@node9/proxy 2.44.0 → 2.45.0

package/dist/cli.js

@@ -35079,12 +35079,6 @@ function isReadable(filePath) {
     return false;
   }
 }
-function scoreLabel(score) {
-  if (score >= 80) return import_chalk3.default.green(`${score}/100  Good`);
-  if (score >= 50) return import_chalk3.default.yellow(`${score}/100  Moderate risk`);
-  if (score >= 25) return import_chalk3.default.red(`${score}/100  High risk`);
-  return import_chalk3.default.red.bold(`${score}/100  Critical`);
-}
 function runBlast() {
   const home = import_os42.default.homedir();
   const cwd = process.cwd();
@@ -35115,7 +35109,7 @@ function registerBlastCommand(program2) {
   program2.command("blast").description("Map what an AI agent can currently reach on this machine").action(() => {
     const home = import_os42.default.homedir();
     const cwd = process.cwd();
-    const { reachable, envFindings, score } = runBlast();
+    const { reachable, envFindings } = runBlast();
     const width = labelColumnWidth([
       ...reachable.map((p) => p.label),
       ...envFindings.map((f) => f.key)
@@ -35147,21 +35141,24 @@ function registerBlastCommand(program2) {
     console.log("  " + import_chalk3.default.dim("\u2500".repeat(70)));
     if (reachable.length === 0 && envFindings.length === 0) {
       console.log("  " + import_chalk3.default.green("\u2705  No sensitive files or environment secrets found."));
-      console.log("  Security Score: " + scoreLabel(score));
     } else {
       console.log(
-        "  Security Score: " + scoreLabel(score) + import_chalk3.default.dim(
-          `  (${reachable.length} file${reachable.length !== 1 ? "s" : ""}, ${envFindings.length} env var${envFindings.length !== 1 ? "s" : ""})`
-        )
+        import_chalk3.default.bold(
+          `  ${reachable.length} file${reachable.length !== 1 ? "s" : ""} and ${envFindings.length} env var${envFindings.length !== 1 ? "s" : ""}`
+        ) + import_chalk3.default.dim(" every AI agent you start can read.")
       );
       console.log("");
       console.log(
         import_chalk3.default.dim(
-          "  Every AI agent you start can read the files and env vars listed above.\n  Run `node9 shield enable project-jail` to restrict agent file access.\n  Run `node9 mask` to redact secrets from existing session history."
+          "  Run `node9 shield enable project-jail` to restrict agent file access.\n  Run `node9 mask` to redact secrets from existing session history."
         )
       );
     }
     console.log("");
+    console.log(
+      import_chalk3.default.dim("  Machine score: ") + import_chalk3.default.cyan("node9 posture") + import_chalk3.default.dim(" (this list is its Secrets section)")
+    );
+    console.log("");
   });
 }
 var import_chalk3, import_fs49, import_path51, import_os42;
@@ -35274,13 +35271,14 @@ var init_scan_derive = __esm({
 });
 
 // src/protection.ts
-var PROTECTIVE_SHIELD_DISCOUNTS;
+function isProtectiveShield(name) {
+  return PROTECTIVE_SHIELDS.has(name);
+}
+var PROTECTIVE_SHIELDS;
 var init_protection = __esm({
   "src/protection.ts"() {
     "use strict";
-    PROTECTIVE_SHIELD_DISCOUNTS = {
-      "project-jail": 0.7
-    };
+    PROTECTIVE_SHIELDS = /* @__PURE__ */ new Set(["project-jail"]);
   }
 });
 
@@ -35321,20 +35319,6 @@ var init_scan_json = __esm({
 function defaultHistoryPath() {
   return import_path52.default.join(import_os43.default.homedir(), ".node9", "scan-history.json");
 }
-function readPreviousScan(opts = {}) {
-  const filePath = opts.path ?? defaultHistoryPath();
-  try {
-    if (!import_fs50.default.existsSync(filePath)) return null;
-    const raw = import_fs50.default.readFileSync(filePath, "utf8");
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed) || parsed.length === 0) return null;
-    const last = parsed[parsed.length - 1];
-    if (!isValidRecord(last)) return null;
-    return last;
-  } catch {
-    return null;
-  }
-}
 function appendScanHistory(record2, opts = {}) {
   const filePath = opts.path ?? defaultHistoryPath();
   const cap = opts.cap ?? SCAN_HISTORY_CAP;
@@ -35362,15 +35346,6 @@ function appendScanHistory(record2, opts = {}) {
     );
   }
 }
-function computeScanDelta(current, previous, now = Date.now()) {
-  if (!previous) return null;
-  const prevMs = Date.parse(previous.timestamp);
-  if (Number.isNaN(prevMs)) return null;
-  const scoreDelta = current.score - previous.score;
-  const daysAgo = Math.max(0, Math.floor((now - prevMs) / 864e5));
-  if (scoreDelta === 0 && daysAgo === 0) return null;
-  return { scoreDelta, daysAgo };
-}
 function isValidRecord(x) {
   if (typeof x !== "object" || x === null) return false;
   const r = x;
@@ -36032,7 +36007,7 @@ async function runUploadHistory(opts) {
       `   Parsed ${linesParsed.toLocaleString()} JSONL lines from ${filesScanned} session${filesScanned === 1 ? "" : "s"} (skipped ${linesSkipped} malformed)`
     )
   );
-  console.log(import_chalk5.default.gray(`   Findings: ${findings.length}, score: ${summary.score}/100`));
+  console.log(import_chalk5.default.gray(`   Findings: ${findings.length}`));
   const scanUrl = creds.apiUrl.endsWith("/policies/sync") ? creds.apiUrl.replace(/\/policies\/sync$/, "/scan/report") : `${creds.apiUrl.replace(/\/$/, "")}/scan/report`;
   await postJson(scanUrl, creds.apiKey, {
     ...summary,
@@ -37813,6 +37788,9 @@ function renderCompactScorecard(input) {
     );
     console.log("");
   }
+  console.log(
+    import_chalk6.default.dim("\u2192  Machine score: run ") + import_chalk6.default.cyan("node9 posture") + import_chalk6.default.dim(" for this machine's score and what to fix first.")
+  );
   console.log(
     import_chalk6.default.dim("\u2192  ") + import_chalk6.default.cyan("npx node9-ai scan") + import_chalk6.default.dim("       run this on your machine")
   );
@@ -37923,6 +37901,9 @@ function renderNarrativeScorecard(input) {
     }
     console.log("");
   }
+  console.log(
+    import_chalk6.default.dim("\u2192  Machine score: run ") + import_chalk6.default.cyan("node9 posture") + import_chalk6.default.dim(" for this machine's score and what to fix first.")
+  );
   console.log(
     import_chalk6.default.dim("\u2192  ") + import_chalk6.default.cyan("npx node9-ai scan") + import_chalk6.default.dim("       run this on your machine")
   );
@@ -38165,24 +38146,24 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
   const shieldImpacts = rollupByShield(summary.sections);
   const shieldLines = [];
   const ranked = [...shieldImpacts].sort((a, b) => {
-    const aDiscount = PROTECTIVE_SHIELD_DISCOUNTS[a.shieldName] ?? 0;
-    const bDiscount = PROTECTIVE_SHIELD_DISCOUNTS[b.shieldName] ?? 0;
-    if (aDiscount !== bDiscount) return bDiscount - aDiscount;
+    const aProt = isProtectiveShield(a.shieldName) ? 1 : 0;
+    const bProt = isProtectiveShield(b.shieldName) ? 1 : 0;
+    if (aProt !== bProt) return bProt - aProt;
     return b.totalCatches - a.totalCatches;
   });
   for (const impact of ranked) {
     if (impact.totalCatches === 0) continue;
-    const discount = PROTECTIVE_SHIELD_DISCOUNTS[impact.shieldName] ?? 0;
+    const protective = isProtectiveShield(impact.shieldName);
     const isOn = enabledSet.has(impact.shieldName);
-    const icon = discount > 0 ? "\u{1F6E1}\uFE0F  " : "\u2610   ";
+    const icon = protective ? "\u{1F6E1}\uFE0F  " : "\u2610   ";
     const wouldCatch = `catches ${impact.totalCatches} op${impact.totalCatches !== 1 ? "s" : ""}`;
-    const suffix = isOn ? "\u2713 enabled" : discount > 0 ? "\u2192 blocks these reads in-path" : "";
+    const suffix = isOn ? "\u2713 enabled" : protective ? "\u2192 blocks these reads in-path" : "";
     shieldLines.push(
       mkLine(
-        [icon, discount > 0 ? import_chalk6.default.cyan : import_chalk6.default.dim],
+        [icon, protective ? import_chalk6.default.cyan : import_chalk6.default.dim],
         [impact.shieldName.padEnd(14), import_chalk6.default.bold],
         [wouldCatch.padEnd(22), import_chalk6.default.dim],
-        [suffix, isOn || discount > 0 ? import_chalk6.default.green.bold : import_chalk6.default.dim]
+        [suffix, isOn || protective ? import_chalk6.default.green.bold : import_chalk6.default.dim]
       )
     );
     if (impact.topRuleLabels.length > 0) {
@@ -38211,10 +38192,10 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     shieldLines.push(mkLine(["      no hits in your history \u2014 install proactively", import_chalk6.default.dim]));
   }
   const topRec = ranked.find(
-    (r) => r.totalCatches > 0 && (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0 && !enabledSet.has(r.shieldName)
+    (r) => r.totalCatches > 0 && isProtectiveShield(r.shieldName) && !enabledSet.has(r.shieldName)
   );
   const allCovered = !topRec && ranked.some(
-    (r) => r.totalCatches > 0 && (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0 && enabledSet.has(r.shieldName)
+    (r) => r.totalCatches > 0 && isProtectiveShield(r.shieldName) && enabledSet.has(r.shieldName)
   );
   if (topRec) {
     const cta = `\u2192 node9 shield enable ${topRec.shieldName}   (start here \u2014 widest coverage)`;
@@ -38419,9 +38400,7 @@ function registerScanCommand(program2) {
         process.stdout.write(JSON.stringify(envelope, null, 2) + "\n");
         return;
       }
-      let scanDelta2 = null;
       if (!screenshotMode) {
-        const previous = readPreviousScan();
         const currentRecord = {
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           score: blast.score,
@@ -38433,7 +38412,6 @@ function registerScanCommand(program2) {
           totalCalls: scan.totalToolCalls
         };
         appendScanHistory(currentRecord);
-        scanDelta2 = computeScanDelta(currentRecord, previous);
       }
       if (options.compact) {
         renderCompactScorecard({
@@ -38472,19 +38450,9 @@ function registerScanCommand(program2) {
       }
       {
         const totalRisky = scan.canaryFindings.length + totalFindings + scan.dlpFindings.length;
-        const score = classifyScore(blast.score);
-        const severityDisplay = score.band === "critical" ? import_chalk6.default.red.bold(score.label) : score.color(score.label);
-        const trendSuffix = (() => {
-          if (!scanDelta2) return "";
-          const { scoreDelta, daysAgo } = scanDelta2;
-          if (scoreDelta === 0) return "";
-          const arrow = scoreDelta > 0 ? import_chalk6.default.green(`\u25B2${scoreDelta}`) : import_chalk6.default.red(`\u25BC${Math.abs(scoreDelta)}`);
-          const since = daysAgo === 0 ? "today" : daysAgo === 1 ? "yesterday" : `${daysAgo} days ago`;
-          return import_chalk6.default.dim("  \xB7  ") + arrow + import_chalk6.default.dim(` since ${since}`);
-        })();
-        if (!useInkForHero) {
+        if (!useInkForHero && totalRisky > 0) {
           console.log(
-            "  " + (score.band === "critical" ? import_chalk6.default.red.bold("\u26A0  ") : "") + import_chalk6.default.bold("Security Score ") + score.color.bold(`${blast.score}/100`) + "  " + severityDisplay + trendSuffix + import_chalk6.default.dim("  \xB7  ") + (totalRisky > 0 ? import_chalk6.default.red.bold(`${totalRisky} risky operation${totalRisky !== 1 ? "s" : ""}`) : import_chalk6.default.green("No risky operations"))
+            "  " + import_chalk6.default.red.bold(`${totalRisky} risky operation${totalRisky !== 1 ? "s" : ""}`) + import_chalk6.default.dim(" in the scanned history")
           );
         }
         const cardParts = [];
@@ -38566,6 +38534,10 @@ function registerScanCommand(program2) {
               keyed
             });
           }
+          console.log(
+            import_chalk6.default.dim("  Machine score: run ") + import_chalk6.default.cyan("node9 posture") + import_chalk6.default.dim(" for this machine's score and what to fix first.")
+          );
+          console.log("");
           const cta = isWired ? "\u2705 node9 is active" : "\u2192 install node9 to enable protection";
           console.log("  " + import_chalk6.default.green(cta));
           console.log(
@@ -38760,6 +38732,10 @@ function registerScanCommand(program2) {
         );
         console.log("");
       }
+      console.log(
+        import_chalk6.default.dim("  Machine score: run ") + import_chalk6.default.cyan("node9 posture") + import_chalk6.default.dim(" for this machine's score and what to fix first.")
+      );
+      console.log("");
       if (isWired) {
         console.log(import_chalk6.default.green("  \u2705 node9 is active \u2014 your future sessions are protected."));
         console.log(
@@ -78234,6 +78210,7 @@ init_agent_wiring();
 init_codex_trust();
 init_sync();
 init_service();
+init_posture();
 function printAgentSection(label3, hookPairs, wrapped) {
   console.log(import_chalk22.default.bold(`  ${label3}`));
   for (const { name, present } of hookPairs) {
@@ -78314,6 +78291,13 @@ function registerStatusCommand(program2) {
     console.log("");
     const modeLabel = levelLabel(settings.mode);
     console.log(`  Mode:    ${modeLabel}`);
+    const posture = await runPosture().catch(() => null);
+    if (posture) {
+      const tier = posture.tier === "good" ? import_chalk22.default.green("Good") : posture.tier === "at-risk" ? import_chalk22.default.yellow("At risk") : import_chalk22.default.red("Critical");
+      console.log(
+        `  Score:   ${import_chalk22.default.bold(`${posture.score}/100`)} (${tier})` + import_chalk22.default.gray("  \xB7 node9 posture for the breakdown")
+      );
+    }
     const wsGoverned = mergedConfig.policySource === "workspace";
     if (wsGoverned) {
       console.log(`  Policy:  ${import_chalk22.default.cyan("Workspace config (app.node9.ai)")}`);

package/dist/cli.mjs

@@ -35073,12 +35073,6 @@ function isReadable(filePath) {
     return false;
   }
 }
-function scoreLabel(score) {
-  if (score >= 80) return chalk3.green(`${score}/100  Good`);
-  if (score >= 50) return chalk3.yellow(`${score}/100  Moderate risk`);
-  if (score >= 25) return chalk3.red(`${score}/100  High risk`);
-  return chalk3.red.bold(`${score}/100  Critical`);
-}
 function runBlast() {
   const home = os43.homedir();
   const cwd = process.cwd();
@@ -35109,7 +35103,7 @@ function registerBlastCommand(program2) {
   program2.command("blast").description("Map what an AI agent can currently reach on this machine").action(() => {
     const home = os43.homedir();
     const cwd = process.cwd();
-    const { reachable, envFindings, score } = runBlast();
+    const { reachable, envFindings } = runBlast();
     const width = labelColumnWidth([
       ...reachable.map((p) => p.label),
       ...envFindings.map((f) => f.key)
@@ -35141,21 +35135,24 @@ function registerBlastCommand(program2) {
     console.log("  " + chalk3.dim("\u2500".repeat(70)));
     if (reachable.length === 0 && envFindings.length === 0) {
       console.log("  " + chalk3.green("\u2705  No sensitive files or environment secrets found."));
-      console.log("  Security Score: " + scoreLabel(score));
     } else {
       console.log(
-        "  Security Score: " + scoreLabel(score) + chalk3.dim(
-          `  (${reachable.length} file${reachable.length !== 1 ? "s" : ""}, ${envFindings.length} env var${envFindings.length !== 1 ? "s" : ""})`
-        )
+        chalk3.bold(
+          `  ${reachable.length} file${reachable.length !== 1 ? "s" : ""} and ${envFindings.length} env var${envFindings.length !== 1 ? "s" : ""}`
+        ) + chalk3.dim(" every AI agent you start can read.")
       );
       console.log("");
       console.log(
         chalk3.dim(
-          "  Every AI agent you start can read the files and env vars listed above.\n  Run `node9 shield enable project-jail` to restrict agent file access.\n  Run `node9 mask` to redact secrets from existing session history."
+          "  Run `node9 shield enable project-jail` to restrict agent file access.\n  Run `node9 mask` to redact secrets from existing session history."
         )
       );
     }
     console.log("");
+    console.log(
+      chalk3.dim("  Machine score: ") + chalk3.cyan("node9 posture") + chalk3.dim(" (this list is its Secrets section)")
+    );
+    console.log("");
   });
 }
 var init_blast = __esm({
@@ -35263,13 +35260,14 @@ var init_scan_derive = __esm({
 });
 
 // src/protection.ts
-var PROTECTIVE_SHIELD_DISCOUNTS;
+function isProtectiveShield(name) {
+  return PROTECTIVE_SHIELDS.has(name);
+}
+var PROTECTIVE_SHIELDS;
 var init_protection = __esm({
   "src/protection.ts"() {
     "use strict";
-    PROTECTIVE_SHIELD_DISCOUNTS = {
-      "project-jail": 0.7
-    };
+    PROTECTIVE_SHIELDS = /* @__PURE__ */ new Set(["project-jail"]);
   }
 });
 
@@ -35313,20 +35311,6 @@ import os44 from "os";
 function defaultHistoryPath() {
   return path54.join(os44.homedir(), ".node9", "scan-history.json");
 }
-function readPreviousScan(opts = {}) {
-  const filePath = opts.path ?? defaultHistoryPath();
-  try {
-    if (!fs52.existsSync(filePath)) return null;
-    const raw = fs52.readFileSync(filePath, "utf8");
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed) || parsed.length === 0) return null;
-    const last = parsed[parsed.length - 1];
-    if (!isValidRecord(last)) return null;
-    return last;
-  } catch {
-    return null;
-  }
-}
 function appendScanHistory(record2, opts = {}) {
   const filePath = opts.path ?? defaultHistoryPath();
   const cap = opts.cap ?? SCAN_HISTORY_CAP;
@@ -35354,15 +35338,6 @@ function appendScanHistory(record2, opts = {}) {
     );
   }
 }
-function computeScanDelta(current, previous, now = Date.now()) {
-  if (!previous) return null;
-  const prevMs = Date.parse(previous.timestamp);
-  if (Number.isNaN(prevMs)) return null;
-  const scoreDelta = current.score - previous.score;
-  const daysAgo = Math.max(0, Math.floor((now - prevMs) / 864e5));
-  if (scoreDelta === 0 && daysAgo === 0) return null;
-  return { scoreDelta, daysAgo };
-}
 function isValidRecord(x) {
   if (typeof x !== "object" || x === null) return false;
   const r = x;
@@ -36026,7 +36001,7 @@ async function runUploadHistory(opts) {
       `   Parsed ${linesParsed.toLocaleString()} JSONL lines from ${filesScanned} session${filesScanned === 1 ? "" : "s"} (skipped ${linesSkipped} malformed)`
     )
   );
-  console.log(chalk5.gray(`   Findings: ${findings.length}, score: ${summary.score}/100`));
+  console.log(chalk5.gray(`   Findings: ${findings.length}`));
   const scanUrl = creds.apiUrl.endsWith("/policies/sync") ? creds.apiUrl.replace(/\/policies\/sync$/, "/scan/report") : `${creds.apiUrl.replace(/\/$/, "")}/scan/report`;
   await postJson(scanUrl, creds.apiKey, {
     ...summary,
@@ -37807,6 +37782,9 @@ function renderCompactScorecard(input) {
     );
     console.log("");
   }
+  console.log(
+    chalk6.dim("\u2192  Machine score: run ") + chalk6.cyan("node9 posture") + chalk6.dim(" for this machine's score and what to fix first.")
+  );
   console.log(
     chalk6.dim("\u2192  ") + chalk6.cyan("npx node9-ai scan") + chalk6.dim("       run this on your machine")
   );
@@ -37917,6 +37895,9 @@ function renderNarrativeScorecard(input) {
     }
     console.log("");
   }
+  console.log(
+    chalk6.dim("\u2192  Machine score: run ") + chalk6.cyan("node9 posture") + chalk6.dim(" for this machine's score and what to fix first.")
+  );
   console.log(
     chalk6.dim("\u2192  ") + chalk6.cyan("npx node9-ai scan") + chalk6.dim("       run this on your machine")
   );
@@ -38159,24 +38140,24 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
   const shieldImpacts = rollupByShield(summary.sections);
   const shieldLines = [];
   const ranked = [...shieldImpacts].sort((a, b) => {
-    const aDiscount = PROTECTIVE_SHIELD_DISCOUNTS[a.shieldName] ?? 0;
-    const bDiscount = PROTECTIVE_SHIELD_DISCOUNTS[b.shieldName] ?? 0;
-    if (aDiscount !== bDiscount) return bDiscount - aDiscount;
+    const aProt = isProtectiveShield(a.shieldName) ? 1 : 0;
+    const bProt = isProtectiveShield(b.shieldName) ? 1 : 0;
+    if (aProt !== bProt) return bProt - aProt;
     return b.totalCatches - a.totalCatches;
   });
   for (const impact of ranked) {
     if (impact.totalCatches === 0) continue;
-    const discount = PROTECTIVE_SHIELD_DISCOUNTS[impact.shieldName] ?? 0;
+    const protective = isProtectiveShield(impact.shieldName);
     const isOn = enabledSet.has(impact.shieldName);
-    const icon = discount > 0 ? "\u{1F6E1}\uFE0F  " : "\u2610   ";
+    const icon = protective ? "\u{1F6E1}\uFE0F  " : "\u2610   ";
     const wouldCatch = `catches ${impact.totalCatches} op${impact.totalCatches !== 1 ? "s" : ""}`;
-    const suffix = isOn ? "\u2713 enabled" : discount > 0 ? "\u2192 blocks these reads in-path" : "";
+    const suffix = isOn ? "\u2713 enabled" : protective ? "\u2192 blocks these reads in-path" : "";
     shieldLines.push(
       mkLine(
-        [icon, discount > 0 ? chalk6.cyan : chalk6.dim],
+        [icon, protective ? chalk6.cyan : chalk6.dim],
         [impact.shieldName.padEnd(14), chalk6.bold],
         [wouldCatch.padEnd(22), chalk6.dim],
-        [suffix, isOn || discount > 0 ? chalk6.green.bold : chalk6.dim]
+        [suffix, isOn || protective ? chalk6.green.bold : chalk6.dim]
       )
     );
     if (impact.topRuleLabels.length > 0) {
@@ -38205,10 +38186,10 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     shieldLines.push(mkLine(["      no hits in your history \u2014 install proactively", chalk6.dim]));
   }
   const topRec = ranked.find(
-    (r) => r.totalCatches > 0 && (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0 && !enabledSet.has(r.shieldName)
+    (r) => r.totalCatches > 0 && isProtectiveShield(r.shieldName) && !enabledSet.has(r.shieldName)
   );
   const allCovered = !topRec && ranked.some(
-    (r) => r.totalCatches > 0 && (PROTECTIVE_SHIELD_DISCOUNTS[r.shieldName] ?? 0) > 0 && enabledSet.has(r.shieldName)
+    (r) => r.totalCatches > 0 && isProtectiveShield(r.shieldName) && enabledSet.has(r.shieldName)
   );
   if (topRec) {
     const cta = `\u2192 node9 shield enable ${topRec.shieldName}   (start here \u2014 widest coverage)`;
@@ -38413,9 +38394,7 @@ function registerScanCommand(program2) {
         process.stdout.write(JSON.stringify(envelope, null, 2) + "\n");
         return;
       }
-      let scanDelta2 = null;
       if (!screenshotMode) {
-        const previous = readPreviousScan();
         const currentRecord = {
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           score: blast.score,
@@ -38427,7 +38406,6 @@ function registerScanCommand(program2) {
           totalCalls: scan.totalToolCalls
         };
         appendScanHistory(currentRecord);
-        scanDelta2 = computeScanDelta(currentRecord, previous);
       }
       if (options.compact) {
         renderCompactScorecard({
@@ -38466,19 +38444,9 @@ function registerScanCommand(program2) {
       }
       {
         const totalRisky = scan.canaryFindings.length + totalFindings + scan.dlpFindings.length;
-        const score = classifyScore(blast.score);
-        const severityDisplay = score.band === "critical" ? chalk6.red.bold(score.label) : score.color(score.label);
-        const trendSuffix = (() => {
-          if (!scanDelta2) return "";
-          const { scoreDelta, daysAgo } = scanDelta2;
-          if (scoreDelta === 0) return "";
-          const arrow = scoreDelta > 0 ? chalk6.green(`\u25B2${scoreDelta}`) : chalk6.red(`\u25BC${Math.abs(scoreDelta)}`);
-          const since = daysAgo === 0 ? "today" : daysAgo === 1 ? "yesterday" : `${daysAgo} days ago`;
-          return chalk6.dim("  \xB7  ") + arrow + chalk6.dim(` since ${since}`);
-        })();
-        if (!useInkForHero) {
+        if (!useInkForHero && totalRisky > 0) {
           console.log(
-            "  " + (score.band === "critical" ? chalk6.red.bold("\u26A0  ") : "") + chalk6.bold("Security Score ") + score.color.bold(`${blast.score}/100`) + "  " + severityDisplay + trendSuffix + chalk6.dim("  \xB7  ") + (totalRisky > 0 ? chalk6.red.bold(`${totalRisky} risky operation${totalRisky !== 1 ? "s" : ""}`) : chalk6.green("No risky operations"))
+            "  " + chalk6.red.bold(`${totalRisky} risky operation${totalRisky !== 1 ? "s" : ""}`) + chalk6.dim(" in the scanned history")
           );
         }
         const cardParts = [];
@@ -38560,6 +38528,10 @@ function registerScanCommand(program2) {
               keyed
             });
           }
+          console.log(
+            chalk6.dim("  Machine score: run ") + chalk6.cyan("node9 posture") + chalk6.dim(" for this machine's score and what to fix first.")
+          );
+          console.log("");
           const cta = isWired ? "\u2705 node9 is active" : "\u2192 install node9 to enable protection";
           console.log("  " + chalk6.green(cta));
           console.log(
@@ -38754,6 +38726,10 @@ function registerScanCommand(program2) {
         );
         console.log("");
       }
+      console.log(
+        chalk6.dim("  Machine score: run ") + chalk6.cyan("node9 posture") + chalk6.dim(" for this machine's score and what to fix first.")
+      );
+      console.log("");
       if (isWired) {
         console.log(chalk6.green("  \u2705 node9 is active \u2014 your future sessions are protected."));
         console.log(
@@ -78214,6 +78190,7 @@ import chalk22 from "chalk";
 import fs88 from "fs";
 import path86 from "path";
 import os73 from "os";
+init_posture();
 function printAgentSection(label3, hookPairs, wrapped) {
   console.log(chalk22.bold(`  ${label3}`));
   for (const { name, present } of hookPairs) {
@@ -78294,6 +78271,13 @@ function registerStatusCommand(program2) {
     console.log("");
     const modeLabel = levelLabel(settings.mode);
     console.log(`  Mode:    ${modeLabel}`);
+    const posture = await runPosture().catch(() => null);
+    if (posture) {
+      const tier = posture.tier === "good" ? chalk22.green("Good") : posture.tier === "at-risk" ? chalk22.yellow("At risk") : chalk22.red("Critical");
+      console.log(
+        `  Score:   ${chalk22.bold(`${posture.score}/100`)} (${tier})` + chalk22.gray("  \xB7 node9 posture for the breakdown")
+      );
+    }
     const wsGoverned = mergedConfig.policySource === "workspace";
     if (wsGoverned) {
       console.log(`  Policy:  ${chalk22.cyan("Workspace config (app.node9.ai)")}`);