21.default.readSync(fd, buf, read, want - read, read);
+    let read2 = 0;
+    while (read2 < want) {
+      const n = import_fs22.default.readSync(fd, buf, read2, want - read2, read2);
       if (n <= 0) break;
-      read += n;
+      read2 += n;
     }
     return {
-      bytes: buf.subarray(0, Math.min(read, maxBytes)),
-      truncated: read > maxBytes
+      bytes: buf.subarray(0, Math.min(read2, maxBytes)),
+      truncated: read2 > maxBytes
     };
   } catch {
     return null;
   } finally {
     try {
-      import_fs21.default.closeSync(fd);
+      import_fs22.default.closeSync(fd);
     } catch {
     }
   }
@@ -18086,7 +19392,7 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = import_path22.default.join(import_os16.default.homedir(), ".node9", "ci-context.json");
+      const ciContextPath = import_path23.default.join(import_os17.default.homedir(), ".node9", "ci-context.json");
       const ci = readCappedText(ciContextPath, 1e4);
       if (!ci) throw new Error("ci-context.json unreadable");
       if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
@@ -18128,9 +19434,9 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
         context: {
           agent: meta?.agent,
           mcpServer: meta?.mcpServer,
-          hostname: import_os16.default.hostname(),
+          hostname: import_os17.default.hostname(),
           cwd: process.cwd(),
-          platform: import_os16.default.platform()
+          platform: import_os17.default.platform()
         },
         // The SaaS validates riskMetadata strictly and would drop it whole on
         // an unknown key, so only fields its schema declares go on the wire.
@@ -18204,14 +19510,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      import_fs22.default.appendFileSync(
+      import_fs23.default.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    import_fs22.default.appendFileSync(
+    import_fs23.default.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err)}
 `
@@ -18220,18 +19526,18 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 }
 
 // src/loop-detector.ts
-var import_fs23 = __toESM(require("fs"));
-var import_path23 = __toESM(require("path"));
-var import_os17 = __toESM(require("os"));
+var import_fs24 = __toESM(require("fs"));
+var import_path24 = __toESM(require("path"));
+var import_os18 = __toESM(require("os"));
 init_dist();
 init_dist();
 function loopStateFile() {
-  return import_path23.default.join(import_os17.default.homedir(), ".node9", "loop-state.json");
+  return import_path24.default.join(import_os18.default.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
-    if (!import_fs23.default.existsSync(loopStateFile())) return [];
-    const raw = import_fs23.default.readFileSync(loopStateFile(), "utf-8");
+    if (!import_fs24.default.existsSync(loopStateFile())) return [];
+    const raw = import_fs24.default.readFileSync(loopStateFile(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return [];
     return parsed;
@@ -18240,11 +19546,11 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir2 = import_path23.default.dirname(loopStateFile());
-  if (!import_fs23.default.existsSync(dir2)) import_fs23.default.mkdirSync(dir2, { recursive: true });
-  const tmpPath = `${loopStateFile()}.${import_os17.default.hostname()}.${process.pid}.tmp`;
-  import_fs23.default.writeFileSync(tmpPath, JSON.stringify(records));
-  import_fs23.default.renameSync(tmpPath, loopStateFile());
+  const dir2 = import_path24.default.dirname(loopStateFile());
+  if (!import_fs24.default.existsSync(dir2)) import_fs24.default.mkdirSync(dir2, { recursive: true });
+  const tmpPath = `${loopStateFile()}.${import_os18.default.hostname()}.${process.pid}.tmp`;
+  import_fs24.default.writeFileSync(tmpPath, JSON.stringify(records));
+  import_fs24.default.renameSync(tmpPath, loopStateFile());
 }
 function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   try {
@@ -18258,21 +19564,21 @@ function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
 
 // src/supply-chain/check.ts
 var import_picomatch3 = __toESM(require("picomatch"));
-var import_path26 = __toESM(require("path"));
+var import_path27 = __toESM(require("path"));
 init_dist();
 
 // src/supply-chain/osv-index.ts
-var import_fs24 = __toESM(require("fs"));
-var import_os18 = __toESM(require("os"));
-var import_path24 = __toESM(require("path"));
+var import_fs25 = __toESM(require("fs"));
+var import_os19 = __toESM(require("os"));
+var import_path25 = __toESM(require("path"));
 var import_crypto9 = require("crypto");
 init_dist();
 var INDEX_FRESH_MS = 72 * 60 * 60 * 1e3;
 function osvRoot() {
-  return import_path24.default.join(import_os18.default.homedir(), ".node9", "osv");
+  return import_path25.default.join(import_os19.default.homedir(), ".node9", "osv");
 }
 function ecoDir(eco) {
-  return import_path24.default.join(osvRoot(), eco);
+  return import_path25.default.join(osvRoot(), eco);
 }
 function indexKey(eco, name) {
   switch (eco) {
@@ -18291,11 +19597,11 @@ function shardOf(key) {
   return (0, import_crypto9.createHash)("sha1").update(key).digest("hex").slice(0, 2);
 }
 function shardPath(eco, shard) {
-  return import_path24.default.join(ecoDir(eco), "shards", `${shard}.json`);
+  return import_path25.default.join(ecoDir(eco), "shards", `${shard}.json`);
 }
 function readMeta(eco) {
   try {
-    const m = JSON.parse(import_fs24.default.readFileSync(import_path24.default.join(ecoDir(eco), "meta.json"), "utf8"));
+    const m = JSON.parse(import_fs25.default.readFileSync(import_path25.default.join(ecoDir(eco), "meta.json"), "utf8"));
     if (typeof m?.syncedAt !== "string" || typeof m?.lastModifiedMs !== "number") return null;
     return m;
   } catch {
@@ -18304,7 +19610,7 @@ function readMeta(eco) {
 }
 function readShard(eco, shard) {
   try {
-    const s = JSON.parse(import_fs24.default.readFileSync(shardPath(eco, shard), "utf8"));
+    const s = JSON.parse(import_fs25.default.readFileSync(shardPath(eco, shard), "utf8"));
     return s && typeof s === "object" && !Array.isArray(s) ? s : {};
   } catch {
     return {};
@@ -18430,14 +19736,102 @@ async function queryOsvMalicious(queries) {
 }
 
 // src/supply-chain/registry.ts
+var import_semver2 = require("semver");
+
+// src/supply-chain/provenance.ts
 var import_semver = require("semver");
 var TIMEOUT_MS2 = 1500;
-var MAX_BYTES = 2 * 1024 * 1024;
+var MAX_BYTES = 256 * 1024;
+function normalizeRepo(raw, host2 = "github.com") {
+  let s = raw.trim().toLowerCase();
+  s = s.replace(/^git\+/, "").replace(/^[a-z]+:\/\//, "");
+  s = s.replace(/@refs\/.*$/, "").replace(/\.git$/, "").replace(/\/+$/, "");
+  if (!s.includes(".") || !s.split("/")[0].includes(".")) s = `${host2}/${s}`;
+  return /^[a-z0-9.-]+\/[\w.-]+\/[\w.-]+/.test(s) ? s : null;
+}
+function npmRepoOf(doc) {
+  const list = doc?.attestations;
+  if (!Array.isArray(list)) return null;
+  for (const a of list) {
+    const att = a;
+    if (!att.predicateType?.startsWith("https://slsa.dev/provenance/")) continue;
+    const payload = att.bundle?.dsseEnvelope?.payload;
+    if (typeof payload !== "string") continue;
+    try {
+      const statement = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
+      const p = statement.predicate;
+      const repo = p?.buildDefinition?.externalParameters?.workflow?.repository ?? p?.invocation?.configSource?.uri;
+      if (typeof repo === "string") return normalizeRepo(repo);
+    } catch {
+    }
+  }
+  return null;
+}
+function pypiRepoOf(doc) {
+  const bundles = doc?.attestation_bundles;
+  if (!Array.isArray(bundles)) return null;
+  for (const b of bundles) {
+    const pub = b.publisher;
+    if (typeof pub?.repository === "string") {
+      const host2 = /gitlab/i.test(pub.kind ?? "") ? "gitlab.com" : "github.com";
+      return normalizeRepo(pub.repository, host2);
+    }
+    if (/^google$/i.test(pub?.kind ?? "") && typeof pub?.email === "string") {
+      return `google:${pub.email.trim().toLowerCase()}`;
+    }
+  }
+  return null;
+}
+async function npmSourceRepo(name, version) {
+  const base2 = endpoints().npmRegistry;
+  if (!base2) return "unknown";
+  const url = `${base2}/-/npm/v1/attestations/${name.replaceAll("/", "%2F")}@${encodeURIComponent(version)}`;
+  return read(url, npmRepoOf);
+}
+async function read(url, repoOf) {
+  try {
+    const doc = await fetchJson(url, { timeoutMs: TIMEOUT_MS2, maxBytes: MAX_BYTES });
+    if (doc === null) return "none";
+    return repoOf(doc) ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+async function pypiSourceRepo(name, version, filename) {
+  const base2 = endpoints().pypi;
+  if (!base2) return "unknown";
+  const url = `${base2}/integrity/${encodeURIComponent(name)}/${encodeURIComponent(version)}/${encodeURIComponent(filename)}/provenance`;
+  return read(url, pypiRepoOf);
+}
+var PYPI_FINAL = /^\d+(?:\.\d+)*$/;
+function comparePypi(a, b) {
+  const x = a.split(".").map(Number);
+  const y = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(x.length, y.length); i++) {
+    const d = (x[i] ?? 0) - (y[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+function previousRelease(eco, versions, version) {
+  if (eco === "npm") {
+    if (!(0, import_semver.valid)(version)) return void 0;
+    const below2 = versions.filter((v) => (0, import_semver.valid)(v) && !(0, import_semver.prerelease)(v) && (0, import_semver.rcompare)(v, version) > 0);
+    return below2.sort(import_semver.rcompare)[0] ?? null;
+  }
+  if (!PYPI_FINAL.test(version)) return void 0;
+  const below = versions.filter((v) => PYPI_FINAL.test(v) && comparePypi(v, version) < 0);
+  return below.sort((a, b) => comparePypi(b, a))[0] ?? null;
+}
+
+// src/supply-chain/registry.ts
+var TIMEOUT_MS3 = 1500;
+var MAX_BYTES2 = 2 * 1024 * 1024;
 var VERSION_DOC_MAX_BYTES = 256 * 1024;
 var INSTALL_SCRIPTS = ["preinstall", "install", "postinstall"];
 async function npmVersionDocument(url, selector) {
   const doc = await fetchJson(`${url}/${encodeURIComponent(selector)}`, {
-    timeoutMs: TIMEOUT_MS2,
+    timeoutMs: TIMEOUT_MS3,
     maxBytes: VERSION_DOC_MAX_BYTES
   });
   if (!doc?.version) return null;
@@ -18461,16 +19855,16 @@ async function npmInfo(name, version, freshWindowMs, raw) {
   let doc;
   try {
     doc = await fetchJson(url, {
-      timeoutMs: TIMEOUT_MS2,
-      maxBytes: MAX_BYTES,
+      timeoutMs: TIMEOUT_MS3,
+      maxBytes: MAX_BYTES2,
       headers: { Accept: "application/vnd.npm.install-v1+json" }
     });
   } catch (err) {
     if (!/too large/.test(err.message)) throw err;
-    const range = !version && spec && (0, import_semver.validRange)(spec) ? spec : null;
+    const range = !version && spec && (0, import_semver2.validRange)(spec) ? spec : null;
     const selector = version ?? (spec && !range ? spec : "latest");
     const info2 = await npmVersionDocument(url, selector);
-    if (info2 && range && !(0, import_semver.satisfies)(info2.version, range)) return null;
+    if (info2 && range && !(0, import_semver2.satisfies)(info2.version, range)) return null;
     return info2;
   }
   if (!doc) return null;
@@ -18479,8 +19873,8 @@ async function npmInfo(name, version, freshWindowMs, raw) {
   if (!resolved) {
     if (!spec) resolved = latest;
     else if (doc["dist-tags"]?.[spec]) resolved = doc["dist-tags"][spec];
-    else if ((0, import_semver.validRange)(spec)) {
-      resolved = latest && (0, import_semver.satisfies)(latest, spec) ? latest : (0, import_semver.maxSatisfying)(Object.keys(doc.versions ?? {}), spec) ?? void 0;
+    else if ((0, import_semver2.validRange)(spec)) {
+      resolved = latest && (0, import_semver2.satisfies)(latest, spec) ? latest : (0, import_semver2.maxSatisfying)(Object.keys(doc.versions ?? {}), spec) ?? void 0;
     }
   }
   if (!resolved) return null;
@@ -18490,13 +19884,23 @@ async function npmInfo(name, version, freshWindowMs, raw) {
     version: resolved,
     hasInstallScript: v?.hasInstallScript === true
   };
+  const previous = previousRelease("npm", Object.keys(doc.versions ?? {}), resolved);
+  if (v && previous !== void 0) {
+    const pv = previous ? doc.versions?.[previous] : void 0;
+    info.history = {
+      previous,
+      previousHasInstallScript: pv ? pv.hasInstallScript === true : void 0,
+      provenance: !!v.dist?.attestations?.provenance,
+      previousProvenance: pv ? !!pv.dist?.attestations?.provenance : void 0
+    };
+  }
   if (!Number.isFinite(modifiedMs)) return info;
   if (Date.now() - modifiedMs >= freshWindowMs) {
     info.publishedAtMs = resolved === latest ? modifiedMs : void 0;
     return info;
   }
   try {
-    const full = await fetchJson(url, { timeoutMs: TIMEOUT_MS2, maxBytes: MAX_BYTES });
+    const full = await fetchJson(url, { timeoutMs: TIMEOUT_MS3, maxBytes: MAX_BYTES2 });
     const t = full?.time?.[resolved];
     const tMs = t ? Date.parse(t) : NaN;
     if (Number.isFinite(tMs)) {
@@ -18514,15 +19918,37 @@ async function pypiInfo(name, version) {
   const base2 = endpoints().pypi;
   if (!base2) return null;
   const url = version ? `${base2}/pypi/${encodeURIComponent(name)}/${encodeURIComponent(version)}/json` : `${base2}/pypi/${encodeURIComponent(name)}/json`;
-  const doc = await fetchJson(url, { timeoutMs: TIMEOUT_MS2, maxBytes: MAX_BYTES });
+  const doc = await fetchJson(url, { timeoutMs: TIMEOUT_MS3, maxBytes: MAX_BYTES2 });
   if (!doc?.info?.version) return null;
   const times = (doc.urls ?? []).map((u) => u.upload_time_iso_8601 ? Date.parse(u.upload_time_iso_8601) : NaN).filter((t) => Number.isFinite(t));
-  return {
-    version: version ?? doc.info.version,
+  const resolved = version ?? doc.info.version;
+  const info = {
+    version: resolved,
     // The earliest file of the release is when it became installable.
-    publishedAtMs: times.length > 0 ? Math.min(...times) : void 0
+    publishedAtMs: times.length > 0 ? Math.min(...times) : void 0,
+    file: doc.urls?.find((u) => typeof u.filename === "string")?.filename
+  };
+  if (doc.releases) info.history = pypiHistoryOf(doc.releases, resolved) ?? void 0;
+  return info;
+}
+function pypiHistoryOf(releases, version) {
+  const versions = Object.keys(releases).filter((v) => (releases[v] ?? []).length > 0);
+  const previous = previousRelease("PyPI", versions, version);
+  if (previous === void 0) return null;
+  return {
+    previous,
+    previousFile: previous ? releases[previous]?.find((f) => typeof f.filename === "string")?.filename : void 0
   };
 }
+async function pypiHistory(name, version) {
+  const base2 = endpoints().pypi;
+  if (!base2) return null;
+  const doc = await fetchJson(`${base2}/pypi/${encodeURIComponent(name)}/json`, {
+    timeoutMs: TIMEOUT_MS3,
+    maxBytes: MAX_BYTES2
+  });
+  return doc?.releases ? pypiHistoryOf(doc.releases, version) : null;
+}
 var HAS_REGISTRY_CLIENT = /* @__PURE__ */ new Set(["npm", "PyPI"]);
 async function registryInfo(eco, name, version, freshWindowMs, raw) {
   if (eco === "npm") return npmInfo(name, version, freshWindowMs, raw);
@@ -18531,19 +19957,19 @@ async function registryInfo(eco, name, version, freshWindowMs, raw) {
 }
 
 // src/supply-chain/local-resolve.ts
-var import_fs25 = __toESM(require("fs"));
-var import_path25 = __toESM(require("path"));
+var import_fs26 = __toESM(require("fs"));
+var import_path26 = __toESM(require("path"));
 var MAX_LEVELS = 32;
 var LOCAL_FIRST_MANAGERS = /* @__PURE__ */ new Set(["npx", "bunx", "npm exec"]);
 function resolveInstalled(name, cwd) {
-  if (!cwd || !import_path25.default.isAbsolute(cwd)) return null;
+  if (!cwd || !import_path26.default.isAbsolute(cwd)) return null;
   if (!/^(?:@[^/\\]+\/)?[^/\\]+$/.test(name)) return null;
-  let dir2 = import_path25.default.resolve(cwd);
+  let dir2 = import_path26.default.resolve(cwd);
   for (let i = 0; i < MAX_LEVELS; i++) {
-    const pkgDir = import_path25.default.join(dir2, "node_modules", ...name.split("/"));
-    const manifest = import_path25.default.join(pkgDir, "package.json");
+    const pkgDir = import_path26.default.join(dir2, "node_modules", ...name.split("/"));
+    const manifest = import_path26.default.join(pkgDir, "package.json");
     try {
-      const raw = import_fs25.default.readFileSync(manifest, "utf8");
+      const raw = import_fs26.default.readFileSync(manifest, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
         return { version: parsed.version, dir: pkgDir };
@@ -18551,7 +19977,7 @@ function resolveInstalled(name, cwd) {
       return null;
     } catch {
     }
-    const parent = import_path25.default.dirname(dir2);
+    const parent = import_path26.default.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -18673,7 +20099,7 @@ function checkInstalled(p, version, misses) {
 }
 async function checkOne(p, cfg, misses, networkCapped, cwd) {
   if (p.ecosystem === "npm" && LOCAL_FIRST_MANAGERS.has(p.manager) && p.localCwd !== null && (p.raw === p.name || p.version)) {
-    const localCwd = cwd && import_path26.default.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => import_path26.default.resolve(dir2, step), cwd) : void 0;
+    const localCwd = cwd && import_path27.default.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => import_path27.default.resolve(dir2, step), cwd) : void 0;
     const installed = resolveInstalled(p.name, localCwd);
     if (installed && (!p.version || p.version === installed.version))
       return checkInstalled(p, installed.version, misses);
@@ -18716,8 +20142,61 @@ async function checkOne(p, cfg, misses, networkCapped, cwd) {
       detail: `${label(p, version)} runs an install script`
     });
   }
+  if (info && version && (cfg.newPackage !== "off" || cfg.installScript !== "off")) {
+    return byHistory(p, version, info, findings, misses);
+  }
   return findings;
 }
+var SOFT = /* @__PURE__ */ new Set(["new", "install-script"]);
+async function byHistory(p, version, info, findings, misses) {
+  let out = findings;
+  let h = info.history;
+  if (!h && p.ecosystem === "PyPI" && out.some((f) => SOFT.has(f.kind))) {
+    try {
+      h = await pypiHistory(p.name, version) ?? void 0;
+    } catch (err) {
+      misses.push(`${label(p, version)}: release history ${err.message}`);
+    }
+  }
+  if (!h || !h.previous) return out;
+  const previous = h.previous;
+  if (h.previousHasInstallScript === true) {
+    out = out.filter((f) => f.kind !== "install-script");
+  }
+  const drop = () => ({
+    pkg: p,
+    version,
+    kind: "provenance-drop",
+    detail: `${label(p, version)} was published without the provenance its previous release (${previous}) had`
+  });
+  if (p.ecosystem === "npm") {
+    if (h.previousProvenance && h.provenance === false) return [...out, drop()];
+    if (!out.some((f) => SOFT.has(f.kind)) || !h.provenance || !h.previousProvenance) return out;
+    const [now, before] = await Promise.all([
+      npmSourceRepo(p.name, version),
+      npmSourceRepo(p.name, previous)
+    ]);
+    return vouched(p, version, now, before, out, misses);
+  }
+  if (p.ecosystem === "PyPI") {
+    if (!out.some((f) => SOFT.has(f.kind)) || !info.file || !h.previousFile) return out;
+    const [now, before] = await Promise.all([
+      pypiSourceRepo(p.name, version, info.file),
+      pypiSourceRepo(p.name, previous, h.previousFile)
+    ]);
+    if (now === "none" && before !== "none" && before !== "unknown") return [...out, drop()];
+    return vouched(p, version, now, before, out, misses);
+  }
+  return out;
+}
+function vouched(p, version, now, before, findings, misses) {
+  if (now === "unknown" || before === "unknown") {
+    misses.push(`${label(p, version)}: provenance unreadable, findings kept`);
+    return findings;
+  }
+  if (now === "none" || before === "none" || now !== before) return findings;
+  return findings.filter((f) => !SOFT.has(f.kind));
+}
 async function runPackageCheck(toolName, args, cfg, cwd) {
   if (!cfg.enabled) return ALLOW;
   try {
@@ -19100,7 +20579,14 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       fileAccess,
       config,
       skipIgnoredFastPath,
-      argumentScan: argScan
+      argumentScan: argScan,
+      // A server a person linked to an app is judged as that app (fw#390).
+      mcpServer: resolveLinkedServer(meta?.mcpServer, {
+        serverKey: meta?.serverKey,
+        managedLinks: config.policy.appLinks,
+        appliedShields: config.policy.appliedShields,
+        workspaceGoverned: config.policySource === "workspace"
+      })
     });
     if (!sessionScript || own.decision === "block") return own;
     const inner = await evaluatePolicy2("Bash", sessionScript.args, meta?.agent, options?.cwd, {
@@ -19316,7 +20802,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         const last = rec.sources[rec.sources.length - 1];
         const readWord = last ? last.word ?? sourceWord(last.tool) : "content";
         const when = last ? new Date(last.at).toTimeString().slice(0, 5) : "";
-        const read = last ? `${/^[aeiou]/i.test(readWord) ? "an" : "a"} ${readWord}` + (last.server ? ` through ${last.server}` : "") + (when ? ` at ${when}` : "") : "outside content";
+        const read2 = last ? `${/^[aeiou]/i.test(readWord) ? "an" : "a"} ${readWord}` + (last.server ? ` through ${last.server}` : "") + (when ? ` at ${when}` : "") : "outside content";
         if ((held.length > 0 || writeHolds.length > 0) && ucPolicy.afterExposure !== "log-only") {
           const noun = (d) => {
             const k = destinationKind(d);
@@ -19325,14 +20811,14 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           const parts = held.map(
             (h) => h.dest ? `sends to ${destinationValue(h.dest)}, ${h.why === "appeared in what was read" ? `${noun(h.dest)} that appeared in that ${last ? readWord : "content"}` : `${noun(h.dest)} this session did not know`}` : h.why === "repository" ? h.repo.endsWith("/*") ? `sends to a repository on ${h.repo.slice(0, -2)} it does not name (a gist, a new repository or an API call)` : `sends to ${h.repo}, a repository that is not one of this project's remotes` : h.why === "unresolved" ? "sends to a destination this session cannot see (built at run time, or a remote of another repository)" : `is ${bare}, a destructive call, with no known destination`
           );
-          const home = import_os19.default.homedir();
+          const home = import_os20.default.homedir();
           const short = (p) => p.startsWith(home + "/") ? "~" + p.slice(home.length) : p;
           for (const w of writeHolds) {
             parts.push(
               w.why === "outside-project" ? `writes outside the project, to ${short(w.path)}` : w.why === "agent-instruction" ? `writes to ${short(w.path)}, a file that runs code or instructs the agent` : `writes content carrying ${destinationValue(w.destination ?? "")}, ${noun(w.destination ?? "host:x")} that appeared in that ${readWord}`
             );
           }
-          exposureReview = `\u{1F6E1}\uFE0F Node9: this session read ${read}. This call ${parts.join("; and ")}.`;
+          exposureReview = `\u{1F6E1}\uFE0F Node9: this session read ${read2}. This call ${parts.join("; and ")}.`;
           exposureFromEid = last?.eid;
           if (exposureFromEid) exposureMeta = { exposureFromEid };
           exposureKeys = [