@node9/proxy 2.37.1 → 2.39.0

package/dist/scan-ink.mjs

@@ -67,7 +67,8 @@ var SmartConditionSchema = z.object({
     }
   ),
   value: z.string().optional(),
-  flags: z.string().optional()
+  flags: z.string().optional(),
+  reading: z.enum(["access"]).optional()
 }).refine(
   (c) => {
     if (c.op === "matchesGlob" || c.op === "notMatchesGlob") return c.value !== void 0;
@@ -78,6 +79,9 @@ var SmartConditionSchema = z.object({
 var SmartRuleSchema = z.object({
   name: z.string().optional(),
   tool: z.string().min(1, "Smart rule tool must not be empty"),
+  // Scope to an MCP server label (glob), or keep off one (node9Firewall#390).
+  server: z.string().min(1).optional(),
+  notServer: z.string().min(1).optional(),
   conditions: z.array(SmartConditionSchema).min(1, "Smart rule must have at least one condition"),
   conditionMode: z.enum(["all", "any"]).optional(),
   verdict: z.enum(["allow", "review", "block"], {
@@ -98,7 +102,8 @@ var SmartRuleSchema = z.object({
 var ConfigFileSchema = z.object({
   version: z.string().optional(),
   settings: z.object({
-    mode: z.enum(["standard", "strict", "audit", "observe"]).optional(),
+    // The protection level (levels.ts in the engine); `observe` is Audit's older name.
+    mode: z.enum(["observe", "audit", "soft", "standard", "strict", "block-all"]).optional(),
     autoStartDaemon: z.boolean().optional(),
     // enableUndo / policy.snapshot: removed with the undo feature. The
     // schema strips undeclared keys silently (plain zod object — no
@@ -236,12 +241,24 @@ import picomatch from "picomatch";
 import safeRegex from "safe-regex2";
 import pm from "picomatch";
 import mvdanSh from "mvdan-sh";
-import safeRegex2 from "safe-regex2";
 import mvdanSh2 from "mvdan-sh";
-import safeRegex3 from "safe-regex2";
+import safeRegex2 from "safe-regex2";
 import { createHash as createHash2 } from "crypto";
 import mvdanSh3 from "mvdan-sh";
 import mvdanSh4 from "mvdan-sh";
+var MAX_REGEX_LENGTH = 256;
+function validateRegex(pattern) {
+  if (!pattern) return "Pattern is required";
+  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return `Invalid regex syntax: ${e.message}`;
+  }
+  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
+  if (!safeRegex(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
+  return null;
+}
 var aws_default = {
   name: "aws",
   description: "Protects AWS infrastructure from destructive AI operations",
@@ -543,77 +560,6 @@ var filesystem_default = {
   ],
   dangerousWords: ["wipefs"]
 };
-var finance_default = {
-  name: "finance",
-  description: "Asks before money moves through a payment or banking app (refunds, payouts, transfers, charges, invoices), whatever the request said. Reads are never asked about.",
-  aliases: ["payments", "money"],
-  smartRules: [
-    {
-      name: "shield:finance:review-refund",
-      tool: "{,mcp__*__}{create_refund,refund_payment,refund_charge,refund_order,issue_refund}",
-      conditions: [],
-      verdict: "review",
-      reason: "A refund returns money to a customer. node9 asks before money moves, whatever the request said (Finance shield)."
-    },
-    {
-      name: "shield:finance:review-payout",
-      tool: "{,mcp__*__}{create_payout,send_payout,payout,create_payouts_batch}",
-      conditions: [],
-      verdict: "review",
-      reason: "A payout moves the balance to a bank account. node9 asks before money moves (Finance shield)."
-    },
-    {
-      name: "shield:finance:review-transfer",
-      tool: "{,mcp__*__}{transfer_create,transfer_authorization_create,create_transfer,transfer_money,transfer_funds,send_money,wire_transfer,create_wire,schedule_transaction,update_scheduled_transaction,create_transaction}",
-      conditions: [],
-      verdict: "review",
-      reason: "A transfer moves money between accounts. node9 asks before money moves (Finance shield)."
-    },
-    {
-      name: "shield:finance:review-charge",
-      tool: "{,mcp__*__}{create_payment_intent,confirm_payment_intent,capture_payment_intent,create_charge,create_payment,capture_payment,capture_order,create_order,authorize_order,create_checkout_session}",
-      conditions: [],
-      verdict: "review",
-      reason: "This charges a card or captures a payment. node9 asks before money moves (Finance shield)."
-    },
-    {
-      name: "shield:finance:review-payment-link",
-      tool: "{,mcp__*__}{create_payment_link,create_invoice,finalize_invoice,send_invoice,pay_invoice,create_invoice_item}",
-      conditions: [],
-      verdict: "review",
-      reason: "This bills someone or creates a link that charges a card. node9 asks before money moves (Finance shield)."
-    },
-    {
-      name: "shield:finance:review-subscription",
-      tool: "{,mcp__*__}{create_subscription,cancel_subscription,update_subscription,pause_subscription,resume_subscription}",
-      conditions: [],
-      verdict: "review",
-      reason: "A subscription starts or stops recurring charges. node9 asks before money moves (Finance shield)."
-    },
-    {
-      name: "shield:finance:review-dispute",
-      tool: "{,mcp__*__}{update_dispute,accept_dispute,close_dispute}",
-      conditions: [],
-      verdict: "review",
-      reason: "This answers or concedes a chargeback. node9 asks before money moves (Finance shield)."
-    },
-    {
-      name: "shield:finance:review-card",
-      tool: "{,mcp__*__}{issue_card,create_virtual_card,create_issuing_card,update_card_limit}",
-      conditions: [],
-      verdict: "review",
-      reason: "This issues a card or changes its limit. node9 asks before money moves (Finance shield)."
-    },
-    {
-      name: "shield:finance:review-withdraw",
-      tool: "{,mcp__*__}{withdraw,withdraw_funds,create_withdrawal,request_withdrawal}",
-      conditions: [],
-      verdict: "review",
-      reason: "A withdrawal moves money out. node9 asks before money moves (Finance shield)."
-    }
-  ],
-  dangerousWords: []
-};
 var github_default = {
   name: "github",
   description: "Protects GitHub repositories from destructive AI operations",
@@ -640,56 +586,6 @@ var github_default = {
   ],
   dangerousWords: []
 };
-var identity_default = {
-  name: "identity",
-  description: "Asks before a password, a key, a token, a role or a user changes in an identity or admin app, whatever the request said. Reads are never asked about.",
-  aliases: ["access", "iam"],
-  smartRules: [
-    {
-      name: "shield:identity:review-password",
-      tool: "{,mcp__*__}{change_password,update_password,reset_password,set_password,expire_password,force_password_reset}",
-      conditions: [],
-      verdict: "review",
-      reason: "This changes or resets a password. node9 asks before credentials change, whatever the request said (Identity shield)."
-    },
-    {
-      name: "shield:identity:review-key",
-      tool: "{,mcp__*__}{rotate_key,rotate_api_key,create_api_key,create_token,create_access_token,create_personal_access_token,regenerate_secret,rotate_secret,create_service_account_key,create_credential}",
-      conditions: [],
-      verdict: "review",
-      reason: "This creates or rotates a key, token or secret. node9 asks before credentials change (Identity shield)."
-    },
-    {
-      name: "shield:identity:review-access",
-      tool: "{,mcp__*__}{grant_access,grant_permission,grant_role,revoke_access,revoke_permission,revoke_role,revoke_token,set_permission,set_permissions,set_role,assign_role,update_role,add_permission,remove_permission,attach_policy,detach_policy}",
-      conditions: [],
-      verdict: "review",
-      reason: "This grants or revokes access. node9 asks before access changes (Identity shield)."
-    },
-    {
-      name: "shield:identity:review-membership",
-      tool: "{,mcp__*__}{add_member,remove_member,add_user_to_group,remove_user_from_group,add_collaborator,remove_collaborator,invite_user,invite_member,invite_user_to_slack,invite_users,add_org_member,remove_org_member,add_team_member,remove_team_member}",
-      conditions: [],
-      verdict: "review",
-      reason: "This changes who belongs where. node9 asks before membership changes (Identity shield)."
-    },
-    {
-      name: "shield:identity:review-user",
-      tool: "{,mcp__*__}{create_user,delete_user,deactivate_user,suspend_user,activate_user,unlock_user,make_admin,promote_user,demote_user,update_user_role}",
-      conditions: [],
-      verdict: "review",
-      reason: "This creates, removes or promotes an account. node9 asks before accounts change (Identity shield)."
-    },
-    {
-      name: "shield:identity:review-mfa",
-      tool: "{,mcp__*__}{reset_mfa,reset_factors,disable_mfa,enroll_factor,deactivate_factor}",
-      conditions: [],
-      verdict: "review",
-      reason: "This changes a second factor. node9 asks before credentials change (Identity shield)."
-    }
-  ],
-  dangerousWords: []
-};
 var k8s_default = {
   name: "k8s",
   description: "Protects Kubernetes clusters from destructive AI operations",
@@ -942,7 +838,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim?|emacs|code|type|[ef]?grep|rg|ag|ack|g?awk|sed|cut|tr|[jy]q|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development)){0,2}(?=[\\s;&|>)<]|$)",
           flags: "i"
         }
       ],
@@ -956,7 +852,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim?|emacs|code|type|[ef]?grep|rg|ag|ack|g?awk|sed|cut|tr|[jy]q|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -1022,6 +918,206 @@ var project_jail_default = {
   ],
   dangerousWords: []
 };
+var redis_default = {
+  name: "redis",
+  description: "Protects Redis instances from destructive AI operations",
+  aliases: [],
+  _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
+  smartRules: [
+    {
+      name: "shield:redis:block-flushall",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "FLUSHALL deletes every key in every database \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:block-flushdb",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "FLUSHDB deletes all keys in the current database \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:block-config-resetstat",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
+          flags: "i"
+        }
+      ],
+      verdict: "block",
+      reason: "CONFIG RESETSTAT resets server statistics irreversibly \u2014 blocked by Redis shield"
+    },
+    {
+      name: "shield:redis:review-config-set",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
+    },
+    {
+      name: "shield:redis:review-del-wildcard",
+      tool: "*",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "Wildcard key deletion requires human approval (Redis shield)"
+    }
+  ],
+  dangerousWords: ["FLUSHALL", "FLUSHDB"]
+};
+var finance_default = {
+  name: "finance",
+  description: "Asks before money moves through a payment or banking app (refunds, payouts, transfers, charges, invoices), whatever the request said. Reads are never asked about.",
+  aliases: ["payments", "money"],
+  smartRules: [
+    {
+      name: "shield:finance:review-refund",
+      tool: "{,mcp__*__}{create_refund,refund_payment,refund_charge,refund_order,issue_refund}",
+      conditions: [],
+      verdict: "review",
+      reason: "A refund returns money to a customer. node9 asks before money moves, whatever the request said (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-payout",
+      tool: "{,mcp__*__}{create_payout,send_payout,payout,create_payouts_batch}",
+      conditions: [],
+      verdict: "review",
+      reason: "A payout moves the balance to a bank account. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-transfer",
+      tool: "{,mcp__*__}{transfer_create,transfer_authorization_create,create_transfer,transfer_money,transfer_funds,send_money,wire_transfer,create_wire,schedule_transaction,update_scheduled_transaction}",
+      conditions: [],
+      verdict: "review",
+      reason: "A transfer moves money between accounts. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-charge",
+      tool: "{,mcp__*__}{create_payment_intent,confirm_payment_intent,capture_payment_intent,create_charge,create_payment,capture_payment,capture_order,create_order,authorize_order,create_checkout_session}",
+      conditions: [],
+      verdict: "review",
+      reason: "This charges a card or captures a payment. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-payment-link",
+      tool: "{,mcp__*__}{create_payment_link,create_invoice,finalize_invoice,send_invoice,pay_invoice,create_invoice_item}",
+      conditions: [],
+      verdict: "review",
+      reason: "This bills someone or creates a link that charges a card. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-subscription",
+      tool: "{,mcp__*__}{create_subscription,cancel_subscription,update_subscription,pause_subscription,resume_subscription}",
+      conditions: [],
+      verdict: "review",
+      reason: "A subscription starts or stops recurring charges. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-dispute",
+      tool: "{,mcp__*__}{update_dispute,accept_dispute,close_dispute}",
+      conditions: [],
+      verdict: "review",
+      reason: "This answers or concedes a chargeback. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-card",
+      tool: "{,mcp__*__}{issue_card,create_virtual_card,create_issuing_card,update_card_limit}",
+      conditions: [],
+      verdict: "review",
+      reason: "This issues a card or changes its limit. node9 asks before money moves (Finance shield)."
+    },
+    {
+      name: "shield:finance:review-withdraw",
+      tool: "{,mcp__*__}{withdraw,withdraw_funds,create_withdrawal,request_withdrawal}",
+      conditions: [],
+      verdict: "review",
+      reason: "A withdrawal moves money out. node9 asks before money moves (Finance shield)."
+    }
+  ],
+  dangerousWords: []
+};
+var identity_default = {
+  name: "identity",
+  description: "Asks before a password, a key, a token, a role or a user changes in an identity or admin app, whatever the request said. Reads are never asked about.",
+  aliases: ["access", "iam"],
+  smartRules: [
+    {
+      name: "shield:identity:review-password",
+      tool: "{,mcp__*__}{change_password,update_password,reset_password,set_password,expire_password,force_password_reset}",
+      conditions: [],
+      verdict: "review",
+      reason: "This changes or resets a password. node9 asks before credentials change, whatever the request said (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-key",
+      tool: "{,mcp__*__}{rotate_key,rotate_api_key,create_api_key,create_token,create_access_token,create_personal_access_token,regenerate_secret,rotate_secret,create_service_account_key,create_credential}",
+      conditions: [],
+      verdict: "review",
+      reason: "This creates or rotates a key, token or secret. node9 asks before credentials change (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-access",
+      tool: "{,mcp__*__}{grant_access,grant_permission,grant_role,revoke_access,revoke_permission,revoke_role,revoke_token,set_permission,set_permissions,set_role,assign_role,update_role,add_permission,remove_permission,attach_policy,detach_policy,share_file}",
+      conditions: [],
+      verdict: "review",
+      reason: "This grants or revokes access. node9 asks before access changes (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-membership",
+      tool: "{,mcp__*__}{add_member,remove_member,add_user_to_group,remove_user_from_group,add_collaborator,remove_collaborator,invite_user,invite_member,invite_user_to_slack,invite_users,add_org_member,remove_org_member,add_team_member,remove_team_member,add_user_to_channel,remove_user_from_slack}",
+      conditions: [],
+      verdict: "review",
+      reason: "This changes who belongs where. node9 asks before membership changes (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-user",
+      tool: "{,mcp__*__}{create_user,delete_user,delete_deactivated_user,deactivate_user,suspend_user,activate_user,unlock_user,make_admin,promote_user,demote_user,update_user_role}",
+      conditions: [],
+      verdict: "review",
+      reason: "This creates, removes or promotes an account. node9 asks before accounts change (Identity shield)."
+    },
+    {
+      name: "shield:identity:review-mfa",
+      tool: "{,mcp__*__}{reset_mfa,reset_factors,disable_mfa,enroll_factor,deactivate_factor}",
+      conditions: [],
+      verdict: "review",
+      reason: "This changes a second factor. node9 asks before credentials change (Identity shield)."
+    }
+  ],
+  dangerousWords: []
+};
 var publishing_default = {
   name: "publishing",
   description: "Asks before something goes public or ships outside the organisation (a release, a package, a deploy, a post), whatever the request said. The same switch covers the shell commands that publish.",
@@ -1106,170 +1202,634 @@ var publishing_default = {
     },
     {
       name: "shield:publishing:review-python-publish",
-      tool: "bash",
-      conditions: [
-        {
-          field: "command",
-          op: "matches",
-          value: "(?:^|[^\\w-])(?:poetry|uv|hatch|flit)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
-          flags: "i"
-        }
-      ],
-      verdict: "review",
-      reason: "This publishes the Python package to PyPI. node9 asks before publishing (Publishing shield)."
-    },
-    {
-      name: "shield:publishing:review-release-tool-publish",
-      tool: "bash",
-      conditions: [
-        {
-          field: "command",
-          op: "matches",
-          value: "(?:^|[^\\w-])(?:lerna|changeset|vsce|ovsx)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
-          flags: "i"
-        }
-      ],
-      verdict: "review",
-      reason: "This publishes packages or an editor extension through a release tool. node9 asks before publishing (Publishing shield)."
-    },
-    {
-      name: "shield:publishing:review-cargo-publish",
-      tool: "bash",
-      conditions: [
-        {
-          field: "command",
-          op: "matches",
-          value: "(?:^|[^\\w-])(?:cargo)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
-          flags: "i"
-        }
-      ],
-      verdict: "review",
-      reason: "cargo publish ships the crate. node9 asks before publishing (Publishing shield)."
-    },
-    {
-      name: "shield:publishing:review-gem-push",
-      tool: "bash",
-      conditions: [
-        {
-          field: "command",
-          op: "matches",
-          value: "(?:^|[^\\w-])(?:gem)(?![\\w-])[^;&|]{0,200}?\\s(?:push)(?![\\w-])",
-          flags: "i"
-        }
-      ],
-      verdict: "review",
-      reason: "gem push publishes to RubyGems. node9 asks before publishing (Publishing shield)."
-    },
-    {
-      name: "shield:publishing:review-docker-push",
-      tool: "bash",
-      conditions: [
-        {
-          field: "command",
-          op: "matches",
-          value: "(?:^|[^\\w-])(?:docker|podman)(?![\\w-])[^;&|]{0,200}?\\s(?:push|--push)(?![\\w-])",
-          flags: "i"
-        }
-      ],
-      verdict: "review",
-      reason: "docker push publishes the image to a registry. node9 asks before publishing (Publishing shield)."
-    },
-    {
-      name: "shield:publishing:review-gh-release",
-      tool: "bash",
-      conditions: [
-        {
-          field: "command",
-          op: "matches",
-          value: "(?:^|[^\\w-])(?:gh)(?![\\w-])[^;&|]{0,200}?\\srelease\\s+(?:create|upload|edit)(?![\\w-])",
-          flags: "i"
-        }
-      ],
-      verdict: "review",
-      reason: "gh release ships a release on GitHub. node9 asks before publishing (Publishing shield)."
-    }
-  ],
-  dangerousWords: []
-};
-var redis_default = {
-  name: "redis",
-  description: "Protects Redis instances from destructive AI operations",
-  aliases: [],
-  _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
-  smartRules: [
+      tool: "bash",
+      conditions: [
+        {
+          field: "command",
+          op: "matches",
+          value: "(?:^|[^\\w-])(?:poetry|uv|hatch|flit)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
+          flags: "i"
+        }
+      ],
+      verdict: "review",
+      reason: "This publishes the Python package to PyPI. node9 asks before publishing (Publishing shield)."
+    },
     {
-      name: "shield:redis:block-flushall",
-      tool: "*",
+      name: "shield:publishing:review-release-tool-publish",
+      tool: "bash",
       conditions: [
         {
           field: "command",
           op: "matches",
-          value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
+          value: "(?:^|[^\\w-])(?:lerna|changeset|vsce|ovsx)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
           flags: "i"
         }
       ],
-      verdict: "block",
-      reason: "FLUSHALL deletes every key in every database \u2014 blocked by Redis shield"
+      verdict: "review",
+      reason: "This publishes packages or an editor extension through a release tool. node9 asks before publishing (Publishing shield)."
     },
     {
-      name: "shield:redis:block-flushdb",
-      tool: "*",
+      name: "shield:publishing:review-cargo-publish",
+      tool: "bash",
       conditions: [
         {
           field: "command",
           op: "matches",
-          value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
+          value: "(?:^|[^\\w-])(?:cargo)(?![\\w-])[^;&|]{0,200}?\\s(?:publish)(?![\\w-])",
           flags: "i"
         }
       ],
-      verdict: "block",
-      reason: "FLUSHDB deletes all keys in the current database \u2014 blocked by Redis shield"
+      verdict: "review",
+      reason: "cargo publish ships the crate. node9 asks before publishing (Publishing shield)."
     },
     {
-      name: "shield:redis:block-config-resetstat",
-      tool: "*",
+      name: "shield:publishing:review-gem-push",
+      tool: "bash",
       conditions: [
         {
           field: "command",
           op: "matches",
-          value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
+          value: "(?:^|[^\\w-])(?:gem)(?![\\w-])[^;&|]{0,200}?\\s(?:push)(?![\\w-])",
           flags: "i"
         }
       ],
-      verdict: "block",
-      reason: "CONFIG RESETSTAT resets server statistics irreversibly \u2014 blocked by Redis shield"
+      verdict: "review",
+      reason: "gem push publishes to RubyGems. node9 asks before publishing (Publishing shield)."
     },
     {
-      name: "shield:redis:review-config-set",
-      tool: "*",
+      name: "shield:publishing:review-docker-push",
+      tool: "bash",
       conditions: [
         {
           field: "command",
           op: "matches",
-          value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
+          value: "(?:^|[^\\w-])(?:docker|podman)(?![\\w-])[^;&|]{0,200}?\\s(?:push|--push)(?![\\w-])",
           flags: "i"
         }
       ],
       verdict: "review",
-      reason: "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
+      reason: "docker push publishes the image to a registry. node9 asks before publishing (Publishing shield)."
     },
     {
-      name: "shield:redis:review-del-wildcard",
-      tool: "*",
+      name: "shield:publishing:review-gh-release",
+      tool: "bash",
       conditions: [
         {
           field: "command",
           op: "matches",
-          value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
+          value: "(?:^|[^\\w-])(?:gh)(?![\\w-])[^;&|]{0,200}?\\srelease\\s+(?:create|upload|edit)(?![\\w-])",
           flags: "i"
         }
       ],
       verdict: "review",
-      reason: "Wildcard key deletion requires human approval (Redis shield)"
+      reason: "gh release ships a release on GitHub. node9 asks before publishing (Publishing shield)."
     }
   ],
-  dangerousWords: ["FLUSHALL", "FLUSHDB"]
+  dangerousWords: []
+};
+var ACTION_TEMPLATES = {
+  finance: finance_default.smartRules,
+  identity: identity_default.smartRules,
+  publishing: publishing_default.smartRules
+};
+var ACTION_CHECKS = {
+  finance: { checkId: "actions.money", slug: "money", label: "Money check" },
+  identity: { checkId: "actions.access", slug: "access", label: "Accounts and access check" },
+  publishing: { checkId: "actions.publish", slug: "publish", label: "Publishing check" }
+};
+function isToolRule(rule) {
+  return rule.tool.startsWith("{,mcp__*__}");
+}
+function actionPart(ruleName) {
+  const m = /^shield:[^:]+:(.+)$/.exec(ruleName ?? "");
+  return m ? m[1] : ruleName ?? "rule";
+}
+function ownReason(reason, owner) {
+  if (!reason) return reason;
+  return reason.replace(/\((?:Finance|Identity|Publishing) shield\)\.?$/, `(${owner}).`);
+}
+var GAP = "[^;&|]{0,200}?";
+var prog = (alt) => `(?:^|[^\\w-])(?:${alt})(?![\\w-])`;
+var httpTo = (host2) => prog("curl|wget|http|https|xh") + "[^;&|]{0,400}?" + host2;
+var httpWrite = (methods) => ({
+  field: "command",
+  op: "matches",
+  value: `-X\\s*(?:${methods})|--(?:request|method)[=\\s]+(?:${methods})|--post-(?:data|file)|\\s(?:${methods}|${methods.toLowerCase()})\\s|^(?!.*\\s(?:-[a-zA-Z]*G|--get)(?![\\w-])).*(?:\\s-d[\\s'"@]|\\s--data|\\s--json\\s|\\s-F\\s|\\s--form\\s)`
+});
+var HTTP_WRITE = httpWrite("POST|DELETE");
+var HTTP_WRITE_ANY = httpWrite("POST|PUT|PATCH|DELETE");
+var NOT_STRIPE_TEST = {
+  field: "command",
+  op: "notMatches",
+  value: "\\b[sr]k_test_"
 };
+var postTo = (host2) => `\\.post\\(\\s*["'\`][^"'\`]{0,80}${host2}`;
+var STRIPE_OBJECTS = "refunds|payouts|charges|transfers|payment_intents|payment_links|invoices|subscriptions|topups";
+var APP_SHIELD_SPECS = [
+  {
+    name: "stripe",
+    label: "Stripe",
+    description: "Asks before money moves in Stripe (refunds, payouts, charges, invoices, subscriptions), whether the agent uses the Stripe MCP server, the stripe CLI, the API or the Stripe library in a script. Reads are never asked about.",
+    template: "finance",
+    server: "*stripe*",
+    doors: [
+      {
+        name: "shield:stripe:review-cli",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            value: prog("stripe") + GAP + `\\s(?:${STRIPE_OBJECTS})\\s+(?:create|cancel|capture|confirm|update|pay|finalize_invoice|send_invoice|void_invoice)(?![\\w-])`,
+            flags: "i"
+          },
+          {
+            field: "command",
+            op: "matches",
+            // The stripe CLI works in test mode unless told otherwise.
+            value: "\\s--live(?![\\w-])|\\b[sr]k_live_"
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "The stripe CLI is about to move money. node9 asks before money moves (Stripe)."
+      },
+      {
+        name: "shield:stripe:review-cli-request",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            value: prog("stripe") + GAP + `\\s(?:post|delete)\\s+/?v1/(?:${STRIPE_OBJECTS})(?![\\w-])`,
+            flags: "i"
+          },
+          {
+            field: "command",
+            op: "matches",
+            // The stripe CLI works in test mode unless told otherwise.
+            value: "\\s--live(?![\\w-])|\\b[sr]k_live_"
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "A raw stripe CLI request is about to move money. node9 asks before money moves (Stripe)."
+      },
+      {
+        name: "shield:stripe:review-api",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            value: httpTo(`api\\.stripe\\.com/v1/(?:${STRIPE_OBJECTS})(?![\\w-])`),
+            flags: "i"
+          },
+          HTTP_WRITE,
+          NOT_STRIPE_TEST
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "A request to the Stripe API is about to move money. node9 asks before money moves (Stripe)."
+      },
+      {
+        name: "shield:stripe:review-code",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Python: stripe.Refund.create(...)
+            value: "\\bstripe\\.(?:Refund|Payout|Transfer|Charge|PaymentIntent|PaymentLink|Invoice|Subscription|Topup)\\.(?:create|cancel|capture|confirm|modify|pay|finalize_invoice|send_invoice|void_invoice)\\b"
+          },
+          NOT_STRIPE_TEST
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "This code moves money through the Stripe library. node9 asks before money moves (Stripe)."
+      },
+      {
+        name: "shield:stripe:review-code-node",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Node: stripe.refunds.create(...)
+            value: "\\bstripe\\.(?:refunds|payouts|transfers|charges|paymentIntents|paymentLinks|invoices|subscriptions|topups)\\.(?:create|cancel|capture|confirm|update|pay|finalizeInvoice|sendInvoice|voidInvoice)\\s*\\("
+          },
+          NOT_STRIPE_TEST
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "This code moves money through the Stripe library. node9 asks before money moves (Stripe)."
+      },
+      {
+        name: "shield:stripe:review-code-http",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // requests.post("https://api.stripe.com/v1/refunds", ...)
+            value: `\\.post\\(\\s*["'\`][^"'\`]{0,80}api\\.stripe\\.com/v1/(?:${STRIPE_OBJECTS})`
+          },
+          NOT_STRIPE_TEST
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "This code posts to the Stripe API. node9 asks before money moves (Stripe)."
+      }
+    ]
+  },
+  {
+    name: "paypal",
+    label: "PayPal",
+    description: "Asks before money moves in PayPal (refunds, payouts, captured orders, invoices, subscriptions), whether the agent uses a PayPal MCP server, the API or the PayPal SDK in a script. The sandbox is never asked about, and neither are reads.",
+    template: "finance",
+    server: "*paypal*",
+    doors: [
+      {
+        name: "shield:paypal:review-api",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The live hosts only: api.paypal.com and api-m.paypal.com. The
+            // sandbox (api-m.sandbox.paypal.com) moves no money.
+            value: httpTo("api(?:-m)?\\.paypal\\.com/v[12]/"),
+            flags: "i"
+          },
+          {
+            field: "command",
+            op: "matches",
+            // The endpoints that move money.
+            value: "\\.paypal\\.com/v[12]/(?:payments/(?:captures|authorizations|sale|payouts|payment|referenced-payouts)|checkout/orders/[^\\s/]{1,64}/(?:capture|authorize)|invoicing/invoices|billing/subscriptions)",
+            flags: "i"
+          },
+          HTTP_WRITE
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "A request to the PayPal API is about to move money. node9 asks before money moves (PayPal)."
+      },
+      {
+        name: "shield:paypal:review-code",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The Node SDKs (checkout-server-sdk, paypal-server-sdk) and the
+            // Python paypalrestsdk.
+            value: "\\b(?:CapturesRefundRequest|OrdersCaptureRequest|AuthorizationsCaptureRequest|PayoutsPostRequest)\\b|\\b(?:captureOrder|refundCapturedPayment|captureAuthorizedPayment|createBatchPayout)\\s*\\(|\\bpaypalrestsdk\\.(?:Payout|Sale|Capture|Invoice|BillingAgreement)\\b"
+          }
+        ],
+        verdict: "review",
+        reason: "This code moves money through PayPal. node9 asks before money moves (PayPal)."
+      },
+      {
+        name: "shield:paypal:review-code-http",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The endpoints that move money; the token call every script
+            // starts with (/v1/oauth2/token) is not one.
+            value: postTo(
+              "api(?:-m)?\\.paypal\\.com/v[12]/(?:payments/(?:captures|authorizations|sale|payouts|payment|referenced-payouts)|checkout/orders/[^\\s/\"'`]{1,64}/(?:capture|authorize)|invoicing/invoices|billing/subscriptions)"
+            )
+          }
+        ],
+        verdict: "review",
+        reason: "This code posts to the PayPal API. node9 asks before money moves (PayPal)."
+      }
+    ]
+  },
+  {
+    name: "square",
+    label: "Square",
+    description: "Asks before money moves in Square (refunds, payments, paid orders, invoices, subscriptions), whether the agent uses a Square MCP server, the API or the Square SDK in a script. The sandbox host is never asked about, and neither are reads.",
+    template: "finance",
+    // Square's servers, never Squarespace (a website builder).
+    server: "{*square,*square[-_]*,*squareup*}",
+    mcpTools: [
+      {
+        // Square's official MCP server has one tool for every API call; the
+        // service and method name what it does.
+        name: "shield:square:review-mcp-request",
+        tool: "{,mcp__*__}make_api_request",
+        conditions: [
+          {
+            field: "service",
+            op: "matches",
+            value: "^(?:refunds|payments|orders|invoices|subscriptions|disputes|gift_cards|gift_card_activities|checkout|terminal)$",
+            flags: "i"
+          },
+          {
+            field: "method",
+            op: "notMatches",
+            value: "^(?:list|get|retrieve|search|batch_?retrieve|calculate)",
+            flags: "i"
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "A request through the Square MCP server is about to move money. node9 asks before money moves (Square)."
+      }
+    ],
+    doors: [
+      {
+        name: "shield:square:review-api",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The live host only; the sandbox is connect.squareupsandbox.com.
+            value: httpTo(
+              "connect\\.squareup\\.com/v2/(?:refunds|payments|orders/[^\\s/?]{1,64}/pay|invoices|subscriptions|disputes|gift-cards/activities)(?![\\w-]|/search)"
+            ),
+            flags: "i"
+          },
+          HTTP_WRITE_ANY
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "A request to the Square API is about to move money. node9 asks before money moves (Square)."
+      },
+      {
+        name: "shield:square:review-code",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The Square SDK in the script: Node (`square`) or Python (`square`, `squareup`).
+            value: `\\bSquareClient\\b|\\bsquare\\.client\\b|from\\s+square[.\\s]|from\\s+["']square["']|require\\(\\s*["']square["']`
+          },
+          {
+            field: "command",
+            op: "matches",
+            value: "\\.refunds(?:Api)?\\.refund(?:Payment|_payment)\\s*\\(|\\.payments(?:Api)?\\.(?:create|complete)(?:Payment|_payment)?\\s*\\(|\\.orders(?:Api)?\\.pay(?:Order|_order)?\\s*\\(|\\.invoices(?:Api)?\\.publish(?:Invoice|_invoice)?\\s*\\("
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "This code moves money through the Square SDK. node9 asks before money moves (Square)."
+      },
+      {
+        name: "shield:square:review-code-http",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            value: postTo(
+              "connect\\.squareup\\.com/v2/(?:refunds|payments|orders/[^\\s/?\"'`]{1,64}/pay|invoices|subscriptions|disputes|gift-cards/activities)(?![\\w-]|/search)"
+            )
+          }
+        ],
+        verdict: "review",
+        reason: "This code posts to the Square API. node9 asks before money moves (Square)."
+      }
+    ]
+  },
+  {
+    name: "plaid",
+    label: "Plaid",
+    description: "Asks before money moves through Plaid (transfers, transfer authorizations, payment initiation), whether the agent uses a Plaid MCP server, the API or the Plaid SDK in a script. The sandbox host is never asked about, and neither are reads such as balances or transactions.",
+    template: "finance",
+    server: "*plaid*",
+    doors: [
+      {
+        name: "shield:plaid:review-api",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Every Plaid endpoint is a POST, so the path is what tells a
+            // write; the live host only, never sandbox.plaid.com. A script
+            // that posts to the URL meets this door too.
+            value: httpTo(
+              "production\\.plaid\\.com/(?:transfer/(?:create|authorization/create|recurring/create)|payment_initiation/payment/create|bank_transfer/create)(?![\\w-])"
+            ),
+            flags: "i"
+          }
+        ],
+        verdict: "review",
+        reason: "A request to the Plaid API is about to move money. node9 asks before money moves (Plaid)."
+      },
+      {
+        name: "shield:plaid:review-code",
+        tool: "bash",
+        conditions: [
+          { field: "command", op: "matches", value: "\\bplaid", flags: "i" },
+          {
+            field: "command",
+            op: "matches",
+            value: "\\b(?:transfer(?:Authorization|Recurring)?Create|paymentInitiationPaymentCreate|bankTransferCreate|transfer_(?:authorization_|recurring_)?create|payment_initiation_payment_create|bank_transfer_create)\\s*\\("
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "This code moves money through Plaid. node9 asks before money moves (Plaid)."
+      }
+    ]
+  },
+  {
+    name: "okta",
+    label: "Okta",
+    description: "Asks before a user, a group member, a role, a password or a key changes in Okta, whether the agent uses an Okta MCP server, the API or the Okta SDK in a script. Reads and signing in are never asked about.",
+    template: "identity",
+    server: "*okta*",
+    doors: [
+      {
+        name: "shield:okta:review-api",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The management API only: sign-in (/api/v1/authn, /sessions,
+            // /oauth2) is not under these paths.
+            value: httpTo(
+              "[\\w-]+\\.okta(?:-emea)?\\.com/api/v1/(?:users|groups|apps|iam|api-tokens|idps|authorizationServers|policies)(?![\\w-])"
+            ),
+            flags: "i"
+          },
+          HTTP_WRITE_ANY
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "A request to the Okta API is about to change who has access. node9 asks before access changes (Okta)."
+      },
+      {
+        name: "shield:okta:review-code",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The Okta SDK in the script: a method named createUser alone is
+            // in half the applications ever written.
+            value: "@okta/okta-sdk|\\bokta\\.Client\\b|from\\s+okta[.\\s]|\\bimport\\s+okta\\b"
+          },
+          {
+            field: "command",
+            op: "matches",
+            value: "\\b(?:(?:create|delete|deactivate|suspend|unlock|activate)User|(?:reset|expire)Password|resetFactors|(?:assign|unassign)User(?:To|From)Group|assignRoleTo(?:User|Group))\\s*\\("
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "This code changes who has access in Okta. node9 asks before access changes (Okta)."
+      },
+      {
+        name: "shield:okta:review-code-py",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            value: "@okta/okta-sdk|\\bokta\\.Client\\b|from\\s+okta[.\\s]|\\bimport\\s+okta\\b"
+          },
+          {
+            field: "command",
+            op: "matches",
+            value: "\\b(?:(?:create|delete|deactivate|deactivate_or_delete|suspend|unlock|activate)_user|(?:reset|expire)_password|reset_factors|(?:add|remove)_user_(?:to|from)_group|assign_role_to_(?:user|group))\\s*\\("
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "This code changes who has access in Okta. node9 asks before access changes (Okta)."
+      }
+    ]
+  },
+  {
+    name: "auth0",
+    label: "Auth0",
+    description: "Asks before a user, a role, an application or its permissions change in Auth0, whether the agent uses an Auth0 MCP server, the auth0 CLI, the Management API or the Auth0 SDK in a script. Reads and signing in are never asked about.",
+    template: "identity",
+    server: "*auth0*",
+    mcpTools: [
+      {
+        // Auth0's official MCP server: applications (their secrets and
+        // callbacks), APIs and their scopes, and Actions (code that runs at
+        // every sign-in).
+        name: "shield:auth0:review-tenant-config",
+        tool: "{,mcp__*__}{auth0_create_application,auth0_update_application,auth0_create_resource_server,auth0_update_resource_server,auth0_create_action,auth0_update_action,auth0_deploy_action}",
+        conditions: [],
+        verdict: "review",
+        reason: "This changes an Auth0 application, API or sign-in Action. node9 asks before access changes (Auth0)."
+      }
+    ],
+    doors: [
+      {
+        name: "shield:auth0:review-cli",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            value: prog("auth0") + GAP + "\\s(?:(?:users|roles|apps|orgs)\\s+(?:create|update|delete|rm)|users\\s+roles\\s+(?:assign|add|remove|rm)|roles\\s+permissions\\s+(?:add|remove|rm)|users\\s+blocks\\s+unblock|api\\s+(?:post|put|patch|delete))(?![\\w-])",
+            flags: "i"
+          }
+        ],
+        verdict: "review",
+        reason: "The auth0 CLI is about to change who has access. node9 asks before access changes (Auth0)."
+      },
+      {
+        name: "shield:auth0:review-api",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The Management API only; /oauth/token is signing in.
+            value: httpTo(
+              "\\.auth0\\.com/api/v2/(?:users|roles|clients|grants|client-grants|organizations|tickets|jobs/users-imports|device-credentials)(?![\\w-])"
+            ),
+            flags: "i"
+          },
+          HTTP_WRITE_ANY
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "A request to the Auth0 Management API is about to change who has access. node9 asks before access changes (Auth0)."
+      },
+      {
+        name: "shield:auth0:review-code",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // The Auth0 SDK in the script (Node `auth0`, Python `auth0`).
+            value: `\\bManagementClient\\b|from\\s+auth0[.\\s]|from\\s+["']auth0["']|require\\(\\s*["']auth0["']`
+          },
+          {
+            field: "command",
+            op: "matches",
+            value: "\\.(?:users|roles|organizations|clients)\\.(?:create|delete|update|assignRoles|deleteRoles|assignUsers|addPermissions|deletePermissions|addMembers|deleteMembers|add_roles|remove_roles|add_users|add_permissions|remove_permissions)\\s*\\("
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "This code changes who has access in Auth0. node9 asks before access changes (Auth0)."
+      }
+    ]
+  }
+];
+function buildAppShield(spec) {
+  const owner = spec.label;
+  const toolRules = ACTION_TEMPLATES[spec.template].filter(isToolRule).map((rule) => ({
+    ...rule,
+    name: `shield:${spec.name}:${actionPart(rule.name)}`,
+    server: spec.server,
+    reason: ownReason(rule.reason, owner)
+  }));
+  const ownTools = (spec.mcpTools ?? []).map((rule) => ({
+    ...rule,
+    server: spec.server
+  }));
+  return {
+    name: spec.name,
+    description: spec.description,
+    aliases: [],
+    smartRules: [...toolRules, ...ownTools, ...spec.doors],
+    dangerousWords: []
+  };
+}
+var APP_SHIELDS = APP_SHIELD_SPECS.map(buildAppShield);
+var APP_SHIELD_NAMES = new Set(APP_SHIELD_SPECS.map((s) => s.name));
+var APP_SERVER_GLOB = `{${APP_SHIELD_SPECS.map((s) => s.server).join(",")}}`;
+function buildGeneralRules() {
+  const out = [];
+  for (const name of Object.keys(ACTION_TEMPLATES)) {
+    const { slug, label } = ACTION_CHECKS[name];
+    for (const rule of ACTION_TEMPLATES[name].filter(isToolRule)) {
+      const part = actionPart(rule.name).replace(/^review-/, "");
+      out.push({
+        ...rule,
+        name: `review-action-${slug}-${part}`,
+        notServer: APP_SERVER_GLOB,
+        reason: ownReason(rule.reason, label)
+      });
+    }
+  }
+  return out;
+}
+var GENERAL_ACTION_RULES = buildGeneralRules();
+function generalActionRuleNames(template) {
+  const { slug } = ACTION_CHECKS[template];
+  return GENERAL_ACTION_RULES.filter((r) => r.name?.startsWith(`review-action-${slug}-`)).map(
+    (r) => r.name
+  );
+}
 function validateShieldDefinition(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
     return { error: "Shield file is not an object" };
@@ -1288,36 +1848,36 @@ var BUILTIN_SHIELDS = {
   [bash_safe_default.name]: bash_safe_default,
   [docker_default.name]: docker_default,
   [filesystem_default.name]: filesystem_default,
-  // Dangerous actions as category shields (node9Firewall#385): an MCP app's
-  // money, credential and publishing tools, asked about whatever the request
-  // said. One glob per rule covers the bare name the gateway sends and the
-  // mcp__<server>__ name the agent hook sends.
-  [finance_default.name]: finance_default,
   [github_default.name]: github_default,
-  [identity_default.name]: identity_default,
   [k8s_default.name]: k8s_default,
   [mongodb_default.name]: mongodb_default,
   [postgres_default.name]: postgres_default,
   [project_jail_default.name]: project_jail_default,
-  [publishing_default.name]: publishing_default,
-  [redis_default.name]: redis_default
+  [redis_default.name]: redis_default,
+  // App shields generated from the action templates (node9Firewall#390): one
+  // per app, every door (MCP server, CLI, API, library), off by default.
+  ...Object.fromEntries(APP_SHIELDS.map((s) => [s.name, s]))
 };
-var ACTION_SHIELD_NAMES = /* @__PURE__ */ new Set([
-  "finance",
-  "identity",
-  "publishing"
-]);
 function assertBuiltinShieldRegexesAreSafe() {
-  for (const shield of Object.values(BUILTIN_SHIELDS)) {
+  const sets = [
+    ...Object.values(BUILTIN_SHIELDS).map((sh) => ({
+      name: sh.name,
+      smartRules: sh.smartRules
+    })),
+    ...Object.entries(ACTION_TEMPLATES).map(([name, smartRules]) => ({ name, smartRules })),
+    { name: "general-action-checks", smartRules: GENERAL_ACTION_RULES }
+  ];
+  for (const shield of sets) {
     for (const rule of shield.smartRules) {
       const conditions = rule.conditions ?? [];
       for (const cond of conditions) {
         if (cond.op !== "matches" && cond.op !== "notMatches") continue;
         const pattern = cond.value;
         if (!pattern) continue;
-        if (!safeRegex(pattern)) {
+        const problem = validateRegex(pattern);
+        if (problem) {
           throw new Error(
-            `[node9 engine] Shield '${shield.name}' rule '${rule.name ?? rule.tool}' has unsafe regex: ${pattern}`
+            `[node9 engine] Shield '${shield.name}' rule '${rule.name ?? rule.tool}' has a regex the runtime refuses (${problem}): ${pattern}`
           );
         }
       }
@@ -1348,9 +1908,9 @@ var CHECK_TEXT = {
   },
   // ── Commands ──────────────────────────────────────────────────────────────
   "commands.inline-exec": {
-    plain: "The agent runs a small program written inside the command itself.",
+    plain: "The agent runs a small program written inside the command itself, and node9 reads it: ordinary code runs, code that deletes, sends data out, runs other commands or reads protected files is held, and so is code node9 cannot read.",
     example: `node -e "require('fs').rmSync('dist', {recursive: true})"`,
-    advice: "Agents do this often for harmless tasks. Set Log if your team finds the review prompts noisy; keep Review if agents work near production."
+    advice: "Keep Review. Strict mode reviews every inline call, harmless or not; Log or Off only if inline code never reaches anything that matters."
   },
   "commands.eval-dynamic": {
     plain: "The agent runs code whose content is built at run time, so node9 cannot read it in advance.",
@@ -1382,6 +1942,21 @@ var CHECK_TEXT = {
     example: "chmod 777 deploy.sh",
     advice: "Keep Review. A narrower permission (755, 644) almost always does the job."
   },
+  "actions.money": {
+    plain: "The agent moves money (a refund, a payout, a transfer, a charge) through an app node9 has no protection for, such as an internal billing server.",
+    example: "refund_order on a server called acme-billing",
+    advice: "Keep Review. When the app is Stripe or PayPal, turn on its own protection instead: it covers the CLI, the API and scripts too, and a call from it no longer comes here."
+  },
+  "actions.access": {
+    plain: "The agent changes a password, a key, a role or who belongs to a team, through an app node9 has no protection for.",
+    example: "invite_user or grant_role on a company admin server",
+    advice: "Keep Review. Set Log on a sandbox workspace where agents manage test users all day."
+  },
+  "actions.publish": {
+    plain: "The agent publishes something outside the organisation (a release, a package, a deploy, a public post) through an app node9 has no protection for.",
+    example: "create_release or deploy_to_production on a company MCP server",
+    advice: "Keep Review. Set Log on a release machine whose pipeline publishes on purpose, never on a developer laptop."
+  },
   "commands.sudo": {
     plain: "The agent runs a command as the administrator (root).",
     example: "sudo apt-get install -y nginx",
@@ -1542,11 +2117,32 @@ var CHECK_TEXT = {
     advice: "Fixed at Block. A person accepts the change on the machine (node9 mcp pin update)."
   },
   "loading.malicious-package": {
-    plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only.",
+    plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only. A new release built from the same repository as the one before it (registry provenance) and an install script the package has always run do not stop; a release that lost the provenance its previous release had does.",
     example: "npm install of a package flagged as malware",
     advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
   }
 };
+var LEVELS = ["audit", "soft", "standard", "strict", "block-all"];
+var MODE_VALUES = ["observe", ...LEVELS];
+var STRICT = {
+  "commands.sql-ddl": "block",
+  "commands.disk-destroy": "block",
+  "commands.node9-disarm": "block",
+  "files.system-dirs": "block",
+  "files.shell-startup": "block",
+  "files.password-hashes": "block",
+  "data.secrets-weak": "block",
+  "data.pipe-chain": "block",
+  "network.unknown-host": "review",
+  "network.internal-addresses": "block",
+  "behavior.prompt-injection": "log",
+  "loading.skill-tamper": "block"
+};
+var BLOCK_ALL = {
+  ...STRICT,
+  "commands.unknown": "review",
+  "commands.temp-binary": "block"
+};
 var VERDICTS = ["off", "log", "review", "block"];
 var ALL = VERDICTS;
 var BUILTIN_DANGEROUS_WORDS = ["mkfs", "shred"];
@@ -1593,7 +2189,7 @@ var PRODUCT_CHECKS = [
     id: "commands.inline-exec",
     group: "commands",
     title: "Inline code execution",
-    catches: "node -e, python -c, bash -c, a heredoc into an interpreter",
+    catches: "inline code (python -c, node -e, a heredoc into an interpreter) that deletes, sends, opens a socket, runs commands, reads protected files or decodes and runs; unreadable inline code",
     values: ALL,
     defaultValue: "review",
     legacy: ["Node9 Standard (Inline Execution)"]
@@ -1950,6 +2546,38 @@ var PRODUCT_CHECKS = [
     values: ALL,
     defaultValue: "block",
     legacy: ["\u{1F4E6} Node9 Package Check (Malicious)", "\u{1F4E6} Node9 Package Check (Review)"]
+  },
+  // ── Actions in apps (node9Firewall#390) ──────────────────────────────────
+  // The safety net under the app shields: an action that moves money, changes
+  // access or publishes, on an MCP server no app shield claims (an internal
+  // billing server, a vendor with no shield, Zapier). Review by default; the
+  // rules come from the action templates (shields/apps.ts).
+  {
+    id: "actions.money",
+    group: "actions",
+    title: "Money moves",
+    catches: "a refund, payout, transfer, charge or withdrawal through an app with no protection of its own",
+    values: ALL,
+    defaultValue: "review",
+    legacy: generalActionRuleNames("finance")
+  },
+  {
+    id: "actions.access",
+    group: "actions",
+    title: "Accounts and access change",
+    catches: "a password, key, role, permission or user changed through an app with no protection of its own",
+    values: ALL,
+    defaultValue: "review",
+    legacy: generalActionRuleNames("identity")
+  },
+  {
+    id: "actions.publish",
+    group: "actions",
+    title: "Something is published",
+    catches: "a release, package, deploy or public post through an app with no protection of its own",
+    values: ALL,
+    defaultValue: "review",
+    legacy: generalActionRuleNames("publishing")
   }
 ];
 var SHIELD_RULE_NAME = /^shield:([^:]+):(block|review|allow)-(.+)$/;
@@ -2071,6 +2699,170 @@ var HOMOGLYPHS = {
   \u03A7: "X"
 };
 var HOMOGLYPH_RE = new RegExp(`[${Object.keys(HOMOGLYPHS).join("")}]`, "g");
+var SYSTEM_DIRS = [
+  "/usr",
+  "/etc",
+  "/boot",
+  "/bin",
+  "/sbin",
+  "/lib",
+  "/lib64",
+  "/var/log"
+];
+var UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
+var LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
+var MAX_INLINE_CODE = 64 * 1024;
+var OUTSIDE = String.raw`(?:~|\.\.[\\/]|/(?!(?:tmp|var/tmp)/(?![^'"\n]*\.\.)|dev/(?:null|stdout|stderr)\b))`;
+var pyImport = (mods) => new RegExp(String.raw`\b(?:import\s+(?:[\w.]+(?:\s+as\s+\w+)?\s*,\s*)*|from\s+)(?:${mods})\b`);
+var either = (...res) => new RegExp(res.map((r) => `(?:${r.source})`).join("|"), "m");
+var PYTHON = [
+  [
+    "deletes",
+    /\bos\.(?:remove|unlink|rmdir|removedirs)\s*\(|\bshutil\.rmtree\s*\(|\.(?:unlink|rmdir)\s*\(|\bfrom\s+(?:os|shutil)\s+import\s+[^\n]*\b(?:remove|unlink|rmdir|removedirs|rmtree)\b/
+  ],
+  [
+    "writes-outside",
+    new RegExp(
+      String.raw`\bopen\s*\(\s*[rRbBuU]?['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*(?:mode\s*=\s*)?[rRbB]?['"][^'"\n]*[wax+]|\bPath\s*\(\s*[rR]?['"]${OUTSIDE}[^'"\n]*['"]\s*\)\s*\.(?:write_text|write_bytes|touch|mkdir|symlink_to)\s*\(|\bshutil\.(?:copy\w*|move)\s*\([^)\n]*['"]${OUTSIDE}|\bos\.(?:rename|replace|symlink|link|truncate|makedirs|mkdir)\s*\([^)\n]*['"]${OUTSIDE}`
+    )
+  ],
+  [
+    "sends",
+    either(
+      pyImport(
+        String.raw`socket|requests|urllib2|urllib3|http\.client|httplib|smtplib|ftplib|paramiko|telnetlib|aiohttp|httpx|websockets?|xmlrpc|poplib|imaplib|pycurl|scapy`
+      ),
+      /\burllib\.request\b|\burlopen\s*\(|\bfrom\s+urllib\s+import\s+[^\n;]*\brequest\b|\basyncio\.open_connection\s*\(/
+    )
+  ],
+  [
+    "listens",
+    either(
+      pyImport(String.raw`pty|socketserver|http\.server`),
+      /\bpty\.spawn\s*\(|\.bind\s*\(\s*\(|\basyncio\.start_server\s*\(/
+    )
+  ],
+  [
+    "runs-commands",
+    either(
+      pyImport("subprocess|pexpect|commands|psutil"),
+      /\bos\.(?:system|popen|exec\w*|spawn\w*|posix_spawn\w*|fork|forkpty|kill|killpg)\s*\(|\bfrom\s+os\s+import\s+[^\n;]*\b(?:system|popen|exec\w*|spawn\w*|fork|kill)\b|\bfrom\s+(?:os|shutil|pty|ctypes)\s+import\s+\*/
+    )
+  ],
+  [
+    "builds-code",
+    /(?<![\w.])(?:exec|eval|compile|execfile)\s*\(|\b__import__\s*\(|\bimportlib\b|\b(?:c?pickle|dill|marshal|shelve)\.loads?\s*\(|\byaml\.(?:unsafe_)?load\s*\((?![^)\n]*SafeLoader)|\bctypes\b|\b(?:getattr|vars)\s*\(\s*(?:os|subprocess|shutil|socket|sys|pty|builtins|__builtins__)\b|\b(?:os|subprocess|shutil|socket|sys|pty|builtins)\.__dict__\b|\b__builtins__\b|\bsys\.modules\b|\bglobals\s*\(\s*\)\s*\[/
+  ],
+  [
+    // Spyware shapes: a screenshot, the clipboard, a key logger.
+    "monitors",
+    either(
+      pyImport(String.raw`pyperclip|pynput|keyboard|pyautogui|pyscreenshot|mss|clipboard`),
+      /\bImageGrab\b|\bpyautogui\.screenshot\b|\bscreencapture\b/
+    )
+  ],
+  [
+    "permissions",
+    /\bos\.(?:chmod|lchmod|fchmod|chown|lchown|fchown|setuid|setgid|seteuid|setegid|setreuid|setregid|setresuid)\s*\(|\.chmod\s*\(|\bshutil\.chown\s*\(/
+  ]
+];
+var NODE = [
+  [
+    "deletes",
+    /\.(?:rm|rmSync|rmdir|rmdirSync|unlink|unlinkSync)\s*\(|\brimraf\b|\bDeno\.remove(?:Sync)?\s*\(/
+  ],
+  [
+    "writes-outside",
+    new RegExp(
+      String.raw`(?:\.(?:writeFile|writeFileSync|appendFile|appendFileSync|createWriteStream|copyFile|copyFileSync|cp|cpSync|rename|renameSync|truncate|truncateSync|symlink|symlinkSync|mkdir|mkdirSync)|\bDeno\.(?:writeTextFile|writeFile|rename|mkdir)(?:Sync)?|\bBun\.write)\s*\(\s*['"\x60]${OUTSIDE}`
+    )
+  ],
+  [
+    "sends",
+    /\bfetch\s*\(|(?:\brequire\s*\(\s*|\bfrom\s+|\bimport\s+)['"\x60](?:node:)?(?:http|https|http2|net|dgram|tls|axios|node-fetch|ws|request|got|undici|nodemailer)['"\x60]|\bnew\s+WebSocket\b|\bXMLHttpRequest\b|\b(?:Deno|Bun)\.connect\w*\s*\(/
+  ],
+  ["listens", /\bcreateServer\s*\(|\b(?:Deno\.(?:listen\w*|serve)|Bun\.(?:listen|serve))\s*\(/],
+  [
+    "runs-commands",
+    /\bchild_process\b|\bprocess\.(?:binding|dlopen|kill)\s*\(|\bDeno\.(?:run|Command)\b|\bBun\.(?:spawn|spawnSync|\$)\b|\bexecSync\s*\(|\bspawnSync\s*\(/
+  ],
+  [
+    "builds-code",
+    /(?<![\w.])eval\s*\(|\bnew\s+Function\s*\(|(?<![\w.])Function\s*\(|(?:\brequire\s*\(\s*|\bfrom\s+)['"\x60](?:node:)?vm['"\x60]|\bvm\.\w+|\brequire\s*\(\s*[^'"\x60\s)]|\bimport\s*\(\s*[^'"\x60\s)]/
+  ],
+  [
+    "permissions",
+    /\.(?:chmod|chmodSync|chown|chownSync|lchown|lchownSync|fchmod|fchmodSync|fchown|fchownSync)\s*\(|\bprocess\.set(?:e)?[ug]id\s*\(|\bDeno\.(?:chmod|chown)(?:Sync)?\s*\(/
+  ]
+];
+var PERL = [
+  ["deletes", /\b(?:unlink|rmdir|rmtree|remove_tree)\b/],
+  [
+    "writes-outside",
+    new RegExp(
+      String.raw`['"]\s*(?:\+?>>?|\+<)\s*['"]?\s*,?\s*['"]?${OUTSIDE}|\b(?:rename|symlink|link|copy|move)\s*\(?[^;\n]*['"]${OUTSIDE}`
+    )
+  ],
+  [
+    "sends",
+    /\b(?:IO::Socket|Socket|LWP|HTTP::Tiny|Net::\w+|Mojo::UserAgent|WWW::Mechanize|IO::Socket::INET)\b/
+  ],
+  [
+    "runs-commands",
+    /\b(?:system|exec|fork|kill|syscall)\b|`[^`]*`|\bqx\s*[{([/|!'"]|\bopen\s*\(?[^;\n]*(?:['"]\s*\||\|\s*['"]|['"]-\|['"])/
+  ],
+  ["builds-code", /\beval\b|\bStorable::thaw\b|\bdo\s+['"]/],
+  ["permissions", /\b(?:chmod|chown)\b/]
+];
+var RUBY = [
+  [
+    "deletes",
+    /\bFile\.(?:delete|unlink)\b|\bFileUtils\.(?:rm\w*|remove\w*)\b|\bDir\.(?:rmdir|delete|unlink)\b|\.(?:rmtree|delete_all)\b/
+  ],
+  [
+    "writes-outside",
+    new RegExp(
+      String.raw`\bFile\.(?:write|binwrite|symlink|rename)\s*\(?\s*['"]${OUTSIDE}|\bFile\.open\s*\(?\s*['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*['"][wa+]|\bFileUtils\.(?:cp\w*|mv|install|ln\w*|mkdir_p|touch)\s*\(?[^\n]*['"]${OUTSIDE}`
+    )
+  ],
+  [
+    "sends",
+    /\bNet::\w+|\b(?:TCPSocket|UDPSocket|UNIXSocket|Socket)\b|\bopen-uri\b|\bURI\.open\b|\b(?:HTTParty|Faraday|RestClient|Excon|Typhoeus)\b|\brequire\s+['"](?:socket|net\/\w+|open-uri)['"]/
+  ],
+  ["listens", /\b(?:TCPServer|UNIXServer|WEBrick|PTY)\b/],
+  [
+    "runs-commands",
+    /(?<![\w.])(?:system|exec|spawn|fork)\b|`[^`]*`|%x[{([|!]|(?<![\w.])open\s*\(?\s*['"]\||\bIO\.popen\b|\bOpen3\b|\bProcess\.(?:spawn|kill|exec)\b|\bKernel\.(?:system|exec|spawn|open)\b/
+  ],
+  [
+    "builds-code",
+    /(?<![\w.])eval\b|\b(?:instance|class|module)_eval\b|\b(?:send|public_send)\s*\(?\s*:?['"]?(?:system|eval|exec|spawn)\b|\bMarshal\.load\b|\bYAML\.(?:unsafe_)?load\b|\bconst_get\b/
+  ],
+  ["permissions", /\b(?:File|FileUtils)\.(?:chmod|chown|lchmod|lchown)\w*\b/]
+];
+var PHP = [
+  ["deletes", /\b(?:unlink|rmdir)\s*\(/],
+  [
+    "writes-outside",
+    new RegExp(
+      String.raw`\b(?:file_put_contents|symlink|link|copy|rename|mkdir|touch)\s*\([^)\n]*['"]${OUTSIDE}|\bfopen\s*\(\s*['"]${OUTSIDE}[^'"\n]*['"]\s*,\s*['"][waxc+]`
+    )
+  ],
+  [
+    "sends",
+    /\b(?:curl_exec|curl_init|fsockopen|pfsockopen|stream_socket_client|socket_create|socket_connect|mail|ftp_connect)\s*\(|\b(?:file_get_contents|fopen|file|readfile)\s*\(\s*['"](?:https?|ftp):/
+  ],
+  ["listens", /\b(?:stream_socket_server|socket_bind|socket_listen)\s*\(/],
+  [
+    "runs-commands",
+    /\b(?:system|exec|shell_exec|passthru|proc_open|popen|pcntl_exec|pcntl_fork|posix_kill)\s*\(|`[^`]*`/
+  ],
+  [
+    "builds-code",
+    /\b(?:eval|assert|create_function|unserialize|call_user_func(?:_array)?)\s*\(|\bbase64_decode\b/
+  ],
+  ["permissions", /\b(?:chmod|chown|chgrp|lchown|lchgrp)\s*\(/]
+];
 var { syntax } = mvdanSh;
 var sharedParser = syntax.NewParser();
 var AST_CACHE_MAX = 5e3;
@@ -2646,18 +3438,6 @@ var DEFAULT_OPS = new Set(
     (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
   )
 );
-var SYSTEM_DIRS = [
-  "/usr",
-  "/etc",
-  "/boot",
-  "/bin",
-  "/sbin",
-  "/lib",
-  "/lib64",
-  "/var/log"
-];
-var UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
-var LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
 var BIP39_ENGLISH = `abandon
 ability
 able
@@ -5718,14 +6498,14 @@ var SENSITIVE_PATH_REGEXES = [
 ];
 function assertBuiltinPatternsAreSafe() {
   for (const p of DLP_PATTERNS) {
-    if (!safeRegex3(p.regex.source)) {
+    if (!safeRegex2(p.regex.source)) {
       throw new Error(
         `[node9 engine] Builtin DLP pattern '${p.name}' is vulnerable to ReDoS: ${p.regex.source}`
       );
     }
   }
   for (const re of SENSITIVE_PATH_PATTERNS) {
-    if (!safeRegex3(re.source)) {
+    if (!safeRegex2(re.source)) {
       throw new Error(
         `[node9 engine] Builtin sensitive-path pattern is vulnerable to ReDoS: ${re.source}`
       );
@@ -5835,7 +6615,11 @@ var MAP_GOVERNED = /* @__PURE__ */ new Set([
   "commands.disk-destroy",
   "commands.dangerous-word",
   "commands.node9-disarm",
-  "data.pipe-chain"
+  "data.pipe-chain",
+  // The general action checks (node9Firewall#390): smart rules the map governs.
+  "actions.money",
+  "actions.access",
+  "actions.publish"
 ]);
 var KNOB_GOVERNED = {
   "data.secrets": ["off", "block"],
@@ -5876,6 +6660,21 @@ var PUBLISH = {
 var OWN_HEADS = /* @__PURE__ */ new Set([...Object.keys(PUBLISH), "git", "gh"]);
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 
+// src/shields/build.ts
+var LEGACY_BASH_PATH_RULE = /^(?:block|review)-path-.+-bash$/;
+function withAccessReading(def) {
+  let changed = false;
+  const smartRules = def.smartRules.map((r) => {
+    const [c, ...rest] = r.conditions ?? [];
+    if (rest.length > 0 || !c || r.tool !== "bash" || !LEGACY_BASH_PATH_RULE.test(r.name ?? "") || c.field !== "command" || c.op !== "matches" || c.reading !== void 0) {
+      return r;
+    }
+    changed = true;
+    return { ...r, conditions: [{ ...c, reading: "access" }] };
+  });
+  return changed ? { ...def, smartRules } : def;
+}
+
 // src/shields.ts
 var USER_SHIELDS_DIR = path.join(os.homedir(), ".node9", "shields");
 function loadUserShields() {
@@ -5902,7 +6701,7 @@ function loadUserShields() {
 `);
         continue;
       }
-      result[v.ok.name] = v.ok;
+      result[v.ok.name] = withAccessReading(v.ok);
     } catch (err) {
       process.stderr.write(`[node9] Failed to load user shield ${file}: ${String(err)}
 `);
@@ -5921,6 +6720,268 @@ var TUNING_FIELDS_BY_NAME = new Map(TUNING_FIELDS.map((f) => [`${f.checkId}.${f.
 
 // src/config/index.ts
 var DANGEROUS_WORDS = [...BUILTIN_DANGEROUS_WORDS];
+var DEFAULT_CONFIG = {
+  version: "1.0",
+  policySource: "local",
+  ssrfStrictSource: "default",
+  settings: {
+    mode: "standard",
+    autoStartDaemon: true,
+    // Off by default: this is a DEBUG facility, not part of the product's job.
+    // When on, every tool call appends a row to ~/.node9/hook-debug.log, which
+    // has no production reader and no size ceiling. Turn it on deliberately
+    // (this setting, or NODE9_DEBUG=1) while investigating something.
+    // Error breadcrumbs written from catch blocks are NOT gated by this and
+    // keep working when it is off — see CLAUDE.md "Always write to
+    // hook-debug.log in catch blocks that guard audit trail".
+    enableHookLogDebug: false,
+    approvalTimeoutMs: 12e4,
+    // 120-second auto-deny timeout
+    flightRecorder: true,
+    auditHashArgs: true,
+    approvers: { native: true, browser: false, cloud: false, terminal: true },
+    cloudSyncIntervalHours: 5,
+    shipper: { enabled: true, intervalSeconds: 20 }
+  },
+  policy: {
+    sandboxPaths: ["/tmp/**", "**/sandbox/**", "**/test-results/**"],
+    dangerousWords: DANGEROUS_WORDS,
+    ignoredTools: [
+      "list_*",
+      "get_*",
+      "read_*",
+      "describe_*",
+      "read",
+      "glob",
+      "grep",
+      "ls",
+      "notebookread",
+      "notebookedit",
+      "webfetch",
+      "websearch",
+      "exitplanmode",
+      "askuserquestion",
+      "agent",
+      "task*",
+      "toolsearch",
+      "mcp__ide__*",
+      "getDiagnostics"
+    ],
+    toolInspection: {
+      bash: "command",
+      shell: "command",
+      run_shell_command: "command",
+      "terminal.execute": "command",
+      "postgres:query": "sql"
+    },
+    smartRules: [
+      // ── rm safety (critical — always evaluated first) ──────────────────────
+      {
+        name: "block-rm-rf-home",
+        tool: "bash",
+        conditionMode: "all",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Anchor rm as a shell command (not inside a string arg like a git commit message).
+            value: "(^|&&|\\|\\||;)\\s*rm\\b[^;&|]*\\s(-[rRfF]*[rR][rRfF]*|--recursive)(\\s|$)"
+          },
+          {
+            field: "command",
+            op: "matches",
+            value: "(~|\\/root(\\/|$)|\\$HOME|\\/home\\/)"
+          }
+        ],
+        verdict: "block",
+        reason: "Recursive delete of home directory is irreversible",
+        description: "The AI wants to recursively delete your home directory. This will permanently destroy all your personal files and cannot be undone."
+      },
+      // ── SQL safety ────────────────────────────────────────────────────────
+      {
+        name: "no-delete-without-where",
+        tool: "*",
+        conditions: [
+          { field: "sql", op: "matches", value: "^(DELETE|UPDATE)\\s", flags: "i" },
+          { field: "sql", op: "notMatches", value: "\\bWHERE\\b", flags: "i" }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "DELETE/UPDATE without WHERE clause \u2014 would affect every row in the table",
+        description: "The AI is running a SQL statement that will modify every row in the table \u2014 no WHERE filter was found. This could wipe or corrupt all your data."
+      },
+      {
+        name: "review-drop-truncate-shell",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Require a DB CLI in the command so grep/cat/echo of SQL strings don't trigger.
+            value: "(^|&&|\\|\\||;|\\|)\\s*(psql|mysql|sqlite3|sqlplus|cockroach|clickhouse-client|mongo)\\b",
+            flags: "i"
+          },
+          {
+            field: "command",
+            op: "matches",
+            value: "\\b(DROP|TRUNCATE)\\s+(TABLE|DATABASE|SCHEMA|INDEX)",
+            flags: "i"
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "SQL DDL destructive statement inside a shell command",
+        description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
+      },
+      // ── node9 itself ──────────────────────────────────────────────────────
+      // The agent runs as the user, so a `node9 ...` command from Bash can
+      // clear the session's taint or exposure, trust a destination or pause
+      // the gate. Those are the user's own commands; from the agent they are
+      // a review (fw#318 review finding 1).
+      {
+        name: "review-node9-disarm",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Single spaces on purpose: a nested `\\s+` inside the alternation
+            // fails the engine's ReDoS check and the rule would be dropped.
+            // `apps`: turning an app off, allowing one of its actions, or
+            // linking a server to an app (the general checks leave it).
+            value: "(^|&&|\\|\\||;)\\s*(npx )?node9 (session-(exposure|taint) clear|trust (add|recipient add)|pause|shield (disable|set)|apps (link|[a-z0-9-]{1,32} (off|[a-z]{1,32} allow))|egress allow|approver set)\\b",
+            flags: "i"
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "node9 self-weakening command run by the agent",
+        description: "The AI wants to run a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield. These are your commands to run, not the agent's."
+      },
+      // ── Git safety ────────────────────────────────────────────────────────
+      {
+        name: "review-force-push",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Anchor git as a shell command so node -e / python -c scripts containing
+            // "git push --force" as a string don't false-positive.
+            value: "(^|&&|\\|\\||;)\\s*git\\s+push[^;&|]*(--force|--force-with-lease|-f\\b)",
+            flags: "i"
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "Force push rewrites remote history \u2014 confirm this is intentional",
+        description: "The AI wants to force push to a remote git branch. This rewrites shared history and can permanently destroy commits that teammates have already pulled."
+      },
+      {
+        name: "review-git-destructive",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Anchor git as a shell command so node -e / python -c scripts containing
+            // "git reset --hard" as a string don't false-positive.
+            value: "(^|&&|\\|\\||;)\\s*git\\s+(reset\\s+--hard|clean\\s+-[fdxX]|rebase\\b|tag\\s+-d|branch\\s+-[dD])",
+            flags: "i"
+          },
+          {
+            field: "command",
+            op: "notMatches",
+            // Exclude recovery ops and routine branch-surgery (--onto) — these are not destructive.
+            value: "\\bgit\\s+rebase\\s+--(abort|continue|skip|onto)\\b",
+            flags: "i"
+          }
+        ],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "Destructive git operation \u2014 discards history or working-tree changes",
+        description: "The AI wants to run a destructive git operation (reset, rebase, clean, or branch delete) that can permanently discard commits or uncommitted work."
+      },
+      // ── Shell safety ──────────────────────────────────────────────────────
+      {
+        name: "review-sudo",
+        tool: "bash",
+        conditions: [{ field: "command", op: "matches", value: "\\bsudo\\s", flags: "i" }],
+        conditionMode: "all",
+        verdict: "review",
+        reason: "Command requires elevated privileges",
+        description: "The AI wants to run a command as root (sudo). Commands with root access can modify system files, install software, or change security settings."
+      },
+      {
+        name: "review-curl-pipe-shell",
+        tool: "bash",
+        conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Anchor curl/wget as a shell command so node -e scripts testing this
+            // regex pattern don't self-match as a false positive.
+            // Downloader and sink groups mirror the engine's DOWNLOAD_CMDS and
+            // SHELL_INTERPRETERS; pipe-to-shell-vocabulary-drift.spec.ts fails if
+            // either list gains a name this regex does not. The PowerShell sinks
+            // carry \b so `iex` cannot match inside e.g. `iexplore`, and so does
+            // `sh`, so a quoted body containing `| Shipment` is not a shell
+            // (fw#372 X3, node9Firewall#332).
+            value: "(^|&&|\\|\\||;)\\s*(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)[^|]*\\|\\s*(?:(ba|z|da|fi|c|k)?sh\\b|(?:iex|invoke-expression|powershell|pwsh)\\b)",
+            flags: "i"
+          }
+        ],
+        conditionMode: "all",
+        verdict: "block",
+        reason: "Piping remote script into a shell is a supply-chain attack vector",
+        description: "The AI wants to download a script from the internet and run it immediately, without you seeing what it contains. This is one of the most common ways malware gets installed."
+      },
+      // ── Actions in apps (node9Firewall#390) ───────────────────────────────
+      // actions.money / actions.access / actions.publish: the action templates
+      // on every MCP server no app shield claims, plus the shell publishing
+      // rules. Review by default; the check value governs them.
+      ...GENERAL_ACTION_RULES
+    ],
+    dlp: { enabled: true, scanIgnoredTools: true, pii: "block" },
+    egress: {
+      enabled: false,
+      mode: "review",
+      allow: [],
+      deny: [],
+      allowPrivate: true,
+      // The SSRF floor is always on and needs no default; these two only
+      // widen or narrow it. See doc/roadmap/active/ssrf-floor-design.md.
+      ssrfAllow: [],
+      ssrfStrict: false
+    },
+    loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
+    injectionScan: { enabled: false, minConfidence: "medium", allow: [] },
+    packageCheck: {
+      enabled: true,
+      onMalicious: "block",
+      newPackage: "review",
+      maxAgeHours: 48,
+      installScript: "review",
+      onlineFallback: true,
+      allow: []
+    },
+    skillPinning: { enabled: false, mode: "warn", roots: [] },
+    untrustedContent: {
+      enabled: true,
+      spotlight: true,
+      afterExposure: "ask-once",
+      orgDomains: [],
+      roles: {},
+      trustedRecipients: []
+    },
+    trustedHosts: [],
+    trustedHostsManaged: false,
+    appPermissions: {},
+    appLinks: {},
+    managedJailPaths: []
+  },
+  environments: {}
+};
 var CACHE_LOG_REARM_MS = 5 * 60 * 1e3;
 
 // src/cli/render/ink/panels/cost-note.ts
@@ -6307,7 +7368,7 @@ function ShieldsPanel({ summary, width, enabledShields = [] }) {
   });
   const hitShields = ranked.filter((i) => i.totalCatches > 0);
   const hitNames = new Set(hitShields.map((i) => i.shieldName));
-  const zeroHitAll = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitNames.has(name) && !ACTION_SHIELD_NAMES.has(name)).sort();
+  const zeroHitAll = Object.keys(BUILTIN_SHIELDS).filter((name) => !hitNames.has(name) && !APP_SHIELD_NAMES.has(name)).sort();
   const zeroHitBuiltins = zeroHitAll.filter((name) => !enabled.has(name));
   const zeroHitEnabled = zeroHitAll.filter((name) => enabled.has(name));
   const topRec = hitShields.find(