@node9/proxy 2.48.2 → 2.50.0

package/dist/index.mjs

@@ -497,6 +497,9 @@ function levelChecks(mode) {
 function levelPackageSignals(mode) {
   return levelOf(mode) === "soft" ? { newPackage: "off", installScript: "off" } : void 0;
 }
+function packRowOwasp(id, shield) {
+  return PACK_RULE_OWASP[id] ?? PACK_SHIELD_OWASP[shield];
+}
 function isVerdict(v) {
   return v === "off" || v === "log" || v === "review" || v === "block";
 }
@@ -516,6 +519,10 @@ function packRows() {
       rows.push({
         id,
         group: "commands",
+        // A shield missing from the table falls back to tool misuse instead of
+        // throwing here: this module loads on every hook call, and a mapping
+        // omission must fail a test (owasp.spec.ts), never the gate.
+        owasp: packRowOwasp(id, shield.name) ?? "ASI02",
         title: rule.name.replace(SHIELD_RULE_NAME, "$3").replace(/-/g, " "),
         catches: rule.description ?? rule.reason ?? "",
         values: ALL,
@@ -9473,7 +9480,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -11563,6 +11570,44 @@ var init_dist = __esm({
       strict: STRICT,
       "block-all": BLOCK_ALL
     };
+    ASI = {
+      ASI01: "Agent Goal Hijack",
+      ASI02: "Tool Misuse and Exploitation",
+      ASI03: "Identity and Privilege Abuse",
+      ASI04: "Agentic Supply Chain Vulnerabilities",
+      ASI05: "Unexpected Code Execution",
+      ASI06: "Memory and Context Poisoning",
+      ASI07: "Insecure Inter-Agent Communication",
+      ASI08: "Cascading Failures",
+      ASI09: "Human-Agent Trust Exploitation",
+      ASI10: "Rogue Agents"
+    };
+    ASI_IDS = Object.keys(ASI);
+    PACK_SHIELD_OWASP = {
+      aws: "ASI02",
+      "bash-safe": "ASI02",
+      docker: "ASI02",
+      filesystem: "ASI02",
+      github: "ASI02",
+      k8s: "ASI02",
+      mongodb: "ASI02",
+      postgres: "ASI02",
+      redis: "ASI02",
+      stripe: "ASI09",
+      paypal: "ASI09",
+      square: "ASI09",
+      plaid: "ASI09",
+      okta: "ASI09",
+      auth0: "ASI09"
+    };
+    PACK_RULE_OWASP = {
+      "packs.bash-safe.pipe-to-shell": "ASI05",
+      "packs.bash-safe.obfuscated-exec": "ASI05",
+      "packs.bash-safe.eval-remote": "ASI05",
+      "packs.bash-safe.eval-dynamic": "ASI05",
+      "packs.aws.iam-changes": "ASI03",
+      "packs.postgres.grant-revoke": "ASI03"
+    };
     VERDICTS = ["off", "log", "review", "block"];
     CHECK_VERDICT_RANK = { off: 0, log: 1, review: 2, block: 3 };
     ALL = VERDICTS;
@@ -11571,6 +11616,7 @@ var init_dist = __esm({
       {
         id: "files.shell-startup",
         group: "files",
+        owasp: "ASI02",
         title: "Shell startup files",
         catches: "Writes, replacements and removals of personal shell startup files",
         values: ALL,
@@ -11580,6 +11626,7 @@ var init_dist = __esm({
       {
         id: "files.system-auth",
         group: "files",
+        owasp: "ASI03",
         title: "System authentication files",
         catches: "Changes to system authentication files and PAM configuration",
         values: ["block"],
@@ -11590,6 +11637,7 @@ var init_dist = __esm({
       {
         id: "files.password-hashes",
         group: "files",
+        owasp: "ASI03",
         title: "System password hashes",
         catches: "Reads and copies of /etc/shadow and /etc/gshadow",
         values: ALL,
@@ -11599,6 +11647,7 @@ var init_dist = __esm({
       {
         id: "files.system-dirs",
         group: "files",
+        owasp: "ASI02",
         title: "System directories",
         catches: "Writes, new files and removals under /usr, /etc, /boot, /bin, /sbin, /lib and /var/log, and uploads of system files",
         values: ALL,
@@ -11608,6 +11657,7 @@ var init_dist = __esm({
       {
         id: "files.agent-instructions",
         group: "files",
+        owasp: "ASI06",
         title: "Agent instruction and memory files",
         catches: "writes to the files every later agent session loads as instructions (CLAUDE.md, AGENTS.md, memory, agents, commands) and changes to the agent's hooks; Standard asks only when the text carries an instruction to hide, skip approvals or touch secrets",
         values: ALL,
@@ -11618,6 +11668,7 @@ var init_dist = __esm({
       {
         id: "commands.inline-exec",
         group: "commands",
+        owasp: "ASI05",
         title: "Inline code execution",
         catches: "inline code (python -c, node -e, a heredoc into an interpreter) that deletes, sends, opens a socket, runs commands, reads protected files or decodes and runs; unreadable inline code",
         values: ALL,
@@ -11627,6 +11678,7 @@ var init_dist = __esm({
       {
         id: "commands.eval-dynamic",
         group: "commands",
+        owasp: "ASI05",
         title: "Eval of dynamic content",
         catches: "generated executable names, shell code from stdin, or dynamic eval/-c payloads",
         values: ALL,
@@ -11636,6 +11688,7 @@ var init_dist = __esm({
       {
         id: "commands.eval-remote",
         group: "commands",
+        owasp: "ASI05",
         title: "Eval of a remote download",
         catches: "eval or sh over the output of curl or wget",
         values: ["block"],
@@ -11646,6 +11699,7 @@ var init_dist = __esm({
       {
         id: "commands.curl-pipe-shell",
         group: "commands",
+        owasp: "ASI05",
         title: "Remote script piped into a shell",
         catches: "curl or wget piped into sh, bash, zsh or PowerShell",
         values: ALL,
@@ -11655,6 +11709,7 @@ var init_dist = __esm({
       {
         id: "commands.rm",
         group: "commands",
+        owasp: "ASI02",
         title: "Delete files",
         catches: "rm outside the known build-artifact paths",
         values: ALL,
@@ -11664,6 +11719,7 @@ var init_dist = __esm({
       {
         id: "commands.rm-home",
         group: "commands",
+        owasp: "ASI02",
         title: "Recursive delete of the home directory",
         catches: "rm -rf on ~, $HOME, /home or /",
         values: ["block"],
@@ -11674,6 +11730,7 @@ var init_dist = __esm({
       {
         id: "commands.chmod",
         group: "commands",
+        owasp: "ASI02",
         title: "World-writable permissions",
         catches: "chmod 777, 0777 or a+rwx",
         values: ALL,
@@ -11683,6 +11740,7 @@ var init_dist = __esm({
       {
         id: "commands.sudo",
         group: "commands",
+        owasp: "ASI03",
         title: "Elevated privileges",
         catches: "a command run through sudo",
         values: ALL,
@@ -11692,6 +11750,7 @@ var init_dist = __esm({
       {
         id: "commands.git-destructive",
         group: "commands",
+        owasp: "ASI02",
         title: "Destructive git operation",
         catches: "force push, reset --hard, clean -f, branch -D or tag delete, also through -C, env, wrappers, variables and aliases",
         values: ALL,
@@ -11701,6 +11760,7 @@ var init_dist = __esm({
       {
         id: "commands.git-hooks-bypass",
         group: "commands",
+        owasp: "ASI10",
         title: "Git hooks bypassed",
         catches: "the agent switches off the git hooks that check its own work: --no-verify, core.hooksPath, HUSKY=0 and its peers, or a hook file removed, emptied or made non-executable",
         values: ALL,
@@ -11710,6 +11770,7 @@ var init_dist = __esm({
       {
         id: "commands.git-stage-all",
         group: "commands",
+        owasp: "ASI02",
         title: "Stage everything at once",
         catches: "git add -A, git add ., git commit -a and other ways to stage every change instead of naming the files; off unless you switch it on",
         values: ALL,
@@ -11719,6 +11780,7 @@ var init_dist = __esm({
       {
         id: "commands.reverse-shell",
         group: "commands",
+        owasp: "ASI05",
         title: "Reverse shell",
         catches: "a shell wired to a network socket: bash -i >& /dev/tcp/\u2026, nc -e, socat exec:, a socket fd read by a shell, a shell piped to and from nc or telnet",
         values: ALL,
@@ -11728,6 +11790,7 @@ var init_dist = __esm({
       {
         id: "commands.node9-disarm",
         group: "commands",
+        owasp: "ASI10",
         title: "node9 disarmed from the shell",
         catches: "a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield, run by the agent",
         values: ALL,
@@ -11737,6 +11800,7 @@ var init_dist = __esm({
       {
         id: "commands.sql-ddl",
         group: "commands",
+        owasp: "ASI02",
         title: "Drop or truncate",
         catches: "DROP or TRUNCATE through a database CLI or a database tool",
         values: ALL,
@@ -11751,6 +11815,7 @@ var init_dist = __esm({
       {
         id: "commands.sql-no-where",
         group: "commands",
+        owasp: "ASI02",
         title: "Unscoped SQL mutation",
         catches: "DELETE or UPDATE without a WHERE clause",
         values: ALL,
@@ -11760,6 +11825,7 @@ var init_dist = __esm({
       {
         id: "commands.temp-binary",
         group: "commands",
+        owasp: "ASI05",
         title: "Binary from a temp directory",
         catches: "an absolute path under /tmp, /var/tmp, /dev/shm or a world-writable file",
         values: ALL,
@@ -11769,6 +11835,7 @@ var init_dist = __esm({
       {
         id: "commands.disk-destroy",
         group: "commands",
+        owasp: "ASI02",
         title: "Disk or filesystem destruction",
         catches: "mkfs, shred, dd and the manual-terminal disaster list",
         values: ALL,
@@ -11778,6 +11845,7 @@ var init_dist = __esm({
       {
         id: "commands.dangerous-word",
         group: "commands",
+        owasp: "ASI02",
         title: "Dangerous word",
         catches: "a word from a pack or from the config dangerousWords list",
         values: ALL,
@@ -11786,6 +11854,7 @@ var init_dist = __esm({
       {
         id: "commands.unanalysable",
         group: "commands",
+        owasp: "ASI02",
         title: "Command too nested to analyse",
         catches: "wrappers nested past the depth the shell parser follows",
         values: ALL,
@@ -11795,6 +11864,7 @@ var init_dist = __esm({
       {
         id: "commands.unknown",
         group: "commands",
+        owasp: "ASI02",
         title: "Any command no check recognised",
         catches: "the strict-mode catch-all",
         values: ["off", "review"],
@@ -11805,6 +11875,7 @@ var init_dist = __esm({
       {
         id: "data.secrets",
         group: "data",
+        owasp: "ASI03",
         title: "Secret in arguments",
         catches: "an API key, token or private key matching one of the DLP patterns",
         values: ALL,
@@ -11814,6 +11885,7 @@ var init_dist = __esm({
       {
         id: "data.secrets-weak",
         group: "data",
+        owasp: "ASI03",
         title: "Weak credential in arguments",
         catches: "a JWT or a bearer token",
         values: ALL,
@@ -11823,6 +11895,7 @@ var init_dist = __esm({
       {
         id: "data.pii",
         group: "data",
+        owasp: "ASI02",
         title: "Personal data in arguments",
         catches: "a social security number or a credit card number",
         values: ALL,
@@ -11832,6 +11905,7 @@ var init_dist = __esm({
       {
         id: "data.credential-files",
         group: "data",
+        owasp: "ASI03",
         title: "Credential file read",
         catches: "~/.ssh, ~/.aws and .env files, through any reader or any file tool",
         values: ALL,
@@ -11840,6 +11914,7 @@ var init_dist = __esm({
       {
         id: "data.credential-files-other",
         group: "data",
+        owasp: "ASI03",
         title: "Other credential file",
         catches: ".netrc, .npmrc, kube and docker config, and a copy of any credential file",
         values: ALL,
@@ -11848,6 +11923,7 @@ var init_dist = __esm({
       {
         id: "data.credential-files-unknown",
         group: "data",
+        owasp: "ASI03",
         title: "Files read by names known only at run time",
         catches: "a reader fed names from a listing that can include credential files (find . | xargs cat)",
         values: ALL,
@@ -11856,6 +11932,7 @@ var init_dist = __esm({
       {
         id: "data.pipe-chain",
         group: "data",
+        owasp: "ASI03",
         title: "Sensitive file piped to the network",
         catches: "a credential file read and piped into curl, nc or ssh",
         values: ALL,
@@ -11865,6 +11942,7 @@ var init_dist = __esm({
       {
         id: "data.pipe-chain-obfuscated",
         group: "data",
+        owasp: "ASI03",
         title: "Obfuscated exfiltration",
         catches: "a sensitive file encoded or compressed on its way to the network",
         values: ALL,
@@ -11877,6 +11955,7 @@ var init_dist = __esm({
       {
         id: "data.env-exfil",
         group: "data",
+        owasp: "ASI03",
         title: "Environment sent out",
         catches: "the whole environment (env, printenv, set, export -p, /proc/*/environ) handed to curl, nc or another sender, through $(\u2026), a pipe or a variable",
         values: ALL,
@@ -11886,6 +11965,7 @@ var init_dist = __esm({
       {
         id: "data.output-secrets",
         group: "data",
+        owasp: "ASI03",
         title: "Secret in tool output",
         catches: "a credential a tool returned; the session is tainted, nothing is stopped",
         values: ["off", "log"],
@@ -11894,6 +11974,7 @@ var init_dist = __esm({
       {
         id: "data.prompt-secrets",
         group: "data",
+        owasp: "ASI03",
         title: "Secret in the prompt",
         catches: "a credential pasted into the conversation",
         values: ALL,
@@ -11902,6 +11983,7 @@ var init_dist = __esm({
       {
         id: "data.canary",
         group: "data",
+        owasp: "ASI03",
         title: "Decoy credential used",
         catches: "a planted decoy value appears in a tool call",
         values: ALL,
@@ -11912,6 +11994,7 @@ var init_dist = __esm({
       {
         id: "network.unknown-host",
         group: "network",
+        owasp: "ASI02",
         title: "Unknown host",
         catches: "a destination on neither the allowlist nor the builtin list",
         values: ["off", "review", "block"],
@@ -11921,6 +12004,7 @@ var init_dist = __esm({
       {
         id: "network.internal-addresses",
         group: "network",
+        owasp: "ASI02",
         title: "Internal address",
         catches: "loopback, the RFC 1918 ranges and carrier-grade NAT",
         values: ["off", "block"],
@@ -11929,6 +12013,7 @@ var init_dist = __esm({
       {
         id: "network.metadata",
         group: "network",
+        owasp: "ASI02",
         title: "Cloud metadata address",
         catches: "169.254.169.254 and its peers, link-local and multicast",
         values: ["block"],
@@ -11939,6 +12024,7 @@ var init_dist = __esm({
       {
         id: "network.taint-egress",
         group: "network",
+        owasp: "ASI01",
         title: "Tainted data sent out",
         catches: "a file or an output flagged earlier in the session reaches a host not on the allowlist",
         values: ALL,
@@ -11952,6 +12038,7 @@ var init_dist = __esm({
       {
         id: "files.jail",
         group: "files",
+        owasp: "ASI03",
         title: "Jailed path",
         catches: "a path the workspace or the developer added to the jail",
         values: ALL,
@@ -11961,6 +12048,7 @@ var init_dist = __esm({
       {
         id: "behavior.loops",
         group: "behavior",
+        owasp: "ASI08",
         title: "Runaway loop",
         catches: "the same tool call repeated past the threshold inside the window",
         values: ["off", "block"],
@@ -11970,6 +12058,7 @@ var init_dist = __esm({
       {
         id: "behavior.prompt-injection",
         group: "behavior",
+        owasp: "ASI01",
         title: "Prompt injection in tool output",
         catches: "instructions aimed at the model inside content a tool returned",
         values: ["off", "log"],
@@ -11978,6 +12067,7 @@ var init_dist = __esm({
       {
         id: "behavior.session-taint",
         group: "behavior",
+        owasp: "ASI01",
         title: "Action after tainted output",
         catches: "a network call or a write after a flagged file or a flagged tool output",
         values: ALL,
@@ -11987,6 +12077,7 @@ var init_dist = __esm({
       {
         id: "behavior.untrusted-content",
         group: "behavior",
+        owasp: "ASI01",
         title: "Send after reading outside content",
         catches: "a send to an unknown destination, a destination found in what was read, or a destructive call after the session read an email, a web page or an issue",
         values: ["off", "log", "review"],
@@ -11997,6 +12088,7 @@ var init_dist = __esm({
       {
         id: "loading.skill-tamper",
         group: "loading",
+        owasp: "ASI04",
         title: "Skill file changed",
         catches: "a skill or plugin file whose hash differs from the one approved",
         values: ["off", "log", "block"],
@@ -12006,6 +12098,7 @@ var init_dist = __esm({
       {
         id: "loading.mcp-tamper",
         group: "loading",
+        owasp: "ASI04",
         title: "MCP server changed",
         catches: "tool definitions that differ from the pinned ones",
         values: ALL,
@@ -12015,6 +12108,7 @@ var init_dist = __esm({
       {
         id: "loading.malicious-package",
         group: "loading",
+        owasp: "ASI04",
         title: "Malicious package",
         catches: "an install of a package the index flags",
         values: ALL,
@@ -12024,6 +12118,7 @@ var init_dist = __esm({
       {
         id: "loading.unknown-registry",
         group: "loading",
+        owasp: "ASI04",
         title: "Package from an unknown registry",
         catches: "an install that names a registry on the command line (--registry, --index-url, -i, npm_config_registry=\u2026) that is not the public one, not in your npm, yarn, bun, pip or uv config and not on the allowlist",
         values: ALL,
@@ -12038,6 +12133,7 @@ var init_dist = __esm({
       {
         id: "actions.money",
         group: "actions",
+        owasp: "ASI09",
         title: "Money moves",
         catches: "a refund, payout, transfer, charge or withdrawal through an app with no protection of its own",
         values: ALL,
@@ -12050,6 +12146,7 @@ var init_dist = __esm({
       {
         id: "actions.access",
         group: "actions",
+        owasp: "ASI09",
         title: "Accounts and access change",
         catches: "a password, key, role, permission or user changed through an app with no protection of its own",
         values: ALL,
@@ -12059,6 +12156,7 @@ var init_dist = __esm({
       {
         id: "actions.publish",
         group: "actions",
+        owasp: "ASI09",
         title: "Something is published",
         catches: "a release, package, deploy or public post through an app with no protection of its own",
         values: ALL,
@@ -12071,6 +12169,7 @@ var init_dist = __esm({
       {
         id: "actions.settings",
         group: "actions",
+        owasp: "ASI09",
         title: "Repository, account and mailbox settings change",
         catches: "a repository made public, a deploy key, webhook or CI secret added, branch protection changed, mail forwarded outside or a public share link, through an app",
         values: ALL,
@@ -12080,6 +12179,7 @@ var init_dist = __esm({
       {
         id: "actions.protected-branch",
         group: "actions",
+        owasp: "ASI09",
         title: "The main branch changes through an app",
         catches: "a merge, a commit straight to main or master, or a CI workflow file written through an app",
         values: ALL,
@@ -19037,8 +19137,8 @@ var ConfigFileSchema = z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path32 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path32}: ${issue.message}`;
+    const path33 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path33}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -19051,9 +19151,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path32 of ordered) {
+  for (const path33 of ordered) {
     let cur = root;
-    for (const key of path32.slice(0, -1)) {
+    for (const key of path33.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -19061,7 +19161,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path32[path32.length - 1];
+    const last = path33[path33.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -19097,7 +19197,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path32) => path32.length > 0);
+      }).filter((path33) => path33.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -20541,13 +20641,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path32 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path32) continue;
+            const path33 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path33) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path32, verdict, "org-managed jail")) {
+            for (const r of pathRules(path33, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path32, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path33, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -22392,12 +22492,45 @@ function getPersistentDecision(toolName) {
 // src/auth/daemon.ts
 init_esm_shims();
 init_forecast_context();
-import fs15 from "fs";
+import fs16 from "fs";
 import http from "http";
 import net from "net";
-import path16 from "path";
+import path17 from "path";
 import os10 from "os";
 
+// src/utils/activity-socket.ts
+init_esm_shims();
+import fs15 from "fs";
+import path16 from "path";
+
+// src/utils/own-dir.ts
+init_esm_shims();
+
+// src/utils/activity-socket.ts
+var currentUid = () => typeof process.getuid === "function" ? process.getuid() : void 0;
+function isPrivateDir(dir2, uid = currentUid()) {
+  try {
+    const st = fs15.lstatSync(dir2);
+    if (st.isSymbolicLink() || !st.isDirectory()) return false;
+    if (uid !== void 0 && st.uid !== uid) return false;
+    return (st.mode & 18) === 0;
+  } catch {
+    return false;
+  }
+}
+var WINDOWS_PIPE = /^\\\\\.\\pipe\\node9-activity-[0-9a-f]{32}$/;
+function isTrustedActivitySocket(socketPath, uid = currentUid()) {
+  if (process.platform === "win32") return WINDOWS_PIPE.test(socketPath);
+  try {
+    const st = fs15.lstatSync(socketPath);
+    if (!st.isSocket()) return false;
+    if (uid !== void 0 && st.uid !== uid) return false;
+  } catch {
+    return false;
+  }
+  return isPrivateDir(path16.dirname(socketPath), uid);
+}
+
 // src/auth/decision-record.ts
 init_esm_shims();
 var CHANNELS = ["terminal", "monitor", "native", "cloud"];
@@ -22547,10 +22680,20 @@ function recordFromLegacyWait(body, now = Date.now()) {
 }
 
 // src/auth/daemon.ts
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path16.join(os10.tmpdir(), "node9-activity.sock");
+function daemonActivitySocket(home = os10.homedir()) {
+  try {
+    const raw = fs16.readFileSync(path17.join(home, ".node9", "daemon.pid"), "utf-8");
+    const p = JSON.parse(raw).activitySocket;
+    return typeof p === "string" && isTrustedActivitySocket(p) ? p : null;
+  } catch {
+    return null;
+  }
+}
 var ACTIVITY_SOCKET_TIMEOUT_MS = 500;
 function notifyActivitySocket(data, opts = {}) {
   if (forecastRun()) return Promise.resolve(false);
+  const target = opts.socketPath ?? daemonActivitySocket();
+  if (!target) return Promise.resolve(false);
   return new Promise((resolve) => {
     let settled = false;
     let sock = null;
@@ -22564,7 +22707,7 @@ function notifyActivitySocket(data, opts = {}) {
     const timer = setTimeout(() => finish(false), opts.timeoutMs ?? ACTIVITY_SOCKET_TIMEOUT_MS);
     try {
       const payload = JSON.stringify(data);
-      sock = net.createConnection(opts.socketPath ?? ACTIVITY_SOCKET_PATH);
+      sock = net.createConnection(target);
       sock.on("connect", () => {
         sock.on("close", () => finish(true));
         sock.end(payload);
@@ -22603,9 +22746,9 @@ var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = path16.join(os10.homedir(), ".node9", "daemon.pid");
-    if (!fs15.existsSync(pidFile)) return null;
-    const data = JSON.parse(fs15.readFileSync(pidFile, "utf-8"));
+    const pidFile = path17.join(os10.homedir(), ".node9", "daemon.pid");
+    if (!fs16.existsSync(pidFile)) return null;
+    const data = JSON.parse(fs16.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -22614,12 +22757,12 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = path16.join(os10.homedir(), ".node9", "daemon.pid");
-  if (fs15.existsSync(pidFile)) {
+  const pidFile = path17.join(os10.homedir(), ".node9", "daemon.pid");
+  if (fs16.existsSync(pidFile)) {
     let pid;
     let port;
     try {
-      const data = JSON.parse(fs15.readFileSync(pidFile, "utf-8"));
+      const data = JSON.parse(fs16.readFileSync(pidFile, "utf-8"));
       pid = data.pid;
       port = data.port;
     } catch {
@@ -22637,7 +22780,7 @@ function isDaemonRunning() {
     } catch (err) {
       if (err instanceof Error && "code" in err && err.code === "ESRCH") {
         try {
-          fs15.unlinkSync(pidFile);
+          fs16.unlinkSync(pidFile);
         } catch {
         }
       }
@@ -22977,9 +23120,9 @@ import { randomUUID as randomUUID2 } from "crypto";
 
 // src/apps/state.ts
 init_esm_shims();
-import fs17 from "fs";
+import fs18 from "fs";
 import os12 from "os";
-import path18 from "path";
+import path19 from "path";
 
 // src/apps/catalog.ts
 init_esm_shims();
@@ -23113,8 +23256,8 @@ init_audit();
 
 // src/daemon/mcp-tools.ts
 init_esm_shims();
-import fs16 from "fs";
-import path17 from "path";
+import fs17 from "fs";
+import path18 from "path";
 import os11 from "os";
 
 // src/mcp-cmd.ts
@@ -23122,13 +23265,13 @@ init_esm_shims();
 
 // src/daemon/mcp-tools.ts
 function getMcpToolsFile() {
-  return path17.join(os11.homedir(), ".node9", "mcp-tools.json");
+  return path18.join(os11.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
     const file2 = getMcpToolsFile();
-    if (!fs16.existsSync(file2)) return {};
-    const raw = fs16.readFileSync(file2, "utf-8");
+    if (!fs17.existsSync(file2)) return {};
+    const raw = fs17.readFileSync(file2, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -23137,7 +23280,7 @@ function readMcpToolsConfig() {
 
 // src/apps/state.ts
 function appsFilePath(home = os12.homedir()) {
-  return path18.join(home, ".node9", "apps.json");
+  return path19.join(home, ".node9", "apps.json");
 }
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["mcp-server", "command", "package", "env-name"]);
 function emptyFile() {
@@ -23185,7 +23328,7 @@ function readAppsFile(home) {
 function readAppsFileStrict(home) {
   let text;
   try {
-    text = fs17.readFileSync(appsFilePath(home), "utf8");
+    text = fs18.readFileSync(appsFilePath(home), "utf8");
   } catch (e) {
     return e.code === "ENOENT" ? emptyFile() : null;
   }
@@ -23200,7 +23343,7 @@ var NO_LINKS = /* @__PURE__ */ Object.create(null);
 function localLinks() {
   const file2 = appsFilePath();
   try {
-    const mtimeMs = fs17.statSync(file2).mtimeMs;
+    const mtimeMs = fs18.statSync(file2).mtimeMs;
     if (!linkCache || linkCache.file !== file2 || linkCache.mtimeMs !== mtimeMs) {
       linkCache = { mtimeMs, file: file2, links: readAppsFile().links };
     }
@@ -23241,16 +23384,16 @@ function resolveLinkedServer(label2, opts = {}) {
 
 // src/auth/orchestrator.ts
 import os21 from "os";
-import path31 from "path";
+import path32 from "path";
 
 // src/ui/native.ts
 init_esm_shims();
 import { spawn } from "child_process";
-import path20 from "path";
+import path21 from "path";
 
 // src/context-sniper.ts
 init_esm_shims();
-import path19 from "path";
+import path20 from "path";
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -23318,7 +23461,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = path19.basename(editFilePath);
+        editFileName = path20.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -23387,7 +23530,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file2 = obj.file_path ? path20.basename(String(obj.file_path)) : "file";
+      const file2 = obj.file_path ? path21.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -23591,25 +23734,25 @@ end run`;
 
 // src/canary/registry.ts
 init_esm_shims();
-import fs19 from "fs";
+import fs20 from "fs";
 import os14 from "os";
-import path22 from "path";
+import path23 from "path";
 init_dist();
 
 // src/shields/jail.ts
 init_esm_shims();
-import fs18 from "fs";
+import fs19 from "fs";
 import os13 from "os";
-import path21 from "path";
+import path22 from "path";
 init_dist();
 var USER_JAIL_SHIELD = "user-jail";
 function jailStorePath() {
-  return path21.join(os13.homedir(), ".node9", "jail-paths.json");
+  return path22.join(os13.homedir(), ".node9", "jail-paths.json");
 }
 function readJailPaths() {
   let text;
   try {
-    text = fs18.readFileSync(jailStorePath(), "utf8");
+    text = fs19.readFileSync(jailStorePath(), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -23638,7 +23781,7 @@ function findJailedPathIn(candidate, paths) {
 
 // src/canary/registry.ts
 function canaryStorePath() {
-  return path22.join(os14.homedir(), ".node9", "canaries.json");
+  return path23.join(os14.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -23649,7 +23792,7 @@ function loadCanaries(opts) {
   const p = canaryStorePath();
   let raw;
   try {
-    raw = fs19.readFileSync(p, "utf-8");
+    raw = fs20.readFileSync(p, "utf-8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -23677,21 +23820,21 @@ init_dist();
 // src/auth/session-script.ts
 init_esm_shims();
 init_dist();
-import fs20 from "fs";
+import fs21 from "fs";
 import os15 from "os";
-import path23 from "path";
+import path24 from "path";
 var MAX_SCRIPT_BYTES = 64 * 1024;
 var MAX_RECORDED_WRITES = 32;
 function readScriptFile(resolved) {
   let fd;
   try {
-    fd = fs20.openSync(resolved, fs20.constants.O_RDONLY | (fs20.constants.O_NONBLOCK ?? 0));
-    const st = fs20.fstatSync(fd);
+    fd = fs21.openSync(resolved, fs21.constants.O_RDONLY | (fs21.constants.O_NONBLOCK ?? 0));
+    const st = fs21.fstatSync(fd);
     if (!st.isFile() || st.size > MAX_SCRIPT_BYTES) return null;
     const buf = Buffer.alloc(MAX_SCRIPT_BYTES + 1);
     let n = 0;
     while (n < buf.length) {
-      const got = fs20.readSync(fd, buf, n, buf.length - n, n);
+      const got = fs21.readSync(fd, buf, n, buf.length - n, n);
       if (got === 0) break;
       n += got;
     }
@@ -23702,7 +23845,7 @@ function readScriptFile(resolved) {
   } finally {
     if (fd !== void 0) {
       try {
-        fs20.closeSync(fd);
+        fs21.closeSync(fd);
       } catch {
       }
     }
@@ -23710,7 +23853,7 @@ function readScriptFile(resolved) {
 }
 function absolute(p, cwd, home) {
   const spelled = p === "~" || p.startsWith("~/") ? home + p.slice(1) : p;
-  return path23.resolve(cwd, spelled);
+  return path24.resolve(cwd, spelled);
 }
 async function resolveSessionScript(toolName, args, cwd, layers, deps, home = os15.homedir()) {
   try {
@@ -23772,27 +23915,27 @@ init_dist();
 
 // src/exposure/known-hosts.ts
 init_esm_shims();
-import fs22 from "fs";
-import path25 from "path";
+import fs23 from "fs";
+import path26 from "path";
 
 // src/utils/git-remotes.ts
 init_esm_shims();
 init_dist();
-import fs21 from "fs";
-import path24 from "path";
+import fs22 from "fs";
+import path25 from "path";
 function readSmallFile(p, max) {
   let fd;
   try {
-    fd = fs21.openSync(p, fs21.constants.O_RDONLY | (fs21.constants.O_NOFOLLOW ?? 0));
-    const st = fs21.fstatSync(fd);
+    fd = fs22.openSync(p, fs22.constants.O_RDONLY | (fs22.constants.O_NOFOLLOW ?? 0));
+    const st = fs22.fstatSync(fd);
     if (!st.isFile() || st.size > max) return null;
     const buf = Buffer.alloc(st.size);
-    const n = fs21.readSync(fd, buf, 0, st.size, 0);
+    const n = fs22.readSync(fd, buf, 0, st.size, 0);
     return buf.subarray(0, n).toString("utf8");
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) fs21.closeSync(fd);
+    if (fd !== void 0) fs22.closeSync(fd);
   }
 }
 function gitRemoteHost(url) {
@@ -23811,20 +23954,20 @@ function gitRemoteHost(url) {
   return null;
 }
 function findGitConfig(dir2, walkUp = true) {
-  let cur = path24.resolve(dir2);
+  let cur = path25.resolve(dir2);
   for (let i = 0; i < (walkUp ? 64 : 1); i++) {
-    const dotGit = path24.join(cur, ".git");
-    const direct = readSmallFile(path24.join(dotGit, "config"), 1e6);
+    const dotGit = path25.join(cur, ".git");
+    const direct = readSmallFile(path25.join(dotGit, "config"), 1e6);
     if (direct !== null) return direct;
     const pointer = readSmallFile(dotGit, 4096);
     const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
     if (m) {
-      let gitDir = path24.resolve(cur, m[1]);
-      const common = readSmallFile(path24.join(gitDir, "commondir"), 4096);
-      if (common !== null) gitDir = path24.resolve(gitDir, common.trim());
-      return readSmallFile(path24.join(gitDir, "config"), 1e6);
+      let gitDir = path25.resolve(cur, m[1]);
+      const common = readSmallFile(path25.join(gitDir, "commondir"), 4096);
+      if (common !== null) gitDir = path25.resolve(gitDir, common.trim());
+      return readSmallFile(path25.join(gitDir, "config"), 1e6);
     }
-    const parent = path24.dirname(cur);
+    const parent = path25.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -23834,12 +23977,12 @@ var cache4 = /* @__PURE__ */ new Map();
 function readGitRemotes(dir2, opts = {}) {
   if (!dir2) return [];
   const walkUp = opts.walkUp !== false;
-  const key = `${walkUp ? "up" : "at"}:${path24.resolve(dir2)}`;
+  const key = `${walkUp ? "up" : "at"}:${path25.resolve(dir2)}`;
   const hit = cache4.get(key);
   if (hit) return hit;
   const out = [];
   try {
-    const cfg = findGitConfig(path24.resolve(dir2), walkUp);
+    const cfg = findGitConfig(path25.resolve(dir2), walkUp);
     if (cfg !== null) {
       let current = null;
       for (const line of cfg.split(/\r?\n/)) {
@@ -23875,15 +24018,15 @@ var ECOSYSTEMS = [
 ];
 var cache5 = /* @__PURE__ */ new Map();
 function manifestRoot(dir2) {
-  let cur = path25.resolve(dir2);
+  let cur = path26.resolve(dir2);
   for (let i = 0; i < 64; i++) {
     for (const [m] of ECOSYSTEMS) {
       try {
-        if (fs22.existsSync(path25.join(cur, m))) return cur;
+        if (fs23.existsSync(path26.join(cur, m))) return cur;
       } catch {
       }
     }
-    const parent = path25.dirname(cur);
+    const parent = path26.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -23892,7 +24035,7 @@ function manifestRoot(dir2) {
 function knownProjectHosts(dir2) {
   const empty = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
   if (!dir2) return empty;
-  const key = path25.resolve(dir2);
+  const key = path26.resolve(dir2);
   const hit = cache5.get(key);
   if (hit) return hit;
   const out = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
@@ -23905,10 +24048,10 @@ function knownProjectHosts(dir2) {
     const root = manifestRoot(key);
     if (root !== null) {
       for (const [m, registry] of ECOSYSTEMS) {
-        if (fs22.existsSync(path25.join(root, m))) out.hosts.add(registry);
+        if (fs23.existsSync(path26.join(root, m))) out.hosts.add(registry);
       }
       try {
-        if (fs22.readdirSync(root).some((f) => f.endsWith(".gemspec")))
+        if (fs23.readdirSync(root).some((f) => f.endsWith(".gemspec")))
           out.hosts.add("host:rubygems.org");
       } catch {
       }
@@ -23922,9 +24065,9 @@ function knownProjectHosts(dir2) {
 // src/exposure/writes.ts
 init_esm_shims();
 init_dist();
-import fs23 from "fs";
+import fs24 from "fs";
 import os16 from "os";
-import path26 from "path";
+import path27 from "path";
 var WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "remove"]);
 var LIFECYCLE_RE = /"(scripts|preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack|publish|postpublish)"\s*:/;
 function writtenContent(args) {
@@ -23953,7 +24096,7 @@ function packageScriptsTouched(args, absPath, shellCommand) {
   if (typeof a.content === "string") {
     try {
       const next = JSON.parse(a.content);
-      const prev = JSON.parse(fs23.readFileSync(absPath, "utf8"));
+      const prev = JSON.parse(fs24.readFileSync(absPath, "utf8"));
       return JSON.stringify(next.scripts ?? null) !== JSON.stringify(prev.scripts ?? null);
     } catch {
       return LIFECYCLE_RE.test(a.content);
@@ -23974,7 +24117,7 @@ function judgeWritesAfterExposure(opts) {
     seen.add(p);
     if (p === "/dev" || p.startsWith("/dev/")) continue;
     if (root !== null && isInside(root, p)) {
-      if (isAgentInstructionPath(p, root) && (path26.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
+      if (isAgentInstructionPath(p, root) && (path27.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
         holds.push({ path: p, why: "agent-instruction" });
       continue;
     }
@@ -23997,9 +24140,9 @@ function judgeWritesAfterExposure(opts) {
 // src/exposure/marker.ts
 init_esm_shims();
 import crypto3 from "crypto";
-import fs24 from "fs";
+import fs25 from "fs";
 import os17 from "os";
-import path27 from "path";
+import path28 from "path";
 
 // src/daemon/exposure-store.ts
 init_esm_shims();
@@ -24008,18 +24151,18 @@ var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
 // src/exposure/marker.ts
 init_forecast_context();
 function dir() {
-  return path27.join(os17.homedir(), ".node9", "exposure-sessions");
+  return path28.join(os17.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = crypto3.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return path27.join(dir(), id);
+  return path28.join(dir(), id);
 }
 function maybeSessionExposed(sessionId) {
   if (!sessionId) return false;
   const forecast = forecastRun();
   if (forecast) return forecast.session.checkExposure(forecast.now) !== null;
   try {
-    const st = fs24.statSync(file(sessionId));
+    const st = fs25.statSync(file(sessionId));
     return Date.now() - st.mtimeMs < SESSION_EXPOSURE_TTL_MS;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -24028,7 +24171,7 @@ function maybeSessionExposed(sessionId) {
 
 // src/exposure/roles.ts
 init_esm_shims();
-import fs25 from "fs";
+import fs26 from "fs";
 var EXPOSURE_LABEL = "\u{1F6E1}\uFE0F Node9 Exposure";
 var AGENT_INTERNAL_PREFIXES = ["ccd_", "visualize"];
 function foldServerName(name) {
@@ -24038,7 +24181,7 @@ var inventoryCache = null;
 var inventoryStamp = null;
 function inventoryFileStamp() {
   try {
-    const st = fs25.statSync(getMcpToolsFile());
+    const st = fs26.statSync(getMcpToolsFile());
     return `${st.mtimeMs}:${st.size}`;
   } catch {
     return "";
@@ -24124,15 +24267,15 @@ function sourceWord(toolName) {
 // src/auth/trusted-recipients.ts
 init_esm_shims();
 init_dist();
-import fs26 from "fs";
-import path28 from "path";
+import fs27 from "fs";
+import path29 from "path";
 import os18 from "os";
 function getTrustedRecipientsPath() {
-  return path28.join(os18.homedir(), ".node9", "trusted-recipients.json");
+  return path29.join(os18.homedir(), ".node9", "trusted-recipients.json");
 }
 function readTrustedRecipients() {
   try {
-    const raw = fs26.readFileSync(getTrustedRecipientsPath(), "utf8");
+    const raw = fs27.readFileSync(getTrustedRecipientsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.entries) ? parsed.entries.filter((e) => e && typeof e.value === "string") : [];
   } catch {
@@ -24141,10 +24284,10 @@ function readTrustedRecipients() {
 }
 function writeTrustedRecipients(entries) {
   const filePath = getTrustedRecipientsPath();
-  fs26.mkdirSync(path28.dirname(filePath), { recursive: true });
+  fs27.mkdirSync(path29.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
-  fs26.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
-  fs26.renameSync(tmp, filePath);
+  fs27.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
+  fs27.renameSync(tmp, filePath);
 }
 function addTrustedRecipient(raw, addedBy = "user") {
   const value = normalizeRecipient(raw);
@@ -24159,7 +24302,7 @@ function addTrustedRecipient(raw, addedBy = "user") {
 var cache6 = null;
 function mtimeOf() {
   try {
-    return fs26.statSync(getTrustedRecipientsPath()).mtimeMs;
+    return fs27.statSync(getTrustedRecipientsPath()).mtimeMs;
   } catch {
     return 0;
   }
@@ -24178,9 +24321,9 @@ init_forecast_context();
 // src/auth/cloud.ts
 init_esm_shims();
 init_audit();
-import fs27 from "fs";
+import fs28 from "fs";
 import os19 from "os";
-import path29 from "path";
+import path30 from "path";
 init_dist();
 var CLOUD_ARRAY_KEYS = /* @__PURE__ */ new Set(["exposureDestinations", "exposureDestinationHashes"]);
 function maskArgsForCloud(args) {
@@ -24215,7 +24358,7 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = path29.join(os19.homedir(), ".node9", "ci-context.json");
+      const ciContextPath = path30.join(os19.homedir(), ".node9", "ci-context.json");
       const ci = readCappedText(ciContextPath, 1e4);
       if (!ci) throw new Error("ci-context.json unreadable");
       if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
@@ -24333,14 +24476,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      fs27.appendFileSync(
+      fs28.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    fs27.appendFileSync(
+    fs28.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err)}
 `
@@ -24353,16 +24496,16 @@ init_esm_shims();
 init_dist();
 init_forecast_context();
 init_dist();
-import fs28 from "fs";
-import path30 from "path";
+import fs29 from "fs";
+import path31 from "path";
 import os20 from "os";
 function loopStateFile() {
-  return path30.join(os20.homedir(), ".node9", "loop-state.json");
+  return path31.join(os20.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
-    if (!fs28.existsSync(loopStateFile())) return [];
-    const raw = fs28.readFileSync(loopStateFile(), "utf-8");
+    if (!fs29.existsSync(loopStateFile())) return [];
+    const raw = fs29.readFileSync(loopStateFile(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return [];
     return parsed;
@@ -24371,11 +24514,11 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir2 = path30.dirname(loopStateFile());
-  if (!fs28.existsSync(dir2)) fs28.mkdirSync(dir2, { recursive: true });
+  const dir2 = path31.dirname(loopStateFile());
+  if (!fs29.existsSync(dir2)) fs29.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${loopStateFile()}.${os20.hostname()}.${process.pid}.tmp`;
-  fs28.writeFileSync(tmpPath, JSON.stringify(records));
-  fs28.renameSync(tmpPath, loopStateFile());
+  fs29.writeFileSync(tmpPath, JSON.stringify(records));
+  fs29.renameSync(tmpPath, loopStateFile());
 }
 function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   try {
@@ -24574,9 +24717,9 @@ function isMcpToolName(toolName) {
   return /^mcp__[^_](?:[^_]|_(?!_))*?__/i.test(toolName);
 }
 function absoluteUploadPath(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? path31.join(os21.homedir(), spelled.slice(1)) : spelled;
-  if (path31.isAbsolute(expanded)) return expanded;
-  return cwd && path31.isAbsolute(cwd) ? path31.resolve(cwd, expanded) : expanded;
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? path32.join(os21.homedir(), spelled.slice(1)) : spelled;
+  if (path32.isAbsolute(expanded)) return expanded;
+  return cwd && path32.isAbsolute(cwd) ? path32.resolve(cwd, expanded) : expanded;
 }
 function extractFilePaths(toolName, args, shellCommand) {
   const paths = [];
@@ -25122,7 +25265,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       systemAccessHandled: !isManual && fileAccess.handledPaths.has(filePath)
     }) : null) ?? argumentScan(),
     pii: () => detectArgsPii(args),
-    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, { offline: !!forecast }) : Promise.resolve(null)
+    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, {
+      offline: !!forecast && forecast.onlinePackages !== true
+    }) : Promise.resolve(null)
   });
   const dlpMatch = gates.stop?.dlpMatch ?? gates.reviews.dlp ?? null;
   if (dlpMatch) {