@node9/proxy 2.43.0 → 2.44.0

package/dist/index.js

@@ -805,12 +805,12 @@ function judgeInlineCode(language, code, isProtected) {
       category
     };
   }
-  const path30 = protectedLiteral(text, isProtected);
-  if (path30) {
+  const path31 = protectedLiteral(text, isProtected);
+  if (path31) {
     return {
       outcome: "dangerous",
       what: WHAT["reads-protected"],
-      evidence: path30.slice(0, 60),
+      evidence: path31.slice(0, 60),
       category: "reads-protected"
     };
   }
@@ -2973,9 +2973,9 @@ function ruleServerMatches(rule, serverLabel) {
   if (rule.notServer && label2 && matchesPattern(label2, rule.notServer)) return false;
   return true;
 }
-function getNestedValue(obj, path30) {
+function getNestedValue(obj, path31) {
   if (!obj || typeof obj !== "object") return null;
-  const segments2 = path30.split(".");
+  const segments2 = path31.split(".");
   for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -3955,8 +3955,8 @@ function collectFileAccesses(tool, args, context = {}, inspection = {}) {
   }
   return out;
 }
-function within(path30, root) {
-  return path30 === root || path30.startsWith(root === "/" ? "/" : root + "/");
+function within(path31, root) {
+  return path31 === root || path31.startsWith(root === "/" ? "/" : root + "/");
 }
 function hits(access, paths, directories, context) {
   const home = context.homeDirs?.[0] ?? "~";
@@ -5344,7 +5344,10 @@ function classify(inv) {
     out.push({ ...f, shown: inv.shown, reason: `${f.reason}: ${inv.shown}` });
   };
   if (hooksBypass(inv)) found(HOOKS_BYPASS);
-  if (stagesEverything(inv)) found(STAGE_ALL);
+  const staged = stagesEverything(inv);
+  if (staged) {
+    found(staged.ifWorkTreeTop === void 0 ? STAGE_ALL : { ...STAGE_ALL, ...staged });
+  }
   if (inv.sub === null) {
     found(UNREADABLE);
     return out;
@@ -5405,12 +5408,35 @@ function appliedValue(env, name) {
   const word = f?.Stmts?.[0]?.Cmd?.Args?.[1];
   return word ? resolveWordLiteral(word) : null;
 }
+function lexicalPath(p) {
+  if (/^[\\/~$]/.test(p) || /^[A-Za-z]:/.test(p)) return null;
+  const parts = [];
+  let climbed = false;
+  for (const part of p.split(/[\\/]+/)) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") {
+      if (parts.length === 0) climbed = true;
+      else parts.pop();
+    } else parts.push(part);
+  }
+  return { parts, climbed };
+}
+function hooksPathBypasses(value) {
+  if (value === null || value === void 0) return true;
+  const v = value.trim();
+  if (v === "" || v === "true") return true;
+  const lp = lexicalPath(v);
+  if (lp === null || lp.climbed || lp.parts.length === 0) return true;
+  return lp.parts[0] === ".git" && lp.parts[1] !== "hooks";
+}
 function hooksBypass(inv) {
-  if (inv.config.has("core.hookspath")) return true;
+  if (inv.config.has("core.hookspath") && hooksPathBypasses(inv.config.get("core.hookspath")))
+    return true;
   for (const [name, value] of inv.env) {
     if (name === "GIT_CONFIG_PARAMETERS" && value !== null && /core\.hookspath/i.test(value))
       return true;
-    if (/^GIT_CONFIG_KEY_\d+$/.test(name) && value !== null && value.toLowerCase() === "core.hookspath")
+    const key = /^GIT_CONFIG_KEY_(\d+)$/.exec(name);
+    if (key && value !== null && value.toLowerCase() === "core.hookspath" && hooksPathBypasses(inv.env.get(`GIT_CONFIG_VALUE_${key[1]}`)))
       return true;
   }
   for (const name of HOOK_KILL_SWITCHES) {
@@ -5452,7 +5478,10 @@ function configWritesHooksPath(args) {
   }
   const key = args[i];
   if (key === null || key === void 0 || key.toLowerCase() !== "core.hookspath") return false;
-  return write || i + 1 < args.length;
+  const unset = args.slice(0, i).some((w) => w === "--unset" || w === "--unset-all") || args[0] === "unset";
+  if (unset) return true;
+  if (i + 1 < args.length) return hooksPathBypasses(args[i + 1]);
+  return write;
 }
 function isHookPath(word) {
   return /(^|[\\/])(\.git[\\/]hooks|\.husky)([\\/]|$)/.test(word);
@@ -5487,31 +5516,49 @@ function chmodDisarmsHook(args, shown) {
 function wholeTree(operand) {
   if (/^:\(top\)\.?$/.test(operand) || operand === ":/" || operand === "*") return true;
   if (operand.startsWith(":")) return false;
+  const lp = lexicalPath(operand);
+  return lp !== null && lp.parts.length === 0;
+}
+function chdirPrefix(inv) {
+  const dirs = inv.chdir ?? [];
+  if (dirs.length === 0) return null;
   const parts = [];
-  for (const part of operand.split("/")) {
-    if (!part || part === ".") continue;
-    if (part === "..") parts.pop();
-    else parts.push(part);
+  for (const d of dirs) {
+    if (d === null || d === "") return null;
+    const lp = lexicalPath(d);
+    if (lp === null || lp.climbed) return null;
+    parts.push(...lp.parts);
   }
-  return parts.length === 0 && !operand.startsWith("/");
+  return parts.length === 0 ? null : parts.join("/");
 }
 function stagesEverything(inv) {
   const sub = inv.sub?.toLowerCase();
+  const prefix = chdirPrefix(inv);
+  const judge = (operands2) => {
+    let conditional = false;
+    for (const operand of operands2) {
+      if (!wholeTree(operand)) continue;
+      if (prefix === null || operand.startsWith(":") || operand.startsWith("/")) return {};
+      if (wholeTree(`${prefix}/${operand === "*" ? "." : operand}`)) return {};
+      conditional = true;
+    }
+    return conditional && prefix !== null ? { ifWorkTreeTop: prefix } : null;
+  };
   if (sub === "add") {
     const o = parseOptions(inv.args, "", ADD_LONG_VALUE);
     if (o.flags.has("-n") || o.flags.has("--dry-run") || o.flags.has("-i") || o.flags.has("--interactive") || o.flags.has("-p") || o.flags.has("--patch") || o.flags.has("-e") || o.flags.has("--edit"))
-      return false;
+      return null;
     const all = o.flags.has("-A") || o.flags.has("--all") || o.flags.has("--no-ignore-removal") || o.flags.has("-u") || o.flags.has("--update");
-    if (all && o.operands.length === 0) return true;
-    return o.operands.some(wholeTree);
+    if (all && o.operands.length === 0) return {};
+    return judge(o.operands);
   }
   if (sub === "commit") {
     const o = parseOptions(inv.args, "mFCcut", COMMIT_LONG_VALUE);
-    if (o.flags.has("--dry-run")) return false;
-    if (o.flags.has("-a") || o.flags.has("--all")) return true;
-    return o.operands.some(wholeTree);
+    if (o.flags.has("--dry-run")) return null;
+    if (o.flags.has("-a") || o.flags.has("--all")) return {};
+    return judge(o.operands);
   }
-  return false;
+  return null;
 }
 function hookTextRunsNothing(text) {
   return text.split(/\r?\n/).every((line) => INERT_LINE_RE.test(line.trim()));
@@ -7167,9 +7214,9 @@ function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
 }
-function valuesAt(args, path30) {
+function valuesAt(args, path31) {
   let cursors = [args];
-  for (const rawSegment of path30.split(".")) {
+  for (const rawSegment of path31.split(".")) {
     const isArray = rawSegment.endsWith("[]");
     const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
     const next = [];
@@ -7200,8 +7247,8 @@ function extractToolDestinations(toolName, args) {
   try {
     const out = [];
     const paths = DESTINATION_ARGS.get(bareToolName(toolName)) ?? [];
-    for (const path30 of paths) {
-      for (const value of valuesAt(args, path30)) {
+    for (const path31 of paths) {
+      for (const value of valuesAt(args, path31)) {
         const host2 = hostOf(value);
         if (host2) out.push({ host: host2, binary: toolName, raw: value });
       }
@@ -7227,8 +7274,8 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    for (const path30 of paths) {
-      for (const value of valuesAt(args, path30)) {
+    for (const path31 of paths) {
+      for (const value of valuesAt(args, path31)) {
         const host2 = hostOf(value);
         if (!host2) continue;
         const m = classifySsrf(host2);
@@ -7237,7 +7284,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const decision = ssrfFloorDecision(m, written, opts);
         if (decision === null) continue;
         const reason = decision === "review" ? ssrfDisguisedReason(m, written) : ssrfReason(m, host2);
-        return { ...m, argPath: path30, host: host2, reason, decision };
+        return { ...m, argPath: path31, host: host2, reason, decision };
       }
     }
     return null;
@@ -7519,7 +7566,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hostHooks =
 }
 async function evaluatePolicyCore(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
-  const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2, isConfiguredRegistry } = hooks;
+  const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2, isConfiguredRegistry, isGitWorkTreeTop: isGitWorkTreeTop2 } = hooks;
   const settingsView = catalogSettings(config);
   const layers = inspectionLayers(config.policy);
   const cv = (id) => checkValue(settingsView, id);
@@ -7673,6 +7720,8 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
         const action = cv(id);
         const finding = action === "off" ? void 0 : git.findings.find((f) => f.checkId === id);
         if (!finding) continue;
+        if (finding.ifWorkTreeTop !== void 0 && isGitWorkTreeTop2 && cwd && !isGitWorkTreeTop2(finding.ifWorkTreeTop, cwd))
+          continue;
         const v = applyCheckValue(action, {
           decision: "review",
           blockedByLabel: `Node9 (AST): ${finding.ruleName}`,
@@ -16301,6 +16350,7 @@ zoo`.split("\n");
       /** The words after `git`: global options, then the subcommand. */
       visitGit(rest, env, depth, viaXargs, fromAlias, shown) {
         const config = /* @__PURE__ */ new Map();
+        const chdir = [];
         let i = 0;
         while (i < rest.length) {
           const w = rest[i];
@@ -16315,6 +16365,7 @@ zoo`.split("\n");
               i++;
               value = i < rest.length ? rest[i] : null;
             }
+            if (name === "-C") chdir.push(viaXargs || (value ?? "").includes("{}") ? null : value);
             if (name === "-c" && value !== null) {
               const ceq = value.indexOf("=");
               const key = (ceq > 0 ? value.slice(0, ceq) : value).toLowerCase();
@@ -16331,7 +16382,7 @@ zoo`.split("\n");
         }
         const subWord = i < rest.length ? rest[i] : void 0;
         const args = rest.slice(i + 1);
-        const inv = { sub: null, args, config, env, shown };
+        const inv = { sub: null, args, config, env, shown, chdir };
         if (subWord === void 0) {
           if (!viaXargs) return;
           this.emit(inv);
@@ -16345,16 +16396,23 @@ zoo`.split("\n");
         const fromConfig = config.get(`alias.${subWord.toLowerCase()}`);
         const alias = fromConfig !== void 0 ? fromConfig : this.aliases.get(subWord);
         if (alias !== void 0 && !fromAlias) {
-          this.expandAlias(subWord, alias, args, env, depth, 0, shown);
+          this.expandAlias(subWord, alias, args, env, depth, 0, shown, chdir);
           return;
         }
         inv.sub = subWord;
         this.emit(inv);
         this.recordAliasDefinition(inv, env, depth);
       }
-      expandAlias(name, value, args, env, depth, level, shown) {
+      expandAlias(name, value, args, env, depth, level, shown, chdir) {
         if (value === null) {
-          this.emit({ sub: null, args, config: /* @__PURE__ */ new Map(), env, shown: `${shown} (alias ${name})` });
+          this.emit({
+            sub: null,
+            args,
+            config: /* @__PURE__ */ new Map(),
+            env,
+            shown: `${shown} (alias ${name})`,
+            chdir
+          });
           return;
         }
         if (value.startsWith("!")) {
@@ -16368,7 +16426,16 @@ zoo`.split("\n");
         const nested = this.aliases.get(sub);
         const expandedShown = `${shown} (alias ${name} = ${value})`;
         if (nested !== void 0 && level < MAX_ALIAS_DEPTH) {
-          this.expandAlias(sub, nested, [...words.slice(1), ...args], env, depth, level + 1, shown);
+          this.expandAlias(
+            sub,
+            nested,
+            [...words.slice(1), ...args],
+            env,
+            depth,
+            level + 1,
+            shown,
+            chdir
+          );
           return;
         }
         this.emit({
@@ -16376,7 +16443,8 @@ zoo`.split("\n");
           args: [...words.slice(1), ...args],
           config: /* @__PURE__ */ new Map(),
           env,
-          shown: expandedShown
+          shown: expandedShown,
+          chdir
         });
       }
       /**
@@ -16410,7 +16478,7 @@ zoo`.split("\n");
         if (i + 1 >= args.length) return;
         const value = args[i + 1];
         this.aliases.set(m[1], value);
-        this.expandAlias(m[1], value, [], env, depth, 0, `${inv.shown}`);
+        this.expandAlias(m[1], value, [], env, depth, 0, `${inv.shown}`, []);
       }
     };
     POSITIONAL2 = "\0positional";
@@ -18333,8 +18401,8 @@ var ConfigFileSchema = import_zod.z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path30 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path30}: ${issue.message}`;
+    const path31 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path31}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -18347,9 +18415,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path30 of ordered) {
+  for (const path31 of ordered) {
     let cur = root;
-    for (const key of path30.slice(0, -1)) {
+    for (const key of path31.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -18357,7 +18425,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path30[path30.length - 1];
+    const last = path31[path31.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -18393,7 +18461,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path30) => path30.length > 0);
+      }).filter((path31) => path31.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -19831,13 +19899,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path30 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path30) continue;
+            const path31 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path31) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path30, verdict, "org-managed jail")) {
+            for (const r of pathRules(path31, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path30, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path31, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -20218,6 +20286,9 @@ function readCappedText(file2, maxBytes, openFlags = "r") {
   return r ? { text: r.bytes.toString("utf8"), truncated: r.truncated } : null;
 }
 
+// src/policy/index.ts
+var import_path13 = __toESM(require("path"));
+
 // src/dlp.ts
 var import_fs6 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
@@ -21538,10 +21609,19 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
       // reaches a long-lived in-process authorizer (the gateway) within seconds.
       isTrustedHost: config.policy.trustedHostsManaged ? (host2) => matchesTrustedHost(host2, config.policy.trustedHosts) : isTrustedHost,
       readAgentSettings,
-      isConfiguredRegistry: (host2, at) => configuredRegistryHosts(at).has(host2)
+      isConfiguredRegistry: (host2, at) => configuredRegistryHosts(at).has(host2),
+      isGitWorkTreeTop
     }
   );
 }
+function isGitWorkTreeTop(dir2, cwd) {
+  if (!import_path13.default.isAbsolute(cwd)) return true;
+  try {
+    return import_fs13.default.existsSync(import_path13.default.join(import_path13.default.resolve(cwd, dir2), ".git"));
+  } catch {
+    return true;
+  }
+}
 var MAX_AGENT_SETTINGS_BYTES = 256 * 1024;
 function readAgentSettings(absPath) {
   const r = readCappedText(
@@ -21557,11 +21637,11 @@ function isIgnoredTool2(toolName) {
 
 // src/auth/state.ts
 var import_fs14 = __toESM(require("fs"));
-var import_path13 = __toESM(require("path"));
+var import_path14 = __toESM(require("path"));
 var import_os9 = __toESM(require("os"));
 init_forecast_context();
-var PAUSED_FILE = import_path13.default.join(import_os9.default.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = import_path13.default.join(import_os9.default.homedir(), ".node9", "trust.json");
+var PAUSED_FILE = import_path14.default.join(import_os9.default.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = import_path14.default.join(import_os9.default.homedir(), ".node9", "trust.json");
 function extractCommandPattern(toolName, args) {
   const lower2 = toolName.toLowerCase();
   if (lower2 !== "bash" && lower2 !== "execute_bash" && lower2 !== "shell") return void 0;
@@ -21638,7 +21718,7 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = import_path13.default.join(import_os9.default.homedir(), ".node9", "decisions.json");
+    const file2 = import_path14.default.join(import_os9.default.homedir(), ".node9", "decisions.json");
     if (!import_fs14.default.existsSync(file2)) return null;
     const decisions = JSON.parse(import_fs14.default.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
@@ -21652,7 +21732,7 @@ function getPersistentDecision(toolName) {
 var import_fs15 = __toESM(require("fs"));
 var import_http = __toESM(require("http"));
 var import_net4 = __toESM(require("net"));
-var import_path14 = __toESM(require("path"));
+var import_path15 = __toESM(require("path"));
 var import_os10 = __toESM(require("os"));
 init_forecast_context();
 
@@ -21804,7 +21884,7 @@ function recordFromLegacyWait(body, now = Date.now()) {
 }
 
 // src/auth/daemon.ts
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path14.default.join(import_os10.default.tmpdir(), "node9-activity.sock");
+var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path15.default.join(import_os10.default.tmpdir(), "node9-activity.sock");
 function notifyActivitySocket(data) {
   if (forecastRun()) return Promise.resolve(false);
   return new Promise((resolve) => {
@@ -21849,7 +21929,7 @@ var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = import_path14.default.join(import_os10.default.homedir(), ".node9", "daemon.pid");
+    const pidFile = import_path15.default.join(import_os10.default.homedir(), ".node9", "daemon.pid");
     if (!import_fs15.default.existsSync(pidFile)) return null;
     const data = JSON.parse(import_fs15.default.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
@@ -21860,7 +21940,7 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = import_path14.default.join(import_os10.default.homedir(), ".node9", "daemon.pid");
+  const pidFile = import_path15.default.join(import_os10.default.homedir(), ".node9", "daemon.pid");
   if (import_fs15.default.existsSync(pidFile)) {
     let pid;
     let port;
@@ -22223,7 +22303,7 @@ var import_crypto10 = require("crypto");
 // src/apps/state.ts
 var import_fs17 = __toESM(require("fs"));
 var import_os12 = __toESM(require("os"));
-var import_path16 = __toESM(require("path"));
+var import_path17 = __toESM(require("path"));
 
 // src/apps/catalog.ts
 var APP_CATALOG = [
@@ -22356,10 +22436,10 @@ init_audit();
 
 // src/daemon/mcp-tools.ts
 var import_fs16 = __toESM(require("fs"));
-var import_path15 = __toESM(require("path"));
+var import_path16 = __toESM(require("path"));
 var import_os11 = __toESM(require("os"));
 function getMcpToolsFile() {
-  return import_path15.default.join(import_os11.default.homedir(), ".node9", "mcp-tools.json");
+  return import_path16.default.join(import_os11.default.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
@@ -22374,7 +22454,7 @@ function readMcpToolsConfig() {
 
 // src/apps/state.ts
 function appsFilePath(home = import_os12.default.homedir()) {
-  return import_path16.default.join(home, ".node9", "apps.json");
+  return import_path17.default.join(home, ".node9", "apps.json");
 }
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["mcp-server", "command", "package", "env-name"]);
 function emptyFile() {
@@ -22478,14 +22558,14 @@ function resolveLinkedServer(label2, opts = {}) {
 
 // src/auth/orchestrator.ts
 var import_os21 = __toESM(require("os"));
-var import_path29 = __toESM(require("path"));
+var import_path30 = __toESM(require("path"));
 
 // src/ui/native.ts
 var import_child_process = require("child_process");
-var import_path18 = __toESM(require("path"));
+var import_path19 = __toESM(require("path"));
 
 // src/context-sniper.ts
-var import_path17 = __toESM(require("path"));
+var import_path18 = __toESM(require("path"));
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -22553,7 +22633,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = import_path17.default.basename(editFilePath);
+        editFileName = import_path18.default.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -22621,7 +22701,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file2 = obj.file_path ? import_path18.default.basename(String(obj.file_path)) : "file";
+      const file2 = obj.file_path ? import_path19.default.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -22826,17 +22906,17 @@ end run`;
 // src/canary/registry.ts
 var import_fs19 = __toESM(require("fs"));
 var import_os14 = __toESM(require("os"));
-var import_path20 = __toESM(require("path"));
+var import_path21 = __toESM(require("path"));
 init_dist();
 
 // src/shields/jail.ts
 var import_fs18 = __toESM(require("fs"));
 var import_os13 = __toESM(require("os"));
-var import_path19 = __toESM(require("path"));
+var import_path20 = __toESM(require("path"));
 init_dist();
 var USER_JAIL_SHIELD = "user-jail";
 function jailStorePath() {
-  return import_path19.default.join(import_os13.default.homedir(), ".node9", "jail-paths.json");
+  return import_path20.default.join(import_os13.default.homedir(), ".node9", "jail-paths.json");
 }
 function readJailPaths() {
   let text;
@@ -22870,7 +22950,7 @@ function findJailedPathIn(candidate, paths) {
 
 // src/canary/registry.ts
 function canaryStorePath() {
-  return import_path20.default.join(import_os14.default.homedir(), ".node9", "canaries.json");
+  return import_path21.default.join(import_os14.default.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -22909,7 +22989,7 @@ init_dist();
 // src/auth/session-script.ts
 var import_fs20 = __toESM(require("fs"));
 var import_os15 = __toESM(require("os"));
-var import_path21 = __toESM(require("path"));
+var import_path22 = __toESM(require("path"));
 init_dist();
 var MAX_SCRIPT_BYTES = 64 * 1024;
 var MAX_RECORDED_WRITES = 32;
@@ -22941,7 +23021,7 @@ function readScriptFile(resolved) {
 }
 function absolute(p, cwd, home) {
   const spelled = p === "~" || p.startsWith("~/") ? home + p.slice(1) : p;
-  return import_path21.default.resolve(cwd, spelled);
+  return import_path22.default.resolve(cwd, spelled);
 }
 async function resolveSessionScript(toolName, args, cwd, layers, deps, home = import_os15.default.homedir()) {
   try {
@@ -23003,11 +23083,11 @@ init_dist();
 
 // src/exposure/known-hosts.ts
 var import_fs22 = __toESM(require("fs"));
-var import_path23 = __toESM(require("path"));
+var import_path24 = __toESM(require("path"));
 
 // src/utils/git-remotes.ts
 var import_fs21 = __toESM(require("fs"));
-var import_path22 = __toESM(require("path"));
+var import_path23 = __toESM(require("path"));
 init_dist();
 function readSmallFile(p, max) {
   let fd;
@@ -23040,20 +23120,20 @@ function gitRemoteHost(url) {
   return null;
 }
 function findGitConfig(dir2, walkUp = true) {
-  let cur = import_path22.default.resolve(dir2);
+  let cur = import_path23.default.resolve(dir2);
   for (let i = 0; i < (walkUp ? 64 : 1); i++) {
-    const dotGit = import_path22.default.join(cur, ".git");
-    const direct = readSmallFile(import_path22.default.join(dotGit, "config"), 1e6);
+    const dotGit = import_path23.default.join(cur, ".git");
+    const direct = readSmallFile(import_path23.default.join(dotGit, "config"), 1e6);
     if (direct !== null) return direct;
     const pointer = readSmallFile(dotGit, 4096);
     const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
     if (m) {
-      let gitDir = import_path22.default.resolve(cur, m[1]);
-      const common = readSmallFile(import_path22.default.join(gitDir, "commondir"), 4096);
-      if (common !== null) gitDir = import_path22.default.resolve(gitDir, common.trim());
-      return readSmallFile(import_path22.default.join(gitDir, "config"), 1e6);
+      let gitDir = import_path23.default.resolve(cur, m[1]);
+      const common = readSmallFile(import_path23.default.join(gitDir, "commondir"), 4096);
+      if (common !== null) gitDir = import_path23.default.resolve(gitDir, common.trim());
+      return readSmallFile(import_path23.default.join(gitDir, "config"), 1e6);
     }
-    const parent = import_path22.default.dirname(cur);
+    const parent = import_path23.default.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -23063,12 +23143,12 @@ var cache4 = /* @__PURE__ */ new Map();
 function readGitRemotes(dir2, opts = {}) {
   if (!dir2) return [];
   const walkUp = opts.walkUp !== false;
-  const key = `${walkUp ? "up" : "at"}:${import_path22.default.resolve(dir2)}`;
+  const key = `${walkUp ? "up" : "at"}:${import_path23.default.resolve(dir2)}`;
   const hit = cache4.get(key);
   if (hit) return hit;
   const out = [];
   try {
-    const cfg = findGitConfig(import_path22.default.resolve(dir2), walkUp);
+    const cfg = findGitConfig(import_path23.default.resolve(dir2), walkUp);
     if (cfg !== null) {
       let current = null;
       for (const line of cfg.split(/\r?\n/)) {
@@ -23104,15 +23184,15 @@ var ECOSYSTEMS = [
 ];
 var cache5 = /* @__PURE__ */ new Map();
 function manifestRoot(dir2) {
-  let cur = import_path23.default.resolve(dir2);
+  let cur = import_path24.default.resolve(dir2);
   for (let i = 0; i < 64; i++) {
     for (const [m] of ECOSYSTEMS) {
       try {
-        if (import_fs22.default.existsSync(import_path23.default.join(cur, m))) return cur;
+        if (import_fs22.default.existsSync(import_path24.default.join(cur, m))) return cur;
       } catch {
       }
     }
-    const parent = import_path23.default.dirname(cur);
+    const parent = import_path24.default.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -23121,7 +23201,7 @@ function manifestRoot(dir2) {
 function knownProjectHosts(dir2) {
   const empty = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
   if (!dir2) return empty;
-  const key = import_path23.default.resolve(dir2);
+  const key = import_path24.default.resolve(dir2);
   const hit = cache5.get(key);
   if (hit) return hit;
   const out = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
@@ -23134,7 +23214,7 @@ function knownProjectHosts(dir2) {
     const root = manifestRoot(key);
     if (root !== null) {
       for (const [m, registry] of ECOSYSTEMS) {
-        if (import_fs22.default.existsSync(import_path23.default.join(root, m))) out.hosts.add(registry);
+        if (import_fs22.default.existsSync(import_path24.default.join(root, m))) out.hosts.add(registry);
       }
       try {
         if (import_fs22.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
@@ -23151,7 +23231,7 @@ function knownProjectHosts(dir2) {
 // src/exposure/writes.ts
 var import_fs23 = __toESM(require("fs"));
 var import_os16 = __toESM(require("os"));
-var import_path24 = __toESM(require("path"));
+var import_path25 = __toESM(require("path"));
 init_dist();
 var WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "remove"]);
 var LIFECYCLE_RE = /"(scripts|preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack|publish|postpublish)"\s*:/;
@@ -23202,7 +23282,7 @@ function judgeWritesAfterExposure(opts) {
     seen.add(p);
     if (p === "/dev" || p.startsWith("/dev/")) continue;
     if (root !== null && isInside(root, p)) {
-      if (isAgentInstructionPath(p, root) && (import_path24.default.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
+      if (isAgentInstructionPath(p, root) && (import_path25.default.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
         holds.push({ path: p, why: "agent-instruction" });
       continue;
     }
@@ -23226,7 +23306,7 @@ function judgeWritesAfterExposure(opts) {
 var import_crypto9 = __toESM(require("crypto"));
 var import_fs24 = __toESM(require("fs"));
 var import_os17 = __toESM(require("os"));
-var import_path25 = __toESM(require("path"));
+var import_path26 = __toESM(require("path"));
 
 // src/daemon/exposure-store.ts
 var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
@@ -23234,11 +23314,11 @@ var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
 // src/exposure/marker.ts
 init_forecast_context();
 function dir() {
-  return import_path25.default.join(import_os17.default.homedir(), ".node9", "exposure-sessions");
+  return import_path26.default.join(import_os17.default.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = import_crypto9.default.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return import_path25.default.join(dir(), id);
+  return import_path26.default.join(dir(), id);
 }
 function maybeSessionExposed(sessionId) {
   if (!sessionId) return false;
@@ -23348,11 +23428,11 @@ function sourceWord(toolName) {
 
 // src/auth/trusted-recipients.ts
 var import_fs26 = __toESM(require("fs"));
-var import_path26 = __toESM(require("path"));
+var import_path27 = __toESM(require("path"));
 var import_os18 = __toESM(require("os"));
 init_dist();
 function getTrustedRecipientsPath() {
-  return import_path26.default.join(import_os18.default.homedir(), ".node9", "trusted-recipients.json");
+  return import_path27.default.join(import_os18.default.homedir(), ".node9", "trusted-recipients.json");
 }
 function readTrustedRecipients() {
   try {
@@ -23365,7 +23445,7 @@ function readTrustedRecipients() {
 }
 function writeTrustedRecipients(entries) {
   const filePath = getTrustedRecipientsPath();
-  import_fs26.default.mkdirSync(import_path26.default.dirname(filePath), { recursive: true });
+  import_fs26.default.mkdirSync(import_path27.default.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
   import_fs26.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
   import_fs26.default.renameSync(tmp, filePath);
@@ -23402,7 +23482,7 @@ init_forecast_context();
 // src/auth/cloud.ts
 var import_fs27 = __toESM(require("fs"));
 var import_os19 = __toESM(require("os"));
-var import_path27 = __toESM(require("path"));
+var import_path28 = __toESM(require("path"));
 init_audit();
 init_dist();
 var CLOUD_ARRAY_KEYS = /* @__PURE__ */ new Set(["exposureDestinations", "exposureDestinationHashes"]);
@@ -23438,7 +23518,7 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = import_path27.default.join(import_os19.default.homedir(), ".node9", "ci-context.json");
+      const ciContextPath = import_path28.default.join(import_os19.default.homedir(), ".node9", "ci-context.json");
       const ci = readCappedText(ciContextPath, 1e4);
       if (!ci) throw new Error("ci-context.json unreadable");
       if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
@@ -23573,13 +23653,13 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 
 // src/loop-detector.ts
 var import_fs28 = __toESM(require("fs"));
-var import_path28 = __toESM(require("path"));
+var import_path29 = __toESM(require("path"));
 var import_os20 = __toESM(require("os"));
 init_dist();
 init_forecast_context();
 init_dist();
 function loopStateFile() {
-  return import_path28.default.join(import_os20.default.homedir(), ".node9", "loop-state.json");
+  return import_path29.default.join(import_os20.default.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
@@ -23593,7 +23673,7 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir2 = import_path28.default.dirname(loopStateFile());
+  const dir2 = import_path29.default.dirname(loopStateFile());
   if (!import_fs28.default.existsSync(dir2)) import_fs28.default.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${loopStateFile()}.${import_os20.default.hostname()}.${process.pid}.tmp`;
   import_fs28.default.writeFileSync(tmpPath, JSON.stringify(records));
@@ -23793,9 +23873,9 @@ function isMcpToolName(toolName) {
   return /^mcp__[^_](?:[^_]|_(?!_))*?__/i.test(toolName);
 }
 function absoluteUploadPath(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path29.default.join(import_os21.default.homedir(), spelled.slice(1)) : spelled;
-  if (import_path29.default.isAbsolute(expanded)) return expanded;
-  return cwd && import_path29.default.isAbsolute(cwd) ? import_path29.default.resolve(cwd, expanded) : expanded;
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path30.default.join(import_os21.default.homedir(), spelled.slice(1)) : spelled;
+  if (import_path30.default.isAbsolute(expanded)) return expanded;
+  return cwd && import_path30.default.isAbsolute(cwd) ? import_path30.default.resolve(cwd, expanded) : expanded;
 }
 function extractFilePaths(toolName, args, shellCommand) {
   const paths = [];