@node9/proxy 2.37.1 → 2.39.0

package/dist/dashboard.mjs

@@ -104,13 +104,99 @@ import picomatch from "picomatch";
 import safeRegex from "safe-regex2";
 import pm from "picomatch";
 import mvdanSh from "mvdan-sh";
-import safeRegex2 from "safe-regex2";
 import mvdanSh2 from "mvdan-sh";
-import safeRegex3 from "safe-regex2";
+import safeRegex2 from "safe-regex2";
 import { createHash as createHash2 } from "crypto";
 import mvdanSh3 from "mvdan-sh";
 import { createHash as createHash3 } from "crypto";
 import mvdanSh4 from "mvdan-sh";
+function validateRegex(pattern) {
+  if (!pattern) return "Pattern is required";
+  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return `Invalid regex syntax: ${e.message}`;
+  }
+  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
+  if (!safeRegex(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
+  return null;
+}
+function getCompiledRegex(pattern, flags = "") {
+  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
+  const key = `${pattern}\0${flags}`;
+  if (regexCache.has(key)) {
+    const cached = regexCache.get(key);
+    regexCache.delete(key);
+    regexCache.set(key, cached);
+    return cached;
+  }
+  if (validateRegex(pattern) !== null) return null;
+  try {
+    const re = new RegExp(pattern, flags);
+    if (regexCache.size >= REGEX_CACHE_MAX) {
+      const oldest = regexCache.keys().next().value;
+      if (oldest) regexCache.delete(oldest);
+    }
+    regexCache.set(key, re);
+    return re;
+  } catch {
+    return null;
+  }
+}
+function isToolRule(rule) {
+  return rule.tool.startsWith("{,mcp__*__}");
+}
+function actionPart(ruleName) {
+  const m = /^shield:[^:]+:(.+)$/.exec(ruleName ?? "");
+  return m ? m[1] : ruleName ?? "rule";
+}
+function ownReason(reason, owner) {
+  if (!reason) return reason;
+  return reason.replace(/\((?:Finance|Identity|Publishing) shield\)\.?$/, `(${owner}).`);
+}
+function buildAppShield(spec) {
+  const owner = spec.label;
+  const toolRules = ACTION_TEMPLATES[spec.template].filter(isToolRule).map((rule) => ({
+    ...rule,
+    name: `shield:${spec.name}:${actionPart(rule.name)}`,
+    server: spec.server,
+    reason: ownReason(rule.reason, owner)
+  }));
+  const ownTools = (spec.mcpTools ?? []).map((rule) => ({
+    ...rule,
+    server: spec.server
+  }));
+  return {
+    name: spec.name,
+    description: spec.description,
+    aliases: [],
+    smartRules: [...toolRules, ...ownTools, ...spec.doors],
+    dangerousWords: []
+  };
+}
+function buildGeneralRules() {
+  const out = [];
+  for (const name of Object.keys(ACTION_TEMPLATES)) {
+    const { slug: slug2, label } = ACTION_CHECKS[name];
+    for (const rule of ACTION_TEMPLATES[name].filter(isToolRule)) {
+      const part = actionPart(rule.name).replace(/^review-/, "");
+      out.push({
+        ...rule,
+        name: `review-action-${slug2}-${part}`,
+        notServer: APP_SERVER_GLOB,
+        reason: ownReason(rule.reason, label)
+      });
+    }
+  }
+  return out;
+}
+function generalActionRuleNames(template) {
+  const { slug: slug2 } = ACTION_CHECKS[template];
+  return GENERAL_ACTION_RULES.filter((r) => r.name?.startsWith(`review-action-${slug2}-`)).map(
+    (r) => r.name
+  );
+}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -148,16 +234,25 @@ function validateOverrides(raw) {
   return { overrides: result, warnings };
 }
 function assertBuiltinShieldRegexesAreSafe() {
-  for (const shield of Object.values(BUILTIN_SHIELDS)) {
+  const sets = [
+    ...Object.values(BUILTIN_SHIELDS).map((sh) => ({
+      name: sh.name,
+      smartRules: sh.smartRules
+    })),
+    ...Object.entries(ACTION_TEMPLATES).map(([name, smartRules]) => ({ name, smartRules })),
+    { name: "general-action-checks", smartRules: GENERAL_ACTION_RULES }
+  ];
+  for (const shield of sets) {
     for (const rule of shield.smartRules) {
       const conditions = rule.conditions ?? [];
       for (const cond of conditions) {
         if (cond.op !== "matches" && cond.op !== "notMatches") continue;
         const pattern = cond.value;
         if (!pattern) continue;
-        if (!safeRegex(pattern)) {
+        const problem = validateRegex(pattern);
+        if (problem) {
           throw new Error(
-            `[node9 engine] Shield '${shield.name}' rule '${rule.name ?? rule.tool}' has unsafe regex: ${pattern}`
+            `[node9 engine] Shield '${shield.name}' rule '${rule.name ?? rule.tool}' has a regex the runtime refuses (${problem}): ${pattern}`
           );
         }
       }
@@ -320,6 +415,28 @@ function classifySsrf(host2) {
     return null;
   }
 }
+function isModeValue(v) {
+  return typeof v === "string" && MODE_VALUES.includes(v);
+}
+function levelOf(mode) {
+  if (mode === "observe") return "audit";
+  return LEVELS.includes(mode ?? "") ? mode : "standard";
+}
+function isRecordOnly(mode) {
+  return levelOf(mode) === "audit";
+}
+function isBlockAll(mode) {
+  return levelOf(mode) === "block-all";
+}
+function levelCheckValue(mode, id) {
+  return LEVEL_CHECKS[levelOf(mode)][id];
+}
+function levelChecks(mode) {
+  return LEVEL_CHECKS[levelOf(mode)];
+}
+function levelPackageSignals(mode) {
+  return levelOf(mode) === "soft" ? { newPackage: "off", installScript: "off" } : void 0;
+}
 function isVerdict(v) {
   return v === "off" || v === "log" || v === "review" || v === "block";
 }
@@ -393,19 +510,21 @@ function resolveCheck(settings, id) {
   if (!def) return void 0;
   if (isLockedCheck(def)) return { id, value: "block", source: "locked" };
   const floor = def.floor ? CHECK_VERDICT_RANK[def.floor] : 0;
+  const levelDefault = levelCheckValue(settings.mode, id) ?? def.defaultValue;
+  const sourceOf = (value2) => value2 === levelDefault ? "default" : "configured";
   const explicit = settings.checks?.[id];
   if (isVerdict(explicit)) {
     const value2 = CHECK_VERDICT_RANK[explicit] < floor ? def.floor : explicit;
-    return { id, value: value2, source: value2 === def.defaultValue ? "default" : "configured" };
+    return { id, value: value2, source: sourceOf(value2) };
   }
   if (def.pack) {
     const on = settings.appliedShields?.includes(def.pack) ?? false;
     return { id, value: on ? def.defaultValue : "off", source: "default" };
   }
   const read = LEGACY_READERS[id]?.(settings);
-  if (read === void 0) return { id, value: def.defaultValue, source: "default" };
+  if (read === void 0) return { id, value: levelDefault, source: "default" };
   const value = CHECK_VERDICT_RANK[read] < floor ? def.floor : read;
-  return { id, value, source: value === def.defaultValue ? "default" : "configured" };
+  return { id, value, source: sourceOf(value) };
 }
 function checkValue(settings, id) {
   return resolveCheck(settings, id)?.value ?? "off";
@@ -486,6 +605,55 @@ function cachedNormalize(command, compute) {
 function normalizeCommandForPolicy(command) {
   return commandReadingsImpl(command).posix;
 }
+function fileAccessView(command) {
+  const hit = accessViewCache.get(command);
+  if (hit !== void 0) return hit;
+  const view = fileAccessViewImpl(command);
+  if (accessViewCache.size >= ACCESS_VIEW_CACHE_MAX) {
+    const oldest = accessViewCache.keys().next().value;
+    if (oldest !== void 0) accessViewCache.delete(oldest);
+  }
+  accessViewCache.set(command, view);
+  return view;
+}
+function fileAccessViewImpl(command) {
+  const text = command.replace(INTERPRETER_LINE, "");
+  const f = parseShared(text);
+  if (f === PARSE_FAIL) return text;
+  const toCharIndex = byteOffsetToCharIndex(text);
+  const at = (byteOffset) => toCharIndex === null ? byteOffset : toCharIndex(byteOffset);
+  const edits = [];
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const words = args.map((a) => resolveWordLiteral(a));
+      const head = unwrapCommandHead(words);
+      for (const i of /* @__PURE__ */ new Set([0, head])) {
+        const word = words[i];
+        if (i >= args.length || word === null || word === void 0 || !/[\\/]/.test(word)) {
+          continue;
+        }
+        if (!PROGRAM_DIR.test(word)) continue;
+        const name = word.split(/[\\/]/).pop() ?? "";
+        if (!name) continue;
+        const s = at(args[i].Pos().Offset());
+        const e = at(args[i].End().Offset());
+        if (s < 0 || e < 0) continue;
+        edits.push([s, e, name]);
+      }
+      return true;
+    });
+  } catch {
+    return text;
+  }
+  edits.sort((a, b) => b[0] - a[0]);
+  let out = text;
+  for (const [s, e, rep] of edits) out = out.slice(0, s) + rep + out.slice(e);
+  return out;
+}
 function commandReadings(command) {
   const r = commandReadingsImpl(command);
   const out = /* @__PURE__ */ new Set([r.posix, r.separator, r.folded]);
@@ -1728,40 +1896,6 @@ function jailedRedirectRead(stmt) {
   }
   return null;
 }
-function validateRegex(pattern) {
-  if (!pattern) return "Pattern is required";
-  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
-  try {
-    new RegExp(pattern);
-  } catch (e) {
-    return `Invalid regex syntax: ${e.message}`;
-  }
-  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
-  if (!safeRegex2(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
-  return null;
-}
-function getCompiledRegex(pattern, flags = "") {
-  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
-  const key = `${pattern}\0${flags}`;
-  if (regexCache.has(key)) {
-    const cached = regexCache.get(key);
-    regexCache.delete(key);
-    regexCache.set(key, cached);
-    return cached;
-  }
-  if (validateRegex(pattern) !== null) return null;
-  try {
-    const re = new RegExp(pattern, flags);
-    if (regexCache.size >= REGEX_CACHE_MAX) {
-      const oldest = regexCache.keys().next().value;
-      if (oldest) regexCache.delete(oldest);
-    }
-    regexCache.set(key, re);
-    return re;
-  } catch {
-    return null;
-  }
-}
 function matchesPattern(text, patterns) {
   const p = Array.isArray(patterns) ? patterns : [patterns];
   if (p.length === 0) return false;
@@ -1794,23 +1928,26 @@ function evaluateSmartConditions(args, rule) {
     return val;
   };
   const readingsCache = /* @__PURE__ */ new Map();
-  const resolveFieldReadings = (field) => {
-    const cached = readingsCache.get(field);
+  const resolveFieldReadings = (field, reading) => {
+    const access = reading === "access" && field === "command";
+    const key = access ? `${field}\0access` : field;
+    const cached = readingsCache.get(key);
     if (cached) return cached;
     const primary = resolveField(field);
     if (primary === null) {
-      readingsCache.set(field, []);
+      readingsCache.set(key, []);
       return [];
     }
     let out = [primary];
     if (field === "command") {
       const raw = getNestedValue(args, field);
       if (typeof raw === "string") {
-        const collapsed = commandReadings(raw).map((r) => r.replace(/\s+/g, " ").trim());
-        out = [.../* @__PURE__ */ new Set([primary, ...collapsed])];
+        const text = access ? fileAccessView(raw) : raw;
+        const collapsed = commandReadings(text).map((r) => r.replace(/\s+/g, " ").trim());
+        out = access ? [...new Set(collapsed)] : [.../* @__PURE__ */ new Set([primary, ...collapsed])];
       }
     }
-    readingsCache.set(field, out);
+    readingsCache.set(key, out);
     return out;
   };
   const results = rule.conditions.map((cond) => {
@@ -1828,14 +1965,14 @@ function evaluateSmartConditions(args, rule) {
         if (val === null || !cond.value) return false;
         const reM = getCompiledRegex(cond.value, cond.flags ?? "");
         if (!reM) return false;
-        return resolveFieldReadings(cond.field).some((v) => reM.test(v));
+        return resolveFieldReadings(cond.field, cond.reading).some((v) => reM.test(v));
       }
       case "notMatches": {
         if (!cond.value) return false;
         if (val === null) return true;
         const reN = getCompiledRegex(cond.value, cond.flags ?? "");
         if (!reN) return false;
-        return !resolveFieldReadings(cond.field).some((v) => reN.test(v));
+        return !resolveFieldReadings(cond.field, cond.reading).some((v) => reN.test(v));
       }
       case "matchesGlob":
         return val !== null && cond.value ? pm.isMatch(val, cond.value) : false;
@@ -2218,14 +2355,14 @@ function validateOtpSecret(raw) {
 }
 function assertBuiltinPatternsAreSafe() {
   for (const p of DLP_PATTERNS) {
-    if (!safeRegex3(p.regex.source)) {
+    if (!safeRegex2(p.regex.source)) {
       throw new Error(
         `[node9 engine] Builtin DLP pattern '${p.name}' is vulnerable to ReDoS: ${p.regex.source}`
       );
     }
   }
   for (const re of SENSITIVE_PATH_PATTERNS) {
-    if (!safeRegex3(re.source)) {
+    if (!safeRegex2(re.source)) {
       throw new Error(
         `[node9 engine] Builtin sensitive-path pattern is vulnerable to ReDoS: ${re.source}`
       );
@@ -2319,6 +2456,20 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
   }
   return null;
 }
+function tuningFromLegacyPolicy(policy) {
+  const out = {};
+  const p = policy;
+  if (policy.packageCheck?.registrySignals === false) {
+    out["loading.malicious-package"] = { newPackage: "off", installScript: "off" };
+  }
+  for (const f of TUNING_FIELDS) {
+    const [block, key] = f.legacy;
+    const value = p[block]?.[key];
+    if (value === void 0) continue;
+    (out[f.checkId] ??= {})[f.name] = value;
+  }
+  return out;
+}
 function tuningToLegacyPolicy(policy, tuning) {
   const unknown = [];
   for (const [id, fields] of Object.entries(tuning)) {
@@ -2433,6 +2584,25 @@ function checkToLegacyPolicy(policy, id, v) {
       return false;
   }
 }
+function knobStatedChecks(policy) {
+  const out = /* @__PURE__ */ new Set();
+  const has2 = (o, key) => !!o && typeof o === "object" && o[key] !== void 0;
+  const { dlp, egress, loopDetection, injectionScan, skillPinning, packageCheck } = policy;
+  const uc = policy.untrustedContent;
+  if (has2(dlp, "enabled")) out.add("data.secrets");
+  if (has2(dlp, "reviewAction") || dlp?.enabled === false) out.add("data.secrets-weak");
+  if (has2(dlp, "pii")) out.add("data.pii");
+  if (has2(egress, "enabled") || has2(egress, "mode")) out.add("network.unknown-host");
+  if (has2(egress, "ssrfStrict")) out.add("network.internal-addresses");
+  if (has2(loopDetection, "enabled")) out.add("behavior.loops");
+  if (has2(injectionScan, "enabled")) out.add("behavior.prompt-injection");
+  if (has2(skillPinning, "enabled") || has2(skillPinning, "mode")) out.add("loading.skill-tamper");
+  if (has2(packageCheck, "enabled") || has2(packageCheck, "onMalicious"))
+    out.add("loading.malicious-package");
+  if (uc && typeof uc === "object" && (uc.enabled === false || has2(uc, "afterExposure")))
+    out.add("behavior.untrusted-content");
+  return out;
+}
 function isKnobGoverned(id) {
   return id in KNOB_GOVERNED;
 }
@@ -2691,10 +2861,13 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var aws_default, bash_safe_default, docker_default, filesystem_default, finance_default, github_default, identity_default, k8s_default, mongodb_default, postgres_default, project_jail_default, publishing_default, redis_default, BUILTIN_SHIELDS, ACTION_SHIELD_NAMES, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, SYSTEM_DIRS, UPLOAD_SYSTEM_DIRS, LEGACY_SYSTEM_PATH_RE, BIP39_ENGLISH, indices, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, EDITOR_HEADS, MANAGER_HEADS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, MASKED_KINDS, ENTRY_RE, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, SYSTEM_DIRS, UPLOAD_SYSTEM_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, WRITES, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, BIP39_ENGLISH, indices, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax3, EDITOR_HEADS, MANAGER_HEADS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, SOURCE_COMMANDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, MASKED_KINDS, ENTRY_RE, syntax4, PUBLISH, OWN_HEADS, TERMINAL_ESCAPE_RE, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
+    MAX_REGEX_LENGTH = 256;
+    REGEX_CACHE_MAX = 500;
+    regexCache = /* @__PURE__ */ new Map();
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -2996,77 +3169,6 @@ var init_dist = __esm({
       ],
       dangerousWords: ["wipefs"]
     };
-    finance_default = {
-      name: "finance",
-      description: "Asks before money moves through a payment or banking app (refunds, payouts, transfers, charges, invoices), whatever the request said. Reads are never asked about.",
-      aliases: ["payments", "money"],
-      smartRules: [
-        {
-          name: "shield:finance:review-refund",
-          tool: "{,mcp__*__}{create_refund,refund_payment,refund_charge,refund_order,issue_refund}",
-          conditions: [],
-          verdict: "review",
-          reason: "A refund returns money to a customer. node9 asks before money moves, whatever the request said (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-payout",
-          tool: "{,mcp__*__}{create_payout,send_payout,payout,create_payouts_batch}",
-          conditions: [],
-          verdict: "review",
-          reason: "A payout moves the balance to a bank account. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-transfer",
-          tool: "{,mcp__*__}{transfer_create,transfer_authorization_create,create_transfer,transfer_money,transfer_funds,send_money,wire_transfer,create_wire,schedule_transaction,update_scheduled_transaction,create_transaction}",
-          conditions: [],
-          verdict: "review",
-          reason: "A transfer moves money between accounts. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-charge",
-          tool: "{,mcp__*__}{create_payment_intent,confirm_payment_intent,capture_payment_intent,create_charge,create_payment,capture_payment,capture_order,create_order,authorize_order,create_checkout_session}",
-          conditions: [],
-          verdict: "review",
-          reason: "This charges a card or captures a payment. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-payment-link",
-          tool: "{,mcp__*__}{create_payment_link,create_invoice,finalize_invoice,send_invoice,pay_invoice,create_invoice_item}",
-          conditions: [],
-          verdict: "review",
-          reason: "This bills someone or creates a link that charges a card. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-subscription",
-          tool: "{,mcp__*__}{create_subscription,cancel_subscription,update_subscription,pause_subscription,resume_subscription}",
-          conditions: [],
-          verdict: "review",
-          reason: "A subscription starts or stops recurring charges. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-dispute",
-          tool: "{,mcp__*__}{update_dispute,accept_dispute,close_dispute}",
-          conditions: [],
-          verdict: "review",
-          reason: "This answers or concedes a chargeback. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-card",
-          tool: "{,mcp__*__}{issue_card,create_virtual_card,create_issuing_card,update_card_limit}",
-          conditions: [],
-          verdict: "review",
-          reason: "This issues a card or changes its limit. node9 asks before money moves (Finance shield)."
-        },
-        {
-          name: "shield:finance:review-withdraw",
-          tool: "{,mcp__*__}{withdraw,withdraw_funds,create_withdrawal,request_withdrawal}",
-          conditions: [],
-          verdict: "review",
-          reason: "A withdrawal moves money out. node9 asks before money moves (Finance shield)."
-        }
-      ],
-      dangerousWords: []
-    };
     github_default = {
       name: "github",
       description: "Protects GitHub repositories from destructive AI operations",
@@ -3093,56 +3195,6 @@ var init_dist = __esm({
       ],
       dangerousWords: []
     };
-    identity_default = {
-      name: "identity",
-      description: "Asks before a password, a key, a token, a role or a user changes in an identity or admin app, whatever the request said. Reads are never asked about.",
-      aliases: ["access", "iam"],
-      smartRules: [
-        {
-          name: "shield:identity:review-password",
-          tool: "{,mcp__*__}{change_password,update_password,reset_password,set_password,expire_password,force_password_reset}",
-          conditions: [],
-          verdict: "review",
-          reason: "This changes or resets a password. node9 asks before credentials change, whatever the request said (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-key",
-          tool: "{,mcp__*__}{rotate_key,rotate_api_key,create_api_key,create_token,create_access_token,create_personal_access_token,regenerate_secret,rotate_secret,create_service_account_key,create_credential}",
-          conditions: [],
-          verdict: "review",
-          reason: "This creates or rotates a key, token or secret. node9 asks before credentials change (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-access",
-          tool: "{,mcp__*__}{grant_access,grant_permission,grant_role,revoke_access,revoke_permission,revoke_role,revoke_token,set_permission,set_permissions,set_role,assign_role,update_role,add_permission,remove_permission,attach_policy,detach_policy}",
-          conditions: [],
-          verdict: "review",
-          reason: "This grants or revokes access. node9 asks before access changes (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-membership",
-          tool: "{,mcp__*__}{add_member,remove_member,add_user_to_group,remove_user_from_group,add_collaborator,remove_collaborator,invite_user,invite_member,invite_user_to_slack,invite_users,add_org_member,remove_org_member,add_team_member,remove_team_member}",
-          conditions: [],
-          verdict: "review",
-          reason: "This changes who belongs where. node9 asks before membership changes (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-user",
-          tool: "{,mcp__*__}{create_user,delete_user,deactivate_user,suspend_user,activate_user,unlock_user,make_admin,promote_user,demote_user,update_user_role}",
-          conditions: [],
-          verdict: "review",
-          reason: "This creates, removes or promotes an account. node9 asks before accounts change (Identity shield)."
-        },
-        {
-          name: "shield:identity:review-mfa",
-          tool: "{,mcp__*__}{reset_mfa,reset_factors,disable_mfa,enroll_factor,deactivate_factor}",
-          conditions: [],
-          verdict: "review",
-          reason: "This changes a second factor. node9 asks before credentials change (Identity shield)."
-        }
-      ],
-      dangerousWords: []
-    };
     k8s_default = {
       name: "k8s",
       description: "Protects Kubernetes clusters from destructive AI operations",
@@ -3395,7 +3447,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+              value: "(cat|less|head|tail|bat|more|open|print|nano|vim?|emacs|code|type|[ef]?grep|rg|ag|ack|g?awk|sed|cut|tr|[jy]q|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development)){0,2}(?=[\\s;&|>)<]|$)",
               flags: "i"
             }
           ],
@@ -3409,7 +3461,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+              value: "(cat|less|head|tail|bat|more|open|print|nano|vim?|emacs|code|type|[ef]?grep|rg|ag|ack|g?awk|sed|cut|tr|[jy]q|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
               flags: "i"
             }
           ],
@@ -3475,15 +3527,215 @@ var init_dist = __esm({
       ],
       dangerousWords: []
     };
-    publishing_default = {
-      name: "publishing",
-      description: "Asks before something goes public or ships outside the organisation (a release, a package, a deploy, a post), whatever the request said. The same switch covers the shell commands that publish.",
-      aliases: ["release", "deploy"],
+    redis_default = {
+      name: "redis",
+      description: "Protects Redis instances from destructive AI operations",
+      aliases: [],
+      _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
       smartRules: [
         {
-          name: "shield:publishing:review-release",
-          tool: "{,mcp__*__}{create_release,publish_release,create_tag_release,update_release,promote_release}",
-          conditions: [],
+          name: "shield:redis:block-flushall",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
+              flags: "i"
+            }
+          ],
+          verdict: "block",
+          reason: "FLUSHALL deletes every key in every database \u2014 blocked by Redis shield"
+        },
+        {
+          name: "shield:redis:block-flushdb",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
+              flags: "i"
+            }
+          ],
+          verdict: "block",
+          reason: "FLUSHDB deletes all keys in the current database \u2014 blocked by Redis shield"
+        },
+        {
+          name: "shield:redis:block-config-resetstat",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
+              flags: "i"
+            }
+          ],
+          verdict: "block",
+          reason: "CONFIG RESETSTAT resets server statistics irreversibly \u2014 blocked by Redis shield"
+        },
+        {
+          name: "shield:redis:review-config-set",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
+        },
+        {
+          name: "shield:redis:review-del-wildcard",
+          tool: "*",
+          conditions: [
+            {
+              field: "command",
+              op: "matches",
+              value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
+              flags: "i"
+            }
+          ],
+          verdict: "review",
+          reason: "Wildcard key deletion requires human approval (Redis shield)"
+        }
+      ],
+      dangerousWords: ["FLUSHALL", "FLUSHDB"]
+    };
+    finance_default = {
+      name: "finance",
+      description: "Asks before money moves through a payment or banking app (refunds, payouts, transfers, charges, invoices), whatever the request said. Reads are never asked about.",
+      aliases: ["payments", "money"],
+      smartRules: [
+        {
+          name: "shield:finance:review-refund",
+          tool: "{,mcp__*__}{create_refund,refund_payment,refund_charge,refund_order,issue_refund}",
+          conditions: [],
+          verdict: "review",
+          reason: "A refund returns money to a customer. node9 asks before money moves, whatever the request said (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-payout",
+          tool: "{,mcp__*__}{create_payout,send_payout,payout,create_payouts_batch}",
+          conditions: [],
+          verdict: "review",
+          reason: "A payout moves the balance to a bank account. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-transfer",
+          tool: "{,mcp__*__}{transfer_create,transfer_authorization_create,create_transfer,transfer_money,transfer_funds,send_money,wire_transfer,create_wire,schedule_transaction,update_scheduled_transaction}",
+          conditions: [],
+          verdict: "review",
+          reason: "A transfer moves money between accounts. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-charge",
+          tool: "{,mcp__*__}{create_payment_intent,confirm_payment_intent,capture_payment_intent,create_charge,create_payment,capture_payment,capture_order,create_order,authorize_order,create_checkout_session}",
+          conditions: [],
+          verdict: "review",
+          reason: "This charges a card or captures a payment. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-payment-link",
+          tool: "{,mcp__*__}{create_payment_link,create_invoice,finalize_invoice,send_invoice,pay_invoice,create_invoice_item}",
+          conditions: [],
+          verdict: "review",
+          reason: "This bills someone or creates a link that charges a card. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-subscription",
+          tool: "{,mcp__*__}{create_subscription,cancel_subscription,update_subscription,pause_subscription,resume_subscription}",
+          conditions: [],
+          verdict: "review",
+          reason: "A subscription starts or stops recurring charges. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-dispute",
+          tool: "{,mcp__*__}{update_dispute,accept_dispute,close_dispute}",
+          conditions: [],
+          verdict: "review",
+          reason: "This answers or concedes a chargeback. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-card",
+          tool: "{,mcp__*__}{issue_card,create_virtual_card,create_issuing_card,update_card_limit}",
+          conditions: [],
+          verdict: "review",
+          reason: "This issues a card or changes its limit. node9 asks before money moves (Finance shield)."
+        },
+        {
+          name: "shield:finance:review-withdraw",
+          tool: "{,mcp__*__}{withdraw,withdraw_funds,create_withdrawal,request_withdrawal}",
+          conditions: [],
+          verdict: "review",
+          reason: "A withdrawal moves money out. node9 asks before money moves (Finance shield)."
+        }
+      ],
+      dangerousWords: []
+    };
+    identity_default = {
+      name: "identity",
+      description: "Asks before a password, a key, a token, a role or a user changes in an identity or admin app, whatever the request said. Reads are never asked about.",
+      aliases: ["access", "iam"],
+      smartRules: [
+        {
+          name: "shield:identity:review-password",
+          tool: "{,mcp__*__}{change_password,update_password,reset_password,set_password,expire_password,force_password_reset}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes or resets a password. node9 asks before credentials change, whatever the request said (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-key",
+          tool: "{,mcp__*__}{rotate_key,rotate_api_key,create_api_key,create_token,create_access_token,create_personal_access_token,regenerate_secret,rotate_secret,create_service_account_key,create_credential}",
+          conditions: [],
+          verdict: "review",
+          reason: "This creates or rotates a key, token or secret. node9 asks before credentials change (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-access",
+          tool: "{,mcp__*__}{grant_access,grant_permission,grant_role,revoke_access,revoke_permission,revoke_role,revoke_token,set_permission,set_permissions,set_role,assign_role,update_role,add_permission,remove_permission,attach_policy,detach_policy,share_file}",
+          conditions: [],
+          verdict: "review",
+          reason: "This grants or revokes access. node9 asks before access changes (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-membership",
+          tool: "{,mcp__*__}{add_member,remove_member,add_user_to_group,remove_user_from_group,add_collaborator,remove_collaborator,invite_user,invite_member,invite_user_to_slack,invite_users,add_org_member,remove_org_member,add_team_member,remove_team_member,add_user_to_channel,remove_user_from_slack}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes who belongs where. node9 asks before membership changes (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-user",
+          tool: "{,mcp__*__}{create_user,delete_user,delete_deactivated_user,deactivate_user,suspend_user,activate_user,unlock_user,make_admin,promote_user,demote_user,update_user_role}",
+          conditions: [],
+          verdict: "review",
+          reason: "This creates, removes or promotes an account. node9 asks before accounts change (Identity shield)."
+        },
+        {
+          name: "shield:identity:review-mfa",
+          tool: "{,mcp__*__}{reset_mfa,reset_factors,disable_mfa,enroll_factor,deactivate_factor}",
+          conditions: [],
+          verdict: "review",
+          reason: "This changes a second factor. node9 asks before credentials change (Identity shield)."
+        }
+      ],
+      dangerousWords: []
+    };
+    publishing_default = {
+      name: "publishing",
+      description: "Asks before something goes public or ships outside the organisation (a release, a package, a deploy, a post), whatever the request said. The same switch covers the shell commands that publish.",
+      aliases: ["release", "deploy"],
+      smartRules: [
+        {
+          name: "shield:publishing:review-release",
+          tool: "{,mcp__*__}{create_release,publish_release,create_tag_release,update_release,promote_release}",
+          conditions: [],
           verdict: "review",
           reason: "A release ships code to everyone who installs it. node9 asks before publishing, whatever the request said (Publishing shield)."
         },
@@ -3644,109 +3896,511 @@ var init_dist = __esm({
       ],
       dangerousWords: []
     };
-    redis_default = {
-      name: "redis",
-      description: "Protects Redis instances from destructive AI operations",
-      aliases: [],
-      _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
-      smartRules: [
-        {
-          name: "shield:redis:block-flushall",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
-              flags: "i"
-            }
-          ],
-          verdict: "block",
-          reason: "FLUSHALL deletes every key in every database \u2014 blocked by Redis shield"
-        },
-        {
-          name: "shield:redis:block-flushdb",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
-              flags: "i"
-            }
-          ],
-          verdict: "block",
-          reason: "FLUSHDB deletes all keys in the current database \u2014 blocked by Redis shield"
-        },
-        {
-          name: "shield:redis:block-config-resetstat",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
-              flags: "i"
-            }
-          ],
-          verdict: "block",
-          reason: "CONFIG RESETSTAT resets server statistics irreversibly \u2014 blocked by Redis shield"
-        },
-        {
-          name: "shield:redis:review-config-set",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
-              flags: "i"
-            }
-          ],
-          verdict: "review",
-          reason: "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
-        },
-        {
-          name: "shield:redis:review-del-wildcard",
-          tool: "*",
-          conditions: [
-            {
-              field: "command",
-              op: "matches",
-              value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
-              flags: "i"
-            }
-          ],
-          verdict: "review",
-          reason: "Wildcard key deletion requires human approval (Redis shield)"
-        }
-      ],
-      dangerousWords: ["FLUSHALL", "FLUSHDB"]
+    ACTION_TEMPLATES = {
+      finance: finance_default.smartRules,
+      identity: identity_default.smartRules,
+      publishing: publishing_default.smartRules
+    };
+    ACTION_CHECKS = {
+      finance: { checkId: "actions.money", slug: "money", label: "Money check" },
+      identity: { checkId: "actions.access", slug: "access", label: "Accounts and access check" },
+      publishing: { checkId: "actions.publish", slug: "publish", label: "Publishing check" }
+    };
+    GAP = "[^;&|]{0,200}?";
+    prog = (alt) => `(?:^|[^\\w-])(?:${alt})(?![\\w-])`;
+    httpTo = (host2) => prog("curl|wget|http|https|xh") + "[^;&|]{0,400}?" + host2;
+    httpWrite = (methods) => ({
+      field: "command",
+      op: "matches",
+      value: `-X\\s*(?:${methods})|--(?:request|method)[=\\s]+(?:${methods})|--post-(?:data|file)|\\s(?:${methods}|${methods.toLowerCase()})\\s|^(?!.*\\s(?:-[a-zA-Z]*G|--get)(?![\\w-])).*(?:\\s-d[\\s'"@]|\\s--data|\\s--json\\s|\\s-F\\s|\\s--form\\s)`
+    });
+    HTTP_WRITE = httpWrite("POST|DELETE");
+    HTTP_WRITE_ANY = httpWrite("POST|PUT|PATCH|DELETE");
+    NOT_STRIPE_TEST = {
+      field: "command",
+      op: "notMatches",
+      value: "\\b[sr]k_test_"
     };
+    postTo = (host2) => `\\.post\\(\\s*["'\`][^"'\`]{0,80}${host2}`;
+    STRIPE_OBJECTS = "refunds|payouts|charges|transfers|payment_intents|payment_links|invoices|subscriptions|topups";
+    APP_SHIELD_SPECS = [
+      {
+        name: "stripe",
+        label: "Stripe",
+        description: "Asks before money moves in Stripe (refunds, payouts, charges, invoices, subscriptions), whether the agent uses the Stripe MCP server, the stripe CLI, the API or the Stripe library in a script. Reads are never asked about.",
+        template: "finance",
+        server: "*stripe*",
+        doors: [
+          {
+            name: "shield:stripe:review-cli",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: prog("stripe") + GAP + `\\s(?:${STRIPE_OBJECTS})\\s+(?:create|cancel|capture|confirm|update|pay|finalize_invoice|send_invoice|void_invoice)(?![\\w-])`,
+                flags: "i"
+              },
+              {
+                field: "command",
+                op: "matches",
+                // The stripe CLI works in test mode unless told otherwise.
+                value: "\\s--live(?![\\w-])|\\b[sr]k_live_"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "The stripe CLI is about to move money. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-cli-request",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: prog("stripe") + GAP + `\\s(?:post|delete)\\s+/?v1/(?:${STRIPE_OBJECTS})(?![\\w-])`,
+                flags: "i"
+              },
+              {
+                field: "command",
+                op: "matches",
+                // The stripe CLI works in test mode unless told otherwise.
+                value: "\\s--live(?![\\w-])|\\b[sr]k_live_"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A raw stripe CLI request is about to move money. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: httpTo(`api\\.stripe\\.com/v1/(?:${STRIPE_OBJECTS})(?![\\w-])`),
+                flags: "i"
+              },
+              HTTP_WRITE,
+              NOT_STRIPE_TEST
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the Stripe API is about to move money. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // Python: stripe.Refund.create(...)
+                value: "\\bstripe\\.(?:Refund|Payout|Transfer|Charge|PaymentIntent|PaymentLink|Invoice|Subscription|Topup)\\.(?:create|cancel|capture|confirm|modify|pay|finalize_invoice|send_invoice|void_invoice)\\b"
+              },
+              NOT_STRIPE_TEST
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code moves money through the Stripe library. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-code-node",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // Node: stripe.refunds.create(...)
+                value: "\\bstripe\\.(?:refunds|payouts|transfers|charges|paymentIntents|paymentLinks|invoices|subscriptions|topups)\\.(?:create|cancel|capture|confirm|update|pay|finalizeInvoice|sendInvoice|voidInvoice)\\s*\\("
+              },
+              NOT_STRIPE_TEST
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code moves money through the Stripe library. node9 asks before money moves (Stripe)."
+          },
+          {
+            name: "shield:stripe:review-code-http",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // requests.post("https://api.stripe.com/v1/refunds", ...)
+                value: `\\.post\\(\\s*["'\`][^"'\`]{0,80}api\\.stripe\\.com/v1/(?:${STRIPE_OBJECTS})`
+              },
+              NOT_STRIPE_TEST
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code posts to the Stripe API. node9 asks before money moves (Stripe)."
+          }
+        ]
+      },
+      {
+        name: "paypal",
+        label: "PayPal",
+        description: "Asks before money moves in PayPal (refunds, payouts, captured orders, invoices, subscriptions), whether the agent uses a PayPal MCP server, the API or the PayPal SDK in a script. The sandbox is never asked about, and neither are reads.",
+        template: "finance",
+        server: "*paypal*",
+        doors: [
+          {
+            name: "shield:paypal:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The live hosts only: api.paypal.com and api-m.paypal.com. The
+                // sandbox (api-m.sandbox.paypal.com) moves no money.
+                value: httpTo("api(?:-m)?\\.paypal\\.com/v[12]/"),
+                flags: "i"
+              },
+              {
+                field: "command",
+                op: "matches",
+                // The endpoints that move money.
+                value: "\\.paypal\\.com/v[12]/(?:payments/(?:captures|authorizations|sale|payouts|payment|referenced-payouts)|checkout/orders/[^\\s/]{1,64}/(?:capture|authorize)|invoicing/invoices|billing/subscriptions)",
+                flags: "i"
+              },
+              HTTP_WRITE
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the PayPal API is about to move money. node9 asks before money moves (PayPal)."
+          },
+          {
+            name: "shield:paypal:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Node SDKs (checkout-server-sdk, paypal-server-sdk) and the
+                // Python paypalrestsdk.
+                value: "\\b(?:CapturesRefundRequest|OrdersCaptureRequest|AuthorizationsCaptureRequest|PayoutsPostRequest)\\b|\\b(?:captureOrder|refundCapturedPayment|captureAuthorizedPayment|createBatchPayout)\\s*\\(|\\bpaypalrestsdk\\.(?:Payout|Sale|Capture|Invoice|BillingAgreement)\\b"
+              }
+            ],
+            verdict: "review",
+            reason: "This code moves money through PayPal. node9 asks before money moves (PayPal)."
+          },
+          {
+            name: "shield:paypal:review-code-http",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The endpoints that move money; the token call every script
+                // starts with (/v1/oauth2/token) is not one.
+                value: postTo(
+                  "api(?:-m)?\\.paypal\\.com/v[12]/(?:payments/(?:captures|authorizations|sale|payouts|payment|referenced-payouts)|checkout/orders/[^\\s/\"'`]{1,64}/(?:capture|authorize)|invoicing/invoices|billing/subscriptions)"
+                )
+              }
+            ],
+            verdict: "review",
+            reason: "This code posts to the PayPal API. node9 asks before money moves (PayPal)."
+          }
+        ]
+      },
+      {
+        name: "square",
+        label: "Square",
+        description: "Asks before money moves in Square (refunds, payments, paid orders, invoices, subscriptions), whether the agent uses a Square MCP server, the API or the Square SDK in a script. The sandbox host is never asked about, and neither are reads.",
+        template: "finance",
+        // Square's servers, never Squarespace (a website builder).
+        server: "{*square,*square[-_]*,*squareup*}",
+        mcpTools: [
+          {
+            // Square's official MCP server has one tool for every API call; the
+            // service and method name what it does.
+            name: "shield:square:review-mcp-request",
+            tool: "{,mcp__*__}make_api_request",
+            conditions: [
+              {
+                field: "service",
+                op: "matches",
+                value: "^(?:refunds|payments|orders|invoices|subscriptions|disputes|gift_cards|gift_card_activities|checkout|terminal)$",
+                flags: "i"
+              },
+              {
+                field: "method",
+                op: "notMatches",
+                value: "^(?:list|get|retrieve|search|batch_?retrieve|calculate)",
+                flags: "i"
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request through the Square MCP server is about to move money. node9 asks before money moves (Square)."
+          }
+        ],
+        doors: [
+          {
+            name: "shield:square:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The live host only; the sandbox is connect.squareupsandbox.com.
+                value: httpTo(
+                  "connect\\.squareup\\.com/v2/(?:refunds|payments|orders/[^\\s/?]{1,64}/pay|invoices|subscriptions|disputes|gift-cards/activities)(?![\\w-]|/search)"
+                ),
+                flags: "i"
+              },
+              HTTP_WRITE_ANY
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the Square API is about to move money. node9 asks before money moves (Square)."
+          },
+          {
+            name: "shield:square:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Square SDK in the script: Node (`square`) or Python (`square`, `squareup`).
+                value: `\\bSquareClient\\b|\\bsquare\\.client\\b|from\\s+square[.\\s]|from\\s+["']square["']|require\\(\\s*["']square["']`
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\.refunds(?:Api)?\\.refund(?:Payment|_payment)\\s*\\(|\\.payments(?:Api)?\\.(?:create|complete)(?:Payment|_payment)?\\s*\\(|\\.orders(?:Api)?\\.pay(?:Order|_order)?\\s*\\(|\\.invoices(?:Api)?\\.publish(?:Invoice|_invoice)?\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code moves money through the Square SDK. node9 asks before money moves (Square)."
+          },
+          {
+            name: "shield:square:review-code-http",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: postTo(
+                  "connect\\.squareup\\.com/v2/(?:refunds|payments|orders/[^\\s/?\"'`]{1,64}/pay|invoices|subscriptions|disputes|gift-cards/activities)(?![\\w-]|/search)"
+                )
+              }
+            ],
+            verdict: "review",
+            reason: "This code posts to the Square API. node9 asks before money moves (Square)."
+          }
+        ]
+      },
+      {
+        name: "plaid",
+        label: "Plaid",
+        description: "Asks before money moves through Plaid (transfers, transfer authorizations, payment initiation), whether the agent uses a Plaid MCP server, the API or the Plaid SDK in a script. The sandbox host is never asked about, and neither are reads such as balances or transactions.",
+        template: "finance",
+        server: "*plaid*",
+        doors: [
+          {
+            name: "shield:plaid:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // Every Plaid endpoint is a POST, so the path is what tells a
+                // write; the live host only, never sandbox.plaid.com. A script
+                // that posts to the URL meets this door too.
+                value: httpTo(
+                  "production\\.plaid\\.com/(?:transfer/(?:create|authorization/create|recurring/create)|payment_initiation/payment/create|bank_transfer/create)(?![\\w-])"
+                ),
+                flags: "i"
+              }
+            ],
+            verdict: "review",
+            reason: "A request to the Plaid API is about to move money. node9 asks before money moves (Plaid)."
+          },
+          {
+            name: "shield:plaid:review-code",
+            tool: "bash",
+            conditions: [
+              { field: "command", op: "matches", value: "\\bplaid", flags: "i" },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\b(?:transfer(?:Authorization|Recurring)?Create|paymentInitiationPaymentCreate|bankTransferCreate|transfer_(?:authorization_|recurring_)?create|payment_initiation_payment_create|bank_transfer_create)\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code moves money through Plaid. node9 asks before money moves (Plaid)."
+          }
+        ]
+      },
+      {
+        name: "okta",
+        label: "Okta",
+        description: "Asks before a user, a group member, a role, a password or a key changes in Okta, whether the agent uses an Okta MCP server, the API or the Okta SDK in a script. Reads and signing in are never asked about.",
+        template: "identity",
+        server: "*okta*",
+        doors: [
+          {
+            name: "shield:okta:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The management API only: sign-in (/api/v1/authn, /sessions,
+                // /oauth2) is not under these paths.
+                value: httpTo(
+                  "[\\w-]+\\.okta(?:-emea)?\\.com/api/v1/(?:users|groups|apps|iam|api-tokens|idps|authorizationServers|policies)(?![\\w-])"
+                ),
+                flags: "i"
+              },
+              HTTP_WRITE_ANY
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the Okta API is about to change who has access. node9 asks before access changes (Okta)."
+          },
+          {
+            name: "shield:okta:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Okta SDK in the script: a method named createUser alone is
+                // in half the applications ever written.
+                value: "@okta/okta-sdk|\\bokta\\.Client\\b|from\\s+okta[.\\s]|\\bimport\\s+okta\\b"
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\b(?:(?:create|delete|deactivate|suspend|unlock|activate)User|(?:reset|expire)Password|resetFactors|(?:assign|unassign)User(?:To|From)Group|assignRoleTo(?:User|Group))\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code changes who has access in Okta. node9 asks before access changes (Okta)."
+          },
+          {
+            name: "shield:okta:review-code-py",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: "@okta/okta-sdk|\\bokta\\.Client\\b|from\\s+okta[.\\s]|\\bimport\\s+okta\\b"
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\b(?:(?:create|delete|deactivate|deactivate_or_delete|suspend|unlock|activate)_user|(?:reset|expire)_password|reset_factors|(?:add|remove)_user_(?:to|from)_group|assign_role_to_(?:user|group))\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code changes who has access in Okta. node9 asks before access changes (Okta)."
+          }
+        ]
+      },
+      {
+        name: "auth0",
+        label: "Auth0",
+        description: "Asks before a user, a role, an application or its permissions change in Auth0, whether the agent uses an Auth0 MCP server, the auth0 CLI, the Management API or the Auth0 SDK in a script. Reads and signing in are never asked about.",
+        template: "identity",
+        server: "*auth0*",
+        mcpTools: [
+          {
+            // Auth0's official MCP server: applications (their secrets and
+            // callbacks), APIs and their scopes, and Actions (code that runs at
+            // every sign-in).
+            name: "shield:auth0:review-tenant-config",
+            tool: "{,mcp__*__}{auth0_create_application,auth0_update_application,auth0_create_resource_server,auth0_update_resource_server,auth0_create_action,auth0_update_action,auth0_deploy_action}",
+            conditions: [],
+            verdict: "review",
+            reason: "This changes an Auth0 application, API or sign-in Action. node9 asks before access changes (Auth0)."
+          }
+        ],
+        doors: [
+          {
+            name: "shield:auth0:review-cli",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                value: prog("auth0") + GAP + "\\s(?:(?:users|roles|apps|orgs)\\s+(?:create|update|delete|rm)|users\\s+roles\\s+(?:assign|add|remove|rm)|roles\\s+permissions\\s+(?:add|remove|rm)|users\\s+blocks\\s+unblock|api\\s+(?:post|put|patch|delete))(?![\\w-])",
+                flags: "i"
+              }
+            ],
+            verdict: "review",
+            reason: "The auth0 CLI is about to change who has access. node9 asks before access changes (Auth0)."
+          },
+          {
+            name: "shield:auth0:review-api",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Management API only; /oauth/token is signing in.
+                value: httpTo(
+                  "\\.auth0\\.com/api/v2/(?:users|roles|clients|grants|client-grants|organizations|tickets|jobs/users-imports|device-credentials)(?![\\w-])"
+                ),
+                flags: "i"
+              },
+              HTTP_WRITE_ANY
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "A request to the Auth0 Management API is about to change who has access. node9 asks before access changes (Auth0)."
+          },
+          {
+            name: "shield:auth0:review-code",
+            tool: "bash",
+            conditions: [
+              {
+                field: "command",
+                op: "matches",
+                // The Auth0 SDK in the script (Node `auth0`, Python `auth0`).
+                value: `\\bManagementClient\\b|from\\s+auth0[.\\s]|from\\s+["']auth0["']|require\\(\\s*["']auth0["']`
+              },
+              {
+                field: "command",
+                op: "matches",
+                value: "\\.(?:users|roles|organizations|clients)\\.(?:create|delete|update|assignRoles|deleteRoles|assignUsers|addPermissions|deletePermissions|addMembers|deleteMembers|add_roles|remove_roles|add_users|add_permissions|remove_permissions)\\s*\\("
+              }
+            ],
+            conditionMode: "all",
+            verdict: "review",
+            reason: "This code changes who has access in Auth0. node9 asks before access changes (Auth0)."
+          }
+        ]
+      }
+    ];
+    APP_SHIELDS = APP_SHIELD_SPECS.map(buildAppShield);
+    APP_SHIELD_NAMES = new Set(APP_SHIELD_SPECS.map((s) => s.name));
+    APP_SERVER_GLOB = `{${APP_SHIELD_SPECS.map((s) => s.server).join(",")}}`;
+    GENERAL_ACTION_RULES = buildGeneralRules();
     BUILTIN_SHIELDS = {
       [aws_default.name]: aws_default,
       [bash_safe_default.name]: bash_safe_default,
       [docker_default.name]: docker_default,
       [filesystem_default.name]: filesystem_default,
-      // Dangerous actions as category shields (node9Firewall#385): an MCP app's
-      // money, credential and publishing tools, asked about whatever the request
-      // said. One glob per rule covers the bare name the gateway sends and the
-      // mcp__<server>__ name the agent hook sends.
-      [finance_default.name]: finance_default,
       [github_default.name]: github_default,
-      [identity_default.name]: identity_default,
       [k8s_default.name]: k8s_default,
       [mongodb_default.name]: mongodb_default,
       [postgres_default.name]: postgres_default,
       [project_jail_default.name]: project_jail_default,
-      [publishing_default.name]: publishing_default,
-      [redis_default.name]: redis_default
+      [redis_default.name]: redis_default,
+      // App shields generated from the action templates (node9Firewall#390): one
+      // per app, every door (MCP server, CLI, API, library), off by default.
+      ...Object.fromEntries(APP_SHIELDS.map((s) => [s.name, s]))
     };
-    ACTION_SHIELD_NAMES = /* @__PURE__ */ new Set([
-      "finance",
-      "identity",
-      "publishing"
-    ]);
     assertBuiltinShieldRegexesAreSafe();
     SSRF_MAX_HOST = 253;
     METADATA_ADDRESSES = /* @__PURE__ */ new Set([
@@ -3792,9 +4446,9 @@ var init_dist = __esm({
       },
       // ── Commands ──────────────────────────────────────────────────────────────
       "commands.inline-exec": {
-        plain: "The agent runs a small program written inside the command itself.",
+        plain: "The agent runs a small program written inside the command itself, and node9 reads it: ordinary code runs, code that deletes, sends data out, runs other commands or reads protected files is held, and so is code node9 cannot read.",
         example: `node -e "require('fs').rmSync('dist', {recursive: true})"`,
-        advice: "Agents do this often for harmless tasks. Set Log if your team finds the review prompts noisy; keep Review if agents work near production."
+        advice: "Keep Review. Strict mode reviews every inline call, harmless or not; Log or Off only if inline code never reaches anything that matters."
       },
       "commands.eval-dynamic": {
         plain: "The agent runs code whose content is built at run time, so node9 cannot read it in advance.",
@@ -3826,6 +4480,21 @@ var init_dist = __esm({
         example: "chmod 777 deploy.sh",
         advice: "Keep Review. A narrower permission (755, 644) almost always does the job."
       },
+      "actions.money": {
+        plain: "The agent moves money (a refund, a payout, a transfer, a charge) through an app node9 has no protection for, such as an internal billing server.",
+        example: "refund_order on a server called acme-billing",
+        advice: "Keep Review. When the app is Stripe or PayPal, turn on its own protection instead: it covers the CLI, the API and scripts too, and a call from it no longer comes here."
+      },
+      "actions.access": {
+        plain: "The agent changes a password, a key, a role or who belongs to a team, through an app node9 has no protection for.",
+        example: "invite_user or grant_role on a company admin server",
+        advice: "Keep Review. Set Log on a sandbox workspace where agents manage test users all day."
+      },
+      "actions.publish": {
+        plain: "The agent publishes something outside the organisation (a release, a package, a deploy, a public post) through an app node9 has no protection for.",
+        example: "create_release or deploy_to_production on a company MCP server",
+        advice: "Keep Review. Set Log on a release machine whose pipeline publishes on purpose, never on a developer laptop."
+      },
       "commands.sudo": {
         plain: "The agent runs a command as the administrator (root).",
         example: "sudo apt-get install -y nginx",
@@ -3986,11 +4655,57 @@ var init_dist = __esm({
         advice: "Fixed at Block. A person accepts the change on the machine (node9 mcp pin update)."
       },
       "loading.malicious-package": {
-        plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only.",
+        plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only. A new release built from the same repository as the one before it (registry provenance) and an install script the package has always run do not stop; a release that lost the provenance its previous release had does.",
         example: "npm install of a package flagged as malware",
         advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
       }
     };
+    LEVELS = ["audit", "soft", "standard", "strict", "block-all"];
+    MODE_VALUES = ["observe", ...LEVELS];
+    SOFT = {
+      "commands.inline-exec": "log",
+      "commands.eval-dynamic": "log",
+      "commands.rm": "log",
+      "commands.chmod": "log",
+      "commands.sudo": "log",
+      "commands.git-destructive": "log",
+      "commands.sql-ddl": "log",
+      "commands.sql-no-where": "log",
+      "commands.temp-binary": "log",
+      "commands.disk-destroy": "log",
+      "commands.dangerous-word": "log",
+      "files.system-dirs": "log",
+      "files.shell-startup": "log",
+      "files.password-hashes": "log",
+      "data.pipe-chain": "log",
+      "behavior.untrusted-content": "log"
+    };
+    STRICT = {
+      "commands.sql-ddl": "block",
+      "commands.disk-destroy": "block",
+      "commands.node9-disarm": "block",
+      "files.system-dirs": "block",
+      "files.shell-startup": "block",
+      "files.password-hashes": "block",
+      "data.secrets-weak": "block",
+      "data.pipe-chain": "block",
+      "network.unknown-host": "review",
+      "network.internal-addresses": "block",
+      "behavior.prompt-injection": "log",
+      "loading.skill-tamper": "block"
+    };
+    BLOCK_ALL = {
+      ...STRICT,
+      "commands.unknown": "review",
+      "commands.temp-binary": "block"
+    };
+    LEVEL_CHECKS = {
+      audit: {},
+      soft: SOFT,
+      standard: {},
+      strict: STRICT,
+      "block-all": BLOCK_ALL
+    };
     VERDICTS = ["off", "log", "review", "block"];
     CHECK_VERDICT_RANK = { off: 0, log: 1, review: 2, block: 3 };
     ALL = VERDICTS;
@@ -4038,7 +4753,7 @@ var init_dist = __esm({
         id: "commands.inline-exec",
         group: "commands",
         title: "Inline code execution",
-        catches: "node -e, python -c, bash -c, a heredoc into an interpreter",
+        catches: "inline code (python -c, node -e, a heredoc into an interpreter) that deletes, sends, opens a socket, runs commands, reads protected files or decodes and runs; unreadable inline code",
         values: ALL,
         defaultValue: "review",
         legacy: ["Node9 Standard (Inline Execution)"]
@@ -4395,6 +5110,38 @@ var init_dist = __esm({
         values: ALL,
         defaultValue: "block",
         legacy: ["\u{1F4E6} Node9 Package Check (Malicious)", "\u{1F4E6} Node9 Package Check (Review)"]
+      },
+      // ── Actions in apps (node9Firewall#390) ──────────────────────────────────
+      // The safety net under the app shields: an action that moves money, changes
+      // access or publishes, on an MCP server no app shield claims (an internal
+      // billing server, a vendor with no shield, Zapier). Review by default; the
+      // rules come from the action templates (shields/apps.ts).
+      {
+        id: "actions.money",
+        group: "actions",
+        title: "Money moves",
+        catches: "a refund, payout, transfer, charge or withdrawal through an app with no protection of its own",
+        values: ALL,
+        defaultValue: "review",
+        legacy: generalActionRuleNames("finance")
+      },
+      {
+        id: "actions.access",
+        group: "actions",
+        title: "Accounts and access change",
+        catches: "a password, key, role, permission or user changed through an app with no protection of its own",
+        values: ALL,
+        defaultValue: "review",
+        legacy: generalActionRuleNames("identity")
+      },
+      {
+        id: "actions.publish",
+        group: "actions",
+        title: "Something is published",
+        catches: "a release, package, deploy or public post through an app with no protection of its own",
+        values: ALL,
+        defaultValue: "review",
+        legacy: generalActionRuleNames("publishing")
       }
     ];
     SHIELD_RULE_NAME = /^shield:([^:]+):(block|review|allow)-(.+)$/;
@@ -4412,7 +5159,7 @@ var init_dist = __esm({
       "commands.rm": (s) => knob(s.commandChecks?.rmAdvisory),
       "commands.chmod": (s) => knob(s.commandChecks?.chmod),
       "commands.sql-ddl": (s) => knob(s.commandChecks?.sqlDdl),
-      "commands.unknown": (s) => s.mode === void 0 ? void 0 : s.mode === "strict" ? "review" : "off",
+      "commands.unknown": (s) => s.mode === void 0 ? void 0 : isBlockAll(s.mode) ? "review" : "off",
       "data.secrets": (s) => enabledOr(s.dlp?.enabled, "block"),
       "data.secrets-weak": (s) => {
         if (s.dlp?.enabled === false) return "off";
@@ -4515,6 +5262,170 @@ var init_dist = __esm({
       \u03A7: "X"
     };
     HOMOGLYPH_RE = new RegExp(`[${Object.keys(HOMOGLYPHS).join("")}]`, "g");
+    SYSTEM_DIRS = [
+      "/usr",
+      "/etc",
+      "/boot",
+      "/bin",
+      "/sbin",
+      "/lib",
+      "/lib64",
+      "/var/log"
+    ];
+    UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
+    LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
+    MAX_INLINE_CODE = 64 * 1024;
+    OUTSIDE = String.raw`(?:~|\.\.[\\/]|/(?!(?:tmp|var/tmp)/(?![^'"\n]*\.\.)|dev/(?:null|stdout|stderr)\b))`;
+    pyImport = (mods) => new RegExp(String.raw`\b(?:import\s+(?:[\w.]+(?:\s+as\s+\w+)?\s*,\s*)*|from\s+)(?:${mods})\b`);
+    either = (...res) => new RegExp(res.map((r) => `(?:${r.source})`).join("|"), "m");
+    PYTHON = [
+      [
+        "deletes",
+        /\bos\.(?:remove|unlink|rmdir|removedirs)\s*\(|\bshutil\.rmtree\s*\(|\.(?:unlink|rmdir)\s*\(|\bfrom\s+(?:os|shutil)\s+import\s+[^\n]*\b(?:remove|unlink|rmdir|removedirs|rmtree)\b/
+      ],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`\bopen\s*\(\s*[rRbBuU]?['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*(?:mode\s*=\s*)?[rRbB]?['"][^'"\n]*[wax+]|\bPath\s*\(\s*[rR]?['"]${OUTSIDE}[^'"\n]*['"]\s*\)\s*\.(?:write_text|write_bytes|touch|mkdir|symlink_to)\s*\(|\bshutil\.(?:copy\w*|move)\s*\([^)\n]*['"]${OUTSIDE}|\bos\.(?:rename|replace|symlink|link|truncate|makedirs|mkdir)\s*\([^)\n]*['"]${OUTSIDE}`
+        )
+      ],
+      [
+        "sends",
+        either(
+          pyImport(
+            String.raw`socket|requests|urllib2|urllib3|http\.client|httplib|smtplib|ftplib|paramiko|telnetlib|aiohttp|httpx|websockets?|xmlrpc|poplib|imaplib|pycurl|scapy`
+          ),
+          /\burllib\.request\b|\burlopen\s*\(|\bfrom\s+urllib\s+import\s+[^\n;]*\brequest\b|\basyncio\.open_connection\s*\(/
+        )
+      ],
+      [
+        "listens",
+        either(
+          pyImport(String.raw`pty|socketserver|http\.server`),
+          /\bpty\.spawn\s*\(|\.bind\s*\(\s*\(|\basyncio\.start_server\s*\(/
+        )
+      ],
+      [
+        "runs-commands",
+        either(
+          pyImport("subprocess|pexpect|commands|psutil"),
+          /\bos\.(?:system|popen|exec\w*|spawn\w*|posix_spawn\w*|fork|forkpty|kill|killpg)\s*\(|\bfrom\s+os\s+import\s+[^\n;]*\b(?:system|popen|exec\w*|spawn\w*|fork|kill)\b|\bfrom\s+(?:os|shutil|pty|ctypes)\s+import\s+\*/
+        )
+      ],
+      [
+        "builds-code",
+        /(?<![\w.])(?:exec|eval|compile|execfile)\s*\(|\b__import__\s*\(|\bimportlib\b|\b(?:c?pickle|dill|marshal|shelve)\.loads?\s*\(|\byaml\.(?:unsafe_)?load\s*\((?![^)\n]*SafeLoader)|\bctypes\b|\b(?:getattr|vars)\s*\(\s*(?:os|subprocess|shutil|socket|sys|pty|builtins|__builtins__)\b|\b(?:os|subprocess|shutil|socket|sys|pty|builtins)\.__dict__\b|\b__builtins__\b|\bsys\.modules\b|\bglobals\s*\(\s*\)\s*\[/
+      ],
+      [
+        // Spyware shapes: a screenshot, the clipboard, a key logger.
+        "monitors",
+        either(
+          pyImport(String.raw`pyperclip|pynput|keyboard|pyautogui|pyscreenshot|mss|clipboard`),
+          /\bImageGrab\b|\bpyautogui\.screenshot\b|\bscreencapture\b/
+        )
+      ],
+      [
+        "permissions",
+        /\bos\.(?:chmod|lchmod|fchmod|chown|lchown|fchown|setuid|setgid|seteuid|setegid|setreuid|setregid|setresuid)\s*\(|\.chmod\s*\(|\bshutil\.chown\s*\(/
+      ]
+    ];
+    NODE = [
+      [
+        "deletes",
+        /\.(?:rm|rmSync|rmdir|rmdirSync|unlink|unlinkSync)\s*\(|\brimraf\b|\bDeno\.remove(?:Sync)?\s*\(/
+      ],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`(?:\.(?:writeFile|writeFileSync|appendFile|appendFileSync|createWriteStream|copyFile|copyFileSync|cp|cpSync|rename|renameSync|truncate|truncateSync|symlink|symlinkSync|mkdir|mkdirSync)|\bDeno\.(?:writeTextFile|writeFile|rename|mkdir)(?:Sync)?|\bBun\.write)\s*\(\s*['"\x60]${OUTSIDE}`
+        )
+      ],
+      [
+        "sends",
+        /\bfetch\s*\(|(?:\brequire\s*\(\s*|\bfrom\s+|\bimport\s+)['"\x60](?:node:)?(?:http|https|http2|net|dgram|tls|axios|node-fetch|ws|request|got|undici|nodemailer)['"\x60]|\bnew\s+WebSocket\b|\bXMLHttpRequest\b|\b(?:Deno|Bun)\.connect\w*\s*\(/
+      ],
+      ["listens", /\bcreateServer\s*\(|\b(?:Deno\.(?:listen\w*|serve)|Bun\.(?:listen|serve))\s*\(/],
+      [
+        "runs-commands",
+        /\bchild_process\b|\bprocess\.(?:binding|dlopen|kill)\s*\(|\bDeno\.(?:run|Command)\b|\bBun\.(?:spawn|spawnSync|\$)\b|\bexecSync\s*\(|\bspawnSync\s*\(/
+      ],
+      [
+        "builds-code",
+        /(?<![\w.])eval\s*\(|\bnew\s+Function\s*\(|(?<![\w.])Function\s*\(|(?:\brequire\s*\(\s*|\bfrom\s+)['"\x60](?:node:)?vm['"\x60]|\bvm\.\w+|\brequire\s*\(\s*[^'"\x60\s)]|\bimport\s*\(\s*[^'"\x60\s)]/
+      ],
+      [
+        "permissions",
+        /\.(?:chmod|chmodSync|chown|chownSync|lchown|lchownSync|fchmod|fchmodSync|fchown|fchownSync)\s*\(|\bprocess\.set(?:e)?[ug]id\s*\(|\bDeno\.(?:chmod|chown)(?:Sync)?\s*\(/
+      ]
+    ];
+    PERL = [
+      ["deletes", /\b(?:unlink|rmdir|rmtree|remove_tree)\b/],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`['"]\s*(?:\+?>>?|\+<)\s*['"]?\s*,?\s*['"]?${OUTSIDE}|\b(?:rename|symlink|link|copy|move)\s*\(?[^;\n]*['"]${OUTSIDE}`
+        )
+      ],
+      [
+        "sends",
+        /\b(?:IO::Socket|Socket|LWP|HTTP::Tiny|Net::\w+|Mojo::UserAgent|WWW::Mechanize|IO::Socket::INET)\b/
+      ],
+      [
+        "runs-commands",
+        /\b(?:system|exec|fork|kill|syscall)\b|`[^`]*`|\bqx\s*[{([/|!'"]|\bopen\s*\(?[^;\n]*(?:['"]\s*\||\|\s*['"]|['"]-\|['"])/
+      ],
+      ["builds-code", /\beval\b|\bStorable::thaw\b|\bdo\s+['"]/],
+      ["permissions", /\b(?:chmod|chown)\b/]
+    ];
+    RUBY = [
+      [
+        "deletes",
+        /\bFile\.(?:delete|unlink)\b|\bFileUtils\.(?:rm\w*|remove\w*)\b|\bDir\.(?:rmdir|delete|unlink)\b|\.(?:rmtree|delete_all)\b/
+      ],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`\bFile\.(?:write|binwrite|symlink|rename)\s*\(?\s*['"]${OUTSIDE}|\bFile\.open\s*\(?\s*['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*['"][wa+]|\bFileUtils\.(?:cp\w*|mv|install|ln\w*|mkdir_p|touch)\s*\(?[^\n]*['"]${OUTSIDE}`
+        )
+      ],
+      [
+        "sends",
+        /\bNet::\w+|\b(?:TCPSocket|UDPSocket|UNIXSocket|Socket)\b|\bopen-uri\b|\bURI\.open\b|\b(?:HTTParty|Faraday|RestClient|Excon|Typhoeus)\b|\brequire\s+['"](?:socket|net\/\w+|open-uri)['"]/
+      ],
+      ["listens", /\b(?:TCPServer|UNIXServer|WEBrick|PTY)\b/],
+      [
+        "runs-commands",
+        /(?<![\w.])(?:system|exec|spawn|fork)\b|`[^`]*`|%x[{([|!]|(?<![\w.])open\s*\(?\s*['"]\||\bIO\.popen\b|\bOpen3\b|\bProcess\.(?:spawn|kill|exec)\b|\bKernel\.(?:system|exec|spawn|open)\b/
+      ],
+      [
+        "builds-code",
+        /(?<![\w.])eval\b|\b(?:instance|class|module)_eval\b|\b(?:send|public_send)\s*\(?\s*:?['"]?(?:system|eval|exec|spawn)\b|\bMarshal\.load\b|\bYAML\.(?:unsafe_)?load\b|\bconst_get\b/
+      ],
+      ["permissions", /\b(?:File|FileUtils)\.(?:chmod|chown|lchmod|lchown)\w*\b/]
+    ];
+    PHP = [
+      ["deletes", /\b(?:unlink|rmdir)\s*\(/],
+      [
+        "writes-outside",
+        new RegExp(
+          String.raw`\b(?:file_put_contents|symlink|link|copy|rename|mkdir|touch)\s*\([^)\n]*['"]${OUTSIDE}|\bfopen\s*\(\s*['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*['"][waxc+]`
+        )
+      ],
+      [
+        "sends",
+        /\b(?:curl_exec|curl_init|fsockopen|pfsockopen|stream_socket_client|socket_create|socket_connect|mail|ftp_connect)\s*\(|\b(?:file_get_contents|fopen|file|readfile)\s*\(\s*['"](?:https?|ftp):/
+      ],
+      ["listens", /\b(?:stream_socket_server|socket_bind|socket_listen)\s*\(/],
+      [
+        "runs-commands",
+        /\b(?:system|exec|shell_exec|passthru|proc_open|popen|pcntl_exec|pcntl_fork|posix_kill)\s*\(|`[^`]*`/
+      ],
+      [
+        "builds-code",
+        /\b(?:eval|assert|create_function|unserialize|call_user_func(?:_array)?)\s*\(|\bbase64_decode\b/
+      ],
+      ["permissions", /\b(?:chmod|chown|chgrp|lchown|lchgrp)\s*\(/]
+    ];
     ({ syntax } = mvdanSh);
     sharedParser = syntax.NewParser();
     MESSAGE_FLAGS = /* @__PURE__ */ new Set([
@@ -4552,6 +5463,10 @@ var init_dist = __esm({
     AST_CACHE_MAX = 5e3;
     astCache = /* @__PURE__ */ new Map();
     PARSE_FAIL = /* @__PURE__ */ Symbol("parse-fail");
+    INTERPRETER_LINE = /^#![ \t]*[\w./+-]+(?:[ \t]+[\w./+=:-]+)*[ \t]*\r?(?=\n|$)/;
+    PROGRAM_DIR = /^(?:\/usr(?:\/local)?|\/opt\/homebrew|\/home\/linuxbrew\/\.linuxbrew)?\/s?bin\/[^/]+$|^\/snap\/bin\/[^/]+$|^(?![/~\\]|[A-Za-z]:|.*\.\.)/;
+    ACCESS_VIEW_CACHE_MAX = 1e3;
+    accessViewCache = /* @__PURE__ */ new Map();
     MAX_READING_PAYLOADS = 8;
     defaultExpansionOps = null;
     VARIABLE_READERS = /* @__PURE__ */ new Set([
@@ -5285,9 +6200,6 @@ var init_dist = __esm({
     positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
     NONE = { kind: "none" };
     UNKNOWN = { kind: "unknown" };
-    MAX_REGEX_LENGTH = 256;
-    REGEX_CACHE_MAX = 500;
-    regexCache = /* @__PURE__ */ new Map();
     FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
     BASH_TOOL_NAMES = /* @__PURE__ */ new Set([
       "bash",
@@ -5325,18 +6237,6 @@ var init_dist = __esm({
         (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
       )
     );
-    SYSTEM_DIRS = [
-      "/usr",
-      "/etc",
-      "/boot",
-      "/bin",
-      "/sbin",
-      "/lib",
-      "/lib64",
-      "/var/log"
-    ];
-    UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
-    LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
     BIP39_ENGLISH = `abandon
 ability
 able
@@ -8377,7 +9277,11 @@ zoo`.split("\n");
       "commands.disk-destroy",
       "commands.dangerous-word",
       "commands.node9-disarm",
-      "data.pipe-chain"
+      "data.pipe-chain",
+      // The general action checks (node9Firewall#390): smart rules the map governs.
+      "actions.money",
+      "actions.access",
+      "actions.publish"
     ]);
     KNOB_GOVERNED = {
       "data.secrets": ["off", "block"],
@@ -9230,7 +10134,8 @@ var init_config_schema = __esm({
         }
       ),
       value: z.string().optional(),
-      flags: z.string().optional()
+      flags: z.string().optional(),
+      reading: z.enum(["access"]).optional()
     }).refine(
       (c) => {
         if (c.op === "matchesGlob" || c.op === "notMatchesGlob") return c.value !== void 0;
@@ -9241,6 +10146,9 @@ var init_config_schema = __esm({
     SmartRuleSchema = z.object({
       name: z.string().optional(),
       tool: z.string().min(1, "Smart rule tool must not be empty"),
+      // Scope to an MCP server label (glob), or keep off one (node9Firewall#390).
+      server: z.string().min(1).optional(),
+      notServer: z.string().min(1).optional(),
       conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
       conditionMode: z.enum(["all", "any"]).optional(),
       verdict: z.enum(["allow", "review", "block"], {
@@ -9261,7 +10169,8 @@ var init_config_schema = __esm({
     ConfigFileSchema = z.object({
       version: z.string().optional(),
       settings: z.object({
-        mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
+        // The protection level (levels.ts in the engine); `observe` is Audit's older name.
+        mode: z.enum(["observe", "audit", "soft", "standard", "strict", "block-all"]).optional(),
         autoStartDaemon: z.boolean().optional(),
         // enableUndo / policy.snapshot: removed with the undo feature. The
         // schema strips undeclared keys silently (plain zod object — no
@@ -9391,6 +10300,82 @@ var init_config_schema = __esm({
   }
 });
 
+// src/shields/build.ts
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function slug(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "rule";
+}
+function pathToRegexFragment(rawPath) {
+  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
+  const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
+  if (segments2.length === 0) return "";
+  return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
+}
+function pathRules(rawPath, verdict, reason) {
+  const value = pathToRegexFragment(rawPath);
+  if (!value) return [];
+  const why = reason ?? `Accessing ${rawPath} is restricted by this shield`;
+  const s = slug(rawPath);
+  return [
+    // `reading: 'access'`: a script's interpreter line and the program a
+    // command runs are not reads of the jailed path (node9Firewall#385).
+    {
+      name: `${verdict}-path-${s}-bash`,
+      tool: "bash",
+      conditions: [{ field: "command", op: "matches", value, reading: "access" }],
+      verdict,
+      reason: why
+    },
+    // Keep the historical `-anytool` name for the file_path rule: the
+    // rule→shield attribution maps (Report SHIELDS panel) key on rule names.
+    {
+      name: `${verdict}-path-${s}-anytool`,
+      tool: "*",
+      conditions: [{ field: "file_path", op: "matches", value }],
+      verdict,
+      reason: why
+    },
+    {
+      name: `${verdict}-path-${s}-anytool-path`,
+      tool: "*",
+      conditions: [{ field: "path", op: "matches", value }],
+      verdict,
+      reason: why
+    },
+    {
+      name: `${verdict}-path-${s}-anytool-pattern`,
+      tool: "*",
+      conditions: [{ field: "pattern", op: "matches", value }],
+      verdict,
+      reason: why
+    }
+  ];
+}
+function withAccessReading(def) {
+  let changed = false;
+  const smartRules = def.smartRules.map((r) => {
+    const [c, ...rest] = r.conditions ?? [];
+    if (rest.length > 0 || !c || r.tool !== "bash" || !LEGACY_BASH_PATH_RULE.test(r.name ?? "") || c.field !== "command" || c.op !== "matches" || c.reading !== void 0) {
+      return r;
+    }
+    changed = true;
+    return { ...r, conditions: [{ ...c, reading: "access" }] };
+  });
+  return changed ? { ...def, smartRules } : def;
+}
+var B, SEP, LEGACY_BASH_PATH_RULE;
+var init_build = __esm({
+  "src/shields/build.ts"() {
+    "use strict";
+    init_dist();
+    B = "[\\s/\\\\]";
+    SEP = "[/\\\\]";
+    LEGACY_BASH_PATH_RULE = /^(?:block|review)-path-.+-bash$/;
+  }
+});
+
 // src/shields.ts
 import fs5 from "fs";
 import path6 from "path";
@@ -9419,7 +10404,7 @@ function loadUserShields() {
 `);
         continue;
       }
-      result[v.ok.name] = v.ok;
+      result[v.ok.name] = withAccessReading(v.ok);
     } catch (err) {
       process.stderr.write(`[node9] Failed to load user shield ${file}: ${String(err)}
 `);
@@ -9475,6 +10460,7 @@ var init_shields = __esm({
   "src/shields.ts"() {
     "use strict";
     init_dist();
+    init_build();
     init_dist();
     USER_SHIELDS_DIR = path6.join(os6.homedir(), ".node9", "shields");
     SHIELDS = buildSHIELDS();
@@ -9590,7 +10576,7 @@ var MODE_ORDER, EGRESS_MODE_ORDER, DLP_PII_ORDER, DLP_REVIEW_ACTION_ORDER, COMMA
 var init_managed = __esm({
   "src/config/managed.ts"() {
     "use strict";
-    MODE_ORDER = ["observe", "audit", "standard", "strict"];
+    MODE_ORDER = ["observe", "audit", "soft", "standard", "strict", "block-all"];
     EGRESS_MODE_ORDER = ["off", "review", "block"];
     DLP_PII_ORDER = ["off", "block"];
     DLP_REVIEW_ACTION_ORDER = ["review", "block"];
@@ -9610,67 +10596,6 @@ var init_managed = __esm({
   }
 });
 
-// src/shields/build.ts
-function escapeRegex(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function slug(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "rule";
-}
-function pathToRegexFragment(rawPath) {
-  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
-  const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
-  if (segments2.length === 0) return "";
-  return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
-}
-function pathRules(rawPath, verdict, reason) {
-  const value = pathToRegexFragment(rawPath);
-  if (!value) return [];
-  const why = reason ?? `Accessing ${rawPath} is restricted by this shield`;
-  const s = slug(rawPath);
-  return [
-    {
-      name: `${verdict}-path-${s}-bash`,
-      tool: "bash",
-      conditions: [{ field: "command", op: "matches", value }],
-      verdict,
-      reason: why
-    },
-    // Keep the historical `-anytool` name for the file_path rule: the
-    // rule→shield attribution maps (Report SHIELDS panel) key on rule names.
-    {
-      name: `${verdict}-path-${s}-anytool`,
-      tool: "*",
-      conditions: [{ field: "file_path", op: "matches", value }],
-      verdict,
-      reason: why
-    },
-    {
-      name: `${verdict}-path-${s}-anytool-path`,
-      tool: "*",
-      conditions: [{ field: "path", op: "matches", value }],
-      verdict,
-      reason: why
-    },
-    {
-      name: `${verdict}-path-${s}-anytool-pattern`,
-      tool: "*",
-      conditions: [{ field: "pattern", op: "matches", value }],
-      verdict,
-      reason: why
-    }
-  ];
-}
-var B, SEP;
-var init_build = __esm({
-  "src/shields/build.ts"() {
-    "use strict";
-    init_dist();
-    B = "[\\s/\\\\]";
-    SEP = "[/\\\\]";
-  }
-});
-
 // src/auth/trusted-hosts.ts
 function normalizeHost2(raw) {
   return raw.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/^[^@]+@/, "").replace(/:\d+$/, "");
@@ -9741,7 +10666,7 @@ function v2ToLegacy(raw, options = {}) {
       continue;
     }
     if (id === "commands.unknown") {
-      warnings.push(`checks.${id}: set "mode": "strict" instead`);
+      warnings.push(`checks.${id}: set "mode": "block-all" instead`);
       continue;
     }
     const allowed = configurableValues(id);
@@ -9974,6 +10899,11 @@ function logCacheReadIssue(cacheFile, kind) {
   } catch {
   }
 }
+function statedSignalFields(policy) {
+  return Object.keys(tuningFromLegacyPolicy(policy)["loading.malicious-package"] ?? {}).filter(
+    (k) => k === "newPackage" || k === "installScript"
+  );
+}
 function catalogSettingsFrom(settings, policy) {
   return catalogSettingsFromConfig(settings, policy);
 }
@@ -10029,6 +10959,7 @@ function getConfig(cwd) {
     trustedHosts: [],
     trustedHostsManaged: false,
     appPermissions: {},
+    appLinks: {},
     managedJailPaths: []
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
@@ -10040,6 +10971,8 @@ function getConfig(cwd) {
   const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
   let ssrfStrictSource = "default";
   const workspaceChecks = {};
+  const managedStatedChecks = /* @__PURE__ */ new Set();
+  const managedStatedSignals = /* @__PURE__ */ new Set();
   const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
@@ -10247,9 +11180,11 @@ function getConfig(cwd) {
       if (raw.managedConfig && typeof raw.managedConfig === "object") {
         const mc = raw.managedConfig;
         const locked = Array.isArray(mc.locked) ? mc.locked.filter((f) => typeof f === "string") : [];
+        for (const id of knobStatedChecks(mc)) managedStatedChecks.add(id);
+        for (const k of statedSignalFields(mc)) managedStatedSignals.add(k);
         if (typeof mc.mode === "string") {
           if (keyed) {
-            if (["observe", "audit", "standard", "strict"].includes(mc.mode)) {
+            if (isModeValue(mc.mode)) {
               mergedSettings.mode = mc.mode;
             }
           } else {
@@ -10426,6 +11361,13 @@ function getConfig(cwd) {
           mergedPolicy.trustedHostsManaged = true;
           mergedPolicy.trustedHosts = mc.trustedHosts.filter((h) => typeof h === "string").map((h) => normalizeHost2(h));
         }
+        if (mc.appLinks && typeof mc.appLinks === "object" && !Array.isArray(mc.appLinks)) {
+          const links = {};
+          for (const [key, slug2] of Object.entries(mc.appLinks)) {
+            if (typeof slug2 === "string" && /^[a-z0-9-]{1,40}$/.test(slug2)) links[key] = slug2;
+          }
+          mergedPolicy.appLinks = links;
+        }
         if (mc.appPermissions && typeof mc.appPermissions === "object" && !Array.isArray(mc.appPermissions)) {
           const coerced = {};
           for (const [srv, tools] of Object.entries(mc.appPermissions)) {
@@ -10524,14 +11466,15 @@ function getConfig(cwd) {
   const envMode = process.env.NODE9_MODE;
   if (envMode && !modeCloudControlled && // PR-2: one listening point includes the env var — a keyed machine's
   // mode comes from the workspace (or the shipped default), never the shell.
-  !keyed && ["observe", "audit", "standard", "strict"].includes(envMode)) {
+  !keyed && isModeValue(envMode)) {
     mergedSettings.mode = envMode;
   }
-  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && (mergedSettings.mode === "observe" || mergedSettings.mode === "audit")) {
+  if ((cloudManagedShields.length > 0 || cloudMandatesEnforcement) && !modeCloudControlled && !modeCloudStaged && isRecordOnly(mergedSettings.mode)) {
     mergedSettings.mode = "standard";
   }
-  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && mergedSettings.mode === "strict";
-  if (modeCloudControlled && mergedSettings.mode === "strict") {
+  const cloudStrictLevel = levelOf(mergedSettings.mode) === "strict" || levelOf(mergedSettings.mode) === "block-all";
+  const managedFloorActive = cloudManagedShields.length > 0 || cloudMandatesEnforcement || modeCloudControlled && cloudStrictLevel;
+  if (modeCloudControlled && cloudStrictLevel) {
     for (const name of Object.keys(mergedEnvironments)) {
       if (mergedEnvironments[name]?.requireApproval === false) {
         const cleaned = { ...mergedEnvironments[name] };
@@ -10549,6 +11492,35 @@ function getConfig(cwd) {
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
   mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
   const resolvedSsrfStrictSource = keyed && ssrfStrictSource === "local" ? "default" : ssrfStrictSource;
+  const level = levelOf(mergedSettings.mode);
+  const levelKnobChecks = Object.entries(levelChecks(level)).filter(([id]) => isKnobGoverned(id));
+  const signals = levelPackageSignals(level);
+  if (levelKnobChecks.length > 0 || signals) {
+    const policyOf = (layer) => layer?.policy ?? {};
+    const trusted = /* @__PURE__ */ new Set([...managedStatedChecks, ...Object.keys(workspaceChecks)]);
+    const trustedSignals = new Set(managedStatedSignals);
+    const project = /* @__PURE__ */ new Set();
+    const projectSignals = /* @__PURE__ */ new Set();
+    if (!keyed) {
+      for (const id of knobStatedChecks(policyOf(globalConfig))) trusted.add(id);
+      for (const k of statedSignalFields(policyOf(globalConfig))) trustedSignals.add(k);
+      for (const id of knobStatedChecks(policyOf(projectConfig))) project.add(id);
+      for (const k of statedSignalFields(policyOf(projectConfig))) projectSignals.add(k);
+    }
+    const before = resolveCheckMap(catalogSettingsFromConfig({}, mergedPolicy));
+    for (const [id, v] of levelKnobChecks) {
+      if (trusted.has(id)) continue;
+      if (project.has(id) && CHECK_VERDICT_RANK[v] <= CHECK_VERDICT_RANK[before[id] ?? "off"])
+        continue;
+      checkToLegacyPolicy(mergedPolicy, id, v);
+    }
+    if (signals) {
+      for (const key of ["newPackage", "installScript"]) {
+        if (trustedSignals.has(key) || projectSignals.has(key)) continue;
+        mergedPolicy.packageCheck[key] = signals[key];
+      }
+    }
+  }
   const explicit = {};
   const checkSources = {};
   if (keyed) {
@@ -10726,6 +11698,7 @@ var init_config = __esm({
     init_build();
     init_trusted_hosts();
     init_dist();
+    init_dist();
     init_v2();
     init_dist();
     init_dist();
@@ -10859,7 +11832,9 @@ var init_config = __esm({
                 op: "matches",
                 // Single spaces on purpose: a nested `\\s+` inside the alternation
                 // fails the engine's ReDoS check and the rule would be dropped.
-                value: "(^|&&|\\|\\||;)\\s*(npx )?node9 (session-(exposure|taint) clear|trust (add|recipient add)|pause|shield (disable|set)|egress allow|approver set)\\b",
+                // `apps`: turning an app off, allowing one of its actions, or
+                // linking a server to an app (the general checks leave it).
+                value: "(^|&&|\\|\\||;)\\s*(npx )?node9 (session-(exposure|taint) clear|trust (add|recipient add)|pause|shield (disable|set)|apps (link|[a-z0-9-]{1,32} (off|[a-z]{1,32} allow))|egress allow|approver set)\\b",
                 flags: "i"
               }
             ],
@@ -10945,7 +11920,12 @@ var init_config = __esm({
             verdict: "block",
             reason: "Piping remote script into a shell is a supply-chain attack vector",
             description: "The AI wants to download a script from the internet and run it immediately, without you seeing what it contains. This is one of the most common ways malware gets installed."
-          }
+          },
+          // ── Actions in apps (node9Firewall#390) ───────────────────────────────
+          // actions.money / actions.access / actions.publish: the action templates
+          // on every MCP server no app shield claims, plus the shell publishing
+          // rules. Review by default; the check value governs them.
+          ...GENERAL_ACTION_RULES
         ],
         dlp: { enabled: true, scanIgnoredTools: true, pii: "block" },
         egress: {
@@ -10982,6 +11962,7 @@ var init_config = __esm({
         trustedHosts: [],
         trustedHostsManaged: false,
         appPermissions: {},
+        appLinks: {},
         managedJailPaths: []
       },
       environments: {}
@@ -12021,6 +13002,7 @@ var init_provenance = __esm({
 var init_policy = __esm({
   "src/policy/index.ts"() {
     "use strict";
+    init_dist();
     init_dlp();
     init_file_access();
     init_config();
@@ -13532,7 +14514,7 @@ function loadShieldStatus() {
       cfg.policySource === "workspace" ? cfg.policy.appliedShields ?? [] : readActiveShields()
     );
     const active = all.filter((n) => activeSet.has(n));
-    const inactive = all.filter((n) => !activeSet.has(n) && !ACTION_SHIELD_NAMES.has(n));
+    const inactive = all.filter((n) => !activeSet.has(n) && !APP_SHIELD_NAMES.has(n));
     return { active, inactive };
   } catch {
     return { active: [], inactive: [] };