@node9/proxy 2.43.0 → 2.44.0

package/dist/index.mjs

@@ -799,12 +799,12 @@ function judgeInlineCode(language, code, isProtected) {
       category
     };
   }
-  const path30 = protectedLiteral(text, isProtected);
-  if (path30) {
+  const path31 = protectedLiteral(text, isProtected);
+  if (path31) {
     return {
       outcome: "dangerous",
       what: WHAT["reads-protected"],
-      evidence: path30.slice(0, 60),
+      evidence: path31.slice(0, 60),
       category: "reads-protected"
     };
   }
@@ -2967,9 +2967,9 @@ function ruleServerMatches(rule, serverLabel) {
   if (rule.notServer && label2 && matchesPattern(label2, rule.notServer)) return false;
   return true;
 }
-function getNestedValue(obj, path30) {
+function getNestedValue(obj, path31) {
   if (!obj || typeof obj !== "object") return null;
-  const segments2 = path30.split(".");
+  const segments2 = path31.split(".");
   for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -3949,8 +3949,8 @@ function collectFileAccesses(tool, args, context = {}, inspection = {}) {
   }
   return out;
 }
-function within(path30, root) {
-  return path30 === root || path30.startsWith(root === "/" ? "/" : root + "/");
+function within(path31, root) {
+  return path31 === root || path31.startsWith(root === "/" ? "/" : root + "/");
 }
 function hits(access, paths, directories, context) {
   const home = context.homeDirs?.[0] ?? "~";
@@ -5338,7 +5338,10 @@ function classify(inv) {
     out.push({ ...f, shown: inv.shown, reason: `${f.reason}: ${inv.shown}` });
   };
   if (hooksBypass(inv)) found(HOOKS_BYPASS);
-  if (stagesEverything(inv)) found(STAGE_ALL);
+  const staged = stagesEverything(inv);
+  if (staged) {
+    found(staged.ifWorkTreeTop === void 0 ? STAGE_ALL : { ...STAGE_ALL, ...staged });
+  }
   if (inv.sub === null) {
     found(UNREADABLE);
     return out;
@@ -5399,12 +5402,35 @@ function appliedValue(env, name) {
   const word = f?.Stmts?.[0]?.Cmd?.Args?.[1];
   return word ? resolveWordLiteral(word) : null;
 }
+function lexicalPath(p) {
+  if (/^[\\/~$]/.test(p) || /^[A-Za-z]:/.test(p)) return null;
+  const parts = [];
+  let climbed = false;
+  for (const part of p.split(/[\\/]+/)) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") {
+      if (parts.length === 0) climbed = true;
+      else parts.pop();
+    } else parts.push(part);
+  }
+  return { parts, climbed };
+}
+function hooksPathBypasses(value) {
+  if (value === null || value === void 0) return true;
+  const v = value.trim();
+  if (v === "" || v === "true") return true;
+  const lp = lexicalPath(v);
+  if (lp === null || lp.climbed || lp.parts.length === 0) return true;
+  return lp.parts[0] === ".git" && lp.parts[1] !== "hooks";
+}
 function hooksBypass(inv) {
-  if (inv.config.has("core.hookspath")) return true;
+  if (inv.config.has("core.hookspath") && hooksPathBypasses(inv.config.get("core.hookspath")))
+    return true;
   for (const [name, value] of inv.env) {
     if (name === "GIT_CONFIG_PARAMETERS" && value !== null && /core\.hookspath/i.test(value))
       return true;
-    if (/^GIT_CONFIG_KEY_\d+$/.test(name) && value !== null && value.toLowerCase() === "core.hookspath")
+    const key = /^GIT_CONFIG_KEY_(\d+)$/.exec(name);
+    if (key && value !== null && value.toLowerCase() === "core.hookspath" && hooksPathBypasses(inv.env.get(`GIT_CONFIG_VALUE_${key[1]}`)))
       return true;
   }
   for (const name of HOOK_KILL_SWITCHES) {
@@ -5446,7 +5472,10 @@ function configWritesHooksPath(args) {
   }
   const key = args[i];
   if (key === null || key === void 0 || key.toLowerCase() !== "core.hookspath") return false;
-  return write || i + 1 < args.length;
+  const unset = args.slice(0, i).some((w) => w === "--unset" || w === "--unset-all") || args[0] === "unset";
+  if (unset) return true;
+  if (i + 1 < args.length) return hooksPathBypasses(args[i + 1]);
+  return write;
 }
 function isHookPath(word) {
   return /(^|[\\/])(\.git[\\/]hooks|\.husky)([\\/]|$)/.test(word);
@@ -5481,31 +5510,49 @@ function chmodDisarmsHook(args, shown) {
 function wholeTree(operand) {
   if (/^:\(top\)\.?$/.test(operand) || operand === ":/" || operand === "*") return true;
   if (operand.startsWith(":")) return false;
+  const lp = lexicalPath(operand);
+  return lp !== null && lp.parts.length === 0;
+}
+function chdirPrefix(inv) {
+  const dirs = inv.chdir ?? [];
+  if (dirs.length === 0) return null;
   const parts = [];
-  for (const part of operand.split("/")) {
-    if (!part || part === ".") continue;
-    if (part === "..") parts.pop();
-    else parts.push(part);
+  for (const d of dirs) {
+    if (d === null || d === "") return null;
+    const lp = lexicalPath(d);
+    if (lp === null || lp.climbed) return null;
+    parts.push(...lp.parts);
   }
-  return parts.length === 0 && !operand.startsWith("/");
+  return parts.length === 0 ? null : parts.join("/");
 }
 function stagesEverything(inv) {
   const sub = inv.sub?.toLowerCase();
+  const prefix = chdirPrefix(inv);
+  const judge = (operands2) => {
+    let conditional = false;
+    for (const operand of operands2) {
+      if (!wholeTree(operand)) continue;
+      if (prefix === null || operand.startsWith(":") || operand.startsWith("/")) return {};
+      if (wholeTree(`${prefix}/${operand === "*" ? "." : operand}`)) return {};
+      conditional = true;
+    }
+    return conditional && prefix !== null ? { ifWorkTreeTop: prefix } : null;
+  };
   if (sub === "add") {
     const o = parseOptions(inv.args, "", ADD_LONG_VALUE);
     if (o.flags.has("-n") || o.flags.has("--dry-run") || o.flags.has("-i") || o.flags.has("--interactive") || o.flags.has("-p") || o.flags.has("--patch") || o.flags.has("-e") || o.flags.has("--edit"))
-      return false;
+      return null;
     const all = o.flags.has("-A") || o.flags.has("--all") || o.flags.has("--no-ignore-removal") || o.flags.has("-u") || o.flags.has("--update");
-    if (all && o.operands.length === 0) return true;
-    return o.operands.some(wholeTree);
+    if (all && o.operands.length === 0) return {};
+    return judge(o.operands);
   }
   if (sub === "commit") {
     const o = parseOptions(inv.args, "mFCcut", COMMIT_LONG_VALUE);
-    if (o.flags.has("--dry-run")) return false;
-    if (o.flags.has("-a") || o.flags.has("--all")) return true;
-    return o.operands.some(wholeTree);
+    if (o.flags.has("--dry-run")) return null;
+    if (o.flags.has("-a") || o.flags.has("--all")) return {};
+    return judge(o.operands);
   }
-  return false;
+  return null;
 }
 function hookTextRunsNothing(text) {
   return text.split(/\r?\n/).every((line) => INERT_LINE_RE.test(line.trim()));
@@ -7161,9 +7208,9 @@ function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
 }
-function valuesAt(args, path30) {
+function valuesAt(args, path31) {
   let cursors = [args];
-  for (const rawSegment of path30.split(".")) {
+  for (const rawSegment of path31.split(".")) {
     const isArray = rawSegment.endsWith("[]");
     const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
     const next = [];
@@ -7194,8 +7241,8 @@ function extractToolDestinations(toolName, args) {
   try {
     const out = [];
     const paths = DESTINATION_ARGS.get(bareToolName(toolName)) ?? [];
-    for (const path30 of paths) {
-      for (const value of valuesAt(args, path30)) {
+    for (const path31 of paths) {
+      for (const value of valuesAt(args, path31)) {
         const host2 = hostOf(value);
         if (host2) out.push({ host: host2, binary: toolName, raw: value });
       }
@@ -7221,8 +7268,8 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    for (const path30 of paths) {
-      for (const value of valuesAt(args, path30)) {
+    for (const path31 of paths) {
+      for (const value of valuesAt(args, path31)) {
         const host2 = hostOf(value);
         if (!host2) continue;
         const m = classifySsrf(host2);
@@ -7231,7 +7278,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const decision = ssrfFloorDecision(m, written, opts);
         if (decision === null) continue;
         const reason = decision === "review" ? ssrfDisguisedReason(m, written) : ssrfReason(m, host2);
-        return { ...m, argPath: path30, host: host2, reason, decision };
+        return { ...m, argPath: path31, host: host2, reason, decision };
       }
     }
     return null;
@@ -7513,7 +7560,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hostHooks =
 }
 async function evaluatePolicyCore(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
-  const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2, isConfiguredRegistry } = hooks;
+  const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2, isConfiguredRegistry, isGitWorkTreeTop: isGitWorkTreeTop2 } = hooks;
   const settingsView = catalogSettings(config);
   const layers = inspectionLayers(config.policy);
   const cv = (id) => checkValue(settingsView, id);
@@ -7667,6 +7714,8 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
         const action = cv(id);
         const finding = action === "off" ? void 0 : git.findings.find((f) => f.checkId === id);
         if (!finding) continue;
+        if (finding.ifWorkTreeTop !== void 0 && isGitWorkTreeTop2 && cwd && !isGitWorkTreeTop2(finding.ifWorkTreeTop, cwd))
+          continue;
         const v = applyCheckValue(action, {
           decision: "review",
           blockedByLabel: `Node9 (AST): ${finding.ruleName}`,
@@ -16278,6 +16327,7 @@ zoo`.split("\n");
       /** The words after `git`: global options, then the subcommand. */
       visitGit(rest, env, depth, viaXargs, fromAlias, shown) {
         const config = /* @__PURE__ */ new Map();
+        const chdir = [];
         let i = 0;
         while (i < rest.length) {
           const w = rest[i];
@@ -16292,6 +16342,7 @@ zoo`.split("\n");
               i++;
               value = i < rest.length ? rest[i] : null;
             }
+            if (name === "-C") chdir.push(viaXargs || (value ?? "").includes("{}") ? null : value);
             if (name === "-c" && value !== null) {
               const ceq = value.indexOf("=");
               const key = (ceq > 0 ? value.slice(0, ceq) : value).toLowerCase();
@@ -16308,7 +16359,7 @@ zoo`.split("\n");
         }
         const subWord = i < rest.length ? rest[i] : void 0;
         const args = rest.slice(i + 1);
-        const inv = { sub: null, args, config, env, shown };
+        const inv = { sub: null, args, config, env, shown, chdir };
         if (subWord === void 0) {
           if (!viaXargs) return;
           this.emit(inv);
@@ -16322,16 +16373,23 @@ zoo`.split("\n");
         const fromConfig = config.get(`alias.${subWord.toLowerCase()}`);
         const alias = fromConfig !== void 0 ? fromConfig : this.aliases.get(subWord);
         if (alias !== void 0 && !fromAlias) {
-          this.expandAlias(subWord, alias, args, env, depth, 0, shown);
+          this.expandAlias(subWord, alias, args, env, depth, 0, shown, chdir);
           return;
         }
         inv.sub = subWord;
         this.emit(inv);
         this.recordAliasDefinition(inv, env, depth);
       }
-      expandAlias(name, value, args, env, depth, level, shown) {
+      expandAlias(name, value, args, env, depth, level, shown, chdir) {
         if (value === null) {
-          this.emit({ sub: null, args, config: /* @__PURE__ */ new Map(), env, shown: `${shown} (alias ${name})` });
+          this.emit({
+            sub: null,
+            args,
+            config: /* @__PURE__ */ new Map(),
+            env,
+            shown: `${shown} (alias ${name})`,
+            chdir
+          });
           return;
         }
         if (value.startsWith("!")) {
@@ -16345,7 +16403,16 @@ zoo`.split("\n");
         const nested = this.aliases.get(sub);
         const expandedShown = `${shown} (alias ${name} = ${value})`;
         if (nested !== void 0 && level < MAX_ALIAS_DEPTH) {
-          this.expandAlias(sub, nested, [...words.slice(1), ...args], env, depth, level + 1, shown);
+          this.expandAlias(
+            sub,
+            nested,
+            [...words.slice(1), ...args],
+            env,
+            depth,
+            level + 1,
+            shown,
+            chdir
+          );
           return;
         }
         this.emit({
@@ -16353,7 +16420,8 @@ zoo`.split("\n");
           args: [...words.slice(1), ...args],
           config: /* @__PURE__ */ new Map(),
           env,
-          shown: expandedShown
+          shown: expandedShown,
+          chdir
         });
       }
       /**
@@ -16387,7 +16455,7 @@ zoo`.split("\n");
         if (i + 1 >= args.length) return;
         const value = args[i + 1];
         this.aliases.set(m[1], value);
-        this.expandAlias(m[1], value, [], env, depth, 0, `${inv.shown}`);
+        this.expandAlias(m[1], value, [], env, depth, 0, `${inv.shown}`, []);
       }
     };
     POSITIONAL2 = "\0positional";
@@ -18303,8 +18371,8 @@ var ConfigFileSchema = z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path30 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path30}: ${issue.message}`;
+    const path31 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path31}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -18317,9 +18385,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path30 of ordered) {
+  for (const path31 of ordered) {
     let cur = root;
-    for (const key of path30.slice(0, -1)) {
+    for (const key of path31.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -18327,7 +18395,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path30[path30.length - 1];
+    const last = path31[path31.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -18363,7 +18431,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path30) => path30.length > 0);
+      }).filter((path31) => path31.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -19801,13 +19869,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path30 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path30) continue;
+            const path31 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path31) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path30, verdict, "org-managed jail")) {
+            for (const r of pathRules(path31, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path30, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path31, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -20188,6 +20256,9 @@ function readCappedText(file2, maxBytes, openFlags = "r") {
   return r ? { text: r.bytes.toString("utf8"), truncated: r.truncated } : null;
 }
 
+// src/policy/index.ts
+import path13 from "path";
+
 // src/dlp.ts
 init_dist();
 init_dist();
@@ -21508,10 +21579,19 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
       // reaches a long-lived in-process authorizer (the gateway) within seconds.
       isTrustedHost: config.policy.trustedHostsManaged ? (host2) => matchesTrustedHost(host2, config.policy.trustedHosts) : isTrustedHost,
       readAgentSettings,
-      isConfiguredRegistry: (host2, at) => configuredRegistryHosts(at).has(host2)
+      isConfiguredRegistry: (host2, at) => configuredRegistryHosts(at).has(host2),
+      isGitWorkTreeTop
     }
   );
 }
+function isGitWorkTreeTop(dir2, cwd) {
+  if (!path13.isAbsolute(cwd)) return true;
+  try {
+    return fs13.existsSync(path13.join(path13.resolve(cwd, dir2), ".git"));
+  } catch {
+    return true;
+  }
+}
 var MAX_AGENT_SETTINGS_BYTES = 256 * 1024;
 function readAgentSettings(absPath) {
   const r = readCappedText(
@@ -21527,11 +21607,11 @@ function isIgnoredTool2(toolName) {
 
 // src/auth/state.ts
 import fs14 from "fs";
-import path13 from "path";
+import path14 from "path";
 import os9 from "os";
 init_forecast_context();
-var PAUSED_FILE = path13.join(os9.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = path13.join(os9.homedir(), ".node9", "trust.json");
+var PAUSED_FILE = path14.join(os9.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = path14.join(os9.homedir(), ".node9", "trust.json");
 function extractCommandPattern(toolName, args) {
   const lower2 = toolName.toLowerCase();
   if (lower2 !== "bash" && lower2 !== "execute_bash" && lower2 !== "shell") return void 0;
@@ -21608,7 +21688,7 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = path13.join(os9.homedir(), ".node9", "decisions.json");
+    const file2 = path14.join(os9.homedir(), ".node9", "decisions.json");
     if (!fs14.existsSync(file2)) return null;
     const decisions = JSON.parse(fs14.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
@@ -21623,7 +21703,7 @@ init_forecast_context();
 import fs15 from "fs";
 import http from "http";
 import net from "net";
-import path14 from "path";
+import path15 from "path";
 import os10 from "os";
 
 // src/auth/decision-record.ts
@@ -21774,7 +21854,7 @@ function recordFromLegacyWait(body, now = Date.now()) {
 }
 
 // src/auth/daemon.ts
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path14.join(os10.tmpdir(), "node9-activity.sock");
+var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path15.join(os10.tmpdir(), "node9-activity.sock");
 function notifyActivitySocket(data) {
   if (forecastRun()) return Promise.resolve(false);
   return new Promise((resolve) => {
@@ -21819,7 +21899,7 @@ var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = path14.join(os10.homedir(), ".node9", "daemon.pid");
+    const pidFile = path15.join(os10.homedir(), ".node9", "daemon.pid");
     if (!fs15.existsSync(pidFile)) return null;
     const data = JSON.parse(fs15.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
@@ -21830,7 +21910,7 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = path14.join(os10.homedir(), ".node9", "daemon.pid");
+  const pidFile = path15.join(os10.homedir(), ".node9", "daemon.pid");
   if (fs15.existsSync(pidFile)) {
     let pid;
     let port;
@@ -22193,7 +22273,7 @@ import { randomUUID as randomUUID2 } from "crypto";
 // src/apps/state.ts
 import fs17 from "fs";
 import os12 from "os";
-import path16 from "path";
+import path17 from "path";
 
 // src/apps/catalog.ts
 var APP_CATALOG = [
@@ -22326,10 +22406,10 @@ init_audit();
 
 // src/daemon/mcp-tools.ts
 import fs16 from "fs";
-import path15 from "path";
+import path16 from "path";
 import os11 from "os";
 function getMcpToolsFile() {
-  return path15.join(os11.homedir(), ".node9", "mcp-tools.json");
+  return path16.join(os11.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
@@ -22344,7 +22424,7 @@ function readMcpToolsConfig() {
 
 // src/apps/state.ts
 function appsFilePath(home = os12.homedir()) {
-  return path16.join(home, ".node9", "apps.json");
+  return path17.join(home, ".node9", "apps.json");
 }
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["mcp-server", "command", "package", "env-name"]);
 function emptyFile() {
@@ -22448,14 +22528,14 @@ function resolveLinkedServer(label2, opts = {}) {
 
 // src/auth/orchestrator.ts
 import os21 from "os";
-import path29 from "path";
+import path30 from "path";
 
 // src/ui/native.ts
 import { spawn } from "child_process";
-import path18 from "path";
+import path19 from "path";
 
 // src/context-sniper.ts
-import path17 from "path";
+import path18 from "path";
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -22523,7 +22603,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = path17.basename(editFilePath);
+        editFileName = path18.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -22591,7 +22671,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file2 = obj.file_path ? path18.basename(String(obj.file_path)) : "file";
+      const file2 = obj.file_path ? path19.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -22796,17 +22876,17 @@ end run`;
 // src/canary/registry.ts
 import fs19 from "fs";
 import os14 from "os";
-import path20 from "path";
+import path21 from "path";
 init_dist();
 
 // src/shields/jail.ts
 import fs18 from "fs";
 import os13 from "os";
-import path19 from "path";
+import path20 from "path";
 init_dist();
 var USER_JAIL_SHIELD = "user-jail";
 function jailStorePath() {
-  return path19.join(os13.homedir(), ".node9", "jail-paths.json");
+  return path20.join(os13.homedir(), ".node9", "jail-paths.json");
 }
 function readJailPaths() {
   let text;
@@ -22840,7 +22920,7 @@ function findJailedPathIn(candidate, paths) {
 
 // src/canary/registry.ts
 function canaryStorePath() {
-  return path20.join(os14.homedir(), ".node9", "canaries.json");
+  return path21.join(os14.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -22880,7 +22960,7 @@ init_dist();
 init_dist();
 import fs20 from "fs";
 import os15 from "os";
-import path21 from "path";
+import path22 from "path";
 var MAX_SCRIPT_BYTES = 64 * 1024;
 var MAX_RECORDED_WRITES = 32;
 function readScriptFile(resolved) {
@@ -22911,7 +22991,7 @@ function readScriptFile(resolved) {
 }
 function absolute(p, cwd, home) {
   const spelled = p === "~" || p.startsWith("~/") ? home + p.slice(1) : p;
-  return path21.resolve(cwd, spelled);
+  return path22.resolve(cwd, spelled);
 }
 async function resolveSessionScript(toolName, args, cwd, layers, deps, home = os15.homedir()) {
   try {
@@ -22973,12 +23053,12 @@ init_dist();
 
 // src/exposure/known-hosts.ts
 import fs22 from "fs";
-import path23 from "path";
+import path24 from "path";
 
 // src/utils/git-remotes.ts
 init_dist();
 import fs21 from "fs";
-import path22 from "path";
+import path23 from "path";
 function readSmallFile(p, max) {
   let fd;
   try {
@@ -23010,20 +23090,20 @@ function gitRemoteHost(url) {
   return null;
 }
 function findGitConfig(dir2, walkUp = true) {
-  let cur = path22.resolve(dir2);
+  let cur = path23.resolve(dir2);
   for (let i = 0; i < (walkUp ? 64 : 1); i++) {
-    const dotGit = path22.join(cur, ".git");
-    const direct = readSmallFile(path22.join(dotGit, "config"), 1e6);
+    const dotGit = path23.join(cur, ".git");
+    const direct = readSmallFile(path23.join(dotGit, "config"), 1e6);
     if (direct !== null) return direct;
     const pointer = readSmallFile(dotGit, 4096);
     const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
     if (m) {
-      let gitDir = path22.resolve(cur, m[1]);
-      const common = readSmallFile(path22.join(gitDir, "commondir"), 4096);
-      if (common !== null) gitDir = path22.resolve(gitDir, common.trim());
-      return readSmallFile(path22.join(gitDir, "config"), 1e6);
+      let gitDir = path23.resolve(cur, m[1]);
+      const common = readSmallFile(path23.join(gitDir, "commondir"), 4096);
+      if (common !== null) gitDir = path23.resolve(gitDir, common.trim());
+      return readSmallFile(path23.join(gitDir, "config"), 1e6);
     }
-    const parent = path22.dirname(cur);
+    const parent = path23.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -23033,12 +23113,12 @@ var cache4 = /* @__PURE__ */ new Map();
 function readGitRemotes(dir2, opts = {}) {
   if (!dir2) return [];
   const walkUp = opts.walkUp !== false;
-  const key = `${walkUp ? "up" : "at"}:${path22.resolve(dir2)}`;
+  const key = `${walkUp ? "up" : "at"}:${path23.resolve(dir2)}`;
   const hit = cache4.get(key);
   if (hit) return hit;
   const out = [];
   try {
-    const cfg = findGitConfig(path22.resolve(dir2), walkUp);
+    const cfg = findGitConfig(path23.resolve(dir2), walkUp);
     if (cfg !== null) {
       let current = null;
       for (const line of cfg.split(/\r?\n/)) {
@@ -23074,15 +23154,15 @@ var ECOSYSTEMS = [
 ];
 var cache5 = /* @__PURE__ */ new Map();
 function manifestRoot(dir2) {
-  let cur = path23.resolve(dir2);
+  let cur = path24.resolve(dir2);
   for (let i = 0; i < 64; i++) {
     for (const [m] of ECOSYSTEMS) {
       try {
-        if (fs22.existsSync(path23.join(cur, m))) return cur;
+        if (fs22.existsSync(path24.join(cur, m))) return cur;
       } catch {
       }
     }
-    const parent = path23.dirname(cur);
+    const parent = path24.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -23091,7 +23171,7 @@ function manifestRoot(dir2) {
 function knownProjectHosts(dir2) {
   const empty = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
   if (!dir2) return empty;
-  const key = path23.resolve(dir2);
+  const key = path24.resolve(dir2);
   const hit = cache5.get(key);
   if (hit) return hit;
   const out = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
@@ -23104,7 +23184,7 @@ function knownProjectHosts(dir2) {
     const root = manifestRoot(key);
     if (root !== null) {
       for (const [m, registry] of ECOSYSTEMS) {
-        if (fs22.existsSync(path23.join(root, m))) out.hosts.add(registry);
+        if (fs22.existsSync(path24.join(root, m))) out.hosts.add(registry);
       }
       try {
         if (fs22.readdirSync(root).some((f) => f.endsWith(".gemspec")))
@@ -23122,7 +23202,7 @@ function knownProjectHosts(dir2) {
 init_dist();
 import fs23 from "fs";
 import os16 from "os";
-import path24 from "path";
+import path25 from "path";
 var WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "remove"]);
 var LIFECYCLE_RE = /"(scripts|preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack|publish|postpublish)"\s*:/;
 function writtenContent(args) {
@@ -23172,7 +23252,7 @@ function judgeWritesAfterExposure(opts) {
     seen.add(p);
     if (p === "/dev" || p.startsWith("/dev/")) continue;
     if (root !== null && isInside(root, p)) {
-      if (isAgentInstructionPath(p, root) && (path24.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
+      if (isAgentInstructionPath(p, root) && (path25.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
         holds.push({ path: p, why: "agent-instruction" });
       continue;
     }
@@ -23196,7 +23276,7 @@ function judgeWritesAfterExposure(opts) {
 import crypto3 from "crypto";
 import fs24 from "fs";
 import os17 from "os";
-import path25 from "path";
+import path26 from "path";
 
 // src/daemon/exposure-store.ts
 var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
@@ -23204,11 +23284,11 @@ var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
 // src/exposure/marker.ts
 init_forecast_context();
 function dir() {
-  return path25.join(os17.homedir(), ".node9", "exposure-sessions");
+  return path26.join(os17.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = crypto3.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return path25.join(dir(), id);
+  return path26.join(dir(), id);
 }
 function maybeSessionExposed(sessionId) {
   if (!sessionId) return false;
@@ -23319,10 +23399,10 @@ function sourceWord(toolName) {
 // src/auth/trusted-recipients.ts
 init_dist();
 import fs26 from "fs";
-import path26 from "path";
+import path27 from "path";
 import os18 from "os";
 function getTrustedRecipientsPath() {
-  return path26.join(os18.homedir(), ".node9", "trusted-recipients.json");
+  return path27.join(os18.homedir(), ".node9", "trusted-recipients.json");
 }
 function readTrustedRecipients() {
   try {
@@ -23335,7 +23415,7 @@ function readTrustedRecipients() {
 }
 function writeTrustedRecipients(entries) {
   const filePath = getTrustedRecipientsPath();
-  fs26.mkdirSync(path26.dirname(filePath), { recursive: true });
+  fs26.mkdirSync(path27.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
   fs26.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
   fs26.renameSync(tmp, filePath);
@@ -23373,7 +23453,7 @@ init_forecast_context();
 init_audit();
 import fs27 from "fs";
 import os19 from "os";
-import path27 from "path";
+import path28 from "path";
 init_dist();
 var CLOUD_ARRAY_KEYS = /* @__PURE__ */ new Set(["exposureDestinations", "exposureDestinationHashes"]);
 function maskArgsForCloud(args) {
@@ -23408,7 +23488,7 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = path27.join(os19.homedir(), ".node9", "ci-context.json");
+      const ciContextPath = path28.join(os19.homedir(), ".node9", "ci-context.json");
       const ci = readCappedText(ciContextPath, 1e4);
       if (!ci) throw new Error("ci-context.json unreadable");
       if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
@@ -23546,10 +23626,10 @@ init_dist();
 init_forecast_context();
 init_dist();
 import fs28 from "fs";
-import path28 from "path";
+import path29 from "path";
 import os20 from "os";
 function loopStateFile() {
-  return path28.join(os20.homedir(), ".node9", "loop-state.json");
+  return path29.join(os20.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
@@ -23563,7 +23643,7 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir2 = path28.dirname(loopStateFile());
+  const dir2 = path29.dirname(loopStateFile());
   if (!fs28.existsSync(dir2)) fs28.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${loopStateFile()}.${os20.hostname()}.${process.pid}.tmp`;
   fs28.writeFileSync(tmpPath, JSON.stringify(records));
@@ -23763,9 +23843,9 @@ function isMcpToolName(toolName) {
   return /^mcp__[^_](?:[^_]|_(?!_))*?__/i.test(toolName);
 }
 function absoluteUploadPath(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? path29.join(os21.homedir(), spelled.slice(1)) : spelled;
-  if (path29.isAbsolute(expanded)) return expanded;
-  return cwd && path29.isAbsolute(cwd) ? path29.resolve(cwd, expanded) : expanded;
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? path30.join(os21.homedir(), spelled.slice(1)) : spelled;
+  if (path30.isAbsolute(expanded)) return expanded;
+  return cwd && path30.isAbsolute(cwd) ? path30.resolve(cwd, expanded) : expanded;
 }
 function extractFilePaths(toolName, args, shellCommand) {
   const paths = [];