@node9/proxy 2.51.0 → 2.53.0

package/dist/dashboard.mjs

@@ -470,15 +470,15 @@ function ssrfExemptMatches(entries, normalized) {
       continue;
     }
     if (!target) continue;
-    const base22 = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
+    const base32 = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
     const prefixText = entry.slice(slash + 1);
     const prefix = /^\d+$/.test(prefixText) ? Number(prefixText) : NaN;
-    if (!base22 || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
+    if (!base32 || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
     // differ, so `0.0.0.0/0` does not release `::1`.
-    base22.length !== target.length || prefix > base22.length) {
+    base32.length !== target.length || prefix > base32.length) {
       continue;
     }
-    if (base22.slice(0, prefix) === target.slice(0, prefix)) return true;
+    if (base32.slice(0, prefix) === target.slice(0, prefix)) return true;
   }
   return false;
 }
@@ -532,6 +532,10 @@ function reviewsEveryAgentFileWrite(mode) {
   const level = levelOf(mode);
   return level === "strict" || level === "block-all";
 }
+function holdsSendsWithoutDaemon(mode) {
+  const level = levelOf(mode);
+  return level === "strict" || level === "block-all";
+}
 function isBlockAll(mode) {
   return levelOf(mode) === "block-all";
 }
@@ -1739,6 +1743,39 @@ function protectedLiteral(code2, isProtected) {
   }
   return null;
 }
+function inlineReadPaths(language, code2, preload = {}) {
+  const out = [];
+  const before = READ_BEFORE[language];
+  const after = READ_AFTER[language];
+  const assigned = /* @__PURE__ */ new Map();
+  for (const m of code2.matchAll(STRING_LITERAL)) {
+    const raw = m[2].trim();
+    const value = raw.replace(/^[<+]\s*/, "");
+    if (!value) continue;
+    const head = code2.slice(Math.max(0, m.index - 160), m.index);
+    const tail = code2.slice(m.index + m[0].length, m.index + m[0].length + 40);
+    if (/^[>|]/.test(raw) || WRITE_MODE_AFTER.test(tail) || PERL_WRITE_BEFORE.test(head)) continue;
+    if (before.test(head) || after?.test(tail) || language === "node" && DOTENV_PATH_OPTION.test(head)) {
+      out.push(value);
+      continue;
+    }
+    const name = ASSIGNED.exec(head)?.[1];
+    if (name) assigned.set(name, [...assigned.get(name) ?? [], value]);
+  }
+  if (assigned.size > 0) {
+    const opened = /* @__PURE__ */ new Set();
+    for (const m of code2.matchAll(OPENED_NAME[language])) opened.add(m[1] ?? m[2]);
+    for (const [name, values] of assigned) if (opened.has(name)) out.push(...values);
+  }
+  if (language === "python" || language === "node") {
+    const d = DOTENV[language];
+    const readsEnv = d.env.test(code2);
+    const loads = /dotenv/.test(code2) && d.load.test(code2) && !d.literalPath.test(code2);
+    if ((loads || preload.dotenv) && (readsEnv || d.values.test(code2))) out.push(".env");
+    if (readsEnv) out.push(...preload.envFiles ?? []);
+  }
+  return out;
+}
 function amplifies(language, code2) {
   const loop = language === "python" ? /\bwhile\s+(?:True|1)\s*:/ : language === "node" ? /\bwhile\s*\(\s*(?:true|1)\s*\)|\bfor\s*\(\s*;\s*;\s*\)|\bsetInterval\s*\(/ : /\bwhile\s*\(?\s*(?:1|true)\s*\)?|\bloop\s+do\b|\bfor\s*\(\s*;\s*;\s*\)/;
   const m = loop.exec(code2);
@@ -2593,15 +2630,28 @@ function inlineExecCall(stmt, pipeFed) {
   const fromStdin = () => {
     if (stdinFed) {
       const { code: code2, source } = stdinCodeOf(redirs);
-      return { interp, code: [code2], source };
+      return { interp, code: [code2], source, preload };
     }
     return { interp, code: [null], source: "pipe" };
   };
   let positionals2 = 0;
   let selectedProgram = false;
   const codes2 = [];
+  const preload = {};
+  const nodeFamily = inlineLanguageOf(interp) === "node";
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
+    if (nodeFamily && !selectedProgram && codes2.length === 0 && a != null) {
+      const flag = NODE_VALUE_FLAG.exec(a);
+      if (flag) {
+        const value = flag[2] ?? args[++i];
+        if (value != null) {
+          if (/^--env-file/.test(flag[1])) (preload.envFiles ??= []).push(value);
+          else if (/^dotenv\/config(?:\.js)?$/.test(value)) preload.dotenv = true;
+        }
+        continue;
+      }
+    }
     if (a == null) {
       if (codes2.length > 0) break;
       positionals2++;
@@ -2638,7 +2688,12 @@ function inlineExecCall(stmt, pipeFed) {
     }
   }
   if (codes2.length > 0) {
-    return { interp, code: codes2, source: codes2.includes(null) ? "variable" : void 0 };
+    return {
+      interp,
+      code: codes2,
+      source: codes2.includes(null) ? "variable" : void 0,
+      preload
+    };
   }
   if (positionals2 === 0 && (stdinFed || pipeFed)) {
     if (!/^(bash|sh|zsh)$/i.test(interp)) return fromStdin();
@@ -3461,7 +3516,7 @@ function extractShellDestTokens(command) {
 }
 function analyzeFsOperation(command) {
   const normalized = normalizeCommandForPolicy(command);
-  if (!FS_OP_PRESCREEN_RE.test(normalized) && !FS_OP_PRESCREEN_RE.test(command) && !SOURCES_FILE_RE.test(command))
+  if (!FS_OP_PRESCREEN_RE.test(normalized) && !FS_OP_PRESCREEN_RE.test(command) && !SOURCES_FILE_RE.test(command) && !runsInlineInterpreter(command, normalized))
     return null;
   if (fsOpCache.has(command)) {
     const hit = fsOpCache.get(command) ?? null;
@@ -3469,7 +3524,8 @@ function analyzeFsOperation(command) {
     fsOpCache.set(command, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(command) ?? (INDIRECT_SHAPE_RE.test(command) ? structuralJailRead(command) : null);
+  const direct = analyzeFsOperationImpl(command) ?? (INDIRECT_SHAPE_RE.test(command) ? structuralJailRead(command) : null);
+  const computed = direct?.verdict === "block" || !runsInlineInterpreter(command, normalized) ? direct : stricter(direct, inlineCodeJailRead(command));
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
@@ -3478,8 +3534,8 @@ function analyzeFsOperation(command) {
   return computed;
 }
 function isSensitiveCleanupName(p) {
-  const base22 = p.replace(/^.*[\\/]/, "");
-  return /^\.env(\.|$)/i.test(base22) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base22) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base22) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base22) || /credential/i.test(p) || /secret/i.test(base22);
+  const base32 = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base32) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base32) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base32) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base32) || /credential/i.test(p) || /secret/i.test(base32);
 }
 function isWaivableCleanupTarget(p) {
   if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
@@ -4208,6 +4264,24 @@ function structuralJailRead(command) {
   }
   return review;
 }
+function inlineCodeJailRead(command) {
+  const calls = inlineExecCalls(command);
+  if (calls === PARSE_FAIL) return null;
+  let review = null;
+  for (const call of calls) {
+    const language = inlineLanguageOf(call.interp);
+    if (language === null) continue;
+    for (const code2 of call.code) {
+      if (code2 === null) continue;
+      for (const p of inlineReadPaths(language, code2, call.preload)) {
+        const hit = matchSensitivePath(p);
+        if (hit?.verdict === "block") return hit;
+        review ??= hit;
+      }
+    }
+  }
+  return review;
+}
 function baseWord(w) {
   return (w ?? "").split("/").pop()?.toLowerCase() ?? "";
 }
@@ -4765,6 +4839,21 @@ function hits(access, paths, directories, context) {
   }
   return false;
 }
+function hitsNode9Dir(access, dirs, context) {
+  const home = context.homeDirs?.[0] ?? "~";
+  if (access.glob) {
+    const pattern = normalizeFilePath(access.glob, access.cwd ?? context.cwd, home);
+    const magic = pattern.search(/[*?[{]/);
+    const literal = magic < 0 ? pattern : pattern.slice(0, pattern.lastIndexOf("/", magic));
+    return dirs.some((d) => within(literal, d));
+  }
+  const candidates = access.candidates ?? [
+    normalizeFilePath(access.path, access.cwd ?? context.cwd, home)
+  ];
+  return candidates.some(
+    (p) => dirs.some((d) => within(p, d)) || access.recursive === true && dirs.some((d) => within(d, p))
+  );
+}
 function hitsSystemDir(access, context, dirs = SYSTEM_DIRS) {
   const home = context.homeDirs?.[0] ?? "~";
   const candidates = access.candidates ?? [
@@ -4805,6 +4894,7 @@ function evaluateProtectedFileAccess(accesses, context, settings) {
   const consider = (result) => {
     if (!best || RANK[result.decision] > RANK[best.decision]) best = result;
   };
+  const node9Dirs = homes.map((home) => `${home.replace(/\/$/, "")}/.node9`);
   for (const access of accesses) {
     const mutation = access.operation !== "read";
     let kind;
@@ -4833,6 +4923,10 @@ function evaluateProtectedFileAccess(accesses, context, settings) {
         "files.system-dirs",
         "review-root-home-read",
         "Reading the root account's home requires approval"
+      ] : mutation && hitsNode9Dir(access, node9Dirs, context) ? [
+        "commands.node9-disarm",
+        "review-node9-disarm",
+        "Changing node9's own files requires approval"
       ] : null;
     } catch {
       consider(incompleteFileVerdict(access.operation));
@@ -5438,9 +5532,9 @@ function validateBelgianNationalNumber(raw) {
   if (!/^\d{11}$/.test(d)) return false;
   const month = Number(d.slice(2, 4)) % 20;
   if (month !== 0 && !plausibleDate(String(month).padStart(2, "0"), d.slice(4, 6))) return false;
-  const base22 = Number(d.slice(0, 9));
+  const base32 = Number(d.slice(0, 9));
   const check = Number(d.slice(9, 11));
-  return 97 - base22 % 97 === check || 97 - (2e9 + base22) % 97 === check;
+  return 97 - base32 % 97 === check || 97 - (2e9 + base32) % 97 === check;
 }
 function validateCuit(raw) {
   const d = raw.replace(/-/g, "");
@@ -6574,9 +6668,9 @@ function evaluateGitHooksFileAccess(args, accesses, context, settings, shell) {
 }
 function agentFileKind(p) {
   const lower2 = p.toLowerCase();
-  const base22 = lower2.slice(lower2.lastIndexOf("/") + 1);
-  if (INSTRUCTION_NAMES.has(base22)) return "instructions";
-  if (base22 === "copilot-instructions.md" && lower2.endsWith("/.github/" + base22))
+  const base32 = lower2.slice(lower2.lastIndexOf("/") + 1);
+  if (INSTRUCTION_NAMES.has(base32)) return "instructions";
+  if (base32 === "copilot-instructions.md" && lower2.endsWith("/.github/" + base32))
     return "instructions";
   if (/\/\.cursor\/rules(?:\/|$)/.test(lower2)) return "instructions";
   if (/\/\.claude\/projects\/[^/]+\/memory(?:\/|$)/.test(lower2)) return "memory";
@@ -6745,7 +6839,7 @@ function evaluateAgentFileWrite(args, accesses, context, settings, shell, hooks
       skills: "agent skill",
       settings: "agent settings"
     };
-    const base22 = `${kindLabel[kind]} written: ${access.path}`;
+    const base32 = `${kindLabel[kind]} written: ${access.path}`;
     if (!signal && !every) {
       return {
         decision: "allow",
@@ -6755,14 +6849,14 @@ function evaluateAgentFileWrite(args, accesses, context, settings, shell, hooks
         path: access.path,
         operation: access.operation,
         kind,
-        reason: base22,
+        reason: base32,
         ruleDescription: "The AI writes to a file every later agent session loads as instructions.",
-        blockedByLabel: `Node9 Files: ${base22}`,
+        blockedByLabel: `Node9 Files: ${base32}`,
         tier: 2
       };
     }
     const ruleName = signal === "content" ? "review-agent-file-content" : signal === "hooks" ? "review-agent-hooks-change" : "review-agent-file-write";
-    const reason = signal ? `${base22} (${detail})` : base22;
+    const reason = signal ? `${base32} (${detail})` : base32;
     const description = signal === "content" ? "The AI writes an instruction into a file every later agent session loads: to hide something from you, to skip approvals or the guard, or to read or send a secret. It would persist past this session; confirm it is yours." : signal === "hooks" ? "The AI changes the hooks in the agent's settings. Hooks are how node9 and your other checks run before each tool call; a change here can disarm them." : "The AI writes to a file every later agent session loads as instructions (CLAUDE.md, AGENTS.md, memory, agents, commands). Confirm the change is yours.";
     return {
       decision: value === "log" ? "allow" : value,
@@ -8370,6 +8464,139 @@ function scanArgumentSecrets(args) {
     severity: "review"
   } : null;
 }
+function patternSelects(pattern, targets) {
+  const pieces = pattern.toLowerCase().split(/[\\^$.*+?()[\]{}|]+/).filter(Boolean);
+  if (pieces.length === 0) return false;
+  return targets.some((t) => pieces.every((p) => t.includes(p)));
+}
+function sourceText(bytes, pos, end) {
+  if (typeof pos !== "number" || typeof end !== "number" || pos < 0 || end < pos) return "";
+  return new TextDecoder().decode(bytes.subarray(pos, end));
+}
+function nextOperand(words, from) {
+  for (let i = from; i < words.length; i++) {
+    const w = words[i];
+    if (w !== null && w.startsWith("-")) continue;
+    return i;
+  }
+  return -1;
+}
+function node9Command(words, h) {
+  const head = base2(words[h]);
+  if (head !== "node9" && head !== "node9.cmd" && words[h] !== "@node9/proxy") return null;
+  const s = nextOperand(words, h + 1);
+  const sub = s < 0 ? "" : (words[s] ?? "").toLowerCase();
+  if (sub === "uninstall") return "node9 uninstall";
+  if (sub !== "daemon") return null;
+  const a = nextOperand(words, s + 1);
+  const action = a < 0 ? "" : (words[a] ?? "").toLowerCase();
+  return action === "stop" || action === "uninstall" ? `node9 daemon ${action}` : null;
+}
+function killsDaemon(words, texts, h, daemonPid) {
+  const head = base2(words[h]);
+  const args = words.slice(h + 1);
+  if (head === "kill") {
+    for (let i = 0; i < args.length; i++) {
+      const w = args[i];
+      if (w === "-s" || w === "-n") {
+        i++;
+        continue;
+      }
+      if (w !== null && w.startsWith("-")) continue;
+      if (w === null) {
+        if (HOME_PID_FILE_RE.test(texts[h + 1 + i] ?? "")) return "kill of the pid in daemon.pid";
+        continue;
+      }
+      if (daemonPid !== null && w === String(daemonPid)) return `kill ${w} (the node9 daemon)`;
+    }
+    return null;
+  }
+  if (head === "pkill") {
+    let full = false;
+    let pattern = null;
+    for (let i = 0; i < args.length; i++) {
+      const w = args[i];
+      if (w === null) continue;
+      if (PKILL_VALUE_FLAGS.has(w)) {
+        i++;
+        continue;
+      }
+      if (w === "--full") full = true;
+      else if (/^-[a-zA-Z]+$/.test(w) && w.includes("f")) full = true;
+      if (w.startsWith("-")) continue;
+      pattern = w;
+    }
+    if (pattern === null) return null;
+    return patternSelects(pattern, full ? DAEMON_CMDLINES : DAEMON_NAMES) ? `pkill ${full ? "-f " : ""}${pattern}` : null;
+  }
+  if (head === "killall") {
+    const regex = args.some((w) => w === "-r" || w === "--regexp");
+    for (const w of args) {
+      if (w === null || w.startsWith("-")) continue;
+      if (regex ? patternSelects(w, DAEMON_NAMES) : KILLALL_NAMES.has(w.toLowerCase()))
+        return `killall ${w}`;
+    }
+    return null;
+  }
+  if (head === "taskkill" || head === "taskkill.exe") {
+    for (let i = 0; i < args.length - 1; i++) {
+      const flag = (args[i] ?? "").toLowerCase();
+      const value = (args[i + 1] ?? "").toLowerCase();
+      if ((flag === "/im" || flag === "-im") && KILLALL_NAMES.has(value))
+        return `taskkill /IM ${value}`;
+      if ((flag === "/pid" || flag === "-pid") && daemonPid !== null && value === String(daemonPid))
+        return `taskkill /PID ${value} (the node9 daemon)`;
+    }
+  }
+  return null;
+}
+function stopsService(words, h) {
+  const head = base2(words[h]);
+  const args = words.slice(h + 1).map((w) => (w ?? "").toLowerCase());
+  if (head === "systemctl") {
+    const action = args.find((w) => STOP_SYSTEMCTL.has(w));
+    if (action && args.some((w) => /^node9-daemon(\.service)?$/.test(w)))
+      return `systemctl ${action} node9-daemon`;
+  }
+  if (head === "launchctl") {
+    const action = args.find((w) => STOP_LAUNCHCTL.has(w));
+    if (action && args.some((w) => w.includes("ai.node9.daemon")))
+      return `launchctl ${action} ai.node9.daemon`;
+  }
+  return null;
+}
+function analyzeNode9Disarm(command, daemonPid = null, depth = 0) {
+  if (depth > 3 || !NAME_PRESCREEN_RE.test(command.replace(/[\\'"]/g, ""))) return null;
+  let shown = null;
+  const bytes = new TextEncoder().encode(command);
+  try {
+    walkCommandScope(command, (node) => {
+      if (shown !== null) return false;
+      const n = node;
+      if (!n || n.kind !== "CallExpr") return true;
+      const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+      if (words.length === 0) return true;
+      const texts = (n.Args || []).map((a) => sourceText(bytes, a.pos, a.end));
+      const h = unwrapCommandHead(words);
+      shown = node9Command(words, h) ?? killsDaemon(words, texts, h, daemonPid) ?? stopsService(words, h);
+      if (shown === null) {
+        const payload = literalShellPayload(words, base2(words[0]));
+        if (payload) {
+          const inner = analyzeNode9Disarm(payload, daemonPid, depth + 1);
+          if (inner) shown = inner.reason.replace(/^node9 switched off by the agent: /, "");
+        }
+      }
+      return true;
+    });
+  } catch {
+  }
+  if (shown === null) return null;
+  return {
+    ruleName: RULE_NAME2,
+    reason: `node9 switched off by the agent: ${shown}`,
+    description: DESCRIPTION
+  };
+}
 function catalogSettings(config) {
   return catalogSettingsFromConfig(config.settings, config.policy);
 }
@@ -8463,6 +8690,10 @@ function egressPolicyVerdict(eg) {
   };
 }
 async function evaluatePolicy(config, toolName, args, context = {}, hostHooks = {}) {
+  const v = await evaluatePolicyVerdict(config, toolName, args, context, hostHooks);
+  return v.decision === "block" && v.checkId !== void 0 && NOT_OVERRIDABLE_CHECKS.has(v.checkId) ? { ...v, overridable: false } : v;
+}
+async function evaluatePolicyVerdict(config, toolName, args, context = {}, hostHooks = {}) {
   let protectedVerdict = null;
   const layers = inspectionLayers(config.policy);
   if (context.agent !== "Terminal") {
@@ -8520,7 +8751,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hostHooks =
 }
 async function evaluatePolicyCore(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
-  const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2, isConfiguredRegistry, isGitWorkTreeTop: isGitWorkTreeTop2 } = hooks;
+  const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2, isConfiguredRegistry, isGitWorkTreeTop: isGitWorkTreeTop2, daemonPid } = hooks;
   const settingsView = catalogSettings(config);
   const layers = inspectionLayers(config.policy);
   const cv = (id) => checkValue(settingsView, id);
@@ -8705,6 +8936,23 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
         else if (v && !pendingAstReview) pendingAstReview = v;
       }
     }
+    if (cv("commands.node9-disarm") !== "off") {
+      const finding = analyzeNode9Disarm(bashCommand, daemonPid?.() ?? null);
+      if (finding) {
+        const v = applyCheckValue(cv("commands.node9-disarm"), {
+          decision: "review",
+          blockedByLabel: `Node9 (AST): ${finding.ruleName}`,
+          reason: finding.reason,
+          tier: 2,
+          ruleName: finding.ruleName,
+          ruleDescription: finding.description,
+          checkId: "commands.node9-disarm"
+        });
+        if (v?.logged) noteLogged(v);
+        else if (v?.decision === "block") return v;
+        else if (v && !pendingAstReview) pendingAstReview = v;
+      }
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
@@ -9152,8 +9400,8 @@ function hasRoutingNumber(text) {
   }
   return false;
 }
-function* validCardRuns(text, base22, exemptFractions = true) {
-  const re = new RegExp(base22.source, "g");
+function* validCardRuns(text, base32, exemptFractions = true) {
+  const re = new RegExp(base32.source, "g");
   let m;
   while ((m = re.exec(text)) !== null) {
     const digits = m[0].replace(/\D/g, "");
@@ -9166,17 +9414,17 @@ function* validCardRuns(text, base22, exemptFractions = true) {
   }
 }
 function hasValidCard(text) {
-  for (const base22 of CARD_PATTERNS) {
-    if (!validCardRuns(text, base22).next().done) return true;
+  for (const base32 of CARD_PATTERNS) {
+    if (!validCardRuns(text, base32).next().done) return true;
   }
   return false;
 }
 function replaceValidCards(text, replace, { exemptFractions = true } = {}) {
   let out = text;
-  for (const base22 of CARD_PATTERNS) {
+  for (const base32 of CARD_PATTERNS) {
     let res = "";
     let last = 0;
-    for (const run of validCardRuns(out, base22, exemptFractions)) {
+    for (const run of validCardRuns(out, base32, exemptFractions)) {
       res += out.slice(last, run.index) + replace(run.digits);
       last = run.index + run.length;
     }
@@ -9417,9 +9665,9 @@ function maskLeaf(value, key, depth) {
     const used = /* @__PURE__ */ new Set();
     return Object.fromEntries(
       Object.entries(value).map(([k, v]) => {
-        const base22 = maskPersonalData(k);
-        let name = base22;
-        for (let n = 2; used.has(name); n++) name = `${base22}#${n}`;
+        const base32 = maskPersonalData(k);
+        let name = base32;
+        for (let n = 2; used.has(name); n++) name = `${base32}#${n}`;
         used.add(name);
         return [name, maskLeaf(v, k, depth + 1)];
       })
@@ -9924,7 +10172,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var getFilename2, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, POSTURE_CATEGORY_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, ENCODED_RUN_RE, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION;
+var getFilename2, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, POSTURE_CATEGORY_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, READ_CALL, ARG, WRAP, STR_PREFIX, WRITE_MODE_LITERAL, WRITE_MODE, WRITE_MODE_AFTER, PERL_WRITE_BEFORE, readCallBefore, READ_BEFORE, READ_AFTER, ASSIGNED, openedName, OPENED_NAME, DOTENV, DOTENV_PATH_OPTION, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NODE_VALUE_FLAG, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, INLINE_INTERP_PRESCREEN_RE, runsInlineInterpreter, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, ENCODED_RUN_RE, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, RULE_NAME2, DESCRIPTION, DAEMON_CMDLINES, DAEMON_NAMES, KILLALL_NAMES, STOP_SYSTEMCTL, STOP_LAUNCHCTL, PKILL_VALUE_FLAGS, NAME_PRESCREEN_RE, base2, HOME_PID_FILE_RE, VERDICT_RANK, SQL_DML_KEYWORDS, NOT_OVERRIDABLE_CHECKS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -11923,7 +12171,7 @@ var init_dist = __esm({
         advice: "Fixed at Review for now."
       },
       "commands.node9-disarm": {
-        plain: "The agent runs a node9 command that would switch off a protection: clear a session flag, trust an address, pause the gate, weaken a shield.",
+        plain: "The agent switches node9 off or weakens it: stops or kills the daemon, stops its service, uninstalls node9, changes files in ~/.node9, clears a session flag, trusts an address, pauses the gate, weakens a shield.",
         example: "After reading a web page, the agent runs node9 session-exposure clear --all",
         advice: "Keep Review: these are your commands to run. Block if the agent should never touch node9."
       },
@@ -12256,7 +12504,7 @@ var init_dist = __esm({
         group: "commands",
         owasp: "ASI10",
         title: "node9 disarmed from the shell",
-        catches: "a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield, run by the agent",
+        catches: "the agent stopping or killing the node9 daemon, stopping its service, uninstalling node9, changing files in ~/.node9, or running a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield",
         values: ALL,
         defaultValue: "review",
         legacy: ["review-node9-disarm"]
@@ -13137,6 +13385,62 @@ var init_dist = __esm({
       php: PHP
     };
     STRING_LITERAL = /(['"`])((?:\\.|(?!\1)[^\\\n]){1,4096})\1/g;
+    READ_CALL = {
+      python: String.raw`(?:\b(?:io|codecs)\.)?\bopen|\b(?:dotenv_values|load_dotenv|get_key|read_file|loadtxt|read_csv)`,
+      node: String.raw`\b(?:readFileSync|readFile|createReadStream|readTextFile(?:Sync)?|readFileStr|openSync|file)`,
+      perl: String.raw`\b(?:open|sysopen|read_file|slurp)`,
+      ruby: String.raw`\b(?:File|IO)\.(?:read|binread|readlines|foreach|open)|\bDotenv\.(?:load|parse|overload)`,
+      php: String.raw`\b(?:file_get_contents|fopen|file|readfile|parse_ini_file|highlight_file|show_source)`
+    };
+    ARG = String.raw`(?:(?:(?:my|our|local)\s+)?[\w.$]+(?:\s*\(\s*\))?|'[^'\n]{0,8}'|"[^"\n]{0,8}")\s*,\s*`;
+    WRAP = String.raw`(?:(?:new\s+)?[\w.$]+\s*\(\s*(?:${ARG}){0,3}){0,3}`;
+    STR_PREFIX = String.raw`[rRbBuUfF]{0,2}`;
+    WRITE_MODE_LITERAL = String.raw`['"](?=[rbtU+]*w|(?![^'"]*\+)[rbtU]*[ax])[rwaxbtU+]{1,4}['"]`;
+    WRITE_MODE = String.raw`\s*,\s*(?:mode\s*=\s*)?${WRITE_MODE_LITERAL}`;
+    WRITE_MODE_AFTER = new RegExp(`^(?:\\s*\\)){0,3}${WRITE_MODE}`);
+    PERL_WRITE_BEFORE = /['"]\s*(?:\+?[>|]|>>)\s*['"]\s*,\s*$/;
+    readCallBefore = (language) => new RegExp(
+      String.raw`(?:${READ_CALL[language]})(?![\w$])\s*\(?\s*(?:${ARG}){0,3}${WRAP}${STR_PREFIX}$`
+    );
+    READ_BEFORE = {
+      python: readCallBefore("python"),
+      node: readCallBefore("node"),
+      perl: readCallBefore("perl"),
+      ruby: readCallBefore("ruby"),
+      php: readCallBefore("php")
+    };
+    READ_AFTER = {
+      python: new RegExp(
+        String.raw`^\s*\)\s*\.\s*(?:read_text|read_bytes|open)\s*\((?!\s*(?:mode\s*=\s*)?${WRITE_MODE_LITERAL})`
+      )
+    };
+    ASSIGNED = new RegExp(String.raw`([$\w]+)\s*=\s*${WRAP}${STR_PREFIX}$`);
+    openedName = (language) => new RegExp(
+      String.raw`(?:${READ_CALL[language]})(?![\w$])\s*\(?\s*(?:${ARG}){0,3}${WRAP}([$\w]+)(?!${WRITE_MODE})\s*[),]` + (language === "python" ? String.raw`|\bPath\s*\(\s*([$\w]+)\s*\)\s*\.\s*(?:read_text|read_bytes|open)\s*\(` : ""),
+      "g"
+    );
+    OPENED_NAME = {
+      python: openedName("python"),
+      node: openedName("node"),
+      perl: openedName("perl"),
+      ruby: openedName("ruby"),
+      php: openedName("php")
+    };
+    DOTENV = {
+      node: {
+        load: /\brequire\s*\(\s*['"`]dotenv(?:\/config)?['"`]\s*\)|\bimport\s*(?:[\w${}\s,*]+\s+from\s*)?['"`]dotenv(?:\/config)?['"`]|\bimport\s*\(\s*['"`]dotenv(?:\/config)?['"`]\s*\)/,
+        values: /\.parsed\b|[(,]\s*(?:require\s*\(\s*['"`]dotenv['"`]\s*\)|dotenv)\s*\.\s*config\s*\(/,
+        env: /\b(?:process|Deno|Bun)\s*\.\s*env\b/,
+        literalPath: /\bconfig\s*\(\s*\{[^)]*\bpath\s*:\s*['"`]/
+      },
+      python: {
+        load: /\b(?:load_dotenv|dotenv_values|get_key)\s*\(/,
+        values: /\b(?:dotenv_values|get_key)\s*\(/,
+        env: /\b(?:environ|getenv)\b/,
+        literalPath: /\b(?:load_dotenv|dotenv_values)\s*\(\s*(?:dotenv_path\s*=\s*)?[rRbBuU]?['"]/
+      }
+    };
+    DOTENV_PATH_OPTION = /\bconfig\s*\(\s*\{[^)]*\bpath\s*:\s*$/;
     sharedParser = lazy(() => getSyntax().NewParser());
     MESSAGE_FLAGS = /* @__PURE__ */ new Set([
       "-m",
@@ -13931,6 +14235,7 @@ var init_dist = __esm({
       "rmdir"
     ]);
     INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
+    NODE_VALUE_FLAG = /^(-r|--require|--import|--loader|--experimental-loader|--env-file|--env-file-if-exists|--input-type|-C|--conditions)(?:=(.*))?$/;
     MAX_PAYLOAD_NESTING = 8;
     payloadNesting = 0;
     MAX_INLINE_CALLS = 16;
@@ -14179,6 +14484,8 @@ var init_dist = __esm({
     JAILED_DIR_NAMES = [".ssh", ".aws"];
     shellGlob = (p) => p.replace(/\[!/g, "[^");
     GLOB_META = /(?<!\\)[*?[]/;
+    INLINE_INTERP_PRESCREEN_RE = /(?:^|[^\w-])(?:python|node|tsx|ts-node|deno|bun|perl|ruby|irb|php)(?![A-Za-z_])/i;
+    runsInlineInterpreter = (command, normalized) => INLINE_INTERP_PRESCREEN_RE.test(command) || INLINE_INTERP_PRESCREEN_RE.test(normalized);
     isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(baseWord(w));
     positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
     NONE = { kind: "none" };
@@ -17495,9 +17802,9 @@ zoo`.split("\n");
           const name = n.Name.Value;
           if (n.Append) {
             const prev = this.appended.has(name) ? this.appended.get(name) : resolveWordLiteral(n.Value) === null ? null : void 0;
-            const base22 = prev === void 0 ? recordedExpansion(name) : prev;
+            const base32 = prev === void 0 ? recordedExpansion(name) : prev;
             const piece = resolveWordLiteral(n.Value);
-            this.appended.set(name, typeof base22 === "string" && piece !== null ? base22 + piece : null);
+            this.appended.set(name, typeof base32 === "string" && piece !== null ? base32 + piece : null);
             this.treeTopVars.delete(name);
             return true;
           }
@@ -19013,12 +19320,50 @@ ${text}` : text);
       const char = value[index] ?? "";
       return RUN_CHAR.test(char) || char !== "" && isInvisibleChar(char);
     };
+    RULE_NAME2 = "review-node9-disarm";
+    DESCRIPTION = "The AI wants to stop node9, remove it, or change its own files. These are your commands to run, not the agent's: with the daemon stopped the outside-content and taint checks are off.";
+    DAEMON_CMDLINES = [
+      "node /usr/lib/node_modules/@node9/proxy/dist/cli.js daemon start",
+      "node9 daemon start"
+    ];
+    DAEMON_NAMES = ["node", "node9"];
+    KILLALL_NAMES = /* @__PURE__ */ new Set(["node", "node9", "node.exe", "node9.exe"]);
+    STOP_SYSTEMCTL = /* @__PURE__ */ new Set(["stop", "disable", "mask", "kill"]);
+    STOP_LAUNCHCTL = /* @__PURE__ */ new Set(["unload", "bootout", "remove", "stop", "kill", "disable"]);
+    PKILL_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-u",
+      "-U",
+      "-g",
+      "-G",
+      "-P",
+      "-s",
+      "-t",
+      "-F",
+      "--signal",
+      "--euid",
+      "--uid",
+      "--pgroup",
+      "--group",
+      "--parent",
+      "--session",
+      "--terminal",
+      "--pidfile",
+      "--ns",
+      "--nslist"
+    ]);
+    NAME_PRESCREEN_RE = /node9|kill|systemctl|launchctl|daemon/i;
+    base2 = (w) => (w ?? "").split(/[\\/]/).pop()?.toLowerCase() ?? "";
+    HOME_PID_FILE_RE = /(?:^|[\s"'(=`])(?:~|\$HOME|\$\{HOME\}|\/home\/[^/\s]+|\/Users\/[^/\s]+|\/root)\/\.node9\/daemon\.pid/;
     VERDICT_RANK = {
       allow: 0,
       review: 1,
       block: 2
     };
     SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
+    NOT_OVERRIDABLE_CHECKS = /* @__PURE__ */ new Set([
+      "data.credential-files",
+      "data.credential-files-other"
+    ]);
     MAX_DESTINATIONS = 200;
     MAX_SCAN_CHARS = 1e5;
     EMAIL_RE = /[\p{L}\p{N}._%+-]+@[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?(?:\.[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?)*\.\p{L}{2,}/gu;
@@ -19362,7 +19707,7 @@ ${text}` : text);
       { view: "separators-stripped", decoder: "separators", stripped: true }
     ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v37";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v39";
   }
 });
 
@@ -19839,7 +20184,7 @@ function statAndFirstLine(file2) {
     fs3.closeSync(fd);
   }
 }
-function listCodexSessionFiles(base3 = codexSessionsDir()) {
+function listCodexSessionFiles(base4 = codexSessionsDir()) {
   const files = [];
   const walk3 = (dir2) => {
     try {
@@ -19851,8 +20196,8 @@ function listCodexSessionFiles(base3 = codexSessionsDir()) {
     } catch {
     }
   };
-  walk3(base3);
-  if (path4.basename(base3) === "sessions") walk3(path4.join(path4.dirname(base3), "archived_sessions"));
+  walk3(base4);
+  if (path4.basename(base4) === "sessions") walk3(path4.join(path4.dirname(base4), "archived_sessions"));
   const sessions = /* @__PURE__ */ new Map();
   for (const file2 of files.sort()) {
     try {
@@ -20263,8 +20608,8 @@ function claudeDesktopConfigPath(homeDir = os6.homedir()) {
 }
 function opencodeConfigDir(home = os6.homedir()) {
   const xdg = process.env.XDG_CONFIG_HOME;
-  const base3 = xdg && path9.isAbsolute(xdg) ? xdg : path9.join(home, ".config");
-  return path9.join(base3, "opencode");
+  const base4 = xdg && path9.isAbsolute(xdg) ? xdg : path9.join(home, ".config");
+  return path9.join(base4, "opencode");
 }
 function commonBinDirs(home) {
   return [
@@ -21779,8 +22124,8 @@ import os13 from "os";
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const base3 = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
-    const m = classifySsrf(base3);
+    const base4 = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base4);
     if (m && !m.overridable) {
       const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
@@ -22542,12 +22887,12 @@ function getConfig(cwd) {
         continue;
       explicit[id] = v;
     }
-    const base3 = resolveCheckMap({
+    const base4 = resolveCheckMap({
       ...catalogSettingsFrom(mergedSettings, mergedPolicy),
       checks: explicit
     });
     for (const [id, v] of Object.entries(v2ChecksByPath.get(projectPath)?.checks ?? {})) {
-      if (CHECK_VERDICT_RANK[v] > CHECK_VERDICT_RANK[base3[id] ?? "off"]) {
+      if (CHECK_VERDICT_RANK[v] > CHECK_VERDICT_RANK[base4[id] ?? "off"]) {
         explicit[id] = v;
         checkSources[id] = "project";
       }
@@ -23193,6 +23538,39 @@ var init_egress = __esm({
   }
 });
 
+// src/utils/read-small-file.ts
+import fs16 from "fs";
+function readSmallFile(file2, maxBytes) {
+  let fd;
+  try {
+    fd = fs16.openSync(file2, fs16.constants.O_RDONLY | (fs16.constants.O_NONBLOCK ?? 0));
+  } catch {
+    return null;
+  }
+  try {
+    const st = fs16.fstatSync(fd);
+    if (!st.isFile() || st.size > maxBytes) return null;
+    const buf = Buffer.alloc(Math.min(st.size, maxBytes));
+    let read2 = 0;
+    while (read2 < buf.length) {
+      const n = fs16.readSync(fd, buf, read2, buf.length - read2, read2);
+      if (n === 0) break;
+      read2 += n;
+    }
+    return buf.toString("utf8", 0, read2);
+  } catch {
+    return null;
+  } finally {
+    fs16.closeSync(fd);
+  }
+}
+var init_read_small_file = __esm({
+  "src/utils/read-small-file.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/policy/gate-order.ts
 function fileGateOutcome(file2, panicMode) {
   if (!file2) return null;
@@ -23412,7 +23790,7 @@ var init_gate_order = __esm({
 });
 
 // src/policy/file-access.ts
-import fs16 from "fs";
+import fs17 from "fs";
 import os14 from "os";
 import path17 from "path";
 function absoluteSpelling(p, cwd, home) {
@@ -23426,13 +23804,13 @@ function physical(p, followFinal, links = 0) {
     return { path: `${parent.path}/${path17.basename(p)}`, missing: parent.missing };
   }
   try {
-    return { path: fs16.realpathSync.native(p), missing: false };
+    return { path: fs17.realpathSync.native(p), missing: false };
   } catch (error) {
     const code2 = error.code;
     if (!["ENOENT", "ENOTDIR"].includes(code2 ?? "")) throw error;
     try {
-      if (fs16.lstatSync(p).isSymbolicLink()) {
-        const target = fs16.readlinkSync(p);
+      if (fs17.lstatSync(p).isSymbolicLink()) {
+        const target = fs17.readlinkSync(p);
         return physical(
           path17.isAbsolute(target) ? target : `${path17.dirname(p)}/${target}`,
           true,
@@ -23472,14 +23850,14 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
     const raw = absoluteSpelling(access.path, access.cwd ?? cwd, home);
     if (access.directoryTarget) {
       try {
-        if (!fs16.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
+        if (!fs17.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
           continue;
       } catch {
       }
     }
     if (access.operation === "create") {
       try {
-        fs16.statSync(raw);
+        fs17.statSync(raw);
         continue;
       } catch {
       }
@@ -23535,7 +23913,7 @@ var init_file_access = __esm({
 });
 
 // src/supply-chain/osv-index.ts
-import fs17 from "fs";
+import fs18 from "fs";
 import os15 from "os";
 import path18 from "path";
 import { createHash as createHash4 } from "crypto";
@@ -23566,7 +23944,7 @@ function shardPath(eco, shard) {
 }
 function readMeta(eco) {
   try {
-    const m = JSON.parse(fs17.readFileSync(path18.join(ecoDir(eco), "meta.json"), "utf8"));
+    const m = JSON.parse(fs18.readFileSync(path18.join(ecoDir(eco), "meta.json"), "utf8"));
     if (typeof m?.syncedAt !== "string" || typeof m?.lastModifiedMs !== "number") return null;
     return m;
   } catch {
@@ -23575,7 +23953,7 @@ function readMeta(eco) {
 }
 function readShard(eco, shard) {
   try {
-    const s = JSON.parse(fs17.readFileSync(shardPath(eco, shard), "utf8"));
+    const s = JSON.parse(fs18.readFileSync(shardPath(eco, shard), "utf8"));
     return s && typeof s === "object" && !Array.isArray(s) ? s : {};
   } catch {
     return {};
@@ -23697,15 +24075,15 @@ var init_net = __esm({
 
 // src/supply-chain/osv-online.ts
 async function queryOsvMalicious(queries) {
-  const base3 = endpoints().osvApi;
-  if (!base3 || queries.length === 0) return null;
+  const base4 = endpoints().osvApi;
+  if (!base4 || queries.length === 0) return null;
   const body = JSON.stringify({
     queries: queries.map((q) => ({
       package: { name: q.name, ecosystem: q.ecosystem },
       ...q.version ? { version: q.version } : {}
     }))
   });
-  const res = await fetchJson(`${base3}/v1/querybatch`, {
+  const res = await fetchJson(`${base4}/v1/querybatch`, {
     timeoutMs: TIMEOUT_MS,
     maxBytes: 1024 * 1024,
     body
@@ -23768,9 +24146,9 @@ function pypiRepoOf(doc) {
   return null;
 }
 async function npmSourceRepo(name, version) {
-  const base3 = endpoints().npmRegistry;
-  if (!base3) return "unknown";
-  const url = `${base3}/-/npm/v1/attestations/${name.replaceAll("/", "%2F")}@${encodeURIComponent(version)}`;
+  const base4 = endpoints().npmRegistry;
+  if (!base4) return "unknown";
+  const url = `${base4}/-/npm/v1/attestations/${name.replaceAll("/", "%2F")}@${encodeURIComponent(version)}`;
   return read(url, npmRepoOf);
 }
 async function read(url, repoOf) {
@@ -23783,9 +24161,9 @@ async function read(url, repoOf) {
   }
 }
 async function pypiSourceRepo(name, version, filename) {
-  const base3 = endpoints().pypi;
-  if (!base3) return "unknown";
-  const url = `${base3}/integrity/${encodeURIComponent(name)}/${encodeURIComponent(version)}/${encodeURIComponent(filename)}/provenance`;
+  const base4 = endpoints().pypi;
+  if (!base4) return "unknown";
+  const url = `${base4}/integrity/${encodeURIComponent(name)}/${encodeURIComponent(version)}/${encodeURIComponent(filename)}/provenance`;
   return read(url, pypiRepoOf);
 }
 function comparePypi(a, b) {
@@ -23837,9 +24215,9 @@ async function npmVersionDocument(url, selector) {
   };
 }
 async function npmInfo(name, version, freshWindowMs, raw) {
-  const base3 = endpoints().npmRegistry;
-  if (!base3) return null;
-  const url = `${base3}/${name.replaceAll("/", "%2F")}`;
+  const base4 = endpoints().npmRegistry;
+  if (!base4) return null;
+  const url = `${base4}/${name.replaceAll("/", "%2F")}`;
   const aliasStart = raw?.indexOf("@npm:") ?? -1;
   const target = aliasStart > 0 ? raw.slice(aliasStart + 5) : raw?.replace(/^npm:/, "");
   const specStart = target?.indexOf("@", 1) ?? -1;
@@ -23907,9 +24285,9 @@ async function npmInfo(name, version, freshWindowMs, raw) {
   return info;
 }
 async function pypiInfo(name, version) {
-  const base3 = endpoints().pypi;
-  if (!base3) return null;
-  const url = version ? `${base3}/pypi/${encodeURIComponent(name)}/${encodeURIComponent(version)}/json` : `${base3}/pypi/${encodeURIComponent(name)}/json`;
+  const base4 = endpoints().pypi;
+  if (!base4) return null;
+  const url = version ? `${base4}/pypi/${encodeURIComponent(name)}/${encodeURIComponent(version)}/json` : `${base4}/pypi/${encodeURIComponent(name)}/json`;
   const doc = await fetchJson(url, { timeoutMs: TIMEOUT_MS3, maxBytes: MAX_BYTES2 });
   if (!doc?.info?.version) return null;
   const times = (doc.urls ?? []).map((u) => u.upload_time_iso_8601 ? Date.parse(u.upload_time_iso_8601) : NaN).filter((t) => Number.isFinite(t));
@@ -23933,9 +24311,9 @@ function pypiHistoryOf(releases, version) {
   };
 }
 async function pypiHistory(name, version) {
-  const base3 = endpoints().pypi;
-  if (!base3) return null;
-  const doc = await fetchJson(`${base3}/pypi/${encodeURIComponent(name)}/json`, {
+  const base4 = endpoints().pypi;
+  if (!base4) return null;
+  const doc = await fetchJson(`${base4}/pypi/${encodeURIComponent(name)}/json`, {
     timeoutMs: TIMEOUT_MS3,
     maxBytes: MAX_BYTES2
   });
@@ -23962,7 +24340,7 @@ var init_registry2 = __esm({
 });
 
 // src/supply-chain/local-resolve.ts
-import fs18 from "fs";
+import fs19 from "fs";
 import path19 from "path";
 function resolveInstalled(name, cwd) {
   if (!cwd || !path19.isAbsolute(cwd)) return null;
@@ -23972,7 +24350,7 @@ function resolveInstalled(name, cwd) {
     const pkgDir = path19.join(dir2, "node_modules", ...name.split("/"));
     const manifest = path19.join(pkgDir, "package.json");
     try {
-      const raw = fs18.readFileSync(manifest, "utf8");
+      const raw = fs19.readFileSync(manifest, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
         return { version: parsed.version, dir: pkgDir };
@@ -24272,7 +24650,7 @@ var init_check = __esm({
 // src/supply-chain/registries.ts
 import os16 from "os";
 import path21 from "path";
-import fs19 from "fs";
+import fs20 from "fs";
 function userFiles(home, env) {
   const xdg = env.XDG_CONFIG_HOME || path21.join(home, ".config");
   return [
@@ -24357,7 +24735,7 @@ function configuredRegistryHosts(cwd, env = process.env, home = os16.homedir())
     const r = readCappedText(
       file2,
       MAX_CONFIG_BYTES,
-      fs19.constants.O_RDONLY | (fs19.constants.O_NONBLOCK ?? 0)
+      fs20.constants.O_RDONLY | (fs20.constants.O_NONBLOCK ?? 0)
     );
     if (r) hostsInText(r.text, hosts);
   }
@@ -24415,7 +24793,7 @@ var init_registries = __esm({
 });
 
 // src/utils/provenance.ts
-import fs20 from "fs";
+import fs21 from "fs";
 import path22 from "path";
 import os17 from "os";
 function findInPath(cmd) {
@@ -24425,7 +24803,7 @@ function findInPath(cmd) {
     if (!dir2) continue;
     const full = path22.join(dir2, cmd);
     try {
-      fs20.accessSync(full, fs20.constants.X_OK);
+      fs21.accessSync(full, fs21.constants.X_OK);
       return full;
     } catch {
     }
@@ -24470,7 +24848,7 @@ function checkProvenance(cmd, cwd) {
         reason: "binary not found in PATH"
       };
     }
-    resolved = fs20.realpathSync(found);
+    resolved = fs21.realpathSync(found);
   } catch {
     return {
       resolvedPath: cmd,
@@ -24479,7 +24857,7 @@ function checkProvenance(cmd, cwd) {
     };
   }
   try {
-    const stat = fs20.statSync(resolved);
+    const stat = fs21.statSync(resolved);
     if (stat.mode & 2) {
       return {
         resolvedPath: resolved,
@@ -24516,8 +24894,9 @@ var init_provenance2 = __esm({
 });
 
 // src/policy/index.ts
-import fs21 from "fs";
+import fs22 from "fs";
 import path23 from "path";
+import os18 from "os";
 async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
   const config = opts?.config ?? getConfig(cwd);
   const prepared = opts?.fileAccess ?? prepareFileAccesses(toolName, args, cwd, inspectionLayers(config.policy));
@@ -24544,14 +24923,26 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
       isTrustedHost: config.policy.trustedHostsManaged ? (host2) => matchesTrustedHost(host2, config.policy.trustedHosts) : isTrustedHost,
       readAgentSettings,
       isConfiguredRegistry: (host2, at) => configuredRegistryHosts(at).has(host2),
-      isGitWorkTreeTop
+      isGitWorkTreeTop,
+      daemonPid: daemonPidFromFile
     }
   );
 }
+function daemonPidFromFile() {
+  if (forecastRun()) return null;
+  const text = readSmallFile(path23.join(os18.homedir(), ".node9", "daemon.pid"), 4096);
+  if (text === null) return null;
+  try {
+    const pid = JSON.parse(text).pid;
+    return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && pid <= 4194304 ? pid : null;
+  } catch {
+    return null;
+  }
+}
 function isGitWorkTreeTop(dir2, cwd) {
   if (!path23.isAbsolute(cwd)) return true;
   try {
-    return fs21.existsSync(path23.join(path23.resolve(cwd, dir2), ".git"));
+    return fs22.existsSync(path23.join(path23.resolve(cwd, dir2), ".git"));
   } catch {
     return true;
   }
@@ -24560,7 +24951,7 @@ function readAgentSettings(absPath) {
   const r = readCappedText(
     absPath,
     MAX_AGENT_SETTINGS_BYTES,
-    fs21.constants.O_RDONLY | (fs21.constants.O_NONBLOCK ?? 0)
+    fs22.constants.O_RDONLY | (fs22.constants.O_NONBLOCK ?? 0)
   );
   return r && !r.truncated ? r.text : null;
 }
@@ -24574,6 +24965,8 @@ var init_policy = __esm({
     init_esm_shims();
     init_dist();
     init_read_capped();
+    init_read_small_file();
+    init_forecast_context();
     init_dlp();
     init_gate_order();
     init_file_access();
@@ -25743,46 +26136,13 @@ var init_codex = __esm({
   }
 });
 
-// src/utils/read-small-file.ts
-import fs22 from "fs";
-function readSmallFile(file2, maxBytes) {
-  let fd;
-  try {
-    fd = fs22.openSync(file2, fs22.constants.O_RDONLY | (fs22.constants.O_NONBLOCK ?? 0));
-  } catch {
-    return null;
-  }
-  try {
-    const st = fs22.fstatSync(fd);
-    if (!st.isFile() || st.size > maxBytes) return null;
-    const buf = Buffer.alloc(Math.min(st.size, maxBytes));
-    let read2 = 0;
-    while (read2 < buf.length) {
-      const n = fs22.readSync(fd, buf, read2, buf.length - read2, read2);
-      if (n === 0) break;
-      read2 += n;
-    }
-    return buf.toString("utf8", 0, read2);
-  } catch {
-    return null;
-  } finally {
-    fs22.closeSync(fd);
-  }
-}
-var init_read_small_file = __esm({
-  "src/utils/read-small-file.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
 // src/posture/agent-permissions.ts
-import os18 from "os";
+import os19 from "os";
 import path25 from "path";
 function readSmall(file2) {
   return readSmallFile(file2, MAX_FILE_BYTES2);
 }
-function base2(agent, severity, title) {
+function base3(agent, severity, title) {
   return {
     category: CATEGORY,
     severity,
@@ -25809,7 +26169,7 @@ function claudeCode(home) {
   const findings = [];
   const mode = typeof cfg.permissions?.defaultMode === "string" ? cfg.permissions.defaultMode : "";
   if (CLAUDE_NO_PROMPT_MODES.has(mode) || cfg.dangerouslySkipPermissions === true) {
-    const f = base2("Claude Code", "high", "Claude Code runs without asking");
+    const f = base3("Claude Code", "high", "Claude Code runs without asking");
     f.what = "Claude Code's own permission prompt is switched off for every session.";
     f.why = CLAUDE_NO_PROMPT_MODES.has(mode) ? `~/.claude/settings.json sets permissions.defaultMode to ${mode}.` : "~/.claude/settings.json sets dangerouslySkipPermissions.";
     f.detail = [
@@ -25820,7 +26180,7 @@ function claudeCode(home) {
   }
   for (const ci of analyzeAgentConfig(".claude/settings.json", text)) {
     if (ci.rule !== "CI-1.broad-allow" && ci.rule !== "CI-1.exec-escape-grant") continue;
-    const f = base2(
+    const f = base3(
       "Claude Code",
       CI_SEVERITY[ci.severity],
       ci.rule === "CI-1.broad-allow" ? "Claude Code pre-approves broad tools for every session" : "Claude Code pre-approves a command that can run other programs"
@@ -25840,7 +26200,7 @@ function codex(home) {
   const findings = [];
   for (const ci of analyzeCodexConfig(".codex/config.toml", text)) {
     if (ci.rule !== "CI-1.codex-unsafe-defaults") continue;
-    const f = base2("Codex", "high", "Codex runs without approval or without a sandbox");
+    const f = base3("Codex", "high", "Codex runs without approval or without a sandbox");
     f.what = "Codex's own approval or sandbox is switched off for every session.";
     f.why = "~/.codex/config.toml sets it for every project.";
     f.detail = ci.signals.slice(0, 6);
@@ -25873,7 +26233,7 @@ function gemini(home) {
   };
   visit2(cfg, "", 0);
   if (hits2.length === 0) return [];
-  const f = base2("Gemini CLI", "high", "Gemini CLI accepts every tool call on its own");
+  const f = base3("Gemini CLI", "high", "Gemini CLI accepts every tool call on its own");
   f.what = "Gemini CLI's own confirmation is switched off for every session.";
   f.why = "~/.gemini/settings.json sets it.";
   f.detail = hits2.slice(0, 4);
@@ -25881,7 +26241,7 @@ function gemini(home) {
   return [f];
 }
 function checkAgentPermissions(ctx) {
-  const home = ctx.home || os18.homedir();
+  const home = ctx.home || os19.homedir();
   return [...claudeCode(home), ...codex(home), ...gemini(home)];
 }
 var CATEGORY, CLAUDE_NO_PROMPT_MODES, MAX_FILE_BYTES2, CI_SEVERITY;
@@ -25905,7 +26265,7 @@ var init_agent_permissions = __esm({
 });
 
 // src/posture/outside-content.ts
-import os19 from "os";
+import os20 from "os";
 function outsideSources(home, roles) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -25924,7 +26284,7 @@ function outsideSources(home, roles) {
   return out;
 }
 function checkOutsideContent(ctx) {
-  const home = ctx.home || os19.homedir();
+  const home = ctx.home || os20.homedir();
   const config = getConfig(ctx.cwd);
   const roles = config.policy.untrustedContent?.roles ?? {};
   const sources = outsideSources(home, roles);
@@ -25982,7 +26342,7 @@ var init_outside_content = __esm({
 
 // src/posture/instruction-files.ts
 import fs23 from "fs";
-import os20 from "os";
+import os21 from "os";
 import path26 from "path";
 function listMd(dir2, depth, out) {
   if (out.length >= MAX_FILES || depth < 0) return;
@@ -26041,7 +26401,7 @@ function counts(ci, memory) {
   return memory ? ci.severity === "high" || ci.severity === "critical" : true;
 }
 function checkInstructionFiles(ctx) {
-  const home = ctx.home || os20.homedir();
+  const home = ctx.home || os21.homedir();
   const findings = [];
   const detail = [];
   let worst = "medium";
@@ -26109,9 +26469,9 @@ var init_instruction_files = __esm({
 // src/skill-pin.ts
 import fs24 from "fs";
 import path27 from "path";
-import os21 from "os";
+import os22 from "os";
 import crypto3 from "crypto";
-function getPinsFilePath(home = os21.homedir()) {
+function getPinsFilePath(home = os22.homedir()) {
   return path27.join(home, ".node9", "skill-pins.json");
 }
 function getRootKey(absPath) {
@@ -26132,7 +26492,7 @@ function readSkillPinsSafe(home) {
     return { ok: false, reason: "corrupt", detail: String(err) };
   }
 }
-function defaultSkillRoots(_cwd, home = os21.homedir()) {
+function defaultSkillRoots(_cwd, home = os22.homedir()) {
   const marketplaces = path27.join(home, ".claude", "plugins", "marketplaces");
   const roots = [];
   let registries;
@@ -26168,7 +26528,7 @@ var init_skill_pin = __esm({
 });
 
 // src/posture/supply-chain.ts
-import os22 from "os";
+import os23 from "os";
 import path28 from "path";
 import { parse as parseToml7 } from "smol-toml";
 function isNode9Managed(command, args = []) {
@@ -26197,7 +26557,7 @@ function readServers(file2, format, agent) {
   }
 }
 function checkSupplyChain(ctx) {
-  const home = ctx.home || os22.homedir();
+  const home = ctx.home || os23.homedir();
   const servers = [];
   for (const spec of AGENT_SPECS) {
     if (!spec.mcpFile || spec.mcpInventory === false) continue;
@@ -26622,7 +26982,7 @@ var init_startup_log = __esm({
 // src/daemon/service.ts
 import fs27 from "fs";
 import path29 from "path";
-import os23 from "os";
+import os24 from "os";
 import { spawnSync, execFileSync } from "child_process";
 function isLaunchdInstalled() {
   return fs27.existsSync(LAUNCHD_PLIST);
@@ -26630,7 +26990,7 @@ function isLaunchdInstalled() {
 function isSystemdInstalled() {
   return fs27.existsSync(SYSTEMD_UNIT);
 }
-function windowsStartupDir(homeDir = os23.homedir()) {
+function windowsStartupDir(homeDir = os24.homedir()) {
   const appData = process.env.APPDATA || path29.join(homeDir, "AppData", "Roaming");
   return path29.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
 }
@@ -26679,8 +27039,8 @@ var init_service = __esm({
     init_startup_log();
     init_api_url();
     LAUNCHD_LABEL = "ai.node9.daemon";
-    LAUNCHD_PLIST = path29.join(os23.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-    SYSTEMD_UNIT_DIR = path29.join(os23.homedir(), ".config", "systemd", "user");
+    LAUNCHD_PLIST = path29.join(os24.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    SYSTEMD_UNIT_DIR = path29.join(os24.homedir(), ".config", "systemd", "user");
     SYSTEMD_UNIT = path29.join(SYSTEMD_UNIT_DIR, "node9-daemon.service");
     STARTUP_FILE = "node9-daemon.vbs";
     WIN_LAUNCHER = () => path29.join(windowsStartupDir(), STARTUP_FILE);
@@ -26690,9 +27050,9 @@ var init_service = __esm({
 });
 
 // src/posture/coverage.ts
-import os24 from "os";
+import os25 from "os";
 function checkCoverage(ctx) {
-  const home = ctx.home || os24.homedir();
+  const home = ctx.home || os25.homedir();
   const findings = [];
   const protectedAgents = getAgentWiring(home).filter((r) => r.isProtected);
   if (protectedAgents.length === 0) {
@@ -26910,14 +27270,14 @@ function scorePosture(findings, checksRun) {
     (f) => f.coverage?.state !== "covered" && f.coverage?.state !== "cant-fix"
   );
   const count = (sev) => open.filter((f) => f.severity === sev && !f.scoreWeight).length;
-  const base3 = computeSecurityScore({
+  const base4 = computeSecurityScore({
     critical: count("critical"),
     high: count("high"),
     medium: count("medium"),
     total: Math.max(checksRun, 1)
   });
   const headroom = open.reduce((sum, f) => sum + (f.scoreWeight ?? 0), 0);
-  const score = Math.max(0, base3.score - headroom);
+  const score = Math.max(0, base4.score - headroom);
   const tier = score >= 80 ? "good" : score >= 50 ? "at-risk" : "critical";
   return { score, tier };
 }
@@ -27091,7 +27451,7 @@ var init_enforcement = __esm({
 });
 
 // src/posture/index.ts
-import os25 from "os";
+import os26 from "os";
 function dropEnforcementRedundant(findings) {
   const coveragePresent = findings.some((f) => f.category === "Coverage");
   if (!coveragePresent) return findings;
@@ -27117,7 +27477,7 @@ async function runChecks(checks, ctx) {
 }
 async function runPosture(opts = {}) {
   const ctx = {
-    home: opts.home ?? os25.homedir(),
+    home: opts.home ?? os26.homedir(),
     cwd: opts.cwd ?? process.cwd(),
     agent: opts.agent,
     env: opts.env
@@ -27215,7 +27575,7 @@ var init_render = __esm({
 import chalk3 from "chalk";
 import fs28 from "fs";
 import path31 from "path";
-import os26 from "os";
+import os27 from "os";
 function buildSensitivePaths(home, cwd) {
   const homeFiles = homeCredentialFiles(home).map(({ full, label: label2, description, score }) => ({
     full,
@@ -27254,7 +27614,7 @@ function isReadable(filePath) {
   }
 }
 function runBlast() {
-  const home = os26.homedir();
+  const home = os27.homedir();
   const cwd = process.cwd();
   const paths = buildSensitivePaths(home, cwd);
   let scoreDeduction = 0;
@@ -27462,7 +27822,7 @@ var init_decision_record = __esm({
 import fs29 from "fs";
 import http from "http";
 import path32 from "path";
-import os27 from "os";
+import os28 from "os";
 async function checkStatePredicates(predicates) {
   if (predicates.length === 0) return {};
   if (forecastRun()) return null;
@@ -27488,7 +27848,7 @@ function resolveDaemonPort(env = process.env) {
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = path32.join(os27.homedir(), ".node9", "daemon.pid");
+    const pidFile = path32.join(os28.homedir(), ".node9", "daemon.pid");
     if (!fs29.existsSync(pidFile)) return null;
     const data = JSON.parse(fs29.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
@@ -27499,7 +27859,7 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = path32.join(os27.homedir(), ".node9", "daemon.pid");
+  const pidFile = path32.join(os28.homedir(), ".node9", "daemon.pid");
   if (fs29.existsSync(pidFile)) {
     let pid;
     let port;
@@ -27546,11 +27906,11 @@ async function daemonHasInteractiveApprover(timeoutMs = 400) {
   }
 }
 async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd, recoveryCommand, skipBackgroundAuth, viewOnly, localSmartRuleMatched, socketActivitySent, sessionId, card) {
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), 5e3);
   try {
-    const res = await fetch(`${base3}/check`, {
+    const res = await fetch(`${base4}/check`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -27660,8 +28020,8 @@ function daemonGet(urlPath, signal, token = getInternalToken()) {
   });
 }
 async function notifyDaemonViewer(toolName, args, meta, riskMetadata, activityId, socketActivitySent, extra) {
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const res = await fetch(`${base3}/check`, {
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const res = await fetch(`${base4}/check`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({
@@ -27693,9 +28053,9 @@ async function notifyTaint(filePath, source, fromEid) {
     return;
   }
   if (!isDaemonRunning()) return;
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    await fetch(`${base3}/taint`, {
+    await fetch(`${base4}/taint`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       // Phase D2 — fromEid is the audit eid that created this taint (edge source).
@@ -27713,9 +28073,9 @@ async function checkTaint(paths) {
     return record2 ? { tainted: true, record: record2 } : { tainted: false };
   }
   if (!isDaemonRunning()) return { tainted: false, daemonUnavailable: true };
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    const res = await fetch(`${base3}/taint/check`, {
+    const res = await fetch(`${base4}/taint/check`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ paths }),
@@ -27743,9 +28103,9 @@ async function notifyWritten(paths) {
     return;
   }
   if (paths.length === 0 || !isDaemonRunning()) return;
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    await fetch(`${base3}/written`, {
+    await fetch(`${base4}/written`, {
       method: "POST",
       headers: exposureHeaders(),
       body: JSON.stringify({ paths: paths.slice(0, 64) }),
@@ -27759,9 +28119,9 @@ async function checkWritten(paths) {
   const forecast = forecastRun();
   if (forecast) return { written: forecast.session.written(paths) };
   if (!isDaemonRunning()) return { written: [], daemonUnavailable: true };
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    const res = await fetch(`${base3}/written/check`, {
+    const res = await fetch(`${base4}/written/check`, {
       method: "POST",
       headers: exposureHeaders(),
       body: JSON.stringify({ paths: paths.slice(0, 64) }),
@@ -27783,9 +28143,9 @@ async function checkSessionTaint(sessionId) {
     return record2 ? { tainted: true, record: record2, exposed } : { tainted: false, exposed };
   }
   if (!sessionId || !isDaemonRunning()) return { tainted: false };
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    const res = await fetch(`${base3}/session-taint/check`, {
+    const res = await fetch(`${base4}/session-taint/check`, {
       method: "POST",
       headers: exposureHeaders(),
       body: JSON.stringify({ sessionId }),
@@ -27803,8 +28163,8 @@ function exposureHeaders() {
   };
 }
 async function exposurePost(route, body, timeoutMs) {
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const res = await fetch(`${base3}${route}`, {
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const res = await fetch(`${base4}${route}`, {
     method: "POST",
     headers: exposureHeaders(),
     body: JSON.stringify(body),
@@ -27819,7 +28179,8 @@ async function checkSessionExposure(sessionId) {
     const record2 = forecast.session.checkExposure(forecast.now);
     return record2 ? { exposed: true, record: record2 } : { exposed: false };
   }
-  if (!sessionId || !isDaemonRunning()) return { exposed: false };
+  if (!sessionId) return { exposed: false };
+  if (!isDaemonRunning()) return { exposed: false, daemonUnavailable: true };
   try {
     return await exposurePost(
       "/session-exposure/check",
@@ -27843,8 +28204,8 @@ async function approveSessionExposure(sessionId, keys) {
   }
 }
 async function resolveViaDaemon(id, decision, internalToken, source, record2) {
-  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const res = await fetch(`${base3}/resolve/${id}`, {
+  const base4 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const res = await fetch(`${base4}/resolve/${id}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Node9-Internal": internalToken },
     body: JSON.stringify({ decision, ...source && { source }, ...record2 && { record: record2 } }),
@@ -28108,7 +28469,7 @@ var init_scan_watermark = __esm({
 
 // src/cli/aggregate/report-audit.ts
 import fs31 from "fs";
-import os28 from "os";
+import os29 from "os";
 import path34 from "path";
 function buildTestTimestamps(allEntries) {
   const testTs = /* @__PURE__ */ new Set();
@@ -28546,10 +28907,10 @@ function dimensionOfBlock(checkedBy, ruleName) {
 }
 function aggregateReportFromAudit(period, opts = {}) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
-  const auditLogPath2 = opts.auditLogPath ?? path34.join(os28.homedir(), ".node9", "audit.log");
-  const claudeProjectsDir = opts.claudeProjectsDir ?? path34.join(os28.homedir(), ".claude", "projects");
+  const auditLogPath2 = opts.auditLogPath ?? path34.join(os29.homedir(), ".node9", "audit.log");
+  const claudeProjectsDir = opts.claudeProjectsDir ?? path34.join(os29.homedir(), ".claude", "projects");
   const codexSessionsDir2 = opts.codexSessionsDir ?? codexSessionsDir();
-  const geminiTmpDir = opts.geminiTmpDir ?? path34.join(os28.homedir(), ".gemini", "tmp");
+  const geminiTmpDir = opts.geminiTmpDir ?? path34.join(os29.homedir(), ".gemini", "tmp");
   const hasAuditFile = fs31.existsSync(auditLogPath2);
   const allEntries = opts.preloadedAuditEntries ?? parseAuditLog(auditLogPath2);
   const unackedDlp = allEntries.filter((e) => e.source === "response-dlp");
@@ -28946,9 +29307,9 @@ var init_catalog = __esm({
 // src/daemon/mcp-tools.ts
 import fs32 from "fs";
 import path35 from "path";
-import os29 from "os";
+import os30 from "os";
 function getMcpToolsFile() {
-  return path35.join(os29.homedir(), ".node9", "mcp-tools.json");
+  return path35.join(os30.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
@@ -28970,9 +29331,9 @@ var init_mcp_tools = __esm({
 
 // src/apps/state.ts
 import fs33 from "fs";
-import os30 from "os";
+import os31 from "os";
 import path36 from "path";
-function appsFilePath(home = os30.homedir()) {
+function appsFilePath(home = os31.homedir()) {
   return path36.join(home, ".node9", "apps.json");
 }
 function emptyFile() {
@@ -29442,7 +29803,7 @@ var init_native = __esm({
 
 // src/auth/session-script.ts
 import fs34 from "fs";
-import os31 from "os";
+import os32 from "os";
 import path39 from "path";
 function readScriptFile(resolved) {
   let fd;
@@ -29474,16 +29835,16 @@ function absolute(p, cwd, home) {
   const spelled = p === "~" || p.startsWith("~/") ? home + p.slice(1) : p;
   return path39.resolve(cwd, spelled);
 }
-async function resolveSessionScript(toolName, args, cwd, layers, deps, home = os31.homedir()) {
+async function resolveSessionScript(toolName, args, cwd, layers, deps, home = os32.homedir()) {
   try {
     const d = deps ?? { checkWritten, readScript: readScriptFile };
     const shell = resolveShellInput(toolName, args, layers);
     if (shell.kind !== "shell") return null;
     const operands2 = shellScriptOperands(shell.command);
     if (operands2.length === 0) return null;
-    const base3 = cwd ?? process.cwd();
+    const base4 = cwd ?? process.cwd();
     const byResolved = /* @__PURE__ */ new Map();
-    for (const op of operands2) byResolved.set(absolute(op, base3, home), op);
+    for (const op of operands2) byResolved.set(absolute(op, base4, home), op);
     const { written } = await d.checkWritten([...byResolved.keys()]);
     for (const resolved of written) {
       const spelled = byResolved.get(resolved);
@@ -29495,7 +29856,7 @@ async function resolveSessionScript(toolName, args, cwd, layers, deps, home = os
         path: spelled,
         resolved,
         args: scriptArgs,
-        fileAccess: prepareFileAccesses("Bash", scriptArgs, base3, layers, home)
+        fileAccess: prepareFileAccesses("Bash", scriptArgs, base4, layers, home)
       };
     }
     return null;
@@ -29503,17 +29864,17 @@ async function resolveSessionScript(toolName, args, cwd, layers, deps, home = os
     return null;
   }
 }
-function sessionWriteTargets(toolName, args, fileAccess, cwd, home = os31.homedir()) {
-  const base3 = cwd ?? process.cwd();
+function sessionWriteTargets(toolName, args, fileAccess, cwd, home = os32.homedir()) {
+  const base4 = cwd ?? process.cwd();
   const out = /* @__PURE__ */ new Set();
   const argsObj = args && typeof args === "object" ? args : {};
   const named = argsObj.file_path ?? argsObj.path ?? argsObj.filename;
   if (typeof named === "string" && named && /write|edit|create|save|append/i.test(toolName))
-    out.add(absolute(named, base3, home));
+    out.add(absolute(named, base4, home));
   for (const a of fileAccess?.accesses ?? []) {
     if (a.operation !== "write" && a.operation !== "create") continue;
     if (a.glob || a.recursive) continue;
-    out.add(absolute(a.path, a.cwd ?? base3, home));
+    out.add(absolute(a.path, a.cwd ?? base4, home));
     if (out.size >= MAX_RECORDED_WRITES) break;
   }
   return [...out];
@@ -29700,7 +30061,7 @@ var init_known_hosts = __esm({
 
 // src/exposure/writes.ts
 import fs37 from "fs";
-import os32 from "os";
+import os33 from "os";
 import path42 from "path";
 function writtenContent(args) {
   if (!args || typeof args !== "object" || Array.isArray(args)) return [];
@@ -29738,8 +30099,8 @@ function packageScriptsTouched(args, absPath, shellCommand) {
 }
 function judgeWritesAfterExposure(opts) {
   const holds = [];
-  const home = opts.home ?? os32.homedir();
-  const tmp = normalizeFilePath(os32.tmpdir());
+  const home = opts.home ?? os33.homedir();
+  const tmp = normalizeFilePath(os33.tmpdir());
   const root = opts.cwd ? normalizeFilePath(opts.cwd, "", home) : null;
   const seen = /* @__PURE__ */ new Set();
   for (const access of opts.accesses) {
@@ -29792,10 +30153,10 @@ var init_exposure_store = __esm({
 // src/exposure/marker.ts
 import crypto4 from "crypto";
 import fs38 from "fs";
-import os33 from "os";
+import os34 from "os";
 import path43 from "path";
 function dir() {
-  return path43.join(os33.homedir(), ".node9", "exposure-sessions");
+  return path43.join(os34.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = crypto4.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
@@ -29926,9 +30287,9 @@ var init_roles = __esm({
 // src/auth/trusted-recipients.ts
 import fs40 from "fs";
 import path44 from "path";
-import os34 from "os";
+import os35 from "os";
 function getTrustedRecipientsPath() {
-  return path44.join(os34.homedir(), ".node9", "trusted-recipients.json");
+  return path44.join(os35.homedir(), ".node9", "trusted-recipients.json");
 }
 function readTrustedRecipients() {
   try {
@@ -29983,7 +30344,7 @@ var init_trusted_recipients = __esm({
 // src/auth/state.ts
 import fs41 from "fs";
 import path45 from "path";
-import os35 from "os";
+import os36 from "os";
 function extractCommandPattern(toolName, args) {
   const lower2 = toolName.toLowerCase();
   if (lower2 !== "bash" && lower2 !== "execute_bash" && lower2 !== "shell") return void 0;
@@ -30060,7 +30421,7 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = path45.join(os35.homedir(), ".node9", "decisions.json");
+    const file2 = path45.join(os36.homedir(), ".node9", "decisions.json");
     if (!fs41.existsSync(file2)) return null;
     const decisions = JSON.parse(fs41.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
@@ -30077,14 +30438,14 @@ var init_state2 = __esm({
     init_policy();
     init_atomic_write();
     init_forecast_context();
-    PAUSED_FILE = path45.join(os35.homedir(), ".node9", "PAUSED");
-    TRUST_FILE = path45.join(os35.homedir(), ".node9", "trust.json");
+    PAUSED_FILE = path45.join(os36.homedir(), ".node9", "PAUSED");
+    TRUST_FILE = path45.join(os36.homedir(), ".node9", "trust.json");
   }
 });
 
 // src/auth/cloud.ts
 import fs42 from "fs";
-import os36 from "os";
+import os37 from "os";
 import path46 from "path";
 function maskArgsForCloud(args) {
   if (args === void 0 || args === null) return args;
@@ -30118,7 +30479,7 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = path46.join(os36.homedir(), ".node9", "ci-context.json");
+      const ciContextPath = path46.join(os37.homedir(), ".node9", "ci-context.json");
       const ci = readCappedText(ciContextPath, 1e4);
       if (!ci) throw new Error("ci-context.json unreadable");
       if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
@@ -30160,9 +30521,9 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
         context: {
           agent: meta?.agent,
           mcpServer: meta?.mcpServer,
-          hostname: os36.hostname(),
+          hostname: os37.hostname(),
           cwd: process.cwd(),
-          platform: os36.platform()
+          platform: os37.platform()
         },
         // The SaaS validates riskMetadata strictly and would drop it whole on
         // an unknown key, so only fields its schema declares go on the wire.
@@ -30267,9 +30628,9 @@ var init_cloud = __esm({
 // src/loop-detector.ts
 import fs43 from "fs";
 import path47 from "path";
-import os37 from "os";
+import os38 from "os";
 function loopStateFile() {
-  return path47.join(os37.homedir(), ".node9", "loop-state.json");
+  return path47.join(os38.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
@@ -30285,7 +30646,7 @@ function readState() {
 function writeState(records) {
   const dir2 = path47.dirname(loopStateFile());
   if (!fs43.existsSync(dir2)) fs43.mkdirSync(dir2, { recursive: true });
-  const tmpPath = `${loopStateFile()}.${os37.hostname()}.${process.pid}.tmp`;
+  const tmpPath = `${loopStateFile()}.${os38.hostname()}.${process.pid}.tmp`;
   fs43.writeFileSync(tmpPath, JSON.stringify(records));
   fs43.renameSync(tmpPath, loopStateFile());
 }
@@ -30449,7 +30810,7 @@ var init_card_result = __esm({
 });
 
 // src/auth/orchestrator.ts
-import os38 from "os";
+import os39 from "os";
 import path48 from "path";
 function isProtectedPathRule(ruleName) {
   if (!ruleName) return false;
@@ -30497,7 +30858,7 @@ function isMcpToolName(toolName) {
   return /^mcp__[^_](?:[^_]|_(?!_))*?__/i.test(toolName);
 }
 function absoluteUploadPath(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? path48.join(os38.homedir(), spelled.slice(1)) : spelled;
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? path48.join(os39.homedir(), spelled.slice(1)) : spelled;
   if (path48.isAbsolute(expanded)) return expanded;
   return cwd && path48.isAbsolute(cwd) ? path48.resolve(cwd, expanded) : expanded;
 }
@@ -30777,8 +31138,17 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const judged = sendsSomething || (!!shellExp?.fetches || writes.length > 0) && mayBeExposed;
     if (judged) {
       const exposure = await checkSessionExposure(meta.sessionId);
-      if (exposure.exposed && exposure.record) {
-        const rec = exposure.record;
+      const unknownRead = exposure.daemonUnavailable === true && holdsSendsWithoutDaemon(config.settings.mode);
+      const rec = exposure.exposed && exposure.record ? exposure.record : unknownRead ? {
+        sessionId: meta.sessionId,
+        sources: [],
+        destinations: [],
+        userMentioned: [],
+        approved: [],
+        createdAt: 0,
+        expiresAt: 0
+      } : null;
+      if (rec) {
         const dests = new Set(
           acts && !shellExp && !mcpFileWrite ? extractArgDestinations(args) : []
         );
@@ -30837,7 +31207,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         if (dests.size === 0 && acts && !mcpFileWrite && (role.destructive === true || isDestructiveToolName(bare))) {
           held.push({ dest: "", why: "destructive" });
         }
-        const writeHolds = writes.length > 0 ? judgeWritesAfterExposure({
+        const writeHolds = writes.length > 0 && !(unknownRead && !exposure.exposed) ? judgeWritesAfterExposure({
           accesses: writes,
           args,
           shellCommand: shellInput.kind === "shell" ? shellInput.command : null,
@@ -30864,14 +31234,14 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           const parts = held.map(
             (h) => h.dest ? `sends to ${destinationValue(h.dest)}, ${h.why === "appeared in what was read" ? `${noun(h.dest)} that appeared in that ${last ? readWord : "content"}` : `${noun(h.dest)} this session did not know`}` : h.why === "repository" ? h.repo.endsWith("/*") ? `sends to a repository on ${h.repo.slice(0, -2)} it does not name (a gist, a new repository or an API call)` : `sends to ${h.repo}, a repository that is not one of this project's remotes` : h.why === "unresolved" ? "sends to a destination this session cannot see (built at run time, or a remote of another repository)" : `is ${bare}, a destructive call, with no known destination`
           );
-          const home = os38.homedir();
+          const home = os39.homedir();
           const short = (p) => p.startsWith(home + "/") ? "~" + p.slice(home.length) : p;
           for (const w of writeHolds) {
             parts.push(
               w.why === "outside-project" ? `writes outside the project, to ${short(w.path)}` : w.why === "agent-instruction" ? `writes to ${short(w.path)}, a file that runs code or instructs the agent` : `writes content carrying ${destinationValue(w.destination ?? "")}, ${noun(w.destination ?? "host:x")} that appeared in that ${readWord}`
             );
           }
-          exposureReview = `\u{1F6E1}\uFE0F Node9: this session read ${read2}. This call ${parts.join("; and ")}.`;
+          exposureReview = unknownRead && !exposure.exposed ? `\u{1F6E1}\uFE0F Node9: the node9 daemon is not running, so node9 cannot tell what this session read. This call ${parts.join("; and ")}. Start it with: node9 daemon start.` : `\u{1F6E1}\uFE0F Node9: this session read ${read2}. This call ${parts.join("; and ")}.`;
           exposureFromEid = last?.eid;
           if (exposureFromEid) exposureMeta = { exposureFromEid };
           exposureKeys = [
@@ -32163,11 +32533,11 @@ var init_version = __esm({
 
 // src/cli/commands/scan-cache.ts
 import fs45 from "fs";
-import os39 from "os";
+import os40 from "os";
 import path50 from "path";
 import { createHash as createHash5 } from "crypto";
 function scanCacheRoot() {
-  return path50.join(os39.homedir(), ".node9", "scan-cache");
+  return path50.join(os40.homedir(), ".node9", "scan-cache");
 }
 function configHashOf(config) {
   const h = createHash5("sha256");
@@ -32175,7 +32545,7 @@ function configHashOf(config) {
   h.update(JSON.stringify(config.policySource));
   h.update(JSON.stringify(config.policy));
   for (const name of SIDECAR_FILES) {
-    const st = fileStamp(path50.join(os39.homedir(), ".node9", name));
+    const st = fileStamp(path50.join(os40.homedir(), ".node9", name));
     h.update(`|${name}:${st ? `${st.size}:${st.mtimeMs}` : "absent"}`);
   }
   return h.digest("hex").slice(0, 16);
@@ -32356,7 +32726,7 @@ var init_scan_cache = __esm({
 
 // src/cli/commands/scan-judge.ts
 import fs46 from "fs";
-import os40 from "os";
+import os41 from "os";
 import path51 from "path";
 function findingDedupKey(f) {
   return `${f.source.rule.name ?? "<unnamed>"}|${preview(f.input)}|${f.project}|${f.repo ?? ""}`;
@@ -32476,7 +32846,7 @@ var init_scan_judge = __esm({
           if (parent === dir2) break;
           dir2 = parent;
         }
-        const home = os40.homedir();
+        const home = os41.homedir();
         const label2 = found && found.startsWith(home) ? "~" + found.slice(home.length) : found;
         this.repos.set(cwd, label2);
         return label2;
@@ -32698,7 +33068,7 @@ var init_scan_history = __esm({
 import chalk6 from "chalk";
 import fs47 from "fs";
 import path52 from "path";
-import os41 from "os";
+import os42 from "os";
 import stringWidth2 from "string-width";
 function dayKey(ts) {
   if (!ts) return "unknown";
@@ -33151,7 +33521,7 @@ async function processClaudeProjectAsync(proj, projectsDir, judge, cache7, start
 }
 function claudeProjectLabel(dirName) {
   const name = decodeURIComponent(dirName);
-  const homeDashed = os41.homedir().replace(/\//g, "-");
+  const homeDashed = os42.homedir().replace(/\//g, "-");
   const label2 = name.startsWith(homeDashed) ? "~" + decodeProjectDirName(name.slice(homeDashed.length)) : decodeProjectDirName(name);
   return stripTerminalEscapes(label2).slice(0, 40);
 }
@@ -33262,7 +33632,7 @@ function mergeFileScan(result, file2, dedup, startDate = null) {
   }
 }
 async function scanClaudeHistoryAsync(startDate, onProgress, onLine, opts = {}) {
-  const projectsDir = path52.join(os41.homedir(), ".claude", "projects");
+  const projectsDir = path52.join(os42.homedir(), ".claude", "projects");
   const result = emptyClaudeScan();
   if (!fs47.existsSync(projectsDir)) return result;
   let projDirs;
@@ -33295,7 +33665,7 @@ async function scanClaudeHistoryAsync(startDate, onProgress, onLine, opts = {})
 }
 async function scanGeminiHistory(startDate, onProgress, onLine, opts = {}) {
   const canaryVals = safeCanaryScanValues();
-  const tmpDir = path52.join(os41.homedir(), ".gemini", "tmp");
+  const tmpDir = path52.join(os42.homedir(), ".gemini", "tmp");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -33332,7 +33702,7 @@ async function scanGeminiHistory(startDate, onProgress, onLine, opts = {}) {
     try {
       projLabel = stripTerminalEscapes(
         fs47.readFileSync(path52.join(slugPath, ".project_root"), "utf-8").trim()
-      ).replace(os41.homedir(), "~").slice(0, 40);
+      ).replace(os42.homedir(), "~").slice(0, 40);
     } catch {
     }
     const chatsDir = path52.join(slugPath, "chats");
@@ -33496,7 +33866,7 @@ async function scanGeminiHistory(startDate, onProgress, onLine, opts = {}) {
   return result;
 }
 function antigravityBrainDirs() {
-  return ["antigravity-cli", "antigravity-ide"].map((surface) => path52.join(os41.homedir(), ".gemini", surface, "brain")).filter((p) => fs47.existsSync(p));
+  return ["antigravity-cli", "antigravity-ide"].map((surface) => path52.join(os42.homedir(), ".gemini", surface, "brain")).filter((p) => fs47.existsSync(p));
 }
 function antigravityTranscriptPath(convPath) {
   const logsDir = path52.join(convPath, ".system_generated", "logs");
@@ -33633,7 +34003,7 @@ async function scanAntigravityHistory(startDate, onProgress, onLine, opts = {})
             day.bashCalls++;
             const cwd = String(input.cwd ?? "");
             if (cwd && projLabel === conv.slice(0, 8)) {
-              projLabel = stripTerminalEscapes(cwd).replace(os41.homedir(), "~").slice(0, 40);
+              projLabel = stripTerminalEscapes(cwd).replace(os42.homedir(), "~").slice(0, 40);
             }
           }
           const rawCmd = String(input.command ?? "").trimStart();
@@ -33682,7 +34052,7 @@ async function scanAntigravityHistory(startDate, onProgress, onLine, opts = {})
 }
 async function scanCopilotHistory(startDate, onProgress, onLine, opts = {}) {
   const canaryVals = safeCanaryScanValues();
-  const sessionDir = path52.join(os41.homedir(), ".copilot", "session-state");
+  const sessionDir = path52.join(os42.homedir(), ".copilot", "session-state");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -33750,7 +34120,7 @@ async function scanCopilotHistory(startDate, onProgress, onLine, opts = {}) {
       if (ev.type === "session.start") {
         const cwd = ev.data?.context?.cwd;
         if (typeof cwd === "string" && cwd) {
-          projLabel = stripTerminalEscapes(cwd).replace(os41.homedir(), "~").slice(0, 40);
+          projLabel = stripTerminalEscapes(cwd).replace(os42.homedir(), "~").slice(0, 40);
           if (path52.isAbsolute(cwd)) sessionCwd = cwd;
         }
         continue;
@@ -33907,7 +34277,7 @@ async function scanCodexHistory(startDate, onProgress, onLine, opts = {}) {
         sessionId = String(payload["id"] ?? filePath);
         startTime = String(payload["timestamp"] ?? "");
         const cwd = String(payload["cwd"] ?? "");
-        projLabel = stripTerminalEscapes(cwd.replace(os41.homedir(), "~")).slice(0, 40);
+        projLabel = stripTerminalEscapes(cwd.replace(os42.homedir(), "~")).slice(0, 40);
         if (path52.isAbsolute(cwd)) sessionCwd = cwd;
         continue;
       }
@@ -34108,12 +34478,12 @@ var init_scan = __esm({
 
 // src/tui/dashboard/data.ts
 import fs48 from "fs";
-import os42 from "os";
+import os43 from "os";
 import path53 from "path";
 import http2 from "http";
 import { execFile } from "child_process";
 function auditLogPath() {
-  return path53.join(os42.homedir(), ".node9", "audit.log");
+  return path53.join(os43.homedir(), ".node9", "audit.log");
 }
 function readAuditEntriesAsync(chunkSize = 1e3, customPath) {
   return new Promise((resolve) => {
@@ -34274,7 +34644,7 @@ async function runPostureDetached() {
     } catch {
     }
   }
-  return runPosture({ home: os42.homedir(), cwd: process.cwd() });
+  return runPosture({ home: os43.homedir(), cwd: process.cwd() });
 }
 async function loadPosture(run = runPostureDetached) {
   try {
@@ -34291,13 +34661,13 @@ async function loadPosture(run = runPostureDetached) {
   }
 }
 function shortenPath(p) {
-  const home = os42.homedir();
+  const home = os43.homedir();
   return p.startsWith(home) ? p.replace(home, "~") : p;
 }
 async function loadReportAuditAsync(period) {
-  const claudeProjectsDir = path53.join(os42.homedir(), ".claude", "projects");
+  const claudeProjectsDir = path53.join(os43.homedir(), ".claude", "projects");
   const codexSessionsDir2 = codexSessionsDir();
-  const geminiTmpDir = path53.join(os42.homedir(), ".gemini", "tmp");
+  const geminiTmpDir = path53.join(os43.homedir(), ".gemini", "tmp");
   const { start, end } = getDateRange(period, /* @__PURE__ */ new Date());
   const entries = await readAuditEntriesAsync();
   void ensurePricingLoaded();