@node9/proxy 2.50.0 → 2.51.0

package/dist/cli-main.js

@@ -2123,9 +2123,15 @@ function detectDangerousShellExec(command) {
     if (f === PARSE_FAIL) return null;
     let result = null;
     const assigned = assignedNames(f);
-    walk(f, (node) => {
+    const known = plainlyNamedPrograms(f);
+    const calledByName = literallyCalledFunctions(f);
+    const bodies = [];
+    const inBody = (pos) => bodies.some(([a, b]) => pos >= a && pos < b);
+    walkWithCalls(f, (node) => {
       if (!node || result === "block") return false;
       const n = node;
+      if (n.kind === "FuncDecl" && n.Body && callDepth === 0 && calledByName.has(n.Name?.Value))
+        bodies.push([n.Body.pos, n.Body.end]);
       if (n.kind === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
         const call = n.Y.Cmd;
         if (call && call.kind === "CallExpr") {
@@ -2149,7 +2155,8 @@ function detectDangerousShellExec(command) {
       );
       const head = unwrapCommandHead(headWords, false, true);
       const lookup = headWords[0]?.toLowerCase() === "command" && headWords.slice(1).some((w) => w === "-v" || w === "-V");
-      if (!lookup && (opaqueExecutable(args[0], assigned) || opaqueExecutable(args[head], assigned)))
+      const unboundBody = callDepth === 0 && inBody(n.pos ?? -1);
+      if (!lookup && !unboundBody && (opaqueExecutable(args[0], assigned, known) || opaqueExecutable(args[head], assigned, known)))
         result = "review";
       const firstParts = args[0].Parts || [];
       if (firstParts.length !== 1 || firstParts[0].kind !== "Lit") return true;
@@ -2209,11 +2216,105 @@ function assignedNames(f) {
   });
   return names;
 }
-function executableParts(word, assigned, quoted = false) {
+function literallyCalledFunctions(f) {
+  const declared = /* @__PURE__ */ new Set();
+  const called = /* @__PURE__ */ new Set();
+  walk(f, (node) => {
+    if (!node) return false;
+    if (node.kind === "FuncDecl" && node.Name?.Value) declared.add(node.Name.Value);
+    if (node.kind === "CallExpr") {
+      const head = resolveWordLiteral(node.Args?.[0]);
+      if (head) called.add(head);
+    }
+    return true;
+  });
+  return new Set([...declared].filter((name) => called.has(name)));
+}
+function plainlyNamedPrograms(f) {
+  const values = /* @__PURE__ */ new Map();
+  const arrays = /* @__PURE__ */ new Set();
+  const give = (name, value) => {
+    if (value === null || !PLAIN_PROGRAM_NAME.test(value)) {
+      values.set(name, null);
+      return;
+    }
+    const cur = values.get(name);
+    if (cur === null) return;
+    if (cur === void 0) values.set(name, /* @__PURE__ */ new Set([value]));
+    else cur.add(value);
+  };
+  const literalOnly = (w) => {
+    const parts = w?.Parts ?? [];
+    if (parts.length !== 1) return null;
+    const p = parts[0];
+    if (p.kind === "Lit") return p.Value ?? null;
+    if (p.kind === "ParamExp" && expansionName(p) === "FUNCNAME") return "FUNCNAME";
+    if (p.kind === "SglQuoted" && !p.Dollar) return p.Value ?? null;
+    if (p.kind === "DblQuoted") {
+      const inner = p.Parts ?? [];
+      return inner.length === 1 && inner[0].kind === "Lit" ? inner[0].Value ?? null : null;
+    }
+    return null;
+  };
+  let ifsTouched = false;
+  walk(f, (node) => {
+    if (!node) return false;
+    const kind = node.kind;
+    if (kind === "FuncDecl" && node.Name?.Value) give(node.Name.Value, node.Name.Value);
+    if (kind === "Assign" && node.Name?.Value) {
+      const name = node.Name.Value;
+      if (name === "IFS") ifsTouched = true;
+      if (node.Append) values.set(name, null);
+      else if (node.Array) {
+        arrays.add(name);
+        for (const el of node.Array.Elems ?? []) give(name, literalOnly(el.Value));
+      } else if (node.Index) {
+        arrays.add(name);
+        give(name, node.Value ? literalOnly(node.Value) : null);
+      } else give(name, node.Value ? literalOnly(node.Value) : null);
+    }
+    if (kind === "ForClause" && node.Loop?.Name?.Value) values.set(node.Loop.Name.Value, null);
+    if (kind === "CallExpr") {
+      const words = (node.Args ?? []).map((a) => resolveWordLiteral(a));
+      if (VARIABLE_READERS.has(words[0] ?? "")) {
+        for (const w of words.slice(1)) if (w && /^[A-Za-z_]\w*$/.test(w)) values.set(w, null);
+      }
+    }
+    return true;
+  });
+  if (ifsTouched) return /* @__PURE__ */ new Set();
+  const functions = /* @__PURE__ */ new Set();
+  walk(f, (node) => {
+    if (node && node.kind === "FuncDecl" && node.Name?.Value) functions.add(node.Name.Value);
+    return true;
+  });
+  const callable = (v) => functions.has(v) || v === "FUNCNAME" || v === "true" || v === "false" || v === ":";
+  for (const [name, vals] of values) {
+    if (vals && ![...vals].every(callable)) values.set(name, null);
+  }
+  const known = /* @__PURE__ */ new Set();
+  for (const [name, vals] of values)
+    if (vals && (vals.size === 1 || arrays.has(name) && vals.size > 0)) known.add(name);
+  return known;
+}
+function expansionName(part) {
+  if (part.kind !== "ParamExp") return null;
+  if (part.Excl || part.Length || part.Width || part.Slice || part.Repl || part.Exp) return null;
+  return part.Param?.Value ?? null;
+}
+function executableParts(word, assigned, quoted = false, known = EMPTY_NAMES) {
   return (word?.Parts ?? []).flatMap((part) => {
     const kind = part.kind;
-    if (kind === "DblQuoted") return executableParts(part, assigned, true);
+    if (kind === "DblQuoted") return executableParts(part, assigned, true, known);
     if (kind === "Lit") return [{ kind: "Lit", value: part.Value ?? "", quoted }];
+    const name = expansionName(part);
+    if (name !== null && (known.has(name) || name === "FUNCNAME"))
+      return [{ kind: "Lit", value: name, quoted }];
+    if (name !== null) {
+      const bound = recordedExpansion(name === "@" || name === "*" ? "1" : name);
+      if (typeof bound === "string" && PLAIN_PROGRAM_NAME.test(bound))
+        return [{ kind: "Lit", value: bound, quoted }];
+    }
     if (kind === "SglQuoted")
       return [{ kind: part.Dollar ? "Dynamic" : "Lit", value: part.Value ?? "", quoted: true }];
     if (kind === "ParamExp" && isDefaultExpansion(part) && !assigned.has(part.Param?.Value)) {
@@ -2221,14 +2322,14 @@ function executableParts(word, assigned, quoted = false) {
       if (fallback !== null) return [{ kind: "Lit", value: fallback, quoted }];
     }
     if (kind === "CmdSubst") {
-      const name = lookupSubstitution(part);
-      if (name !== null) return [{ kind: "Lit", value: name, quoted }];
+      const name2 = lookupSubstitution(part);
+      if (name2 !== null) return [{ kind: "Lit", value: name2, quoted }];
     }
     return [{ kind: "Dynamic", value: "", quoted }];
   });
 }
-function opaqueExecutable(word, assigned) {
-  const parts = executableParts(word, assigned);
+function opaqueExecutable(word, assigned, known = EMPTY_NAMES) {
+  const parts = executableParts(word, assigned, false, known);
   let lastSlash = -1;
   parts.forEach((p, i) => {
     if (p.kind === "Lit" && p.value.includes("/")) lastSlash = i;
@@ -2350,6 +2451,9 @@ function deriveBinaryOp(sample) {
 function isListOp(op) {
   return listOps().has(op);
 }
+function isPipeOp(op) {
+  return pipeOps().has(op);
+}
 function listOps() {
   if (_listOps) return _listOps;
   _listOps = new Set(
@@ -2594,6 +2698,33 @@ function isProtectedCodePath(p) {
   if (matchSensitivePath(p) !== null) return true;
   return SYSTEM_AUTH_FILES.includes(p) || SYSTEM_AUTH_DIRS.some((d) => p === d || p.startsWith(d + "/"));
 }
+function isJailedCodePath(literal, jailPaths) {
+  const value = trimTrailingSlashes(literal.replace(/\\/g, "/"));
+  if (!value) return false;
+  for (const raw of jailPaths) {
+    const jail = trimTrailingSlashes(raw.trim().replace(/\\/g, "/"));
+    if (!jail) continue;
+    const home = homeTail(jail);
+    if (home === null) {
+      if (value === jail || value.startsWith(jail + "/")) return true;
+      continue;
+    }
+    if (!home) continue;
+    const tail = homeTail(value);
+    if (tail !== null && (tail === home || tail.startsWith(home + "/"))) return true;
+  }
+  return false;
+}
+function trimTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
+  return s.slice(0, end);
+}
+function homeTail(p) {
+  const m = /^(?:~|\$\{?HOME\}?|\/home\/[^/]+|\/Users\/[^/]+|\/root)(?:\/(.*))?$/.exec(p);
+  if (!m) return null;
+  return m[1] ?? "";
+}
 function inlineExecDescription(r) {
   const lead = r ? `The AI is running code directly from the command line: ${inlineExecReason(r).replace(/^This/, "this")}.` : "The AI is running code directly from the command line.";
   return `${lead} Review the full script below before allowing it to execute.`;
@@ -2602,7 +2733,8 @@ function inlineExecReason(r) {
   const who = r.interp ? `This inline ${r.interp} code` : "This inline code";
   return r.evidence ? `${who} ${r.what} (${r.evidence})` : `${who} ${r.what}`;
 }
-function inlineExecReview(command) {
+function inlineExecReview(command, jailPaths = []) {
+  const isProtected = jailPaths.length === 0 ? isProtectedCodePath : (p) => isProtectedCodePath(p) || isJailedCodePath(p, jailPaths);
   const calls = inlineExecCalls(command);
   if (calls === PARSE_FAIL) {
     return INLINE_EXEC_FALLBACK.test(command) ? { outcome: "unreadable", interp: "", what: "could not be parsed" } : null;
@@ -2625,7 +2757,7 @@ function inlineExecReview(command) {
           what: `is ${call.interp} code, which node9 does not read`
         };
       } else {
-        const judged = judgeInlineCode(language, code2, isProtectedCodePath);
+        const judged = judgeInlineCode(language, code2, isProtected);
         if (judged) finding = { ...judged, interp: call.interp };
       }
       if (finding?.outcome === "dangerous") return finding;
@@ -2806,6 +2938,11 @@ function recordTopLevelStmt(stmt) {
   if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
   return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
 }
+function arrayElements(value) {
+  if (typeof value !== "string" || !value.startsWith(ARRAY_MARK)) return null;
+  const body = value.slice(ARRAY_MARK.length);
+  return body === "" ? [] : body.split(ARRAY_SEP);
+}
 function recordAssignments(n, at) {
   if (!assignmentTable) return;
   const t = n.kind;
@@ -2819,7 +2956,19 @@ function recordAssignments(n, at) {
   } else return;
   for (const a of assigns) {
     const name = a?.Name?.Value;
-    if (!name || !a.Value || a.Append) continue;
+    if (!name) continue;
+    if (a.Array) {
+      const elems = (a.Array.Elems || []).map(
+        (e) => e?.Index ? null : resolveWordLiteral(e?.Value)
+      );
+      const literal = elems.every((v) => v !== null);
+      assignmentTable.set(name, {
+        value: literal && !a.Append ? ARRAY_MARK + elems.join(ARRAY_SEP) : null,
+        at
+      });
+      continue;
+    }
+    if (!a.Value || a.Append) continue;
     assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
   }
 }
@@ -2830,7 +2979,33 @@ function resolveTrivialSubst(part) {
   const st = stmts[0];
   if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
   const cmd = st.Cmd;
-  if (!cmd || cmd.kind !== "CallExpr") return void 0;
+  if (!cmd) return void 0;
+  if (cmd.kind === "BinaryCmd" && pipeOps().has(cmd.Op)) {
+    const left = cmd.X?.Cmd;
+    const right = cmd.Y?.Cmd;
+    if (!left || !right || left.kind !== "CallExpr" || right.kind !== "CallExpr") return void 0;
+    if ((cmd.X.Redirs || []).length > 0 || (cmd.Y.Redirs || []).length > 0) return void 0;
+    const input = trivialCallOutput(left);
+    if (input === void 0) return void 0;
+    const filter = (right.Args || []).map((a) => resolveWordLiteral(a));
+    if (filter.some((w) => w === null)) return void 0;
+    const f = baseWord(filter[0]);
+    const flags = filter.slice(1);
+    if (f === "base64" && flags.length === 1 && /^(-d|-D|--decode)$/.test(flags[0])) {
+      try {
+        const out = Buffer.from(input, "base64").toString("utf8");
+        return /^[\x20-\x7e]*$/.test(out) ? out : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    if (f === "rev" && flags.length === 0) return [...input].reverse().join("");
+    return void 0;
+  }
+  if (cmd.kind !== "CallExpr") return void 0;
+  return trivialCallOutput(cmd);
+}
+function trivialCallOutput(cmd) {
   if ((cmd.Assigns || []).length > 0) return void 0;
   const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
   if (words.length === 0 || words.some((w) => w === null)) return void 0;
@@ -2842,9 +3017,16 @@ function resolveTrivialSubst(part) {
     return rest.slice(i).join(" ");
   }
   if (head === "printf") {
+    if (rest.length === 1 && /^(?:\\(?:[0-7]{1,3}|x[0-9A-Fa-f]{1,2}))+$/.test(rest[0])) {
+      return rest[0].replace(
+        /\\(?:x([0-9A-Fa-f]{1,2})|([0-7]{1,3}))/g,
+        (_, hex, oct) => String.fromCharCode(hex ? parseInt(hex, 16) : parseInt(oct, 8))
+      );
+    }
     if (rest.length !== 2) return void 0;
-    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
-    return rest[1];
+    const m = /^([^%]*)%s([^%]*?)(\\n)?$/.exec(rest[0]);
+    if (!m) return void 0;
+    return m[1] + rest[1] + m[2];
   }
   return void 0;
 }
@@ -2858,11 +3040,28 @@ function isPlainParam(p) {
   if (p.kind !== "ParamExp") return false;
   return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
 }
+function indexedParam(p) {
+  if (p.kind !== "ParamExp" || !p.Index) return null;
+  if (p.Excl || p.Length || p.Width || p.Slice || p.Repl || p.Exp) return null;
+  const index = resolveWordLiteral(p.Index);
+  const name = p.Param?.Value;
+  return name && index !== null ? { name, index } : null;
+}
 function expandPlainParam(p) {
   if (!assignmentTable) return void 0;
+  const indexed = indexedParam(p);
+  if (indexed) {
+    const elems = arrayElements(recordedExpansion(indexed.name));
+    if (elems === null) return void 0;
+    if (indexed.index === "@" || indexed.index === "*") return elems.join(" ");
+    return /^\d+$/.test(indexed.index) ? elems[Number(indexed.index)] ?? null : null;
+  }
   if (!isPlainParam(p)) return void 0;
   const recorded = recordedExpansion(p.Param?.Value);
-  if (recorded !== void 0) return recorded;
+  if (recorded !== void 0) {
+    const elems = arrayElements(recorded);
+    return elems === null ? recorded : elems[0] ?? "";
+  }
   return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
 }
 function functionBodies(f) {
@@ -5935,7 +6134,59 @@ function dynamicOptionWord(word) {
   if (/^--[a-z-]+=/.test(prefix) || /^-[cC]/.test(prefix)) return `${prefix}$\u2026`;
   return null;
 }
-function resolveGitWords(word) {
+function arrayExpansionWords(word) {
+  let parts = word?.Parts || [];
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp" || !parts[0].Index) return null;
+  const index = resolveWordLiteral(parts[0].Index);
+  if (index !== "@" && index !== "*") return null;
+  const elems = arrayElements(recordedExpansion(parts[0].Param?.Value));
+  return elems;
+}
+function producedLiteral(call) {
+  if ((call.Assigns || []).length > 0) return null;
+  const words = (call.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return null;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "git" && rest[0] === "rev-parse" && rest[1] === "--show-toplevel" && rest.length === 2)
+    return ":/";
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.length - i === 1 ? rest[i] : null;
+  }
+  if (head === "printf" && rest.length === 2 && /^%s(\\[0n])?$/.test(rest[0])) return rest[1];
+  return null;
+}
+function treeTopWord(word, treeTopVars = NO_VARS) {
+  let parts = word?.Parts || [];
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1) return false;
+  const p = parts[0];
+  if (p.kind === "ParamExp") {
+    const name = plainParamName(word)?.name;
+    return name === "PWD" || name !== void 0 && treeTopVars.has(name);
+  }
+  if (p.kind !== "CmdSubst") return false;
+  const stmts = p.Stmts || [];
+  if (stmts.length !== 1 || !stmts[0].Cmd || stmts[0].Cmd.kind !== "CallExpr") return false;
+  const words = (stmts[0].Cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.some((w) => w === null)) return false;
+  const head = baseWord(words[0]);
+  if (head === "pwd") return words.length === 1 || words[1] === "-P" || words[1] === "-L";
+  return head === "git" && words[1] === "rev-parse" && words[2] === "--show-toplevel";
+}
+function resolveGitWords(word, treeTopVars = NO_VARS, appended = NO_APPENDS) {
+  if (treeTopWord(word, treeTopVars)) return [":/"];
+  const plain = plainParamName(word);
+  if (plain && appended.has(plain.name)) {
+    const v = appended.get(plain.name);
+    if (v === null || v === void 0) return [null];
+    return plain.quoted ? [v] : splitFields(v);
+  }
+  const elems = arrayExpansionWords(word);
+  if (elems !== null) return elems;
   const value = resolveWordLiteral(word);
   if (value === null) {
     if (isPositionalParam(word)) return boundPositionals() ?? [POSITIONAL2];
@@ -6043,6 +6294,8 @@ function classify(inv) {
       if (o.flags.has("-n") || o.flags.has("--dry-run")) break;
       const forced = o.flags.has("-f") || o.flags.has("--force") || o.flags.has("--force-with-lease") || o.flags.has("--force-if-includes") || o.flags.has("--mirror") || o.operands.some((r) => r.startsWith("+"));
       if (forced) found(FORCE_PUSH);
+      const deletes = o.flags.has("-d") || o.flags.has("--delete") || o.operands.some((r) => /^:[^:]/.test(r));
+      if (deletes) found(DESTRUCTIVE);
       break;
     }
     case "reset": {
@@ -6070,11 +6323,72 @@ function classify(inv) {
       if (o.flags.has("-d") || o.flags.has("--delete")) found(DESTRUCTIVE);
       break;
     }
+    // node9Firewall#385: history and work discarded through plumbing. A ref
+    // deleted by hand, a stash dropped, the reflog expired or pruned: the
+    // commits behind them are gone the way `branch -D` loses them.
+    case "update-ref": {
+      const o = parseOptions(inv.args, "m", /* @__PURE__ */ new Set());
+      if (o.flags.has("-d") && (o.dynamic || o.operands.some(isHistoryRef))) found(DESTRUCTIVE);
+      break;
+    }
+    case "reflog": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "expire" || o.operands[0] === "delete") found(DESTRUCTIVE);
+      break;
+    }
+    case "gc": {
+      if (inv.config.get("gc.reflogexpire") === "now") found(DESTRUCTIVE);
+      break;
+    }
+    case "stash": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "clear" || o.operands[0] === "drop") found(DESTRUCTIVE);
+      break;
+    }
+    case "worktree": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "remove" && (o.flags.has("-f") || o.flags.has("--force")))
+        found(DESTRUCTIVE);
+      break;
+    }
+    // The working tree overwritten: `restore` from another ref, a forced
+    // checkout, or `checkout -- .` (every local change dropped). A bare
+    // `restore .` or `checkout .` stays an ordinary undo, as pinned.
+    case "restore": {
+      const o = parseOptions(inv.args, "s", RESTORE_LONG_VALUE);
+      const src = restoreSource(inv.args);
+      const whole = o.dynamic || o.operands.some(wholeTree);
+      if (src !== null && src !== "HEAD" && whole) found(DESTRUCTIVE);
+      break;
+    }
+    case "checkout": {
+      const o = parseOptions(inv.args, "bB", CHECKOUT_LONG_VALUE);
+      const forced = o.flags.has("-f") || o.flags.has("--force");
+      const dropAll = inv.args.includes("--") && o.operands.some(wholeTree);
+      if (forced || dropAll) found(DESTRUCTIVE);
+      break;
+    }
     default:
       break;
   }
   return out;
 }
+function isExcludePathspec(operand) {
+  return /^:[!^]/.test(operand) || /^:\([^)]*\bexclude\b[^)]*\)/.test(operand);
+}
+function restoreSource(args) {
+  for (let i = 0; i < args.length; i++) {
+    const w = args[i];
+    if (w === null) continue;
+    if (w.startsWith("--source=")) return w.slice("--source=".length);
+    if (w === "--source" || w === "-s") return args[i + 1] ?? null;
+    if (/^-s./.test(w)) return w.slice(2);
+  }
+  return null;
+}
+function isHistoryRef(ref) {
+  return /^refs\/(heads|stash)(\/|$)/.test(ref);
+}
 function killSwitchSet(name, value) {
   if (value === null) return false;
   switch (name) {
@@ -6132,6 +6446,7 @@ function hooksBypass(inv) {
     const o = parseOptions(inv.args, "mFCcut", COMMIT_LONG_VALUE);
     return o.flags.has("-n") || o.flags.has("--no-verify");
   }
+  if (sub === "commit-tree") return true;
   if (sub !== void 0 && NO_VERIFY_SUBS.has(sub)) {
     return inv.args.some((a) => a === "--no-verify");
   }
@@ -6169,7 +6484,20 @@ function configWritesHooksPath(args) {
   return write2;
 }
 function isHookPath(word) {
-  return /(^|[\\/])(\.git[\\/]hooks|\.husky)([\\/]|$)/.test(word);
+  return /(^|[\\/])(\.git[\\/]hooks|\.husky|\.githooks)([\\/]|$)/.test(word);
+}
+function isLiveHookFile(word) {
+  if (!isHookPath(word)) return false;
+  const m = /(^|[\\/])(\.git[\\/]hooks|\.husky|\.githooks)(?:[\\/](.*))?$/.exec(word);
+  if (!m) return false;
+  const rest = m[3] ?? "";
+  if (rest === "" || rest === "_") return true;
+  const leaf = rest.replace(/^_[\\/]/, "");
+  return /^[a-z-]+$/.test(leaf);
+}
+function hookBodyIsEmpty(text) {
+  const lines = text.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== "" && !l.startsWith("#"));
+  return lines.every((l) => /^(exit(\s+0)?|true|:|set\s+-[a-zA-Z]+|set\s+-o\s+\w+)$/.test(l));
 }
 function modeRemovesExecute(mode) {
   if (/^[0-7]{3,4}$/.test(mode)) {
@@ -6178,6 +6506,22 @@ function modeRemovesExecute(mode) {
   }
   return mode.split(",").some((part) => /^[ugoa]*-[rwst]*x/.test(part));
 }
+function redirOpIsAppend(redir) {
+  return redir?.Op === appendOp();
+}
+function appendOp() {
+  if (_appendOp !== null) return _appendOp;
+  try {
+    const f = parseShared("echo x >> y");
+    _appendOp = typeof f === "symbol" ? -1 : f.Stmts[0].Redirs[0].Op;
+  } catch {
+    _appendOp = -1;
+  }
+  return _appendOp;
+}
+function hooksBypassed(shown) {
+  return { ...HOOKS_BYPASS, shown, reason: `${HOOKS_BYPASS.reason}: ${shown}` };
+}
 function chmodDisarmsHook(args, shown) {
   let i = 0;
   while (i < args.length) {
@@ -6220,6 +6564,7 @@ function stagesEverything(inv) {
   const sub = inv.sub?.toLowerCase();
   const prefix = chdirPrefix(inv);
   const judge = (operands2) => {
+    if (operands2.length > 0 && operands2.every(isExcludePathspec)) return {};
     let conditional = false;
     for (const operand of operands2) {
       if (!wholeTree(operand)) continue;
@@ -6512,7 +6857,7 @@ function evaluateAgentFileWrite(args, accesses, context, settings, shell, hooks
   }
   return null;
 }
-function isPipeOp(op) {
+function isPipeOp2(op) {
   return !isListOp(op);
 }
 function isDupInOp(op) {
@@ -8590,7 +8935,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       if (v?.logged) noteLogged(v);
       else if (v) candidates2.push(v);
     };
-    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
+    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand, config.policy.jailPaths);
     if (inline !== null) {
       consider("commands.inline-exec", {
         decision: "review",
@@ -8933,7 +9278,7 @@ function* validCardRuns(text, base22, exemptFractions = true) {
   let m;
   while ((m = re.exec(text)) !== null) {
     const digits = m[0].replace(/\D/g, "");
-    const fraction = exemptFractions && isDecimalFraction(text, m.index, digits.length === m[0].length);
+    const fraction = exemptFractions && (isDecimalFraction(text, m.index, digits.length === m[0].length) || isInteriorDotNumber(m[0]));
     if (!fraction && validateLuhn(digits)) {
       yield { index: m.index, length: m[0].length, digits };
     } else {
@@ -8960,6 +9305,12 @@ function replaceValidCards(text, replace, { exemptFractions = true } = {}) {
   }
   return out;
 }
+function isInteriorDotNumber(run) {
+  const first = run.indexOf(".");
+  if (first <= 0 || first === run.length - 1) return false;
+  if (run.indexOf(".", first + 1) !== -1) return false;
+  return !/[-\s]/.test(run);
+}
 function isDecimalFraction(text, index, unseparated) {
   if (!unseparated) return false;
   const sep = text[index - 1];
@@ -10370,7 +10721,7 @@ function* stringLeavesWithKeys(obj, depth = 0, key) {
   }
   for (const [k, v] of Object.entries(obj)) yield* stringLeavesWithKeys(v, depth + 1, k);
 }
-var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto2, import_crypto3, import_crypto4, import_crypto5, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, REPLACED_SHIELDS, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, POSTURE_CATEGORY_OWASP, VERDICTS, CHECK_VERDICT_RANK, CHECK_GROUPS, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, BATCH_SEPARATOR, ENCODED_RUN_RE, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, SHIELD_RULE, ACTION_RULE, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
+var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto2, import_crypto3, import_crypto4, import_crypto5, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, REPLACED_SHIELDS, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, POSTURE_CATEGORY_OWASP, VERDICTS, CHECK_VERDICT_RANK, CHECK_GROUPS, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, BATCH_SEPARATOR, ENCODED_RUN_RE, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, SHIELD_RULE, ACTION_RULE, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, MAX_BLAST_PATH, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -13684,6 +14035,7 @@ var init_dist = __esm({
       "sqlite3"
     ]);
     defaultExpansionOps = null;
+    EMPTY_NAMES = /* @__PURE__ */ new Set();
     VARIABLE_READERS = /* @__PURE__ */ new Set([
       "read",
       "mapfile",
@@ -13696,6 +14048,7 @@ var init_dist = __esm({
       "readonly",
       "printf"
     ]);
+    PLAIN_PROGRAM_NAME = /^[A-Za-z_][\w.+-]*$/;
     FS_READ_TOOLS = /* @__PURE__ */ new Set([
       "cat",
       "less",
@@ -14590,6 +14943,8 @@ var init_dist = __esm({
         AND_OR_OPS: new Set([and, or].filter((o) => o !== null))
       };
     });
+    ARRAY_MARK = "
array
";
+    ARRAY_SEP = "
";
     MAX_CALL_DEPTH2 = 4;
     MAX_CALL_WALKS2 = 256;
     callDepth = 0;
@@ -17927,7 +18282,22 @@ zoo`.split("\n");
       found;
       /** Aliases defined earlier in this command: name -> value (null = dynamic). */
       aliases = /* @__PURE__ */ new Map();
+      /** node9Firewall#385: variables assigned a tree-top word (`scope="$PWD"`,
+       *  `root=$(git rev-parse --show-toplevel)`, `DIR=$(pwd)`), so the
+       *  variable reads as the top where it is used. */
+      treeTopVars = /* @__PURE__ */ new Set();
+      /** node9Firewall#385 (c): a string a script builds with `+=` from
+       *  literals (`mode=--ha; mode+=rd`). The jail's table does not follow an
+       *  append (JAIL-14a); the git rules read the built word, since a flag
+       *  spelled in two halves is still that flag. name -> value, null once a
+       *  half is unknown. */
+      appended = /* @__PURE__ */ new Map();
       payloads = /* @__PURE__ */ new Set();
+      /** node9Firewall#385 (a): the text this command writes to each path
+       *  (`cat > /tmp/x.sh <<'SH' ... SH`, `echo '...' > f`, `>>` appends), so
+       *  a later statement that runs the path (`bash f`, `sh f`, `./f`) is
+       *  judged on what it runs. null once a write to the path is unknown. */
+      written = /* @__PURE__ */ new Map();
       /** `for NAME in a b c`: the literal items, or null when one is dynamic. */
       loopVars = /* @__PURE__ */ new Map();
       /** Walk one command string. Returns false when it did not parse. */
@@ -17946,6 +18316,25 @@ zoo`.split("\n");
         const type = n.kind;
         if (type === "Stmt") {
           this.visitHeredocShell(n, depth);
+          this.visitPipeline(n, depth);
+          this.visitHookWrite(n);
+          this.recordScriptWrite(n);
+          this.visitWrittenScript(n, depth);
+          return true;
+        }
+        if (type === "Assign" && n.Name?.Value && n.Value) {
+          const name = n.Name.Value;
+          if (n.Append) {
+            const prev = this.appended.has(name) ? this.appended.get(name) : resolveWordLiteral(n.Value) === null ? null : void 0;
+            const base22 = prev === void 0 ? recordedExpansion(name) : prev;
+            const piece = resolveWordLiteral(n.Value);
+            this.appended.set(name, typeof base22 === "string" && piece !== null ? base22 + piece : null);
+            this.treeTopVars.delete(name);
+            return true;
+          }
+          this.appended.delete(name);
+          if (treeTopWord(n.Value, this.treeTopVars)) this.treeTopVars.add(name);
+          else this.treeTopVars.delete(name);
           return true;
         }
         if (type === "ForClause") {
@@ -17974,13 +18363,13 @@ zoo`.split("\n");
           const param = plainParamName(rawArgs[loopArg]);
           for (const item of this.loopVars.get(param.name)) {
             const words2 = rawArgs.flatMap(
-              (a, i) => i === loopArg ? param.quoted ? [item] : splitFields(item) : resolveGitWords(a)
+              (a, i) => i === loopArg ? param.quoted ? [item] : splitFields(item) : resolveGitWords(a, this.treeTopVars, this.appended)
             );
             this.visitWords(words2, new Map(prefixEnv), depth, false);
           }
           return true;
         }
-        const words = rawArgs.flatMap((a) => resolveGitWords(a));
+        const words = rawArgs.flatMap((a) => resolveGitWords(a, this.treeTopVars, this.appended));
         this.visitWords(words, prefixEnv, depth, false);
         return true;
       }
@@ -18005,6 +18394,23 @@ zoo`.split("\n");
           if (f) this.found(f);
           return;
         }
+        if (headWord === "rm" || headWord === "unlink") {
+          if (words.slice(head + 1).some((w) => w !== null && isLiveHookFile(w)))
+            this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
+        if (headWord === "mv") {
+          const operands2 = words.slice(head + 1).filter((w) => w === null || !w.startsWith("-"));
+          const src = operands2[0];
+          if (typeof src === "string" && isLiveHookFile(src)) this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
+        if (headWord === "perl") {
+          const code2 = words.slice(head + 1).find((w) => w !== null && /\brename\b/.test(w));
+          const m = code2 ? /rename\s*\(?\s*q[qw]?\s*[(\[{<'"]([^)\]}>'"]+)/.exec(code2) : null;
+          if (m && isLiveHookFile(m[1])) this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
         if (depth < MAX_PAYLOAD_DEPTH2) {
           const payload = literalShellPayload(words, baseWord(words[0]));
           if (payload !== null) this.runPayload(payload, depth);
@@ -18015,6 +18421,127 @@ zoo`.split("\n");
         this.payloads.add(payload);
         this.run(payload, depth + 1);
       }
+      /**
+       * node9Firewall#385: a pipeline whose last stage reads its pathspec from
+       * stdin (`git add --pathspec-from-file=-`) or runs git over the names it
+       * is fed (`xargs -0 git add --`), with a producer that is one literal
+       * (`git rev-parse --show-toplevel`, `printf '%s\0' .`): the literal is
+       * the operand, and the call is judged with it.
+       */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitPipeline(stmt, depth) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "BinaryCmd" || !isPipeOp(cmd.Op)) return;
+        const stages = [];
+        let cur = cmd;
+        while (cur?.kind === "BinaryCmd" && isPipeOp(cur.Op)) {
+          stages.unshift(cur.Y);
+          const left = cur.X;
+          if (left?.Cmd?.kind === "BinaryCmd" && isPipeOp(left.Cmd.Op)) cur = left.Cmd;
+          else {
+            stages.unshift(left);
+            break;
+          }
+        }
+        if (stages.length < 2) return;
+        const producer = stages[stages.length - 2]?.Cmd;
+        const consumer = stages[stages.length - 1]?.Cmd;
+        if (!producer || !consumer || producer.kind !== "CallExpr" || consumer.kind !== "CallExpr")
+          return;
+        const fed = producedLiteral(producer);
+        if (fed === null) return;
+        const words = (consumer.Args || []).flatMap(
+          (a) => resolveGitWords(a, this.treeTopVars, this.appended)
+        );
+        const head = unwrapCommandHead(words);
+        const viaXargs = words.slice(0, head).some((w) => baseWord(w) === "xargs");
+        const fromFile = words.findIndex(
+          (w) => w === "--pathspec-from-file=-" || w === "--pathspec-from-file"
+        );
+        if (!viaXargs && fromFile < 0) return;
+        let fedWords;
+        if (fromFile >= 0) {
+          fedWords = words.filter(
+            (w, k) => !(k === fromFile || w === "-" && words[k - 1] === "--pathspec-from-file")
+          );
+          fedWords.push(fed);
+        } else fedWords = [...words, fed];
+        this.visitWords(fedWords, /* @__PURE__ */ new Map(), depth, false);
+      }
+      /**
+       * node9Firewall#385 (e): a hook file written with a body that checks
+       * nothing (`cat > .githooks/pre-commit <<'SH' exit 0 SH`, `echo 'exit 0'
+       * > .git/hooks/pre-push`, `: > .githooks/pre-commit`). A real body (a
+       * test, a linter) is ordinary work on the hooks.
+       */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitHookWrite(stmt) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr") return;
+        const redirs = stmt.Redirs || [];
+        const target = redirs.find((r) => r?.Word && !r.Hdoc && (r.N == null || r.N.Value === "1"));
+        if (!target) return;
+        const path210 = resolveWordLiteral(target.Word);
+        if (path210 === null || !isLiveHookFile(path210)) return;
+        const hdoc = redirs.find((r) => r?.Hdoc);
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = baseWord(words[0]);
+        let body = null;
+        if (hdoc) body = resolveWordLiteral(hdoc.Hdoc);
+        else if (head === ":" || head === "true" || words.length === 0) body = "";
+        else if (head === "echo" || head === "printf") {
+          const rest = words.slice(1);
+          body = rest.some((w) => w === null) ? null : rest.filter((w) => !/^-[neE]+$/.test(w)).join(" ");
+          if (body !== null) body = body.replace(/\\n/g, "\n");
+        }
+        if (body !== null && hookBodyIsEmpty(body)) this.found(hooksBypassed(shownOf(words)));
+      }
+      /** A statement that writes a literal text to a path, by redirect. */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      recordScriptWrite(stmt) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr") return;
+        const redirs = stmt.Redirs || [];
+        const target = redirs.find((r) => r?.Word && !r.Hdoc && (r.N == null || r.N.Value === "1"));
+        if (!target) return;
+        const path210 = resolveWordLiteral(target.Word);
+        if (path210 === null) return;
+        const append = /^>>/.test(target.Op?.toString() ?? "") || redirOpIsAppend(target);
+        const hdoc = redirs.find((r) => r?.Hdoc);
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = baseWord(words[0]);
+        let text = null;
+        if (hdoc && (head === "cat" || head === "tee")) text = resolveWordLiteral(hdoc.Hdoc);
+        else if (head === "echo" || head === "printf") {
+          const rest = words.slice(1);
+          text = rest.some((w) => w === null) ? null : rest.filter((w) => !/^-[neE]+$/.test(w)).join(" ");
+          if (text !== null && head === "printf") text = text.replace(/\\n/g, "\n");
+        } else return;
+        const prev = this.written.get(path210);
+        if (text === null || append && prev === null) this.written.set(path210, null);
+        else this.written.set(path210, append && typeof prev === "string" ? `${prev}
+${text}` : text);
+      }
+      /** A statement that runs a path this command wrote: the text is the script. */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitWrittenScript(stmt, depth) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr" || this.written.size === 0 || depth >= MAX_PAYLOAD_DEPTH2)
+          return;
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = unwrapCommandHead(words);
+        const name = baseWord(words[head]);
+        let ran = null;
+        if (PAYLOAD_SHELLS.has(name) && name !== "eval") {
+          const operand = words.slice(head + 1).find((w) => w === null || !w.startsWith("-"));
+          if (typeof operand === "string") ran = operand;
+        } else if (typeof words[head] === "string" && this.written.has(words[head])) {
+          ran = words[head];
+        }
+        if (ran === null) return;
+        const text = this.written.get(ran);
+        if (typeof text === "string") this.runPayload(text, depth);
+      }
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       visitHeredocShell(stmt, depth) {
         const cmd = stmt.Cmd;
@@ -18166,6 +18693,8 @@ zoo`.split("\n");
       }
     };
     POSITIONAL2 = "\0positional";
+    NO_VARS = /* @__PURE__ */ new Set();
+    NO_APPENDS = /* @__PURE__ */ new Map();
     FORCE_PUSH = {
       checkId: "commands.git-destructive",
       ruleName: "review-force-push",
@@ -18224,6 +18753,8 @@ zoo`.split("\n");
       "--cleanup"
     ]);
     CLEAN_LONG_VALUE = /* @__PURE__ */ new Set(["--exclude"]);
+    RESTORE_LONG_VALUE = /* @__PURE__ */ new Set(["--source", "--pathspec-from-file"]);
+    CHECKOUT_LONG_VALUE = /* @__PURE__ */ new Set(["--pathspec-from-file", "--orphan", "--conflict"]);
     HOOKS_BYPASS = {
       checkId: "commands.git-hooks-bypass",
       ruleName: "review-git-hooks-bypass",
@@ -18249,6 +18780,7 @@ zoo`.split("\n");
       "--gpg-sign"
     ]);
     CHMOD_OPTION_RE = /^-[RvcfHLP]+$/;
+    _appendOp = null;
     STAGE_ALL = {
       checkId: "commands.git-stage-all",
       ruleName: "review-git-stage-all",
@@ -18373,7 +18905,7 @@ zoo`.split("\n");
           this.visitStmt(n, depth);
           return true;
         }
-        if (type === "BinaryCmd" && isPipeOp(n.Op)) {
+        if (type === "BinaryCmd" && isPipeOp2(n.Op)) {
           this.visitPipeline(n);
           return true;
         }
@@ -18474,7 +19006,7 @@ zoo`.split("\n");
         const stages = [];
         const flatten = (s) => {
           const c = s?.Cmd;
-          if (c && c.kind === "BinaryCmd" && isPipeOp(c.Op)) {
+          if (c && c.kind === "BinaryCmd" && isPipeOp2(c.Op)) {
             flatten(c.X);
             flatten(c.Y);
           } else stages.push(s);
@@ -19705,7 +20237,7 @@ zoo`.split("\n");
       { view: "separators-stripped", decoder: "separators", stripped: true }
     ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v36";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v37";
     DEDUPE_PREVIEW_LEN = 120;
     ENGINE_VERSION = "1.4.0";
   }
@@ -20211,11 +20743,18 @@ function slug(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "rule";
 }
 function pathToRegexFragment(rawPath) {
-  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
+  const trimmed = rawPath.trim();
+  const tail = trimmed.replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
   const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
   if (segments2.length === 0) return "";
+  if (isAbsoluteOutsideHome(trimmed)) {
+    return `(^|[^A-Za-z0-9_.~\\/-])/${segments2.join(SEP)}(${B}|$)`;
+  }
   return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
 }
+function isAbsoluteOutsideHome(p) {
+  return p.startsWith("/") && !/^\/(?:home|Users|root)(?:\/|$)/.test(p);
+}
 function toolRule(tool, verdict, reason) {
   return {
     name: `${verdict}-${slug(tool)}`,
@@ -20636,13 +21175,115 @@ var init_managed = __esm({
   }
 });
 
+// src/shields/jail.ts
+function jailStorePath() {
+  return import_path3.default.join(import_os3.default.homedir(), ".node9", "jail-paths.json");
+}
+function readJailPaths() {
+  let text;
+  try {
+    text = import_fs3.default.readFileSync(jailStorePath(), "utf8");
+  } catch (err2) {
+    if (err2.code === "ENOENT") return [];
+    throw err2;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`${jailStorePath()} is not valid JSON \u2014 fix it before changing the jail.`);
+  }
+  if (!Array.isArray(parsed.paths)) return [];
+  return parsed.paths.filter(
+    (p) => !!p && typeof p.path === "string" && (p.verdict === "block" || p.verdict === "review")
+  );
+}
+function writeJailPaths(paths) {
+  const p = jailStorePath();
+  import_fs3.default.mkdirSync(import_path3.default.dirname(p), { recursive: true });
+  import_fs3.default.writeFileSync(p, JSON.stringify({ paths }, null, 2) + "\n", { mode: 384 });
+}
+function addJailPath(rawPath, verdict) {
+  const norm = rawPath.trim();
+  const fragment = pathToRegexFragment(norm);
+  if (!fragment) {
+    throw new Error(
+      `"${rawPath}" is too broad to jail \u2014 give a specific path (e.g. ~/.gmail-mcp), not a home or root directory.`
+    );
+  }
+  const rejection = validateRegex(fragment);
+  if (rejection !== null) {
+    throw new Error(
+      `"${rawPath}" cannot be jailed: the generated match pattern was rejected by the policy engine (${rejection}). Try a shorter or more specific path.`
+    );
+  }
+  const next = [...readJailPaths().filter((p) => p.path !== norm), { path: norm, verdict }];
+  writeJailPaths(next);
+  return next;
+}
+function findJailedPath(candidate) {
+  return findJailedPathIn(candidate, readJailPaths());
+}
+function findJailedPathIn(candidate, paths) {
+  if (!candidate) return null;
+  for (const entry of paths) {
+    if (pathMatchesFragment(candidate, entry.path)) return entry;
+  }
+  return null;
+}
+function removeJailPath(rawPath) {
+  const norm = rawPath.trim();
+  const before = readJailPaths();
+  const after = before.filter((p) => p.path !== norm);
+  const removed = after.length !== before.length;
+  if (removed) writeJailPaths(after);
+  return { removed, paths: after };
+}
+function regenerateUserJail(paths) {
+  const file2 = import_path3.default.join(USER_SHIELDS_DIR_PATH, `${USER_JAIL_SHIELD}.json`);
+  if (paths.length === 0) {
+    const active2 = readActiveShields();
+    if (active2.includes(USER_JAIL_SHIELD)) {
+      writeActiveShields(active2.filter((s) => s !== USER_JAIL_SHIELD));
+    }
+    try {
+      import_fs3.default.rmSync(file2, { force: true });
+    } catch {
+    }
+    return;
+  }
+  const def = buildShield({
+    name: USER_JAIL_SHIELD,
+    description: "User-added credential jail paths (node9 jail add)",
+    blockPaths: paths.filter((p) => p.verdict === "block").map((p) => p.path),
+    reviewPaths: paths.filter((p) => p.verdict === "review").map((p) => p.path)
+  });
+  installShield(USER_JAIL_SHIELD, def);
+  const active = readActiveShields();
+  if (!active.includes(USER_JAIL_SHIELD)) writeActiveShields([...active, USER_JAIL_SHIELD]);
+}
+var import_fs3, import_os3, import_path3, USER_JAIL_SHIELD;
+var init_jail = __esm({
+  "src/shields/jail.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_fs3 = __toESM(require("fs"));
+    import_os3 = __toESM(require("os"));
+    import_path3 = __toESM(require("path"));
+    init_build();
+    init_dist();
+    init_shields();
+    USER_JAIL_SHIELD = "user-jail";
+  }
+});
+
 // src/auth/trusted-hosts.ts
 function getTrustedHostsPath() {
-  return import_path3.default.join(import_os3.default.homedir(), ".node9", "trusted-hosts.json");
+  return import_path4.default.join(import_os4.default.homedir(), ".node9", "trusted-hosts.json");
 }
 function readTrustedHosts() {
   try {
-    const raw = import_fs3.default.readFileSync(getTrustedHostsPath(), "utf8");
+    const raw = import_fs4.default.readFileSync(getTrustedHostsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.hosts) ? parsed.hosts : [];
   } catch {
@@ -20651,7 +21292,7 @@ function readTrustedHosts() {
 }
 function getFileMtime() {
   try {
-    return import_fs3.default.statSync(getTrustedHostsPath()).mtimeMs;
+    return import_fs4.default.statSync(getTrustedHostsPath()).mtimeMs;
   } catch {
     return 0;
   }
@@ -20668,10 +21309,10 @@ function getCachedHosts() {
 }
 function writeTrustedHosts(hosts) {
   const filePath = getTrustedHostsPath();
-  import_fs3.default.mkdirSync(import_path3.default.dirname(filePath), { recursive: true });
+  import_fs4.default.mkdirSync(import_path4.default.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
-  import_fs3.default.writeFileSync(tmp, JSON.stringify({ hosts }, null, 2), { mode: 384 });
-  import_fs3.default.renameSync(tmp, filePath);
+  import_fs4.default.writeFileSync(tmp, JSON.stringify({ hosts }, null, 2), { mode: 384 });
+  import_fs4.default.renameSync(tmp, filePath);
   _cache = { hosts, expiry: Date.now() + CACHE_TTL_MS, mtime: getFileMtime() };
 }
 function addTrustedHost(host2) {
@@ -20716,14 +21357,14 @@ function isTrustedHost(host2) {
     getCachedHosts().map((entry) => entry.host)
   );
 }
-var import_fs3, import_path3, import_os3, _cache, CACHE_TTL_MS;
+var import_fs4, import_path4, import_os4, _cache, CACHE_TTL_MS;
 var init_trusted_hosts = __esm({
   "src/auth/trusted-hosts.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs3 = __toESM(require("fs"));
-    import_path3 = __toESM(require("path"));
-    import_os3 = __toESM(require("os"));
+    import_fs4 = __toESM(require("fs"));
+    import_path4 = __toESM(require("path"));
+    import_os4 = __toESM(require("os"));
     _cache = null;
     CACHE_TTL_MS = 5e3;
   }
@@ -21004,9 +21645,9 @@ function _resetConfigCache() {
 }
 function getGlobalSettings() {
   try {
-    const globalConfigPath2 = import_path4.default.join(import_os4.default.homedir(), ".node9", "config.json");
-    if (import_fs4.default.existsSync(globalConfigPath2)) {
-      const raw = JSON.parse(import_fs4.default.readFileSync(globalConfigPath2, "utf-8"));
+    const globalConfigPath2 = import_path5.default.join(import_os5.default.homedir(), ".node9", "config.json");
+    if (import_fs5.default.existsSync(globalConfigPath2)) {
+      const raw = JSON.parse(import_fs5.default.readFileSync(globalConfigPath2, "utf-8"));
       const parsed = isV2File(raw) ? v2ToLegacy(raw).legacy : raw;
       const settings = parsed.settings || {};
       return {
@@ -21035,8 +21676,8 @@ function noteRejectedApiUrl(raw) {
   if (rejectedApiUrlsSeen.has(key)) return;
   rejectedApiUrlsSeen.add(key);
   try {
-    import_fs4.default.appendFileSync(
-      import_path4.default.join(import_os4.default.homedir(), ".node9", "hook-debug.log"),
+    import_fs5.default.appendFileSync(
+      import_path5.default.join(import_os5.default.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] REFUSED apiUrl, using the default instead: ${String(raw).slice(0, 200).replace(/[\r\n]+/g, " ")}
 `
     );
@@ -21053,9 +21694,9 @@ function getCredentials() {
     };
   }
   try {
-    const credPath = import_path4.default.join(import_os4.default.homedir(), ".node9", "credentials.json");
-    if (import_fs4.default.existsSync(credPath)) {
-      const creds = JSON.parse(import_fs4.default.readFileSync(credPath, "utf-8"));
+    const credPath = import_path5.default.join(import_os5.default.homedir(), ".node9", "credentials.json");
+    if (import_fs5.default.existsSync(credPath)) {
+      const creds = JSON.parse(import_fs5.default.readFileSync(credPath, "utf-8"));
       const profileName = process.env.NODE9_PROFILE || "default";
       const profile = creds[profileName];
       if (typeof profile?.apiKey === "string" && profile.apiKey.length > 0) {
@@ -21087,7 +21728,7 @@ function readRulesCacheResilient(cacheFile) {
   for (let attempt = 0; attempt < 3; attempt++) {
     let content;
     try {
-      content = import_fs4.default.readFileSync(cacheFile, "utf-8");
+      content = import_fs5.default.readFileSync(cacheFile, "utf-8");
       existed = true;
     } catch (err2) {
       if (err2.code === "ENOENT") return {};
@@ -21102,10 +21743,10 @@ function readRulesCacheResilient(cacheFile) {
     }
   }
   if (existed || sawReadError) {
-    const backup = import_path4.default.join(import_path4.default.dirname(cacheFile), "rules-cache.last-good.json");
+    const backup = import_path5.default.join(import_path5.default.dirname(cacheFile), "rules-cache.last-good.json");
     if (backup !== cacheFile) {
       try {
-        const raw = JSON.parse(import_fs4.default.readFileSync(backup, "utf-8"));
+        const raw = JSON.parse(import_fs5.default.readFileSync(backup, "utf-8"));
         logCacheReadIssue(cacheFile, "RULES_CACHE_CORRUPT_USED_BACKUP");
         lastParsedRulesCache = raw;
         return raw;
@@ -21125,8 +21766,8 @@ function logCacheReadIssue(cacheFile, kind) {
   if (now - cacheReadLastLoggedAt < CACHE_LOG_REARM_MS) return;
   cacheReadLastLoggedAt = now;
   try {
-    import_fs4.default.appendFileSync(
-      import_path4.default.join(import_os4.default.homedir(), ".node9", "hook-debug.log"),
+    import_fs5.default.appendFileSync(
+      import_path5.default.join(import_os5.default.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] ${kind} ${cacheFile}
 `
     );
@@ -21143,8 +21784,8 @@ function catalogSettingsFrom(settings, policy) {
 }
 function getConfig(cwd) {
   if (!cwd && cachedConfig) return cachedConfig;
-  const globalPath = import_path4.default.join(import_os4.default.homedir(), ".node9", "config.json");
-  const projectPath = import_path4.default.join(cwd ?? process.cwd(), "node9.config.json");
+  const globalPath = import_path5.default.join(import_os5.default.homedir(), ".node9", "config.json");
+  const projectPath = import_path5.default.join(cwd ?? process.cwd(), "node9.config.json");
   const globalConfig = tryLoadConfig(globalPath);
   const projectConfig = tryLoadConfig(projectPath, { project: true });
   const mergedSettings = {
@@ -21194,7 +21835,8 @@ function getConfig(cwd) {
     trustedHostsManaged: false,
     appPermissions: {},
     appLinks: {},
-    managedJailPaths: []
+    managedJailPaths: [],
+    jailPaths: []
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const rank = (v) => {
@@ -21389,7 +22031,7 @@ function getConfig(cwd) {
   let cloudMandatesEnforcement = false;
   let cloudMandatesAppPerm = false;
   {
-    const cacheFile = import_path4.default.join(import_os4.default.homedir(), ".node9", "rules-cache.json");
+    const cacheFile = import_path5.default.join(import_os5.default.homedir(), ".node9", "rules-cache.json");
     try {
       const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
@@ -21589,6 +22231,7 @@ function getConfig(cwd) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
             mergedPolicy.managedJailPaths.push({ path: path114, verdict });
+            mergedPolicy.jailPaths.push(path114);
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -21664,6 +22307,11 @@ function getConfig(cwd) {
     }
   }
   mergedPolicy.appliedShields = appliedShields.sort();
+  if (appliedShields.includes(USER_JAIL_SHIELD)) {
+    for (const { path: path114 } of readJailPaths()) {
+      if (!mergedPolicy.jailPaths.includes(path114)) mergedPolicy.jailPaths.push(path114);
+    }
+  }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
   const cc = mergedPolicy.commandChecks ?? {};
   const advisoryKnobKey = (name) => {
@@ -21821,10 +22469,10 @@ function getConfig(cwd) {
 }
 function tryLoadConfig(filePath, options = {}) {
   v2ChecksByPath.delete(filePath);
-  if (!import_fs4.default.existsSync(filePath)) return null;
+  if (!import_fs5.default.existsSync(filePath)) return null;
   let raw;
   try {
-    raw = JSON.parse(import_fs4.default.readFileSync(filePath, "utf-8"));
+    raw = JSON.parse(import_fs5.default.readFileSync(filePath, "utf-8"));
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
     process.stderr.write(
@@ -21922,18 +22570,19 @@ function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false
     cur.roles = next;
   }
 }
-var import_fs4, import_path4, import_os4, DANGEROUS_WORDS, RUNTIME_ONLY_CONFIG_KEYS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, rejectedApiUrlsSeen, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt, v2ChecksByPath, KNOB_TO_CHECK;
+var import_fs5, import_path5, import_os5, DANGEROUS_WORDS, RUNTIME_ONLY_CONFIG_KEYS, DEFAULT_CONFIG, RM_SAFE_PATH_PATTERN, VERDICT_ORDER, ADVISORY_SMART_RULES, cachedConfig, rejectedApiUrlsSeen, lastParsedRulesCache, CACHE_LOG_REARM_MS, cacheReadLastLoggedAt, v2ChecksByPath, KNOB_TO_CHECK;
 var init_config = __esm({
   "src/config/index.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs4 = __toESM(require("fs"));
-    import_path4 = __toESM(require("path"));
-    import_os4 = __toESM(require("os"));
+    import_fs5 = __toESM(require("fs"));
+    import_path5 = __toESM(require("path"));
+    import_os5 = __toESM(require("os"));
     init_config_schema();
     init_shields();
     init_managed();
     init_build();
+    init_jail();
     init_trusted_hosts();
     init_dist();
     init_dist();
@@ -22202,7 +22851,8 @@ var init_config = __esm({
         trustedHostsManaged: false,
         appPermissions: {},
         appLinks: {},
-        managedJailPaths: []
+        managedJailPaths: [],
+        jailPaths: []
       },
       environments: {}
     };
@@ -22295,18 +22945,18 @@ function readCapped(file2, maxBytes, openFlags = "r") {
   if (maxBytes < 0) return null;
   let fd;
   try {
-    fd = import_fs5.default.openSync(file2, openFlags);
+    fd = import_fs6.default.openSync(file2, openFlags);
   } catch {
     return null;
   }
   try {
-    const st = import_fs5.default.fstatSync(fd);
+    const st = import_fs6.default.fstatSync(fd);
     if (!st.isFile()) return null;
     const want = Math.min(st.size, maxBytes + 1);
     const buf = Buffer.alloc(want);
     let read3 = 0;
     while (read3 < want) {
-      const n = import_fs5.default.readSync(fd, buf, read3, want - read3, read3);
+      const n = import_fs6.default.readSync(fd, buf, read3, want - read3, read3);
       if (n <= 0) break;
       read3 += n;
     }
@@ -22318,7 +22968,7 @@ function readCapped(file2, maxBytes, openFlags = "r") {
     return null;
   } finally {
     try {
-      import_fs5.default.closeSync(fd);
+      import_fs6.default.closeSync(fd);
     } catch {
     }
   }
@@ -22327,12 +22977,12 @@ function readCappedText(file2, maxBytes, openFlags = "r") {
   const r = readCapped(file2, maxBytes, openFlags);
   return r ? { text: r.bytes.toString("utf8"), truncated: r.truncated } : null;
 }
-var import_fs5;
+var import_fs6;
 var init_read_capped = __esm({
   "src/utils/read-capped.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs5 = __toESM(require("fs"));
+    import_fs6 = __toESM(require("fs"));
   }
 });
 
@@ -22341,25 +22991,25 @@ function scanFilePath(filePath, cwd = process.cwd(), options = {}) {
   if (!filePath) return null;
   let resolved;
   try {
-    const absolute2 = import_path5.default.resolve(cwd, filePath);
-    resolved = import_fs6.default.realpathSync.native(absolute2);
+    const absolute2 = import_path6.default.resolve(cwd, filePath);
+    resolved = import_fs7.default.realpathSync.native(absolute2);
   } catch (err2) {
     const code2 = err2.code;
     if (code2 === "ENOENT" || code2 === "ENOTDIR") {
-      resolved = import_path5.default.resolve(cwd, filePath);
+      resolved = import_path6.default.resolve(cwd, filePath);
     } else {
       return sensitivePathMatch(filePath);
     }
   }
   return matchSensitivePath2(resolved, filePath, options);
 }
-var import_fs6, import_path5;
+var import_fs7, import_path6;
 var init_dlp = __esm({
   "src/dlp.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs6 = __toESM(require("fs"));
-    import_path5 = __toESM(require("path"));
+    import_fs7 = __toESM(require("fs"));
+    import_path6 = __toESM(require("path"));
     init_dist();
     init_dist();
   }
@@ -22586,24 +23236,24 @@ var init_gate_order = __esm({
 // src/policy/file-access.ts
 function absoluteSpelling(p, cwd, home) {
   if (p === "~" || p.startsWith("~/")) p = home + p.slice(1);
-  return import_path6.default.isAbsolute(p) ? p : `${cwd}/${p}`;
+  return import_path7.default.isAbsolute(p) ? p : `${cwd}/${p}`;
 }
 function physical(p, followFinal, links = 0) {
   if (links > 40) throw new Error("Too many symbolic links");
   if (!followFinal) {
-    const parent = physical(import_path6.default.dirname(p), true, links);
-    return { path: `${parent.path}/${import_path6.default.basename(p)}`, missing: parent.missing };
+    const parent = physical(import_path7.default.dirname(p), true, links);
+    return { path: `${parent.path}/${import_path7.default.basename(p)}`, missing: parent.missing };
   }
   try {
-    return { path: import_fs7.default.realpathSync.native(p), missing: false };
+    return { path: import_fs8.default.realpathSync.native(p), missing: false };
   } catch (error) {
     const code2 = error.code;
     if (!["ENOENT", "ENOTDIR"].includes(code2 ?? "")) throw error;
     try {
-      if (import_fs7.default.lstatSync(p).isSymbolicLink()) {
-        const target = import_fs7.default.readlinkSync(p);
+      if (import_fs8.default.lstatSync(p).isSymbolicLink()) {
+        const target = import_fs8.default.readlinkSync(p);
         return physical(
-          import_path6.default.isAbsolute(target) ? target : `${import_path6.default.dirname(p)}/${target}`,
+          import_path7.default.isAbsolute(target) ? target : `${import_path7.default.dirname(p)}/${target}`,
           true,
           links + 1
         );
@@ -22612,13 +23262,13 @@ function physical(p, followFinal, links = 0) {
       if (!["ENOENT", "ENOTDIR"].includes(linkError.code ?? ""))
         throw linkError;
     }
-    const parent = import_path6.default.dirname(p);
+    const parent = import_path7.default.dirname(p);
     if (parent === p) return { path: p, missing: true };
     const resolved = physical(parent, true, links);
-    return { path: `${resolved.path}/${import_path6.default.basename(p)}`, missing: true };
+    return { path: `${resolved.path}/${import_path7.default.basename(p)}`, missing: true };
   }
 }
-function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, home = import_os5.default.homedir()) {
+function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, home = import_os6.default.homedir()) {
   const context = { cwd, homeDirs: [home, "/root"] };
   const accesses = collectFileAccesses(tool, args, context, inspection);
   const handledPaths = /* @__PURE__ */ new Set();
@@ -22641,14 +23291,14 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
     const raw = absoluteSpelling(access.path, access.cwd ?? cwd, home);
     if (access.directoryTarget) {
       try {
-        if (!import_fs7.default.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
+        if (!import_fs8.default.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
           continue;
       } catch {
       }
     }
     if (access.operation === "create") {
       try {
-        import_fs7.default.statSync(raw);
+        import_fs8.default.statSync(raw);
         continue;
       } catch {
       }
@@ -22695,59 +23345,59 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
   }
   return { ...context, accesses: prepared, handledPaths };
 }
-var import_fs7, import_os5, import_path6;
+var import_fs8, import_os6, import_path7;
 var init_file_access = __esm({
   "src/policy/file-access.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs7 = __toESM(require("fs"));
-    import_os5 = __toESM(require("os"));
-    import_path6 = __toESM(require("path"));
+    import_fs8 = __toESM(require("fs"));
+    import_os6 = __toESM(require("os"));
+    import_path7 = __toESM(require("path"));
     init_dist();
   }
 });
 
 // src/utils/atomic-write.ts
 function atomicWriteSync(filePath, data, options) {
-  const dir2 = import_path7.default.dirname(filePath);
-  if (!import_fs8.default.existsSync(dir2)) import_fs8.default.mkdirSync(dir2, { recursive: true });
+  const dir2 = import_path8.default.dirname(filePath);
+  if (!import_fs9.default.existsSync(dir2)) import_fs9.default.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${filePath}.${(0, import_crypto8.randomUUID)()}.tmp`;
   try {
-    import_fs8.default.writeFileSync(tmpPath, data, options);
+    import_fs9.default.writeFileSync(tmpPath, data, options);
   } catch (err2) {
     try {
-      import_fs8.default.unlinkSync(tmpPath);
+      import_fs9.default.unlinkSync(tmpPath);
     } catch {
     }
     throw err2;
   }
   try {
-    import_fs8.default.renameSync(tmpPath, filePath);
+    import_fs9.default.renameSync(tmpPath, filePath);
   } catch (err2) {
     try {
-      import_fs8.default.unlinkSync(tmpPath);
+      import_fs9.default.unlinkSync(tmpPath);
     } catch {
     }
     throw err2;
   }
 }
-var import_fs8, import_path7, import_crypto8;
+var import_fs9, import_path8, import_crypto8;
 var init_atomic_write = __esm({
   "src/utils/atomic-write.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs8 = __toESM(require("fs"));
-    import_path7 = __toESM(require("path"));
+    import_fs9 = __toESM(require("fs"));
+    import_path8 = __toESM(require("path"));
     import_crypto8 = require("crypto");
   }
 });
 
 // src/supply-chain/osv-index.ts
 function osvRoot() {
-  return import_path8.default.join(import_os6.default.homedir(), ".node9", "osv");
+  return import_path9.default.join(import_os7.default.homedir(), ".node9", "osv");
 }
 function ecoDir(eco) {
-  return import_path8.default.join(osvRoot(), eco);
+  return import_path9.default.join(osvRoot(), eco);
 }
 function indexKey(eco, name) {
   switch (eco) {
@@ -22769,11 +23419,11 @@ function shardOf(key) {
   return (0, import_crypto9.createHash)("sha1").update(key).digest("hex").slice(0, 2);
 }
 function shardPath(eco, shard) {
-  return import_path8.default.join(ecoDir(eco), "shards", `${shard}.json`);
+  return import_path9.default.join(ecoDir(eco), "shards", `${shard}.json`);
 }
 function readMeta(eco) {
   try {
-    const m = JSON.parse(import_fs9.default.readFileSync(import_path8.default.join(ecoDir(eco), "meta.json"), "utf8"));
+    const m = JSON.parse(import_fs10.default.readFileSync(import_path9.default.join(ecoDir(eco), "meta.json"), "utf8"));
     if (typeof m?.syncedAt !== "string" || typeof m?.lastModifiedMs !== "number") return null;
     return m;
   } catch {
@@ -22781,11 +23431,11 @@ function readMeta(eco) {
   }
 }
 function writeMeta(eco, meta) {
-  atomicWriteSync(import_path8.default.join(ecoDir(eco), "meta.json"), JSON.stringify(meta));
+  atomicWriteSync(import_path9.default.join(ecoDir(eco), "meta.json"), JSON.stringify(meta));
 }
 function readShard(eco, shard) {
   try {
-    const s = JSON.parse(import_fs9.default.readFileSync(shardPath(eco, shard), "utf8"));
+    const s = JSON.parse(import_fs10.default.readFileSync(shardPath(eco, shard), "utf8"));
     return s && typeof s === "object" && !Array.isArray(s) ? s : {};
   } catch {
     return {};
@@ -22880,14 +23530,14 @@ function entryCovers(entry, version2) {
   if (entry.versions?.includes(version2)) return true;
   return (entry.ranges ?? []).some((r) => inRange(version2, r));
 }
-var import_fs9, import_os6, import_path8, import_crypto9, INDEX_FRESH_MS;
+var import_fs10, import_os7, import_path9, import_crypto9, INDEX_FRESH_MS;
 var init_osv_index = __esm({
   "src/supply-chain/osv-index.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs9 = __toESM(require("fs"));
-    import_os6 = __toESM(require("os"));
-    import_path8 = __toESM(require("path"));
+    import_fs10 = __toESM(require("fs"));
+    import_os7 = __toESM(require("os"));
+    import_path9 = __toESM(require("path"));
     import_crypto9 = require("crypto");
     init_dist();
     init_atomic_write();
@@ -23229,14 +23879,14 @@ var init_registry = __esm({
 
 // src/supply-chain/local-resolve.ts
 function resolveInstalled(name, cwd) {
-  if (!cwd || !import_path9.default.isAbsolute(cwd)) return null;
+  if (!cwd || !import_path10.default.isAbsolute(cwd)) return null;
   if (!/^(?:@[^/\\]+\/)?[^/\\]+$/.test(name)) return null;
-  let dir2 = import_path9.default.resolve(cwd);
+  let dir2 = import_path10.default.resolve(cwd);
   for (let i = 0; i < MAX_LEVELS; i++) {
-    const pkgDir = import_path9.default.join(dir2, "node_modules", ...name.split("/"));
-    const manifest = import_path9.default.join(pkgDir, "package.json");
+    const pkgDir = import_path10.default.join(dir2, "node_modules", ...name.split("/"));
+    const manifest = import_path10.default.join(pkgDir, "package.json");
     try {
-      const raw = import_fs10.default.readFileSync(manifest, "utf8");
+      const raw = import_fs11.default.readFileSync(manifest, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
         return { version: parsed.version, dir: pkgDir };
@@ -23244,19 +23894,19 @@ function resolveInstalled(name, cwd) {
       return null;
     } catch {
     }
-    const parent = import_path9.default.dirname(dir2);
+    const parent = import_path10.default.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
   return null;
 }
-var import_fs10, import_path9, MAX_LEVELS, LOCAL_FIRST_MANAGERS;
+var import_fs11, import_path10, MAX_LEVELS, LOCAL_FIRST_MANAGERS;
 var init_local_resolve = __esm({
   "src/supply-chain/local-resolve.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs10 = __toESM(require("fs"));
-    import_path9 = __toESM(require("path"));
+    import_fs11 = __toESM(require("fs"));
+    import_path10 = __toESM(require("path"));
     MAX_LEVELS = 32;
     LOCAL_FIRST_MANAGERS = /* @__PURE__ */ new Set(["npx", "bunx", "npm exec"]);
   }
@@ -23364,7 +24014,7 @@ function checkInstalled(p, version2, misses) {
 }
 async function checkOne(p, cfg, misses, networkCapped, cwd) {
   if (p.ecosystem === "npm" && LOCAL_FIRST_MANAGERS.has(p.manager) && p.localCwd !== null && (p.raw === p.name || p.version)) {
-    const localCwd = cwd && import_path10.default.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => import_path10.default.resolve(dir2, step), cwd) : void 0;
+    const localCwd = cwd && import_path11.default.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => import_path11.default.resolve(dir2, step), cwd) : void 0;
     const installed = resolveInstalled(p.name, localCwd);
     if (installed && (!p.version || p.version === installed.version))
       return checkInstalled(p, installed.version, misses);
@@ -23505,13 +24155,13 @@ async function runPackageCheck(toolName, args, cfg, cwd, opts = {}) {
     return { ...ALLOW, misses: [`package check error: ${err2?.message ?? err2}`] };
   }
 }
-var import_picomatch4, import_path10, MAX_NETWORK_PACKAGES, ALLOW, KIND, SOFT2;
+var import_picomatch4, import_path11, MAX_NETWORK_PACKAGES, ALLOW, KIND, SOFT2;
 var init_check = __esm({
   "src/supply-chain/check.ts"() {
     "use strict";
     init_cjs_shims();
     import_picomatch4 = __toESM(require("picomatch"));
-    import_path10 = __toESM(require("path"));
+    import_path11 = __toESM(require("path"));
     init_dist();
     init_osv_index();
     init_osv_online();
@@ -23537,29 +24187,29 @@ var init_check = __esm({
 
 // src/supply-chain/registries.ts
 function userFiles(home, env) {
-  const xdg = env.XDG_CONFIG_HOME || import_path11.default.join(home, ".config");
+  const xdg = env.XDG_CONFIG_HOME || import_path12.default.join(home, ".config");
   return [
-    env.NPM_CONFIG_USERCONFIG || env.npm_config_userconfig || import_path11.default.join(home, ".npmrc"),
-    import_path11.default.join(home, ".yarnrc"),
-    import_path11.default.join(home, ".yarnrc.yml"),
-    import_path11.default.join(home, ".bunfig.toml"),
+    env.NPM_CONFIG_USERCONFIG || env.npm_config_userconfig || import_path12.default.join(home, ".npmrc"),
+    import_path12.default.join(home, ".yarnrc"),
+    import_path12.default.join(home, ".yarnrc.yml"),
+    import_path12.default.join(home, ".bunfig.toml"),
     env.PIP_CONFIG_FILE || "",
-    import_path11.default.join(xdg, "pip", "pip.conf"),
-    import_path11.default.join(home, ".pip", "pip.conf"),
+    import_path12.default.join(xdg, "pip", "pip.conf"),
+    import_path12.default.join(home, ".pip", "pip.conf"),
     "/etc/pip.conf",
-    env.VIRTUAL_ENV ? import_path11.default.join(env.VIRTUAL_ENV, "pip.conf") : "",
+    env.VIRTUAL_ENV ? import_path12.default.join(env.VIRTUAL_ENV, "pip.conf") : "",
     env.UV_CONFIG_FILE || "",
-    import_path11.default.join(xdg, "uv", "uv.toml"),
+    import_path12.default.join(xdg, "uv", "uv.toml"),
     "/etc/uv/uv.toml"
   ].filter(Boolean);
 }
 function projectFiles(cwd) {
-  if (!cwd || !import_path11.default.isAbsolute(cwd)) return [];
+  if (!cwd || !import_path12.default.isAbsolute(cwd)) return [];
   const out = [];
   let dir2 = cwd;
   for (let i = 0; i < MAX_PARENT_DIRS; i++) {
-    for (const f of PROJECT_FILES) out.push(import_path11.default.join(dir2, f));
-    const parent = import_path11.default.dirname(dir2);
+    for (const f of PROJECT_FILES) out.push(import_path12.default.join(dir2, f));
+    const parent = import_path12.default.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -23598,7 +24248,7 @@ function hostsInText(text, out) {
     }
   }
 }
-function configuredRegistryHosts(cwd, env = process.env, home = import_os7.default.homedir()) {
+function configuredRegistryHosts(cwd, env = process.env, home = import_os8.default.homedir()) {
   const key = [
     cwd ?? "",
     home,
@@ -23620,21 +24270,21 @@ function configuredRegistryHosts(cwd, env = process.env, home = import_os7.defau
     const r = readCappedText(
       file2,
       MAX_CONFIG_BYTES,
-      import_fs11.default.constants.O_RDONLY | (import_fs11.default.constants.O_NONBLOCK ?? 0)
+      import_fs12.default.constants.O_RDONLY | (import_fs12.default.constants.O_NONBLOCK ?? 0)
     );
     if (r) hostsInText(r.text, hosts);
   }
   cache3.set(key, { at: Date.now(), hosts });
   return hosts;
 }
-var import_os7, import_path11, import_fs11, MAX_CONFIG_BYTES, MAX_PARENT_DIRS, TTL_MS, PROJECT_FILES, ENV_VARS, PATH_VARS, REGISTRY_KEY_RE, REGISTRY_SECTION_RE, URL_RE2, cache3;
+var import_os8, import_path12, import_fs12, MAX_CONFIG_BYTES, MAX_PARENT_DIRS, TTL_MS, PROJECT_FILES, ENV_VARS, PATH_VARS, REGISTRY_KEY_RE, REGISTRY_SECTION_RE, URL_RE2, cache3;
 var init_registries = __esm({
   "src/supply-chain/registries.ts"() {
     "use strict";
     init_cjs_shims();
-    import_os7 = __toESM(require("os"));
-    import_path11 = __toESM(require("path"));
-    import_fs11 = __toESM(require("fs"));
+    import_os8 = __toESM(require("os"));
+    import_path12 = __toESM(require("path"));
+    import_fs12 = __toESM(require("fs"));
     init_dist();
     init_read_capped();
     MAX_CONFIG_BYTES = 256 * 1024;
@@ -23682,13 +24332,13 @@ var init_registries = __esm({
 
 // src/utils/provenance.ts
 function findInPath(cmd) {
-  if (import_path12.default.posix.isAbsolute(cmd)) return cmd;
+  if (import_path13.default.posix.isAbsolute(cmd)) return cmd;
   const pathEnv = process.env.PATH ?? "";
-  for (const dir2 of pathEnv.split(import_path12.default.delimiter)) {
+  for (const dir2 of pathEnv.split(import_path13.default.delimiter)) {
     if (!dir2) continue;
-    const full = import_path12.default.join(dir2, cmd);
+    const full = import_path13.default.join(dir2, cmd);
     try {
-      import_fs12.default.accessSync(full, import_fs12.default.constants.X_OK);
+      import_fs13.default.accessSync(full, import_fs13.default.constants.X_OK);
       return full;
     } catch {
     }
@@ -23699,7 +24349,7 @@ function _classifyPath(resolved, cwd) {
   if (cwd && resolved.startsWith(cwd + "/")) {
     return { trustLevel: "user", reason: "binary in project directory" };
   }
-  const osTmp = import_os8.default.tmpdir();
+  const osTmp = import_os9.default.tmpdir();
   const allSuspect = osTmp ? [...SUSPECT_PREFIXES, osTmp] : SUSPECT_PREFIXES;
   if (allSuspect.some((p) => resolved === p || resolved.startsWith(p + "/"))) {
     return { trustLevel: "suspect", reason: `binary in temp directory: ${resolved}` };
@@ -23717,7 +24367,7 @@ function _classifyPath(resolved, cwd) {
 }
 function checkProvenance(cmd, cwd) {
   const bare = cmd.startsWith("./") ? cmd.slice(2) : cmd;
-  if (import_path12.default.posix.isAbsolute(bare)) {
+  if (import_path13.default.posix.isAbsolute(bare)) {
     const early = _classifyPath(bare, cwd);
     if (early.trustLevel === "suspect") {
       return { resolvedPath: bare, ...early };
@@ -23733,7 +24383,7 @@ function checkProvenance(cmd, cwd) {
         reason: "binary not found in PATH"
       };
     }
-    resolved = import_fs12.default.realpathSync(found);
+    resolved = import_fs13.default.realpathSync(found);
   } catch {
     return {
       resolvedPath: cmd,
@@ -23742,7 +24392,7 @@ function checkProvenance(cmd, cwd) {
     };
   }
   try {
-    const stat = import_fs12.default.statSync(resolved);
+    const stat = import_fs13.default.statSync(resolved);
     if (stat.mode & 2) {
       return {
         resolvedPath: resolved,
@@ -23760,22 +24410,22 @@ function checkProvenance(cmd, cwd) {
   const classify2 = _classifyPath(resolved, cwd);
   return { resolvedPath: resolved, ...classify2 };
 }
-var import_fs12, import_path12, import_os8, SYSTEM_PREFIXES, MANAGED_PREFIXES, USER_PREFIXES, SUSPECT_PREFIXES;
+var import_fs13, import_path13, import_os9, SYSTEM_PREFIXES, MANAGED_PREFIXES, USER_PREFIXES, SUSPECT_PREFIXES;
 var init_provenance2 = __esm({
   "src/utils/provenance.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs12 = __toESM(require("fs"));
-    import_path12 = __toESM(require("path"));
-    import_os8 = __toESM(require("os"));
+    import_fs13 = __toESM(require("fs"));
+    import_path13 = __toESM(require("path"));
+    import_os9 = __toESM(require("os"));
     SYSTEM_PREFIXES = ["/usr/bin", "/usr/sbin", "/bin", "/sbin"];
     MANAGED_PREFIXES = ["/usr/local/bin", "/opt/homebrew", "/home/linuxbrew", "/nix/store"];
     USER_PREFIXES = [
-      import_path12.default.join(import_os8.default.homedir(), "bin"),
-      import_path12.default.join(import_os8.default.homedir(), ".local", "bin"),
-      import_path12.default.join(import_os8.default.homedir(), ".cargo", "bin"),
-      import_path12.default.join(import_os8.default.homedir(), ".npm-global", "bin"),
-      import_path12.default.join(import_os8.default.homedir(), ".volta", "bin")
+      import_path13.default.join(import_os9.default.homedir(), "bin"),
+      import_path13.default.join(import_os9.default.homedir(), ".local", "bin"),
+      import_path13.default.join(import_os9.default.homedir(), ".cargo", "bin"),
+      import_path13.default.join(import_os9.default.homedir(), ".npm-global", "bin"),
+      import_path13.default.join(import_os9.default.homedir(), ".volta", "bin")
     ];
     SUSPECT_PREFIXES = ["/tmp", "/var/tmp", "/dev/shm"];
   }
@@ -23813,9 +24463,9 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
   );
 }
 function isGitWorkTreeTop(dir2, cwd) {
-  if (!import_path13.default.isAbsolute(cwd)) return true;
+  if (!import_path14.default.isAbsolute(cwd)) return true;
   try {
-    return import_fs13.default.existsSync(import_path13.default.join(import_path13.default.resolve(cwd, dir2), ".git"));
+    return import_fs14.default.existsSync(import_path14.default.join(import_path14.default.resolve(cwd, dir2), ".git"));
   } catch {
     return true;
   }
@@ -23824,7 +24474,7 @@ function readAgentSettings(absPath) {
   const r = readCappedText(
     absPath,
     MAX_AGENT_SETTINGS_BYTES,
-    import_fs13.default.constants.O_RDONLY | (import_fs13.default.constants.O_NONBLOCK ?? 0)
+    import_fs14.default.constants.O_RDONLY | (import_fs14.default.constants.O_NONBLOCK ?? 0)
   );
   return r && !r.truncated ? r.text : null;
 }
@@ -24017,9 +24667,9 @@ async function explainEngineVerdict(toolName, args, agent, config, prepared) {
   };
 }
 function explainWaterfall(config) {
-  const globalPath = import_path13.default.join(import_os9.default.homedir(), ".node9", "config.json");
-  const projectPath = import_path13.default.join(process.cwd(), "node9.config.json");
-  const credsPath = import_path13.default.join(import_os9.default.homedir(), ".node9", "credentials.json");
+  const globalPath = import_path14.default.join(import_os10.default.homedir(), ".node9", "config.json");
+  const projectPath = import_path14.default.join(process.cwd(), "node9.config.json");
+  const credsPath = import_path14.default.join(import_os10.default.homedir(), ".node9", "credentials.json");
   const wsGoverned = config.policySource === "workspace";
   const waterfall = [
     {
@@ -24031,22 +24681,22 @@ function explainWaterfall(config) {
     {
       tier: 2,
       label: wsGoverned ? "Workspace config" : "Cloud policy",
-      status: import_fs13.default.existsSync(credsPath) ? "active" : "missing",
-      note: import_fs13.default.existsSync(credsPath) ? wsGoverned ? "authoritative \u2014 this machine follows the workspace configuration (app.node9.ai)" : "credentials found (not evaluated in explain mode)" : "not connected \u2014 run: node9 login"
+      status: import_fs14.default.existsSync(credsPath) ? "active" : "missing",
+      note: import_fs14.default.existsSync(credsPath) ? wsGoverned ? "authoritative \u2014 this machine follows the workspace configuration (app.node9.ai)" : "credentials found (not evaluated in explain mode)" : "not connected \u2014 run: node9 login"
     },
     {
       tier: 3,
       label: "Project config",
-      status: import_fs13.default.existsSync(projectPath) ? "active" : "missing",
+      status: import_fs14.default.existsSync(projectPath) ? "active" : "missing",
       path: projectPath,
-      ...wsGoverned && import_fs13.default.existsSync(projectPath) ? { note: "present \u2014 ignored (workspace config governs policy)" } : {}
+      ...wsGoverned && import_fs14.default.existsSync(projectPath) ? { note: "present \u2014 ignored (workspace config governs policy)" } : {}
     },
     {
       tier: 4,
       label: "Global config",
-      status: import_fs13.default.existsSync(globalPath) ? "active" : "missing",
+      status: import_fs14.default.existsSync(globalPath) ? "active" : "missing",
       path: globalPath,
-      ...wsGoverned && import_fs13.default.existsSync(globalPath) ? { note: "present \u2014 ignored (workspace config governs policy)" } : {}
+      ...wsGoverned && import_fs14.default.existsSync(globalPath) ? { note: "present \u2014 ignored (workspace config governs policy)" } : {}
     },
     {
       tier: 5,
@@ -24133,7 +24783,7 @@ async function deriveExplainTrace(toolName, args) {
     });
     const everyInline = reviewsEveryInline(config.settings.mode);
     const strictInline = everyInline && detectInlineExec(shellCommand);
-    const inline = everyInline ? null : inlineExecReview(shellCommand);
+    const inline = everyInline ? null : inlineExecReview(shellCommand, config.policy.jailPaths);
     const inlineValue = checkValue(
       catalogSettingsFromConfig(config.settings, config.policy),
       "commands.inline-exec"
@@ -24306,16 +24956,16 @@ async function deriveExplainTrace(toolName, args) {
   });
   return { tool: toolName, args, waterfall, steps, decision: "allow" };
 }
-var import_fs13, import_path13, import_os9, MAX_AGENT_SETTINGS_BYTES, SQL_DML_KEYWORDS2, EXPLAIN_AGENT, PACKAGE_STEP, ENGINE_STEP, GATE_STEP, GATE_PLAIN;
+var import_fs14, import_path14, import_os10, MAX_AGENT_SETTINGS_BYTES, SQL_DML_KEYWORDS2, EXPLAIN_AGENT, PACKAGE_STEP, ENGINE_STEP, GATE_STEP, GATE_PLAIN;
 var init_policy = __esm({
   "src/policy/index.ts"() {
     "use strict";
     init_cjs_shims();
     init_dist();
-    import_fs13 = __toESM(require("fs"));
+    import_fs14 = __toESM(require("fs"));
     init_read_capped();
-    import_path13 = __toESM(require("path"));
-    import_os9 = __toESM(require("os"));
+    import_path14 = __toESM(require("path"));
+    import_os10 = __toESM(require("os"));
     init_dlp();
     init_gate_order();
     init_file_access();
@@ -24360,11 +25010,11 @@ function extractCommandPattern(toolName, args) {
 function checkPause() {
   if (forecastRun()) return { paused: false };
   try {
-    if (!import_fs14.default.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(import_fs14.default.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!import_fs15.default.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(import_fs15.default.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        import_fs14.default.unlinkSync(PAUSED_FILE);
+        import_fs15.default.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -24380,15 +25030,15 @@ function pauseNode9(durationMs, durationStr) {
 }
 function resumeNode9() {
   try {
-    if (import_fs14.default.existsSync(PAUSED_FILE)) import_fs14.default.unlinkSync(PAUSED_FILE);
+    if (import_fs15.default.existsSync(PAUSED_FILE)) import_fs15.default.unlinkSync(PAUSED_FILE);
   } catch {
   }
 }
 function getActiveTrustSession(toolName, args) {
   if (forecastRun()) return false;
   try {
-    if (!import_fs14.default.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(import_fs14.default.readFileSync(TRUST_FILE, "utf-8"));
+    if (!import_fs15.default.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(import_fs15.default.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
@@ -24411,8 +25061,8 @@ function writeTrustSession(toolName, durationMs, args) {
   try {
     let trust = { entries: [] };
     try {
-      if (import_fs14.default.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(import_fs14.default.readFileSync(TRUST_FILE, "utf-8"));
+      if (import_fs15.default.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(import_fs15.default.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -24434,28 +25084,28 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = import_path14.default.join(import_os10.default.homedir(), ".node9", "decisions.json");
-    if (!import_fs14.default.existsSync(file2)) return null;
-    const decisions = JSON.parse(import_fs14.default.readFileSync(file2, "utf-8"));
+    const file2 = import_path15.default.join(import_os11.default.homedir(), ".node9", "decisions.json");
+    if (!import_fs15.default.existsSync(file2)) return null;
+    const decisions = JSON.parse(import_fs15.default.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
   }
   return null;
 }
-var import_fs14, import_path14, import_os10, PAUSED_FILE, TRUST_FILE;
+var import_fs15, import_path15, import_os11, PAUSED_FILE, TRUST_FILE;
 var init_state = __esm({
   "src/auth/state.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs14 = __toESM(require("fs"));
-    import_path14 = __toESM(require("path"));
-    import_os10 = __toESM(require("os"));
+    import_fs15 = __toESM(require("fs"));
+    import_path15 = __toESM(require("path"));
+    import_os11 = __toESM(require("os"));
     init_policy();
     init_atomic_write();
     init_forecast_context();
-    PAUSED_FILE = import_path14.default.join(import_os10.default.homedir(), ".node9", "PAUSED");
-    TRUST_FILE = import_path14.default.join(import_os10.default.homedir(), ".node9", "trust.json");
+    PAUSED_FILE = import_path15.default.join(import_os11.default.homedir(), ".node9", "PAUSED");
+    TRUST_FILE = import_path15.default.join(import_os11.default.homedir(), ".node9", "trust.json");
   }
 });
 
@@ -24469,8 +25119,8 @@ function ownRealDir(st) {
 }
 function ensureOwnDir(dir2) {
   try {
-    import_fs15.default.mkdirSync(dir2, { recursive: true, mode: 448 });
-    const st = import_fs15.default.lstatSync(dir2);
+    import_fs16.default.mkdirSync(dir2, { recursive: true, mode: 448 });
+    const st = import_fs16.default.lstatSync(dir2);
     return ownRealDir(st) ? { dev: st.dev, ino: st.ino } : null;
   } catch {
     return null;
@@ -24478,7 +25128,7 @@ function ensureOwnDir(dir2) {
 }
 function isSameOwnDir(dir2, seen) {
   try {
-    const st = import_fs15.default.lstatSync(dir2);
+    const st = import_fs16.default.lstatSync(dir2);
     return ownRealDir(st) && st.dev === seen.dev && st.ino === seen.ino;
   } catch {
     return false;
@@ -24486,22 +25136,22 @@ function isSameOwnDir(dir2, seen) {
 }
 function removeOldFlag(dir2, seen, name, cutoffMs) {
   if (!isSessionFlagName(name)) return;
-  const p = import_path15.default.join(dir2, name);
+  const p = import_path16.default.join(dir2, name);
   try {
-    const st = import_fs15.default.lstatSync(p);
+    const st = import_fs16.default.lstatSync(p);
     if (!st.isFile() || st.mtimeMs >= cutoffMs) return;
     if (!isSameOwnDir(dir2, seen)) return;
-    import_fs15.default.unlinkSync(p);
+    import_fs16.default.unlinkSync(p);
   } catch {
   }
 }
-var import_fs15, import_path15, SESSION_FLAG_SUFFIX, SESSION_FLAG_NAME;
+var import_fs16, import_path16, SESSION_FLAG_SUFFIX, SESSION_FLAG_NAME;
 var init_own_dir = __esm({
   "src/utils/own-dir.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs15 = __toESM(require("fs"));
-    import_path15 = __toESM(require("path"));
+    import_fs16 = __toESM(require("fs"));
+    import_path16 = __toESM(require("path"));
     SESSION_FLAG_SUFFIX = ".node9-flag";
     SESSION_FLAG_NAME = /^[A-Za-z0-9_-]{1,128}\.node9-flag$/;
   }
@@ -24513,7 +25163,7 @@ function maxSocketPathBytes(platform) {
 }
 function isPrivateDir(dir2, uid = currentUid()) {
   try {
-    const st = import_fs16.default.lstatSync(dir2);
+    const st = import_fs17.default.lstatSync(dir2);
     if (st.isSymbolicLink() || !st.isDirectory()) return false;
     if (uid !== void 0 && st.uid !== uid) return false;
     return (st.mode & 18) === 0;
@@ -24524,30 +25174,32 @@ function isPrivateDir(dir2, uid = currentUid()) {
 function privateDir(dir2) {
   if (!ensureOwnDir(dir2)) return false;
   try {
-    const st = import_fs16.default.lstatSync(dir2);
-    if ((st.mode & 63) !== 0) import_fs16.default.chmodSync(dir2, 448);
+    const st = import_fs17.default.lstatSync(dir2);
+    if ((st.mode & 63) !== 0) import_fs17.default.chmodSync(dir2, 448);
   } catch {
     return false;
   }
   return isPrivateDir(dir2);
 }
+function perHomeRuntimeDir(env, home) {
+  const xdg = env.XDG_RUNTIME_DIR;
+  if (!xdg || !import_path17.default.isAbsolute(xdg)) return null;
+  return import_path17.default.join(xdg, `node9-${(0, import_crypto10.createHash)("sha256").update(home).digest("hex").slice(0, 12)}`);
+}
 function chooseActivitySocketPath(env, home, platform = process.platform) {
   const candidates2 = [];
-  const xdg = env.XDG_RUNTIME_DIR;
-  if (xdg && import_path16.default.isAbsolute(xdg) && isPrivateDir(xdg))
-    candidates2.push(
-      import_path16.default.join(xdg, `node9-${(0, import_crypto10.createHash)("sha256").update(home).digest("hex").slice(0, 12)}`)
-    );
-  candidates2.push(import_path16.default.join(home, ".node9", "run"));
+  const xdgDir = perHomeRuntimeDir(env, home);
+  if (xdgDir && isPrivateDir(import_path17.default.dirname(xdgDir))) candidates2.push(xdgDir);
+  candidates2.push(import_path17.default.join(home, ".node9", "run"));
   for (const dir2 of candidates2) {
-    const socketPath = import_path16.default.join(dir2, SOCKET_NAME);
+    const socketPath = import_path17.default.join(dir2, SOCKET_NAME);
     if (Buffer.byteLength(socketPath) >= maxSocketPathBytes(platform)) continue;
     if (privateDir(dir2)) return socketPath;
   }
   return null;
 }
 function ensureActivitySocketDir(socketPath) {
-  return privateDir(import_path16.default.dirname(socketPath));
+  return privateDir(import_path17.default.dirname(socketPath));
 }
 function windowsActivityPipeName() {
   return `\\\\.\\pipe\\node9-activity-${(0, import_crypto10.randomBytes)(16).toString("hex")}`;
@@ -24555,30 +25207,43 @@ function windowsActivityPipeName() {
 function isTrustedActivitySocket(socketPath, uid = currentUid()) {
   if (process.platform === "win32") return WINDOWS_PIPE.test(socketPath);
   try {
-    const st = import_fs16.default.lstatSync(socketPath);
+    const st = import_fs17.default.lstatSync(socketPath);
     if (!st.isSocket()) return false;
     if (uid !== void 0 && st.uid !== uid) return false;
   } catch {
     return false;
   }
-  return isPrivateDir(import_path16.default.dirname(socketPath), uid);
+  return isPrivateDir(import_path17.default.dirname(socketPath), uid);
 }
 function isOwnStaleSocket(socketPath) {
   try {
-    const st = import_fs16.default.lstatSync(socketPath);
+    const st = import_fs17.default.lstatSync(socketPath);
     const uid = currentUid();
     return st.isSocket() && (uid === void 0 || st.uid === uid);
   } catch {
     return false;
   }
 }
-var import_fs16, import_path16, import_crypto10, SOCKET_NAME, currentUid, WINDOWS_PIPE;
+function removeOwnSocketDir(socketPath, env, home, platform = process.platform) {
+  if (platform === "win32") return false;
+  const dir2 = import_path17.default.dirname(socketPath);
+  if (dir2 !== perHomeRuntimeDir(env, home)) return false;
+  if (!isPrivateDir(dir2)) return false;
+  try {
+    if (import_fs17.default.readdirSync(dir2).length > 0) return false;
+    import_fs17.default.rmdirSync(dir2);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var import_fs17, import_path17, import_crypto10, SOCKET_NAME, currentUid, WINDOWS_PIPE;
 var init_activity_socket = __esm({
   "src/utils/activity-socket.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs16 = __toESM(require("fs"));
-    import_path16 = __toESM(require("path"));
+    import_fs17 = __toESM(require("fs"));
+    import_path17 = __toESM(require("path"));
     import_crypto10 = require("crypto");
     init_own_dir();
     SOCKET_NAME = "activity.sock";
@@ -24784,9 +25449,9 @@ var init_decision_record = __esm({
 });
 
 // src/auth/daemon.ts
-function daemonActivitySocket(home = import_os11.default.homedir()) {
+function daemonActivitySocket(home = import_os12.default.homedir()) {
   try {
-    const raw = import_fs17.default.readFileSync(import_path17.default.join(home, ".node9", "daemon.pid"), "utf-8");
+    const raw = import_fs18.default.readFileSync(import_path18.default.join(home, ".node9", "daemon.pid"), "utf-8");
     const p = JSON.parse(raw).activitySocket;
     return typeof p === "string" && isTrustedActivitySocket(p) ? p : null;
   } catch {
@@ -24846,9 +25511,9 @@ function resolveDaemonPort(env = process.env) {
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = import_path17.default.join(import_os11.default.homedir(), ".node9", "daemon.pid");
-    if (!import_fs17.default.existsSync(pidFile)) return null;
-    const data = JSON.parse(import_fs17.default.readFileSync(pidFile, "utf-8"));
+    const pidFile = import_path18.default.join(import_os12.default.homedir(), ".node9", "daemon.pid");
+    if (!import_fs18.default.existsSync(pidFile)) return null;
+    const data = JSON.parse(import_fs18.default.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -24857,12 +25522,12 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = import_path17.default.join(import_os11.default.homedir(), ".node9", "daemon.pid");
-  if (import_fs17.default.existsSync(pidFile)) {
+  const pidFile = import_path18.default.join(import_os12.default.homedir(), ".node9", "daemon.pid");
+  if (import_fs18.default.existsSync(pidFile)) {
     let pid;
     let port;
     try {
-      const data = JSON.parse(import_fs17.default.readFileSync(pidFile, "utf-8"));
+      const data = JSON.parse(import_fs18.default.readFileSync(pidFile, "utf-8"));
       pid = data.pid;
       port = data.port;
     } catch {
@@ -24880,7 +25545,7 @@ function isDaemonRunning() {
     } catch (err2) {
       if (err2 instanceof Error && "code" in err2 && err2.code === "ESRCH") {
         try {
-          import_fs17.default.unlinkSync(pidFile);
+          import_fs18.default.unlinkSync(pidFile);
         } catch {
         }
       }
@@ -25352,16 +26017,16 @@ async function resolveViaDaemon(id, decision, internalToken, source, record2) {
   const winner = parseDecisionRecord(body?.record);
   return winner && typeof body?.won === "boolean" ? { won: body.won, record: winner } : null;
 }
-var import_fs17, import_http, import_net4, import_path17, import_os11, ACTIVITY_SOCKET_TIMEOUT_MS, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
+var import_fs18, import_http, import_net4, import_path18, import_os12, ACTIVITY_SOCKET_TIMEOUT_MS, DEFAULT_DAEMON_PORT, DAEMON_PORT, DAEMON_HOST;
 var init_daemon = __esm({
   "src/auth/daemon.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs17 = __toESM(require("fs"));
+    import_fs18 = __toESM(require("fs"));
     import_http = __toESM(require("http"));
     import_net4 = __toESM(require("net"));
-    import_path17 = __toESM(require("path"));
-    import_os11 = __toESM(require("os"));
+    import_path18 = __toESM(require("path"));
+    import_os12 = __toESM(require("os"));
     init_forecast_context();
     init_activity_socket();
     init_decision_record();
@@ -25624,13 +26289,13 @@ function deriveServerName(cmd) {
   return strip(base3) || "MCP Server";
 }
 function getMcpToolsFile() {
-  return import_path18.default.join(import_os12.default.homedir(), ".node9", "mcp-tools.json");
+  return import_path19.default.join(import_os13.default.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
     const file2 = getMcpToolsFile();
-    if (!import_fs18.default.existsSync(file2)) return {};
-    const raw = import_fs18.default.readFileSync(file2, "utf-8");
+    if (!import_fs19.default.existsSync(file2)) return {};
+    const raw = import_fs19.default.readFileSync(file2, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -25639,11 +26304,11 @@ function readMcpToolsConfig() {
 function writeMcpToolsConfig(config) {
   try {
     const file2 = getMcpToolsFile();
-    const dir2 = import_path18.default.dirname(file2);
-    if (!import_fs18.default.existsSync(dir2)) import_fs18.default.mkdirSync(dir2, { recursive: true });
-    const tmpPath = `${file2}.${import_os12.default.hostname()}.${process.pid}.tmp`;
-    import_fs18.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2));
-    import_fs18.default.renameSync(tmpPath, file2);
+    const dir2 = import_path19.default.dirname(file2);
+    if (!import_fs19.default.existsSync(dir2)) import_fs19.default.mkdirSync(dir2, { recursive: true });
+    const tmpPath = `${file2}.${import_os13.default.hostname()}.${process.pid}.tmp`;
+    import_fs19.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2));
+    import_fs19.default.renameSync(tmpPath, file2);
   } catch (e) {
     console.error("Failed to write mcp-tools.json", e);
   }
@@ -25698,21 +26363,21 @@ function approveServer(serverKey, disabledTools) {
     writeMcpToolsConfig(config);
   }
 }
-var import_fs18, import_path18, import_os12;
+var import_fs19, import_path19, import_os13;
 var init_mcp_tools = __esm({
   "src/daemon/mcp-tools.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs18 = __toESM(require("fs"));
-    import_path18 = __toESM(require("path"));
-    import_os12 = __toESM(require("os"));
+    import_fs19 = __toESM(require("fs"));
+    import_path19 = __toESM(require("path"));
+    import_os13 = __toESM(require("os"));
     init_mcp_cmd();
   }
 });
 
 // src/apps/state.ts
-function appsFilePath(home = import_os13.default.homedir()) {
-  return import_path19.default.join(home, ".node9", "apps.json");
+function appsFilePath(home = import_os14.default.homedir()) {
+  return import_path20.default.join(home, ".node9", "apps.json");
 }
 function emptyFile() {
   return { version: 1, apps: /* @__PURE__ */ Object.create(null), links: /* @__PURE__ */ Object.create(null) };
@@ -25759,7 +26424,7 @@ function readAppsFile(home) {
 function readAppsFileStrict(home) {
   let text;
   try {
-    text = import_fs19.default.readFileSync(appsFilePath(home), "utf8");
+    text = import_fs20.default.readFileSync(appsFilePath(home), "utf8");
   } catch (e) {
     return e.code === "ENOENT" ? emptyFile() : null;
   }
@@ -25771,10 +26436,10 @@ function readAppsFileStrict(home) {
 }
 function writeAppsFile(data, home) {
   const file2 = appsFilePath(home);
-  import_fs19.default.mkdirSync(import_path19.default.dirname(file2), { recursive: true });
+  import_fs20.default.mkdirSync(import_path20.default.dirname(file2), { recursive: true });
   const tmp = `${file2}.${import_crypto11.default.randomBytes(6).toString("hex")}.tmp`;
-  import_fs19.default.writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
-  import_fs19.default.renameSync(tmp, file2);
+  import_fs20.default.writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+  import_fs20.default.renameSync(tmp, file2);
 }
 function applyDetection(found, opts = { managed: false }) {
   const result = { turnedOn: [], recordedOnly: [] };
@@ -25840,7 +26505,7 @@ function setLink(server, slug2, home) {
 function localLinks() {
   const file2 = appsFilePath();
   try {
-    const mtimeMs = import_fs19.default.statSync(file2).mtimeMs;
+    const mtimeMs = import_fs20.default.statSync(file2).mtimeMs;
     if (!linkCache || linkCache.file !== file2 || linkCache.mtimeMs !== mtimeMs) {
       linkCache = { mtimeMs, file: file2, links: readAppsFile().links };
     }
@@ -25878,14 +26543,14 @@ function resolveLinkedServer(label3, opts = {}) {
   }
   return label3;
 }
-var import_fs19, import_os13, import_path19, import_crypto11, SIGNAL_KINDS, linkCache, NO_LINKS;
+var import_fs20, import_os14, import_path20, import_crypto11, SIGNAL_KINDS, linkCache, NO_LINKS;
 var init_state2 = __esm({
   "src/apps/state.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs19 = __toESM(require("fs"));
-    import_os13 = __toESM(require("os"));
-    import_path19 = __toESM(require("path"));
+    import_fs20 = __toESM(require("fs"));
+    import_os14 = __toESM(require("os"));
+    import_path20 = __toESM(require("path"));
     import_crypto11 = __toESM(require("crypto"));
     init_catalog();
     init_shields();
@@ -25949,7 +26614,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = import_path20.default.basename(editFilePath);
+        editFileName = import_path21.default.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -25981,12 +26646,12 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
     ...ruleName && { ruleName }
   };
 }
-var import_path20, CODE_KEYS;
+var import_path21, CODE_KEYS;
 var init_context_sniper = __esm({
   "src/context-sniper.ts"() {
     "use strict";
     init_cjs_shims();
-    import_path20 = __toESM(require("path"));
+    import_path21 = __toESM(require("path"));
     CODE_KEYS = [
       "command",
       "cmd",
@@ -26043,7 +26708,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file2 = obj.file_path ? import_path21.default.basename(String(obj.file_path)) : "file";
+      const file2 = obj.file_path ? import_path22.default.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -26260,13 +26925,13 @@ end run`;
     }
   });
 }
-var import_child_process, import_path21, isTestEnv, MIN_INTERACTION_MS;
+var import_child_process, import_path22, isTestEnv, MIN_INTERACTION_MS;
 var init_native = __esm({
   "src/ui/native.ts"() {
     "use strict";
     init_cjs_shims();
     import_child_process = require("child_process");
-    import_path21 = __toESM(require("path"));
+    import_path22 = __toESM(require("path"));
     init_context_sniper();
     init_safe_text();
     isTestEnv = () => {
@@ -26276,108 +26941,6 @@ var init_native = __esm({
   }
 });
 
-// src/shields/jail.ts
-function jailStorePath() {
-  return import_path22.default.join(import_os14.default.homedir(), ".node9", "jail-paths.json");
-}
-function readJailPaths() {
-  let text;
-  try {
-    text = import_fs20.default.readFileSync(jailStorePath(), "utf8");
-  } catch (err2) {
-    if (err2.code === "ENOENT") return [];
-    throw err2;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    throw new Error(`${jailStorePath()} is not valid JSON \u2014 fix it before changing the jail.`);
-  }
-  if (!Array.isArray(parsed.paths)) return [];
-  return parsed.paths.filter(
-    (p) => !!p && typeof p.path === "string" && (p.verdict === "block" || p.verdict === "review")
-  );
-}
-function writeJailPaths(paths) {
-  const p = jailStorePath();
-  import_fs20.default.mkdirSync(import_path22.default.dirname(p), { recursive: true });
-  import_fs20.default.writeFileSync(p, JSON.stringify({ paths }, null, 2) + "\n", { mode: 384 });
-}
-function addJailPath(rawPath, verdict) {
-  const norm = rawPath.trim();
-  const fragment = pathToRegexFragment(norm);
-  if (!fragment) {
-    throw new Error(
-      `"${rawPath}" is too broad to jail \u2014 give a specific path (e.g. ~/.gmail-mcp), not a home or root directory.`
-    );
-  }
-  const rejection = validateRegex(fragment);
-  if (rejection !== null) {
-    throw new Error(
-      `"${rawPath}" cannot be jailed: the generated match pattern was rejected by the policy engine (${rejection}). Try a shorter or more specific path.`
-    );
-  }
-  const next = [...readJailPaths().filter((p) => p.path !== norm), { path: norm, verdict }];
-  writeJailPaths(next);
-  return next;
-}
-function findJailedPath(candidate) {
-  return findJailedPathIn(candidate, readJailPaths());
-}
-function findJailedPathIn(candidate, paths) {
-  if (!candidate) return null;
-  for (const entry of paths) {
-    if (pathMatchesFragment(candidate, entry.path)) return entry;
-  }
-  return null;
-}
-function removeJailPath(rawPath) {
-  const norm = rawPath.trim();
-  const before = readJailPaths();
-  const after = before.filter((p) => p.path !== norm);
-  const removed = after.length !== before.length;
-  if (removed) writeJailPaths(after);
-  return { removed, paths: after };
-}
-function regenerateUserJail(paths) {
-  const file2 = import_path22.default.join(USER_SHIELDS_DIR_PATH, `${USER_JAIL_SHIELD}.json`);
-  if (paths.length === 0) {
-    const active2 = readActiveShields();
-    if (active2.includes(USER_JAIL_SHIELD)) {
-      writeActiveShields(active2.filter((s) => s !== USER_JAIL_SHIELD));
-    }
-    try {
-      import_fs20.default.rmSync(file2, { force: true });
-    } catch {
-    }
-    return;
-  }
-  const def = buildShield({
-    name: USER_JAIL_SHIELD,
-    description: "User-added credential jail paths (node9 jail add)",
-    blockPaths: paths.filter((p) => p.verdict === "block").map((p) => p.path),
-    reviewPaths: paths.filter((p) => p.verdict === "review").map((p) => p.path)
-  });
-  installShield(USER_JAIL_SHIELD, def);
-  const active = readActiveShields();
-  if (!active.includes(USER_JAIL_SHIELD)) writeActiveShields([...active, USER_JAIL_SHIELD]);
-}
-var import_fs20, import_os14, import_path22, USER_JAIL_SHIELD;
-var init_jail = __esm({
-  "src/shields/jail.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_fs20 = __toESM(require("fs"));
-    import_os14 = __toESM(require("os"));
-    import_path22 = __toESM(require("path"));
-    init_build();
-    init_dist();
-    init_shields();
-    USER_JAIL_SHIELD = "user-jail";
-  }
-});
-
 // src/canary/registry.ts
 function canaryStorePath() {
   return import_path23.default.join(import_os15.default.homedir(), ".node9", "canaries.json");
@@ -44460,6 +45023,9 @@ function getDaemonServer() {
 function markRejectionHandlerRegistered() {
   daemonRejectionHandlerRegistered = true;
 }
+function markSignalHandlersRegistered() {
+  daemonSignalHandlersRegistered = true;
+}
 function getActivitySocketPath() {
   return ACTIVITY_SOCKET_PATH;
 }
@@ -44679,18 +45245,80 @@ function startActivitySocket() {
     return;
   }
   bindActivitySocket();
-  activityHealthInterval = setInterval(() => {
-    if (ACTIVITY_SOCKET_PATH && !import_fs65.default.existsSync(ACTIVITY_SOCKET_PATH)) attemptRebind("health-probe");
-  }, ACTIVITY_HEALTH_PROBE_MS);
+  startHealthProbe();
+  process.on("exit", stopActivitySocket);
+}
+function startHealthProbe() {
+  if (activityHealthInterval) clearInterval(activityHealthInterval);
+  activityHealthInterval = setInterval(probeActivitySocket, ACTIVITY_HEALTH_PROBE_MS);
   activityHealthInterval.unref();
-  process.on("exit", () => {
-    if (activityHealthInterval) clearInterval(activityHealthInterval);
-    try {
-      if (ACTIVITY_SOCKET_PATH && isOwnStaleSocket(ACTIVITY_SOCKET_PATH))
-        import_fs65.default.unlinkSync(ACTIVITY_SOCKET_PATH);
-    } catch {
-    }
-  });
+}
+function stopHealthProbe() {
+  if (activityHealthInterval) clearInterval(activityHealthInterval);
+  activityHealthInterval = null;
+}
+function isLiveOtherDaemonPid(pid) {
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0 || pid > 4194304)
+    return false;
+  if (pid === process.pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function anotherDaemonOwnsPidFile() {
+  try {
+    const raw = import_fs65.default.readFileSync(import_path68.default.join(homeDir, ".node9", "daemon.pid"), "utf-8");
+    return isLiveOtherDaemonPid(JSON.parse(raw).pid);
+  } catch {
+    return false;
+  }
+}
+function yieldToOtherDaemon() {
+  if (!activityYieldLogged) {
+    logActivitySocket("another daemon owns daemon.pid; this one leaves the socket to it");
+    activityYieldLogged = true;
+  }
+}
+function probeActivitySocket() {
+  const socketPath = ACTIVITY_SOCKET_PATH;
+  if (!socketPath) return;
+  if (process.platform === "win32") {
+    if (!import_fs65.default.existsSync(socketPath)) attemptRebind("health-probe");
+    return;
+  }
+  let st;
+  try {
+    st = import_fs65.default.lstatSync(socketPath);
+  } catch {
+    attemptRebind("health-probe");
+    return;
+  }
+  const bound = activitySocketIdentity;
+  if (!bound || st.dev === bound.dev && st.ino === bound.ino) return;
+  if (anotherDaemonOwnsPidFile()) {
+    yieldToOtherDaemon();
+    return;
+  }
+  activityYieldLogged = false;
+  attemptRebind("socket-replaced");
+}
+function stopActivitySocket() {
+  stopHealthProbe();
+  const socketPath = ACTIVITY_SOCKET_PATH;
+  const bound = activitySocketIdentity;
+  ACTIVITY_SOCKET_PATH = null;
+  activitySocketIdentity = null;
+  if (!socketPath || !bound || process.platform === "win32") return;
+  try {
+    const st = import_fs65.default.lstatSync(socketPath);
+    if (isOwnStaleSocket(socketPath) && st.dev === bound.dev && st.ino === bound.ino)
+      import_fs65.default.unlinkSync(socketPath);
+  } catch {
+  }
+  removeOwnSocketDir(socketPath, process.env, import_os55.default.homedir());
 }
 function attemptRebind(reason) {
   if (!shouldRebind()) {
@@ -44701,6 +45329,7 @@ function attemptRebind(reason) {
       reason: "rebind-loop",
       message: "Activity socket repeatedly disappearing \u2014 run: node9 daemon restart"
     });
+    stopHealthProbe();
     return;
   }
   logActivitySocket(`rebinding (reason: ${reason}, attempt ${activityRebindAttempts.length})`);
@@ -44824,6 +45453,8 @@ function bindActivitySocket() {
     if (process.platform !== "win32") {
       try {
         import_fs65.default.chmodSync(socketPath, 384);
+        const st = import_fs65.default.lstatSync(socketPath);
+        activitySocketIdentity = { dev: st.dev, ino: st.ino };
       } catch {
       }
     }
@@ -44831,7 +45462,7 @@ function bindActivitySocket() {
   });
   activitySocketServer = unixServer;
 }
-var import_net5, import_fs65, import_path68, import_os55, import_crypto20, homeDir, DAEMON_PID_FILE, DECISIONS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, INSIGHT_COUNTS_FILE, sseClients, cards, suggestionTracker, taintStore, sessionTaintStore, sessionExposureStore, sessionWriteStore, insightCounts, _abandonTimer, _hadBrowserClient, _daemonServer, daemonRejectionHandlerRegistered, AUTO_DENY_MS, TRUST_DURATIONS, autoStarted, ACTIVITY_SOCKET_PATH, activitySocketPathListeners, ACTIVITY_RING_SIZE, activityRing, LARGE_RESPONSE_RING_SIZE, largeResponseRing, cachedScanResult, cachedScanTs, SCAN_CACHE_TTL_MS, SECRET_KEY_RE, INPUT_PRICE_PER_1M, OUTPUT_PRICE_PER_1M, BYTES_PER_TOKEN, CRITICAL_FORENSIC_CATEGORIES, WRITE_TOOL_NAMES, ACTIVITY_REBIND_MAX_ATTEMPTS, ACTIVITY_REBIND_WINDOW_MS, ACTIVITY_HEALTH_PROBE_MS, activitySocketServer, activityHealthInterval, activityRebindAttempts, activityCircuitTripped;
+var import_net5, import_fs65, import_path68, import_os55, import_crypto20, homeDir, DAEMON_PID_FILE, DECISIONS_FILE, AUDIT_LOG_FILE, TRUST_FILE2, GLOBAL_CONFIG_FILE, CREDENTIALS_FILE, INSIGHT_COUNTS_FILE, sseClients, cards, suggestionTracker, taintStore, sessionTaintStore, sessionExposureStore, sessionWriteStore, insightCounts, _abandonTimer, _hadBrowserClient, _daemonServer, daemonRejectionHandlerRegistered, daemonSignalHandlersRegistered, AUTO_DENY_MS, TRUST_DURATIONS, autoStarted, ACTIVITY_SOCKET_PATH, activitySocketPathListeners, ACTIVITY_RING_SIZE, activityRing, LARGE_RESPONSE_RING_SIZE, largeResponseRing, cachedScanResult, cachedScanTs, SCAN_CACHE_TTL_MS, SECRET_KEY_RE, INPUT_PRICE_PER_1M, OUTPUT_PRICE_PER_1M, BYTES_PER_TOKEN, CRITICAL_FORENSIC_CATEGORIES, WRITE_TOOL_NAMES, ACTIVITY_REBIND_MAX_ATTEMPTS, ACTIVITY_REBIND_WINDOW_MS, ACTIVITY_HEALTH_PROBE_MS, activitySocketServer, activitySocketIdentity, activityHealthInterval, activityRebindAttempts, activityCircuitTripped, activityYieldLogged;
 var init_state3 = __esm({
   "src/daemon/state.ts"() {
     "use strict";
@@ -44876,6 +45507,7 @@ var init_state3 = __esm({
     _hadBrowserClient = false;
     _daemonServer = null;
     daemonRejectionHandlerRegistered = false;
+    daemonSignalHandlersRegistered = false;
     AUTO_DENY_MS = 12e4;
     TRUST_DURATIONS = {
       "30m": 30 * 6e4,
@@ -44916,9 +45548,11 @@ var init_state3 = __esm({
     ACTIVITY_REBIND_WINDOW_MS = 6e4;
     ACTIVITY_HEALTH_PROBE_MS = 2e3;
     activitySocketServer = null;
+    activitySocketIdentity = null;
     activityHealthInterval = null;
     activityRebindAttempts = [];
     activityCircuitTripped = false;
+    activityYieldLogged = false;
   }
 });
 
@@ -48528,6 +49162,12 @@ data: ${JSON.stringify(item.data)}
       console.error(import_chalk8.default.red("[node9 daemon] unhandled rejection \u2014 keeping daemon alive:"), stack);
     });
   }
+  if (!daemonSignalHandlersRegistered) {
+    markSignalHandlersRegistered();
+    process.once("SIGTERM", () => process.exit(0));
+    process.once("SIGINT", () => process.exit(130));
+    process.once("SIGHUP", () => process.exit(129));
+  }
   const writeOwnPidFile = () => atomicWriteSync(
     DAEMON_PID_FILE,
     JSON.stringify({
@@ -48544,6 +49184,7 @@ data: ${JSON.stringify(item.data)}
     { mode: 384 }
   );
   server.listen(DAEMON_PORT, DAEMON_HOST, () => {
+    startActivitySocket();
     writeOwnPidFile();
     onActivitySocketPathChange(() => {
       try {
@@ -48558,7 +49199,6 @@ data: ${JSON.stringify(item.data)}
   if (watchMode) {
     console.error(import_chalk8.default.cyan("\u{1F6F0}\uFE0F  Flight Recorder active \u2014 daemon will not idle-timeout"));
   }
-  startActivitySocket();
 }
 var import_http4, import_fs72, import_path74, import_os60, import_crypto23, import_child_process5, import_chalk8;
 var init_server = __esm({
@@ -85738,7 +86378,8 @@ function summarize(results, config) {
       if (stopped) c.interrupted++;
       continue;
     }
-    if (!stopped && (r.unknown?.length ?? 0) > 0) {
+    const notEnforcedStop = r.enforced === false && (r.decision === "review" || r.decision === "block");
+    if (!stopped && !notEnforcedStop && (r.unknown?.length ?? 0) > 0) {
       c.undetermined++;
       continue;
     }