@node9/proxy 2.51.0 → 2.53.0

package/dist/index.js

@@ -436,15 +436,15 @@ function ssrfExemptMatches(entries, normalized) {
       continue;
     }
     if (!target) continue;
-    const base2 = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
+    const base3 = bitsOf(normalizeIpLiteral(entry.slice(0, slash)) ?? "");
     const prefixText = entry.slice(slash + 1);
     const prefix = /^\d+$/.test(prefixText) ? Number(prefixText) : NaN;
-    if (!base2 || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
+    if (!base3 || !Number.isInteger(prefix) || prefix < 0 || // A v4 range never matches a v6 address, and the reverse: the widths
     // differ, so `0.0.0.0/0` does not release `::1`.
-    base2.length !== target.length || prefix > base2.length) {
+    base3.length !== target.length || prefix > base3.length) {
       continue;
     }
-    if (base2.slice(0, prefix) === target.slice(0, prefix)) return true;
+    if (base3.slice(0, prefix) === target.slice(0, prefix)) return true;
   }
   return false;
 }
@@ -498,6 +498,10 @@ function reviewsEveryAgentFileWrite(mode) {
   const level = levelOf(mode);
   return level === "strict" || level === "block-all";
 }
+function holdsSendsWithoutDaemon(mode) {
+  const level = levelOf(mode);
+  return level === "strict" || level === "block-all";
+}
 function isBlockAll(mode) {
   return levelOf(mode) === "block-all";
 }
@@ -1702,6 +1706,39 @@ function protectedLiteral(code, isProtected) {
   }
   return null;
 }
+function inlineReadPaths(language, code, preload = {}) {
+  const out = [];
+  const before = READ_BEFORE[language];
+  const after = READ_AFTER[language];
+  const assigned = /* @__PURE__ */ new Map();
+  for (const m of code.matchAll(STRING_LITERAL)) {
+    const raw = m[2].trim();
+    const value = raw.replace(/^[<+]\s*/, "");
+    if (!value) continue;
+    const head = code.slice(Math.max(0, m.index - 160), m.index);
+    const tail = code.slice(m.index + m[0].length, m.index + m[0].length + 40);
+    if (/^[>|]/.test(raw) || WRITE_MODE_AFTER.test(tail) || PERL_WRITE_BEFORE.test(head)) continue;
+    if (before.test(head) || after?.test(tail) || language === "node" && DOTENV_PATH_OPTION.test(head)) {
+      out.push(value);
+      continue;
+    }
+    const name = ASSIGNED.exec(head)?.[1];
+    if (name) assigned.set(name, [...assigned.get(name) ?? [], value]);
+  }
+  if (assigned.size > 0) {
+    const opened = /* @__PURE__ */ new Set();
+    for (const m of code.matchAll(OPENED_NAME[language])) opened.add(m[1] ?? m[2]);
+    for (const [name, values] of assigned) if (opened.has(name)) out.push(...values);
+  }
+  if (language === "python" || language === "node") {
+    const d = DOTENV[language];
+    const readsEnv = d.env.test(code);
+    const loads = /dotenv/.test(code) && d.load.test(code) && !d.literalPath.test(code);
+    if ((loads || preload.dotenv) && (readsEnv || d.values.test(code))) out.push(".env");
+    if (readsEnv) out.push(...preload.envFiles ?? []);
+  }
+  return out;
+}
 function amplifies(language, code) {
   const loop = language === "python" ? /\bwhile\s+(?:True|1)\s*:/ : language === "node" ? /\bwhile\s*\(\s*(?:true|1)\s*\)|\bfor\s*\(\s*;\s*;\s*\)|\bsetInterval\s*\(/ : /\bwhile\s*\(?\s*(?:1|true)\s*\)?|\bloop\s+do\b|\bfor\s*\(\s*;\s*;\s*\)/;
   const m = loop.exec(code);
@@ -2556,15 +2593,28 @@ function inlineExecCall(stmt, pipeFed) {
   const fromStdin = () => {
     if (stdinFed) {
       const { code, source } = stdinCodeOf(redirs);
-      return { interp, code: [code], source };
+      return { interp, code: [code], source, preload };
     }
     return { interp, code: [null], source: "pipe" };
   };
   let positionals2 = 0;
   let selectedProgram = false;
   const codes = [];
+  const preload = {};
+  const nodeFamily = inlineLanguageOf(interp) === "node";
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
+    if (nodeFamily && !selectedProgram && codes.length === 0 && a != null) {
+      const flag = NODE_VALUE_FLAG.exec(a);
+      if (flag) {
+        const value = flag[2] ?? args[++i];
+        if (value != null) {
+          if (/^--env-file/.test(flag[1])) (preload.envFiles ??= []).push(value);
+          else if (/^dotenv\/config(?:\.js)?$/.test(value)) preload.dotenv = true;
+        }
+        continue;
+      }
+    }
     if (a == null) {
       if (codes.length > 0) break;
       positionals2++;
@@ -2601,7 +2651,12 @@ function inlineExecCall(stmt, pipeFed) {
     }
   }
   if (codes.length > 0) {
-    return { interp, code: codes, source: codes.includes(null) ? "variable" : void 0 };
+    return {
+      interp,
+      code: codes,
+      source: codes.includes(null) ? "variable" : void 0,
+      preload
+    };
   }
   if (positionals2 === 0 && (stdinFed || pipeFed)) {
     if (!/^(bash|sh|zsh)$/i.test(interp)) return fromStdin();
@@ -3424,7 +3479,7 @@ function extractShellDestTokens(command) {
 }
 function analyzeFsOperation(command) {
   const normalized = normalizeCommandForPolicy(command);
-  if (!FS_OP_PRESCREEN_RE.test(normalized) && !FS_OP_PRESCREEN_RE.test(command) && !SOURCES_FILE_RE.test(command))
+  if (!FS_OP_PRESCREEN_RE.test(normalized) && !FS_OP_PRESCREEN_RE.test(command) && !SOURCES_FILE_RE.test(command) && !runsInlineInterpreter(command, normalized))
     return null;
   if (fsOpCache.has(command)) {
     const hit = fsOpCache.get(command) ?? null;
@@ -3432,7 +3487,8 @@ function analyzeFsOperation(command) {
     fsOpCache.set(command, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(command) ?? (INDIRECT_SHAPE_RE.test(command) ? structuralJailRead(command) : null);
+  const direct = analyzeFsOperationImpl(command) ?? (INDIRECT_SHAPE_RE.test(command) ? structuralJailRead(command) : null);
+  const computed = direct?.verdict === "block" || !runsInlineInterpreter(command, normalized) ? direct : stricter(direct, inlineCodeJailRead(command));
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
@@ -3441,8 +3497,8 @@ function analyzeFsOperation(command) {
   return computed;
 }
 function isSensitiveCleanupName(p) {
-  const base2 = p.replace(/^.*[\\/]/, "");
-  return /^\.env(\.|$)/i.test(base2) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base2) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base2) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base2) || /credential/i.test(p) || /secret/i.test(base2);
+  const base3 = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base3) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base3) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base3) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base3) || /credential/i.test(p) || /secret/i.test(base3);
 }
 function isWaivableCleanupTarget(p) {
   if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
@@ -4171,6 +4227,24 @@ function structuralJailRead(command) {
   }
   return review;
 }
+function inlineCodeJailRead(command) {
+  const calls = inlineExecCalls(command);
+  if (calls === PARSE_FAIL) return null;
+  let review = null;
+  for (const call of calls) {
+    const language = inlineLanguageOf(call.interp);
+    if (language === null) continue;
+    for (const code of call.code) {
+      if (code === null) continue;
+      for (const p of inlineReadPaths(language, code, call.preload)) {
+        const hit = matchSensitivePath(p);
+        if (hit?.verdict === "block") return hit;
+        review ??= hit;
+      }
+    }
+  }
+  return review;
+}
 function baseWord(w) {
   return (w ?? "").split("/").pop()?.toLowerCase() ?? "";
 }
@@ -4728,6 +4802,21 @@ function hits(access, paths, directories, context) {
   }
   return false;
 }
+function hitsNode9Dir(access, dirs, context) {
+  const home = context.homeDirs?.[0] ?? "~";
+  if (access.glob) {
+    const pattern = normalizeFilePath(access.glob, access.cwd ?? context.cwd, home);
+    const magic = pattern.search(/[*?[{]/);
+    const literal = magic < 0 ? pattern : pattern.slice(0, pattern.lastIndexOf("/", magic));
+    return dirs.some((d) => within(literal, d));
+  }
+  const candidates = access.candidates ?? [
+    normalizeFilePath(access.path, access.cwd ?? context.cwd, home)
+  ];
+  return candidates.some(
+    (p) => dirs.some((d) => within(p, d)) || access.recursive === true && dirs.some((d) => within(d, p))
+  );
+}
 function hitsSystemDir(access, context, dirs = SYSTEM_DIRS) {
   const home = context.homeDirs?.[0] ?? "~";
   const candidates = access.candidates ?? [
@@ -4768,6 +4857,7 @@ function evaluateProtectedFileAccess(accesses, context, settings) {
   const consider = (result) => {
     if (!best || RANK[result.decision] > RANK[best.decision]) best = result;
   };
+  const node9Dirs = homes.map((home) => `${home.replace(/\/$/, "")}/.node9`);
   for (const access of accesses) {
     const mutation = access.operation !== "read";
     let kind;
@@ -4796,6 +4886,10 @@ function evaluateProtectedFileAccess(accesses, context, settings) {
         "files.system-dirs",
         "review-root-home-read",
         "Reading the root account's home requires approval"
+      ] : mutation && hitsNode9Dir(access, node9Dirs, context) ? [
+        "commands.node9-disarm",
+        "review-node9-disarm",
+        "Changing node9's own files requires approval"
       ] : null;
     } catch {
       consider(incompleteFileVerdict(access.operation));
@@ -5401,9 +5495,9 @@ function validateBelgianNationalNumber(raw) {
   if (!/^\d{11}$/.test(d)) return false;
   const month = Number(d.slice(2, 4)) % 20;
   if (month !== 0 && !plausibleDate(String(month).padStart(2, "0"), d.slice(4, 6))) return false;
-  const base2 = Number(d.slice(0, 9));
+  const base3 = Number(d.slice(0, 9));
   const check = Number(d.slice(9, 11));
-  return 97 - base2 % 97 === check || 97 - (2e9 + base2) % 97 === check;
+  return 97 - base3 % 97 === check || 97 - (2e9 + base3) % 97 === check;
 }
 function validateCuit(raw) {
   const d = raw.replace(/-/g, "");
@@ -6505,9 +6599,9 @@ function evaluateGitHooksFileAccess(args, accesses, context, settings, shell) {
 }
 function agentFileKind(p) {
   const lower2 = p.toLowerCase();
-  const base2 = lower2.slice(lower2.lastIndexOf("/") + 1);
-  if (INSTRUCTION_NAMES.has(base2)) return "instructions";
-  if (base2 === "copilot-instructions.md" && lower2.endsWith("/.github/" + base2))
+  const base3 = lower2.slice(lower2.lastIndexOf("/") + 1);
+  if (INSTRUCTION_NAMES.has(base3)) return "instructions";
+  if (base3 === "copilot-instructions.md" && lower2.endsWith("/.github/" + base3))
     return "instructions";
   if (/\/\.cursor\/rules(?:\/|$)/.test(lower2)) return "instructions";
   if (/\/\.claude\/projects\/[^/]+\/memory(?:\/|$)/.test(lower2)) return "memory";
@@ -6676,7 +6770,7 @@ function evaluateAgentFileWrite(args, accesses, context, settings, shell, hooks
       skills: "agent skill",
       settings: "agent settings"
     };
-    const base2 = `${kindLabel[kind]} written: ${access.path}`;
+    const base3 = `${kindLabel[kind]} written: ${access.path}`;
     if (!signal && !every) {
       return {
         decision: "allow",
@@ -6686,14 +6780,14 @@ function evaluateAgentFileWrite(args, accesses, context, settings, shell, hooks
         path: access.path,
         operation: access.operation,
         kind,
-        reason: base2,
+        reason: base3,
         ruleDescription: "The AI writes to a file every later agent session loads as instructions.",
-        blockedByLabel: `Node9 Files: ${base2}`,
+        blockedByLabel: `Node9 Files: ${base3}`,
         tier: 2
       };
     }
     const ruleName = signal === "content" ? "review-agent-file-content" : signal === "hooks" ? "review-agent-hooks-change" : "review-agent-file-write";
-    const reason = signal ? `${base2} (${detail})` : base2;
+    const reason = signal ? `${base3} (${detail})` : base3;
     const description = signal === "content" ? "The AI writes an instruction into a file every later agent session loads: to hide something from you, to skip approvals or the guard, or to read or send a secret. It would persist past this session; confirm it is yours." : signal === "hooks" ? "The AI changes the hooks in the agent's settings. Hooks are how node9 and your other checks run before each tool call; a change here can disarm them." : "The AI writes to a file every later agent session loads as instructions (CLAUDE.md, AGENTS.md, memory, agents, commands). Confirm the change is yours.";
     return {
       decision: value === "log" ? "allow" : value,
@@ -8301,6 +8395,139 @@ function scanArgumentSecrets(args) {
     severity: "review"
   } : null;
 }
+function patternSelects(pattern, targets) {
+  const pieces = pattern.toLowerCase().split(/[\\^$.*+?()[\]{}|]+/).filter(Boolean);
+  if (pieces.length === 0) return false;
+  return targets.some((t) => pieces.every((p) => t.includes(p)));
+}
+function sourceText(bytes, pos, end) {
+  if (typeof pos !== "number" || typeof end !== "number" || pos < 0 || end < pos) return "";
+  return new TextDecoder().decode(bytes.subarray(pos, end));
+}
+function nextOperand(words, from) {
+  for (let i = from; i < words.length; i++) {
+    const w = words[i];
+    if (w !== null && w.startsWith("-")) continue;
+    return i;
+  }
+  return -1;
+}
+function node9Command(words, h) {
+  const head = base2(words[h]);
+  if (head !== "node9" && head !== "node9.cmd" && words[h] !== "@node9/proxy") return null;
+  const s = nextOperand(words, h + 1);
+  const sub = s < 0 ? "" : (words[s] ?? "").toLowerCase();
+  if (sub === "uninstall") return "node9 uninstall";
+  if (sub !== "daemon") return null;
+  const a = nextOperand(words, s + 1);
+  const action = a < 0 ? "" : (words[a] ?? "").toLowerCase();
+  return action === "stop" || action === "uninstall" ? `node9 daemon ${action}` : null;
+}
+function killsDaemon(words, texts, h, daemonPid) {
+  const head = base2(words[h]);
+  const args = words.slice(h + 1);
+  if (head === "kill") {
+    for (let i = 0; i < args.length; i++) {
+      const w = args[i];
+      if (w === "-s" || w === "-n") {
+        i++;
+        continue;
+      }
+      if (w !== null && w.startsWith("-")) continue;
+      if (w === null) {
+        if (HOME_PID_FILE_RE.test(texts[h + 1 + i] ?? "")) return "kill of the pid in daemon.pid";
+        continue;
+      }
+      if (daemonPid !== null && w === String(daemonPid)) return `kill ${w} (the node9 daemon)`;
+    }
+    return null;
+  }
+  if (head === "pkill") {
+    let full = false;
+    let pattern = null;
+    for (let i = 0; i < args.length; i++) {
+      const w = args[i];
+      if (w === null) continue;
+      if (PKILL_VALUE_FLAGS.has(w)) {
+        i++;
+        continue;
+      }
+      if (w === "--full") full = true;
+      else if (/^-[a-zA-Z]+$/.test(w) && w.includes("f")) full = true;
+      if (w.startsWith("-")) continue;
+      pattern = w;
+    }
+    if (pattern === null) return null;
+    return patternSelects(pattern, full ? DAEMON_CMDLINES : DAEMON_NAMES) ? `pkill ${full ? "-f " : ""}${pattern}` : null;
+  }
+  if (head === "killall") {
+    const regex = args.some((w) => w === "-r" || w === "--regexp");
+    for (const w of args) {
+      if (w === null || w.startsWith("-")) continue;
+      if (regex ? patternSelects(w, DAEMON_NAMES) : KILLALL_NAMES.has(w.toLowerCase()))
+        return `killall ${w}`;
+    }
+    return null;
+  }
+  if (head === "taskkill" || head === "taskkill.exe") {
+    for (let i = 0; i < args.length - 1; i++) {
+      const flag = (args[i] ?? "").toLowerCase();
+      const value = (args[i + 1] ?? "").toLowerCase();
+      if ((flag === "/im" || flag === "-im") && KILLALL_NAMES.has(value))
+        return `taskkill /IM ${value}`;
+      if ((flag === "/pid" || flag === "-pid") && daemonPid !== null && value === String(daemonPid))
+        return `taskkill /PID ${value} (the node9 daemon)`;
+    }
+  }
+  return null;
+}
+function stopsService(words, h) {
+  const head = base2(words[h]);
+  const args = words.slice(h + 1).map((w) => (w ?? "").toLowerCase());
+  if (head === "systemctl") {
+    const action = args.find((w) => STOP_SYSTEMCTL.has(w));
+    if (action && args.some((w) => /^node9-daemon(\.service)?$/.test(w)))
+      return `systemctl ${action} node9-daemon`;
+  }
+  if (head === "launchctl") {
+    const action = args.find((w) => STOP_LAUNCHCTL.has(w));
+    if (action && args.some((w) => w.includes("ai.node9.daemon")))
+      return `launchctl ${action} ai.node9.daemon`;
+  }
+  return null;
+}
+function analyzeNode9Disarm(command, daemonPid = null, depth = 0) {
+  if (depth > 3 || !NAME_PRESCREEN_RE.test(command.replace(/[\\'"]/g, ""))) return null;
+  let shown = null;
+  const bytes = new TextEncoder().encode(command);
+  try {
+    walkCommandScope(command, (node) => {
+      if (shown !== null) return false;
+      const n = node;
+      if (!n || n.kind !== "CallExpr") return true;
+      const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+      if (words.length === 0) return true;
+      const texts = (n.Args || []).map((a) => sourceText(bytes, a.pos, a.end));
+      const h = unwrapCommandHead(words);
+      shown = node9Command(words, h) ?? killsDaemon(words, texts, h, daemonPid) ?? stopsService(words, h);
+      if (shown === null) {
+        const payload = literalShellPayload(words, base2(words[0]));
+        if (payload) {
+          const inner = analyzeNode9Disarm(payload, daemonPid, depth + 1);
+          if (inner) shown = inner.reason.replace(/^node9 switched off by the agent: /, "");
+        }
+      }
+      return true;
+    });
+  } catch {
+  }
+  if (shown === null) return null;
+  return {
+    ruleName: RULE_NAME2,
+    reason: `node9 switched off by the agent: ${shown}`,
+    description: DESCRIPTION
+  };
+}
 function catalogSettings(config) {
   return catalogSettingsFromConfig(config.settings, config.policy);
 }
@@ -8394,6 +8621,10 @@ function egressPolicyVerdict(eg) {
   };
 }
 async function evaluatePolicy(config, toolName, args, context = {}, hostHooks = {}) {
+  const v = await evaluatePolicyVerdict(config, toolName, args, context, hostHooks);
+  return v.decision === "block" && v.checkId !== void 0 && NOT_OVERRIDABLE_CHECKS.has(v.checkId) ? { ...v, overridable: false } : v;
+}
+async function evaluatePolicyVerdict(config, toolName, args, context = {}, hostHooks = {}) {
   let protectedVerdict = null;
   const layers = inspectionLayers(config.policy);
   if (context.agent !== "Terminal") {
@@ -8451,7 +8682,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hostHooks =
 }
 async function evaluatePolicyCore(config, toolName, args, context = {}, hooks = {}) {
   const { agent, cwd, activeEnvironment } = context;
-  const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2, isConfiguredRegistry, isGitWorkTreeTop: isGitWorkTreeTop2 } = hooks;
+  const { checkProvenance: checkProvenance2, isTrustedHost: isTrustedHost2, isConfiguredRegistry, isGitWorkTreeTop: isGitWorkTreeTop2, daemonPid } = hooks;
   const settingsView = catalogSettings(config);
   const layers = inspectionLayers(config.policy);
   const cv = (id) => checkValue(settingsView, id);
@@ -8636,6 +8867,23 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
         else if (v && !pendingAstReview) pendingAstReview = v;
       }
     }
+    if (cv("commands.node9-disarm") !== "off") {
+      const finding = analyzeNode9Disarm(bashCommand, daemonPid?.() ?? null);
+      if (finding) {
+        const v = applyCheckValue(cv("commands.node9-disarm"), {
+          decision: "review",
+          blockedByLabel: `Node9 (AST): ${finding.ruleName}`,
+          reason: finding.reason,
+          tier: 2,
+          ruleName: finding.ruleName,
+          ruleDescription: finding.description,
+          checkId: "commands.node9-disarm"
+        });
+        if (v?.logged) noteLogged(v);
+        else if (v?.decision === "block") return v;
+        else if (v && !pendingAstReview) pendingAstReview = v;
+      }
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
@@ -9083,8 +9331,8 @@ function hasRoutingNumber(text) {
   }
   return false;
 }
-function* validCardRuns(text, base2, exemptFractions = true) {
-  const re = new RegExp(base2.source, "g");
+function* validCardRuns(text, base3, exemptFractions = true) {
+  const re = new RegExp(base3.source, "g");
   let m;
   while ((m = re.exec(text)) !== null) {
     const digits = m[0].replace(/\D/g, "");
@@ -9097,17 +9345,17 @@ function* validCardRuns(text, base2, exemptFractions = true) {
   }
 }
 function hasValidCard(text) {
-  for (const base2 of CARD_PATTERNS) {
-    if (!validCardRuns(text, base2).next().done) return true;
+  for (const base3 of CARD_PATTERNS) {
+    if (!validCardRuns(text, base3).next().done) return true;
   }
   return false;
 }
 function replaceValidCards(text, replace, { exemptFractions = true } = {}) {
   let out = text;
-  for (const base2 of CARD_PATTERNS) {
+  for (const base3 of CARD_PATTERNS) {
     let res = "";
     let last = 0;
-    for (const run of validCardRuns(out, base2, exemptFractions)) {
+    for (const run of validCardRuns(out, base3, exemptFractions)) {
       res += out.slice(last, run.index) + replace(run.digits);
       last = run.index + run.length;
     }
@@ -9348,9 +9596,9 @@ function maskLeaf(value, key, depth) {
     const used = /* @__PURE__ */ new Set();
     return Object.fromEntries(
       Object.entries(value).map(([k, v]) => {
-        const base2 = maskPersonalData(k);
-        let name = base2;
-        for (let n = 2; used.has(name); n++) name = `${base2}#${n}`;
+        const base3 = maskPersonalData(k);
+        let name = base3;
+        for (let n = 2; used.has(name); n++) name = `${base3}#${n}`;
         used.add(name);
         return [name, maskLeaf(v, k, depth + 1)];
       })
@@ -9844,7 +10092,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto2, import_crypto3, import_crypto4, import_crypto5, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto2, import_crypto3, import_crypto4, import_crypto5, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, READ_CALL, ARG, WRAP, STR_PREFIX, WRITE_MODE_LITERAL, WRITE_MODE, WRITE_MODE_AFTER, PERL_WRITE_BEFORE, readCallBefore, READ_BEFORE, READ_AFTER, ASSIGNED, openedName, OPENED_NAME, DOTENV, DOTENV_PATH_OPTION, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NODE_VALUE_FLAG, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, INLINE_INTERP_PRESCREEN_RE, runsInlineInterpreter, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, RULE_NAME2, DESCRIPTION, DAEMON_CMDLINES, DAEMON_NAMES, KILLALL_NAMES, STOP_SYSTEMCTL, STOP_LAUNCHCTL, PKILL_VALUE_FLAGS, NAME_PRESCREEN_RE, base2, HOME_PID_FILE_RE, VERDICT_RANK, SQL_DML_KEYWORDS, NOT_OVERRIDABLE_CHECKS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -11854,7 +12102,7 @@ var init_dist = __esm({
         advice: "Fixed at Review for now."
       },
       "commands.node9-disarm": {
-        plain: "The agent runs a node9 command that would switch off a protection: clear a session flag, trust an address, pause the gate, weaken a shield.",
+        plain: "The agent switches node9 off or weakens it: stops or kills the daemon, stops its service, uninstalls node9, changes files in ~/.node9, clears a session flag, trusts an address, pauses the gate, weakens a shield.",
         example: "After reading a web page, the agent runs node9 session-exposure clear --all",
         advice: "Keep Review: these are your commands to run. Block if the agent should never touch node9."
       },
@@ -12167,7 +12415,7 @@ var init_dist = __esm({
         group: "commands",
         owasp: "ASI10",
         title: "node9 disarmed from the shell",
-        catches: "a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield, run by the agent",
+        catches: "the agent stopping or killing the node9 daemon, stopping its service, uninstalling node9, changing files in ~/.node9, or running a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield",
         values: ALL,
         defaultValue: "review",
         legacy: ["review-node9-disarm"]
@@ -13048,6 +13296,62 @@ var init_dist = __esm({
       php: PHP
     };
     STRING_LITERAL = /(['"`])((?:\\.|(?!\1)[^\\\n]){1,4096})\1/g;
+    READ_CALL = {
+      python: String.raw`(?:\b(?:io|codecs)\.)?\bopen|\b(?:dotenv_values|load_dotenv|get_key|read_file|loadtxt|read_csv)`,
+      node: String.raw`\b(?:readFileSync|readFile|createReadStream|readTextFile(?:Sync)?|readFileStr|openSync|file)`,
+      perl: String.raw`\b(?:open|sysopen|read_file|slurp)`,
+      ruby: String.raw`\b(?:File|IO)\.(?:read|binread|readlines|foreach|open)|\bDotenv\.(?:load|parse|overload)`,
+      php: String.raw`\b(?:file_get_contents|fopen|file|readfile|parse_ini_file|highlight_file|show_source)`
+    };
+    ARG = String.raw`(?:(?:(?:my|our|local)\s+)?[\w.$]+(?:\s*\(\s*\))?|'[^'\n]{0,8}'|"[^"\n]{0,8}")\s*,\s*`;
+    WRAP = String.raw`(?:(?:new\s+)?[\w.$]+\s*\(\s*(?:${ARG}){0,3}){0,3}`;
+    STR_PREFIX = String.raw`[rRbBuUfF]{0,2}`;
+    WRITE_MODE_LITERAL = String.raw`['"](?=[rbtU+]*w|(?![^'"]*\+)[rbtU]*[ax])[rwaxbtU+]{1,4}['"]`;
+    WRITE_MODE = String.raw`\s*,\s*(?:mode\s*=\s*)?${WRITE_MODE_LITERAL}`;
+    WRITE_MODE_AFTER = new RegExp(`^(?:\\s*\\)){0,3}${WRITE_MODE}`);
+    PERL_WRITE_BEFORE = /['"]\s*(?:\+?[>|]|>>)\s*['"]\s*,\s*$/;
+    readCallBefore = (language) => new RegExp(
+      String.raw`(?:${READ_CALL[language]})(?![\w$])\s*\(?\s*(?:${ARG}){0,3}${WRAP}${STR_PREFIX}$`
+    );
+    READ_BEFORE = {
+      python: readCallBefore("python"),
+      node: readCallBefore("node"),
+      perl: readCallBefore("perl"),
+      ruby: readCallBefore("ruby"),
+      php: readCallBefore("php")
+    };
+    READ_AFTER = {
+      python: new RegExp(
+        String.raw`^\s*\)\s*\.\s*(?:read_text|read_bytes|open)\s*\((?!\s*(?:mode\s*=\s*)?${WRITE_MODE_LITERAL})`
+      )
+    };
+    ASSIGNED = new RegExp(String.raw`([$\w]+)\s*=\s*${WRAP}${STR_PREFIX}$`);
+    openedName = (language) => new RegExp(
+      String.raw`(?:${READ_CALL[language]})(?![\w$])\s*\(?\s*(?:${ARG}){0,3}${WRAP}([$\w]+)(?!${WRITE_MODE})\s*[),]` + (language === "python" ? String.raw`|\bPath\s*\(\s*([$\w]+)\s*\)\s*\.\s*(?:read_text|read_bytes|open)\s*\(` : ""),
+      "g"
+    );
+    OPENED_NAME = {
+      python: openedName("python"),
+      node: openedName("node"),
+      perl: openedName("perl"),
+      ruby: openedName("ruby"),
+      php: openedName("php")
+    };
+    DOTENV = {
+      node: {
+        load: /\brequire\s*\(\s*['"`]dotenv(?:\/config)?['"`]\s*\)|\bimport\s*(?:[\w${}\s,*]+\s+from\s*)?['"`]dotenv(?:\/config)?['"`]|\bimport\s*\(\s*['"`]dotenv(?:\/config)?['"`]\s*\)/,
+        values: /\.parsed\b|[(,]\s*(?:require\s*\(\s*['"`]dotenv['"`]\s*\)|dotenv)\s*\.\s*config\s*\(/,
+        env: /\b(?:process|Deno|Bun)\s*\.\s*env\b/,
+        literalPath: /\bconfig\s*\(\s*\{[^)]*\bpath\s*:\s*['"`]/
+      },
+      python: {
+        load: /\b(?:load_dotenv|dotenv_values|get_key)\s*\(/,
+        values: /\b(?:dotenv_values|get_key)\s*\(/,
+        env: /\b(?:environ|getenv)\b/,
+        literalPath: /\b(?:load_dotenv|dotenv_values)\s*\(\s*(?:dotenv_path\s*=\s*)?[rRbBuU]?['"]/
+      }
+    };
+    DOTENV_PATH_OPTION = /\bconfig\s*\(\s*\{[^)]*\bpath\s*:\s*$/;
     sharedParser = lazy(() => getSyntax().NewParser());
     MESSAGE_FLAGS = /* @__PURE__ */ new Set([
       "-m",
@@ -13842,6 +14146,7 @@ var init_dist = __esm({
       "rmdir"
     ]);
     INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
+    NODE_VALUE_FLAG = /^(-r|--require|--import|--loader|--experimental-loader|--env-file|--env-file-if-exists|--input-type|-C|--conditions)(?:=(.*))?$/;
     MAX_PAYLOAD_NESTING = 8;
     payloadNesting = 0;
     MAX_INLINE_CALLS = 16;
@@ -14090,6 +14395,8 @@ var init_dist = __esm({
     JAILED_DIR_NAMES = [".ssh", ".aws"];
     shellGlob = (p) => p.replace(/\[!/g, "[^");
     GLOB_META = /(?<!\\)[*?[]/;
+    INLINE_INTERP_PRESCREEN_RE = /(?:^|[^\w-])(?:python|node|tsx|ts-node|deno|bun|perl|ruby|irb|php)(?![A-Za-z_])/i;
+    runsInlineInterpreter = (command, normalized) => INLINE_INTERP_PRESCREEN_RE.test(command) || INLINE_INTERP_PRESCREEN_RE.test(normalized);
     isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(baseWord(w));
     positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
     NONE = { kind: "none" };
@@ -17405,9 +17712,9 @@ zoo`.split("\n");
           const name = n.Name.Value;
           if (n.Append) {
             const prev = this.appended.has(name) ? this.appended.get(name) : resolveWordLiteral(n.Value) === null ? null : void 0;
-            const base2 = prev === void 0 ? recordedExpansion(name) : prev;
+            const base3 = prev === void 0 ? recordedExpansion(name) : prev;
             const piece = resolveWordLiteral(n.Value);
-            this.appended.set(name, typeof base2 === "string" && piece !== null ? base2 + piece : null);
+            this.appended.set(name, typeof base3 === "string" && piece !== null ? base3 + piece : null);
             this.treeTopVars.delete(name);
             return true;
           }
@@ -18923,12 +19230,50 @@ ${text}` : text);
       const char = value[index] ?? "";
       return RUN_CHAR.test(char) || char !== "" && isInvisibleChar(char);
     };
+    RULE_NAME2 = "review-node9-disarm";
+    DESCRIPTION = "The AI wants to stop node9, remove it, or change its own files. These are your commands to run, not the agent's: with the daemon stopped the outside-content and taint checks are off.";
+    DAEMON_CMDLINES = [
+      "node /usr/lib/node_modules/@node9/proxy/dist/cli.js daemon start",
+      "node9 daemon start"
+    ];
+    DAEMON_NAMES = ["node", "node9"];
+    KILLALL_NAMES = /* @__PURE__ */ new Set(["node", "node9", "node.exe", "node9.exe"]);
+    STOP_SYSTEMCTL = /* @__PURE__ */ new Set(["stop", "disable", "mask", "kill"]);
+    STOP_LAUNCHCTL = /* @__PURE__ */ new Set(["unload", "bootout", "remove", "stop", "kill", "disable"]);
+    PKILL_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "-u",
+      "-U",
+      "-g",
+      "-G",
+      "-P",
+      "-s",
+      "-t",
+      "-F",
+      "--signal",
+      "--euid",
+      "--uid",
+      "--pgroup",
+      "--group",
+      "--parent",
+      "--session",
+      "--terminal",
+      "--pidfile",
+      "--ns",
+      "--nslist"
+    ]);
+    NAME_PRESCREEN_RE = /node9|kill|systemctl|launchctl|daemon/i;
+    base2 = (w) => (w ?? "").split(/[\\/]/).pop()?.toLowerCase() ?? "";
+    HOME_PID_FILE_RE = /(?:^|[\s"'(=`])(?:~|\$HOME|\$\{HOME\}|\/home\/[^/\s]+|\/Users\/[^/\s]+|\/root)\/\.node9\/daemon\.pid/;
     VERDICT_RANK = {
       allow: 0,
       review: 1,
       block: 2
     };
     SQL_DML_KEYWORDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "merge", "upsert"]);
+    NOT_OVERRIDABLE_CHECKS = /* @__PURE__ */ new Set([
+      "data.credential-files",
+      "data.credential-files-other"
+    ]);
     MAX_DESTINATIONS = 200;
     MAX_SCAN_CHARS = 1e5;
     EMAIL_RE = /[\p{L}\p{N}._%+-]+@[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?(?:\.[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?)*\.\p{L}{2,}/gu;
@@ -20347,8 +20692,8 @@ function safeApiUrl(raw, onReject) {
 function sanitizeSsrfAllow(entries, source) {
   const kept = [];
   for (const entry of entries) {
-    const base2 = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
-    const m = classifySsrf(base2);
+    const base3 = entry.includes("/") ? entry.slice(0, entry.indexOf("/")).trim() : entry;
+    const m = classifySsrf(base3);
     if (m && !m.overridable) {
       const what = entry.includes("/") ? "covers only protected addresses" : "is a protected address";
       process.emitWarning(
@@ -21448,12 +21793,12 @@ function getConfig(cwd) {
         continue;
       explicit[id] = v;
     }
-    const base2 = resolveCheckMap({
+    const base3 = resolveCheckMap({
       ...catalogSettingsFrom(mergedSettings, mergedPolicy),
       checks: explicit
     });
     for (const [id, v] of Object.entries(v2ChecksByPath.get(projectPath)?.checks ?? {})) {
-      if (CHECK_VERDICT_RANK[v] > CHECK_VERDICT_RANK[base2[id] ?? "off"]) {
+      if (CHECK_VERDICT_RANK[v] > CHECK_VERDICT_RANK[base3[id] ?? "off"]) {
         explicit[id] = v;
         checkSources[id] = "project";
       }
@@ -21605,7 +21950,7 @@ init_dist();
 // src/policy/index.ts
 init_cjs_shims();
 init_dist();
-var import_fs14 = __toESM(require("fs"));
+var import_fs15 = __toESM(require("fs"));
 
 // src/utils/read-capped.ts
 init_cjs_shims();
@@ -21649,10 +21994,42 @@ function readCappedText(file2, maxBytes, openFlags = "r") {
 
 // src/policy/index.ts
 var import_path14 = __toESM(require("path"));
+var import_os10 = __toESM(require("os"));
 
-// src/dlp.ts
+// src/utils/read-small-file.ts
 init_cjs_shims();
 var import_fs7 = __toESM(require("fs"));
+function readSmallFile(file2, maxBytes) {
+  let fd;
+  try {
+    fd = import_fs7.default.openSync(file2, import_fs7.default.constants.O_RDONLY | (import_fs7.default.constants.O_NONBLOCK ?? 0));
+  } catch {
+    return null;
+  }
+  try {
+    const st = import_fs7.default.fstatSync(fd);
+    if (!st.isFile() || st.size > maxBytes) return null;
+    const buf = Buffer.alloc(Math.min(st.size, maxBytes));
+    let read2 = 0;
+    while (read2 < buf.length) {
+      const n = import_fs7.default.readSync(fd, buf, read2, buf.length - read2, read2);
+      if (n === 0) break;
+      read2 += n;
+    }
+    return buf.toString("utf8", 0, read2);
+  } catch {
+    return null;
+  } finally {
+    import_fs7.default.closeSync(fd);
+  }
+}
+
+// src/policy/index.ts
+init_forecast_context();
+
+// src/dlp.ts
+init_cjs_shims();
+var import_fs8 = __toESM(require("fs"));
 var import_path6 = __toESM(require("path"));
 init_dist();
 init_dist();
@@ -21661,7 +22038,7 @@ function scanFilePath(filePath, cwd = process.cwd(), options = {}) {
   let resolved;
   try {
     const absolute2 = import_path6.default.resolve(cwd, filePath);
-    resolved = import_fs7.default.realpathSync.native(absolute2);
+    resolved = import_fs8.default.realpathSync.native(absolute2);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -21887,7 +22264,7 @@ function combineWithEngine(gates, engine, opts = { panicMode: false }) {
 
 // src/policy/file-access.ts
 init_cjs_shims();
-var import_fs8 = __toESM(require("fs"));
+var import_fs9 = __toESM(require("fs"));
 var import_os6 = __toESM(require("os"));
 var import_path7 = __toESM(require("path"));
 init_dist();
@@ -21902,13 +22279,13 @@ function physical(p, followFinal, links = 0) {
     return { path: `${parent.path}/${import_path7.default.basename(p)}`, missing: parent.missing };
   }
   try {
-    return { path: import_fs8.default.realpathSync.native(p), missing: false };
+    return { path: import_fs9.default.realpathSync.native(p), missing: false };
   } catch (error) {
     const code = error.code;
     if (!["ENOENT", "ENOTDIR"].includes(code ?? "")) throw error;
     try {
-      if (import_fs8.default.lstatSync(p).isSymbolicLink()) {
-        const target = import_fs8.default.readlinkSync(p);
+      if (import_fs9.default.lstatSync(p).isSymbolicLink()) {
+        const target = import_fs9.default.readlinkSync(p);
         return physical(
           import_path7.default.isAbsolute(target) ? target : `${import_path7.default.dirname(p)}/${target}`,
           true,
@@ -21948,14 +22325,14 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
     const raw = absoluteSpelling(access.path, access.cwd ?? cwd, home);
     if (access.directoryTarget) {
       try {
-        if (!import_fs8.default.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
+        if (!import_fs9.default.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
           continue;
       } catch {
       }
     }
     if (access.operation === "create") {
       try {
-        import_fs8.default.statSync(raw);
+        import_fs9.default.statSync(raw);
         continue;
       } catch {
       }
@@ -22011,7 +22388,7 @@ init_dist();
 
 // src/supply-chain/osv-index.ts
 init_cjs_shims();
-var import_fs10 = __toESM(require("fs"));
+var import_fs11 = __toESM(require("fs"));
 var import_os7 = __toESM(require("os"));
 var import_path9 = __toESM(require("path"));
 var import_crypto8 = require("crypto");
@@ -22019,27 +22396,27 @@ init_dist();
 
 // src/utils/atomic-write.ts
 init_cjs_shims();
-var import_fs9 = __toESM(require("fs"));
+var import_fs10 = __toESM(require("fs"));
 var import_path8 = __toESM(require("path"));
 var import_crypto7 = require("crypto");
 function atomicWriteSync(filePath, data, options) {
   const dir2 = import_path8.default.dirname(filePath);
-  if (!import_fs9.default.existsSync(dir2)) import_fs9.default.mkdirSync(dir2, { recursive: true });
+  if (!import_fs10.default.existsSync(dir2)) import_fs10.default.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${filePath}.${(0, import_crypto7.randomUUID)()}.tmp`;
   try {
-    import_fs9.default.writeFileSync(tmpPath, data, options);
+    import_fs10.default.writeFileSync(tmpPath, data, options);
   } catch (err) {
     try {
-      import_fs9.default.unlinkSync(tmpPath);
+      import_fs10.default.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
   }
   try {
-    import_fs9.default.renameSync(tmpPath, filePath);
+    import_fs10.default.renameSync(tmpPath, filePath);
   } catch (err) {
     try {
-      import_fs9.default.unlinkSync(tmpPath);
+      import_fs10.default.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
@@ -22075,7 +22452,7 @@ function shardPath(eco, shard) {
 }
 function readMeta(eco) {
   try {
-    const m = JSON.parse(import_fs10.default.readFileSync(import_path9.default.join(ecoDir(eco), "meta.json"), "utf8"));
+    const m = JSON.parse(import_fs11.default.readFileSync(import_path9.default.join(ecoDir(eco), "meta.json"), "utf8"));
     if (typeof m?.syncedAt !== "string" || typeof m?.lastModifiedMs !== "number") return null;
     return m;
   } catch {
@@ -22084,7 +22461,7 @@ function readMeta(eco) {
 }
 function readShard(eco, shard) {
   try {
-    const s = JSON.parse(import_fs10.default.readFileSync(shardPath(eco, shard), "utf8"));
+    const s = JSON.parse(import_fs11.default.readFileSync(shardPath(eco, shard), "utf8"));
     return s && typeof s === "object" && !Array.isArray(s) ? s : {};
   } catch {
     return {};
@@ -22194,15 +22571,15 @@ async function fetchJson(url, opts) {
 // src/supply-chain/osv-online.ts
 var TIMEOUT_MS = 2500;
 async function queryOsvMalicious(queries) {
-  const base2 = endpoints().osvApi;
-  if (!base2 || queries.length === 0) return null;
+  const base3 = endpoints().osvApi;
+  if (!base3 || queries.length === 0) return null;
   const body = JSON.stringify({
     queries: queries.map((q) => ({
       package: { name: q.name, ecosystem: q.ecosystem },
       ...q.version ? { version: q.version } : {}
     }))
   });
-  const res = await fetchJson(`${base2}/v1/querybatch`, {
+  const res = await fetchJson(`${base3}/v1/querybatch`, {
     timeoutMs: TIMEOUT_MS,
     maxBytes: 1024 * 1024,
     body
@@ -22263,9 +22640,9 @@ function pypiRepoOf(doc) {
   return null;
 }
 async function npmSourceRepo(name, version) {
-  const base2 = endpoints().npmRegistry;
-  if (!base2) return "unknown";
-  const url = `${base2}/-/npm/v1/attestations/${name.replaceAll("/", "%2F")}@${encodeURIComponent(version)}`;
+  const base3 = endpoints().npmRegistry;
+  if (!base3) return "unknown";
+  const url = `${base3}/-/npm/v1/attestations/${name.replaceAll("/", "%2F")}@${encodeURIComponent(version)}`;
   return read(url, npmRepoOf);
 }
 async function read(url, repoOf) {
@@ -22278,9 +22655,9 @@ async function read(url, repoOf) {
   }
 }
 async function pypiSourceRepo(name, version, filename) {
-  const base2 = endpoints().pypi;
-  if (!base2) return "unknown";
-  const url = `${base2}/integrity/${encodeURIComponent(name)}/${encodeURIComponent(version)}/${encodeURIComponent(filename)}/provenance`;
+  const base3 = endpoints().pypi;
+  if (!base3) return "unknown";
+  const url = `${base3}/integrity/${encodeURIComponent(name)}/${encodeURIComponent(version)}/${encodeURIComponent(filename)}/provenance`;
   return read(url, pypiRepoOf);
 }
 var PYPI_FINAL = /^\d+(?:\.\d+)*$/;
@@ -22325,9 +22702,9 @@ async function npmVersionDocument(url, selector) {
   };
 }
 async function npmInfo(name, version, freshWindowMs, raw) {
-  const base2 = endpoints().npmRegistry;
-  if (!base2) return null;
-  const url = `${base2}/${name.replaceAll("/", "%2F")}`;
+  const base3 = endpoints().npmRegistry;
+  if (!base3) return null;
+  const url = `${base3}/${name.replaceAll("/", "%2F")}`;
   const aliasStart = raw?.indexOf("@npm:") ?? -1;
   const target = aliasStart > 0 ? raw.slice(aliasStart + 5) : raw?.replace(/^npm:/, "");
   const specStart = target?.indexOf("@", 1) ?? -1;
@@ -22395,9 +22772,9 @@ async function npmInfo(name, version, freshWindowMs, raw) {
   return info;
 }
 async function pypiInfo(name, version) {
-  const base2 = endpoints().pypi;
-  if (!base2) return null;
-  const url = version ? `${base2}/pypi/${encodeURIComponent(name)}/${encodeURIComponent(version)}/json` : `${base2}/pypi/${encodeURIComponent(name)}/json`;
+  const base3 = endpoints().pypi;
+  if (!base3) return null;
+  const url = version ? `${base3}/pypi/${encodeURIComponent(name)}/${encodeURIComponent(version)}/json` : `${base3}/pypi/${encodeURIComponent(name)}/json`;
   const doc = await fetchJson(url, { timeoutMs: TIMEOUT_MS3, maxBytes: MAX_BYTES2 });
   if (!doc?.info?.version) return null;
   const times = (doc.urls ?? []).map((u) => u.upload_time_iso_8601 ? Date.parse(u.upload_time_iso_8601) : NaN).filter((t) => Number.isFinite(t));
@@ -22421,9 +22798,9 @@ function pypiHistoryOf(releases, version) {
   };
 }
 async function pypiHistory(name, version) {
-  const base2 = endpoints().pypi;
-  if (!base2) return null;
-  const doc = await fetchJson(`${base2}/pypi/${encodeURIComponent(name)}/json`, {
+  const base3 = endpoints().pypi;
+  if (!base3) return null;
+  const doc = await fetchJson(`${base3}/pypi/${encodeURIComponent(name)}/json`, {
     timeoutMs: TIMEOUT_MS3,
     maxBytes: MAX_BYTES2
   });
@@ -22438,7 +22815,7 @@ async function registryInfo(eco, name, version, freshWindowMs, raw) {
 
 // src/supply-chain/local-resolve.ts
 init_cjs_shims();
-var import_fs11 = __toESM(require("fs"));
+var import_fs12 = __toESM(require("fs"));
 var import_path10 = __toESM(require("path"));
 var MAX_LEVELS = 32;
 var LOCAL_FIRST_MANAGERS = /* @__PURE__ */ new Set(["npx", "bunx", "npm exec"]);
@@ -22450,7 +22827,7 @@ function resolveInstalled(name, cwd) {
     const pkgDir = import_path10.default.join(dir2, "node_modules", ...name.split("/"));
     const manifest = import_path10.default.join(pkgDir, "package.json");
     try {
-      const raw = import_fs11.default.readFileSync(manifest, "utf8");
+      const raw = import_fs12.default.readFileSync(manifest, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
         return { version: parsed.version, dir: pkgDir };
@@ -22727,7 +23104,7 @@ async function runPackageCheck(toolName, args, cfg, cwd, opts = {}) {
 init_cjs_shims();
 var import_os8 = __toESM(require("os"));
 var import_path12 = __toESM(require("path"));
-var import_fs12 = __toESM(require("fs"));
+var import_fs13 = __toESM(require("fs"));
 init_dist();
 var MAX_CONFIG_BYTES = 256 * 1024;
 var MAX_PARENT_DIRS = 12;
@@ -22853,7 +23230,7 @@ function configuredRegistryHosts(cwd, env = process.env, home = import_os8.defau
     const r = readCappedText(
       file2,
       MAX_CONFIG_BYTES,
-      import_fs12.default.constants.O_RDONLY | (import_fs12.default.constants.O_NONBLOCK ?? 0)
+      import_fs13.default.constants.O_RDONLY | (import_fs13.default.constants.O_NONBLOCK ?? 0)
     );
     if (r) hostsInText(r.text, hosts);
   }
@@ -22863,7 +23240,7 @@ function configuredRegistryHosts(cwd, env = process.env, home = import_os8.defau
 
 // src/utils/provenance.ts
 init_cjs_shims();
-var import_fs13 = __toESM(require("fs"));
+var import_fs14 = __toESM(require("fs"));
 var import_path13 = __toESM(require("path"));
 var import_os9 = __toESM(require("os"));
 var SYSTEM_PREFIXES = ["/usr/bin", "/usr/sbin", "/bin", "/sbin"];
@@ -22883,7 +23260,7 @@ function findInPath(cmd) {
     if (!dir2) continue;
     const full = import_path13.default.join(dir2, cmd);
     try {
-      import_fs13.default.accessSync(full, import_fs13.default.constants.X_OK);
+      import_fs14.default.accessSync(full, import_fs14.default.constants.X_OK);
       return full;
     } catch {
     }
@@ -22928,7 +23305,7 @@ function checkProvenance(cmd, cwd) {
         reason: "binary not found in PATH"
       };
     }
-    resolved = import_fs13.default.realpathSync(found);
+    resolved = import_fs14.default.realpathSync(found);
   } catch {
     return {
       resolvedPath: cmd,
@@ -22937,7 +23314,7 @@ function checkProvenance(cmd, cwd) {
     };
   }
   try {
-    const stat = import_fs13.default.statSync(resolved);
+    const stat = import_fs14.default.statSync(resolved);
     if (stat.mode & 2) {
       return {
         resolvedPath: resolved,
@@ -22986,14 +23363,26 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
       isTrustedHost: config.policy.trustedHostsManaged ? (host2) => matchesTrustedHost(host2, config.policy.trustedHosts) : isTrustedHost,
       readAgentSettings,
       isConfiguredRegistry: (host2, at) => configuredRegistryHosts(at).has(host2),
-      isGitWorkTreeTop
+      isGitWorkTreeTop,
+      daemonPid: daemonPidFromFile
     }
   );
 }
+function daemonPidFromFile() {
+  if (forecastRun()) return null;
+  const text = readSmallFile(import_path14.default.join(import_os10.default.homedir(), ".node9", "daemon.pid"), 4096);
+  if (text === null) return null;
+  try {
+    const pid = JSON.parse(text).pid;
+    return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && pid <= 4194304 ? pid : null;
+  } catch {
+    return null;
+  }
+}
 function isGitWorkTreeTop(dir2, cwd) {
   if (!import_path14.default.isAbsolute(cwd)) return true;
   try {
-    return import_fs14.default.existsSync(import_path14.default.join(import_path14.default.resolve(cwd, dir2), ".git"));
+    return import_fs15.default.existsSync(import_path14.default.join(import_path14.default.resolve(cwd, dir2), ".git"));
   } catch {
     return true;
   }
@@ -23003,7 +23392,7 @@ function readAgentSettings(absPath) {
   const r = readCappedText(
     absPath,
     MAX_AGENT_SETTINGS_BYTES,
-    import_fs14.default.constants.O_RDONLY | (import_fs14.default.constants.O_NONBLOCK ?? 0)
+    import_fs15.default.constants.O_RDONLY | (import_fs15.default.constants.O_NONBLOCK ?? 0)
   );
   return r && !r.truncated ? r.text : null;
 }
@@ -23013,12 +23402,12 @@ function isIgnoredTool2(toolName) {
 
 // src/auth/state.ts
 init_cjs_shims();
-var import_fs15 = __toESM(require("fs"));
+var import_fs16 = __toESM(require("fs"));
 var import_path15 = __toESM(require("path"));
-var import_os10 = __toESM(require("os"));
+var import_os11 = __toESM(require("os"));
 init_forecast_context();
-var PAUSED_FILE = import_path15.default.join(import_os10.default.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = import_path15.default.join(import_os10.default.homedir(), ".node9", "trust.json");
+var PAUSED_FILE = import_path15.default.join(import_os11.default.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = import_path15.default.join(import_os11.default.homedir(), ".node9", "trust.json");
 function extractCommandPattern(toolName, args) {
   const lower2 = toolName.toLowerCase();
   if (lower2 !== "bash" && lower2 !== "execute_bash" && lower2 !== "shell") return void 0;
@@ -23031,11 +23420,11 @@ function extractCommandPattern(toolName, args) {
 function checkPause() {
   if (forecastRun()) return { paused: false };
   try {
-    if (!import_fs15.default.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(import_fs15.default.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!import_fs16.default.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(import_fs16.default.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        import_fs15.default.unlinkSync(PAUSED_FILE);
+        import_fs16.default.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -23048,8 +23437,8 @@ function checkPause() {
 function getActiveTrustSession(toolName, args) {
   if (forecastRun()) return false;
   try {
-    if (!import_fs15.default.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(import_fs15.default.readFileSync(TRUST_FILE, "utf-8"));
+    if (!import_fs16.default.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(import_fs16.default.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
@@ -23072,8 +23461,8 @@ function writeTrustSession(toolName, durationMs, args) {
   try {
     let trust = { entries: [] };
     try {
-      if (import_fs15.default.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(import_fs15.default.readFileSync(TRUST_FILE, "utf-8"));
+      if (import_fs16.default.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(import_fs16.default.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -23095,9 +23484,9 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = import_path15.default.join(import_os10.default.homedir(), ".node9", "decisions.json");
-    if (!import_fs15.default.existsSync(file2)) return null;
-    const decisions = JSON.parse(import_fs15.default.readFileSync(file2, "utf-8"));
+    const file2 = import_path15.default.join(import_os11.default.homedir(), ".node9", "decisions.json");
+    if (!import_fs16.default.existsSync(file2)) return null;
+    const decisions = JSON.parse(import_fs16.default.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
@@ -23107,16 +23496,16 @@ function getPersistentDecision(toolName) {
 
 // src/auth/daemon.ts
 init_cjs_shims();
-var import_fs17 = __toESM(require("fs"));
+var import_fs18 = __toESM(require("fs"));
 var import_http = __toESM(require("http"));
 var import_net4 = __toESM(require("net"));
 var import_path17 = __toESM(require("path"));
-var import_os11 = __toESM(require("os"));
+var import_os12 = __toESM(require("os"));
 init_forecast_context();
 
 // src/utils/activity-socket.ts
 init_cjs_shims();
-var import_fs16 = __toESM(require("fs"));
+var import_fs17 = __toESM(require("fs"));
 var import_path16 = __toESM(require("path"));
 
 // src/utils/own-dir.ts
@@ -23126,7 +23515,7 @@ init_cjs_shims();
 var currentUid = () => typeof process.getuid === "function" ? process.getuid() : void 0;
 function isPrivateDir(dir2, uid = currentUid()) {
   try {
-    const st = import_fs16.default.lstatSync(dir2);
+    const st = import_fs17.default.lstatSync(dir2);
     if (st.isSymbolicLink() || !st.isDirectory()) return false;
     if (uid !== void 0 && st.uid !== uid) return false;
     return (st.mode & 18) === 0;
@@ -23138,7 +23527,7 @@ var WINDOWS_PIPE = /^\\\\\.\\pipe\\node9-activity-[0-9a-f]{32}$/;
 function isTrustedActivitySocket(socketPath, uid = currentUid()) {
   if (process.platform === "win32") return WINDOWS_PIPE.test(socketPath);
   try {
-    const st = import_fs16.default.lstatSync(socketPath);
+    const st = import_fs17.default.lstatSync(socketPath);
     if (!st.isSocket()) return false;
     if (uid !== void 0 && st.uid !== uid) return false;
   } catch {
@@ -23296,9 +23685,9 @@ function recordFromLegacyWait(body, now = Date.now()) {
 }
 
 // src/auth/daemon.ts
-function daemonActivitySocket(home = import_os11.default.homedir()) {
+function daemonActivitySocket(home = import_os12.default.homedir()) {
   try {
-    const raw = import_fs17.default.readFileSync(import_path17.default.join(home, ".node9", "daemon.pid"), "utf-8");
+    const raw = import_fs18.default.readFileSync(import_path17.default.join(home, ".node9", "daemon.pid"), "utf-8");
     const p = JSON.parse(raw).activitySocket;
     return typeof p === "string" && isTrustedActivitySocket(p) ? p : null;
   } catch {
@@ -23362,9 +23751,9 @@ var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = import_path17.default.join(import_os11.default.homedir(), ".node9", "daemon.pid");
-    if (!import_fs17.default.existsSync(pidFile)) return null;
-    const data = JSON.parse(import_fs17.default.readFileSync(pidFile, "utf-8"));
+    const pidFile = import_path17.default.join(import_os12.default.homedir(), ".node9", "daemon.pid");
+    if (!import_fs18.default.existsSync(pidFile)) return null;
+    const data = JSON.parse(import_fs18.default.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -23373,12 +23762,12 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = import_path17.default.join(import_os11.default.homedir(), ".node9", "daemon.pid");
-  if (import_fs17.default.existsSync(pidFile)) {
+  const pidFile = import_path17.default.join(import_os12.default.homedir(), ".node9", "daemon.pid");
+  if (import_fs18.default.existsSync(pidFile)) {
     let pid;
     let port;
     try {
-      const data = JSON.parse(import_fs17.default.readFileSync(pidFile, "utf-8"));
+      const data = JSON.parse(import_fs18.default.readFileSync(pidFile, "utf-8"));
       pid = data.pid;
       port = data.port;
     } catch {
@@ -23396,7 +23785,7 @@ function isDaemonRunning() {
     } catch (err) {
       if (err instanceof Error && "code" in err && err.code === "ESRCH") {
         try {
-          import_fs17.default.unlinkSync(pidFile);
+          import_fs18.default.unlinkSync(pidFile);
         } catch {
         }
       }
@@ -23420,11 +23809,11 @@ async function daemonHasInteractiveApprover(timeoutMs = 400) {
   }
 }
 async function registerDaemonEntry(toolName, args, meta, riskMetadata, activityId, cwd, recoveryCommand, skipBackgroundAuth, viewOnly, localSmartRuleMatched, socketActivitySent, sessionId, card) {
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), 5e3);
   try {
-    const res = await fetch(`${base2}/check`, {
+    const res = await fetch(`${base3}/check`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -23534,8 +23923,8 @@ function daemonGet(urlPath, signal, token = getInternalToken()) {
   });
 }
 async function notifyDaemonViewer(toolName, args, meta, riskMetadata, activityId, socketActivitySent, extra) {
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const res = await fetch(`${base2}/check`, {
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const res = await fetch(`${base3}/check`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({
@@ -23567,9 +23956,9 @@ async function notifyTaint(filePath, source, fromEid) {
     return;
   }
   if (!isDaemonRunning()) return;
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    await fetch(`${base2}/taint`, {
+    await fetch(`${base3}/taint`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       // Phase D2 — fromEid is the audit eid that created this taint (edge source).
@@ -23587,9 +23976,9 @@ async function checkTaint(paths) {
     return record ? { tainted: true, record } : { tainted: false };
   }
   if (!isDaemonRunning()) return { tainted: false, daemonUnavailable: true };
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    const res = await fetch(`${base2}/taint/check`, {
+    const res = await fetch(`${base3}/taint/check`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ paths }),
@@ -23617,9 +24006,9 @@ async function notifyWritten(paths) {
     return;
   }
   if (paths.length === 0 || !isDaemonRunning()) return;
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    await fetch(`${base2}/written`, {
+    await fetch(`${base3}/written`, {
       method: "POST",
       headers: exposureHeaders(),
       body: JSON.stringify({ paths: paths.slice(0, 64) }),
@@ -23633,9 +24022,9 @@ async function checkWritten(paths) {
   const forecast = forecastRun();
   if (forecast) return { written: forecast.session.written(paths) };
   if (!isDaemonRunning()) return { written: [], daemonUnavailable: true };
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    const res = await fetch(`${base2}/written/check`, {
+    const res = await fetch(`${base3}/written/check`, {
       method: "POST",
       headers: exposureHeaders(),
       body: JSON.stringify({ paths: paths.slice(0, 64) }),
@@ -23657,9 +24046,9 @@ async function checkSessionTaint(sessionId) {
     return record ? { tainted: true, record, exposed } : { tainted: false, exposed };
   }
   if (!sessionId || !isDaemonRunning()) return { tainted: false };
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
   try {
-    const res = await fetch(`${base2}/session-taint/check`, {
+    const res = await fetch(`${base3}/session-taint/check`, {
       method: "POST",
       headers: exposureHeaders(),
       body: JSON.stringify({ sessionId }),
@@ -23677,8 +24066,8 @@ function exposureHeaders() {
   };
 }
 async function exposurePost(route, body, timeoutMs) {
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const res = await fetch(`${base2}${route}`, {
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const res = await fetch(`${base3}${route}`, {
     method: "POST",
     headers: exposureHeaders(),
     body: JSON.stringify(body),
@@ -23693,7 +24082,8 @@ async function checkSessionExposure(sessionId) {
     const record = forecast.session.checkExposure(forecast.now);
     return record ? { exposed: true, record } : { exposed: false };
   }
-  if (!sessionId || !isDaemonRunning()) return { exposed: false };
+  if (!sessionId) return { exposed: false };
+  if (!isDaemonRunning()) return { exposed: false, daemonUnavailable: true };
   try {
     return await exposurePost(
       "/session-exposure/check",
@@ -23717,8 +24107,8 @@ async function approveSessionExposure(sessionId, keys) {
   }
 }
 async function resolveViaDaemon(id, decision, internalToken, source, record) {
-  const base2 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
-  const res = await fetch(`${base2}/resolve/${id}`, {
+  const base3 = `http://${DAEMON_HOST}:${DAEMON_PORT}`;
+  const res = await fetch(`${base3}/resolve/${id}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Node9-Internal": internalToken },
     body: JSON.stringify({ decision, ...source && { source }, ...record && { record } }),
@@ -23736,8 +24126,8 @@ var import_crypto10 = require("crypto");
 
 // src/apps/state.ts
 init_cjs_shims();
-var import_fs19 = __toESM(require("fs"));
-var import_os13 = __toESM(require("os"));
+var import_fs20 = __toESM(require("fs"));
+var import_os14 = __toESM(require("os"));
 var import_path19 = __toESM(require("path"));
 
 // src/apps/catalog.ts
@@ -23872,22 +24262,22 @@ init_audit();
 
 // src/daemon/mcp-tools.ts
 init_cjs_shims();
-var import_fs18 = __toESM(require("fs"));
+var import_fs19 = __toESM(require("fs"));
 var import_path18 = __toESM(require("path"));
-var import_os12 = __toESM(require("os"));
+var import_os13 = __toESM(require("os"));
 
 // src/mcp-cmd.ts
 init_cjs_shims();
 
 // src/daemon/mcp-tools.ts
 function getMcpToolsFile() {
-  return import_path18.default.join(import_os12.default.homedir(), ".node9", "mcp-tools.json");
+  return import_path18.default.join(import_os13.default.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
     const file2 = getMcpToolsFile();
-    if (!import_fs18.default.existsSync(file2)) return {};
-    const raw = import_fs18.default.readFileSync(file2, "utf-8");
+    if (!import_fs19.default.existsSync(file2)) return {};
+    const raw = import_fs19.default.readFileSync(file2, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -23895,7 +24285,7 @@ function readMcpToolsConfig() {
 }
 
 // src/apps/state.ts
-function appsFilePath(home = import_os13.default.homedir()) {
+function appsFilePath(home = import_os14.default.homedir()) {
   return import_path19.default.join(home, ".node9", "apps.json");
 }
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["mcp-server", "command", "package", "env-name"]);
@@ -23944,7 +24334,7 @@ function readAppsFile(home) {
 function readAppsFileStrict(home) {
   let text;
   try {
-    text = import_fs19.default.readFileSync(appsFilePath(home), "utf8");
+    text = import_fs20.default.readFileSync(appsFilePath(home), "utf8");
   } catch (e) {
     return e.code === "ENOENT" ? emptyFile() : null;
   }
@@ -23959,7 +24349,7 @@ var NO_LINKS = /* @__PURE__ */ Object.create(null);
 function localLinks() {
   const file2 = appsFilePath();
   try {
-    const mtimeMs = import_fs19.default.statSync(file2).mtimeMs;
+    const mtimeMs = import_fs20.default.statSync(file2).mtimeMs;
     if (!linkCache || linkCache.file !== file2 || linkCache.mtimeMs !== mtimeMs) {
       linkCache = { mtimeMs, file: file2, links: readAppsFile().links };
     }
@@ -23999,7 +24389,7 @@ function resolveLinkedServer(label2, opts = {}) {
 }
 
 // src/auth/orchestrator.ts
-var import_os21 = __toESM(require("os"));
+var import_os22 = __toESM(require("os"));
 var import_path31 = __toESM(require("path"));
 
 // src/ui/native.ts
@@ -24350,12 +24740,12 @@ end run`;
 
 // src/canary/registry.ts
 init_cjs_shims();
-var import_fs20 = __toESM(require("fs"));
-var import_os14 = __toESM(require("os"));
+var import_fs21 = __toESM(require("fs"));
+var import_os15 = __toESM(require("os"));
 var import_path22 = __toESM(require("path"));
 init_dist();
 function canaryStorePath() {
-  return import_path22.default.join(import_os14.default.homedir(), ".node9", "canaries.json");
+  return import_path22.default.join(import_os15.default.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -24366,7 +24756,7 @@ function loadCanaries(opts) {
   const p = canaryStorePath();
   let raw;
   try {
-    raw = import_fs20.default.readFileSync(p, "utf-8");
+    raw = import_fs21.default.readFileSync(p, "utf-8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -24393,8 +24783,8 @@ init_dist();
 
 // src/auth/session-script.ts
 init_cjs_shims();
-var import_fs21 = __toESM(require("fs"));
-var import_os15 = __toESM(require("os"));
+var import_fs22 = __toESM(require("fs"));
+var import_os16 = __toESM(require("os"));
 var import_path23 = __toESM(require("path"));
 init_dist();
 var MAX_SCRIPT_BYTES = 64 * 1024;
@@ -24402,13 +24792,13 @@ var MAX_RECORDED_WRITES = 32;
 function readScriptFile(resolved) {
   let fd;
   try {
-    fd = import_fs21.default.openSync(resolved, import_fs21.default.constants.O_RDONLY | (import_fs21.default.constants.O_NONBLOCK ?? 0));
-    const st = import_fs21.default.fstatSync(fd);
+    fd = import_fs22.default.openSync(resolved, import_fs22.default.constants.O_RDONLY | (import_fs22.default.constants.O_NONBLOCK ?? 0));
+    const st = import_fs22.default.fstatSync(fd);
     if (!st.isFile() || st.size > MAX_SCRIPT_BYTES) return null;
     const buf = Buffer.alloc(MAX_SCRIPT_BYTES + 1);
     let n = 0;
     while (n < buf.length) {
-      const got = import_fs21.default.readSync(fd, buf, n, buf.length - n, n);
+      const got = import_fs22.default.readSync(fd, buf, n, buf.length - n, n);
       if (got === 0) break;
       n += got;
     }
@@ -24419,7 +24809,7 @@ function readScriptFile(resolved) {
   } finally {
     if (fd !== void 0) {
       try {
-        import_fs21.default.closeSync(fd);
+        import_fs22.default.closeSync(fd);
       } catch {
       }
     }
@@ -24429,16 +24819,16 @@ function absolute(p, cwd, home) {
   const spelled = p === "~" || p.startsWith("~/") ? home + p.slice(1) : p;
   return import_path23.default.resolve(cwd, spelled);
 }
-async function resolveSessionScript(toolName, args, cwd, layers, deps, home = import_os15.default.homedir()) {
+async function resolveSessionScript(toolName, args, cwd, layers, deps, home = import_os16.default.homedir()) {
   try {
     const d = deps ?? { checkWritten, readScript: readScriptFile };
     const shell = resolveShellInput(toolName, args, layers);
     if (shell.kind !== "shell") return null;
     const operands2 = shellScriptOperands(shell.command);
     if (operands2.length === 0) return null;
-    const base2 = cwd ?? process.cwd();
+    const base3 = cwd ?? process.cwd();
     const byResolved = /* @__PURE__ */ new Map();
-    for (const op of operands2) byResolved.set(absolute(op, base2, home), op);
+    for (const op of operands2) byResolved.set(absolute(op, base3, home), op);
     const { written } = await d.checkWritten([...byResolved.keys()]);
     for (const resolved of written) {
       const spelled = byResolved.get(resolved);
@@ -24450,7 +24840,7 @@ async function resolveSessionScript(toolName, args, cwd, layers, deps, home = im
         path: spelled,
         resolved,
         args: scriptArgs,
-        fileAccess: prepareFileAccesses("Bash", scriptArgs, base2, layers, home)
+        fileAccess: prepareFileAccesses("Bash", scriptArgs, base3, layers, home)
       };
     }
     return null;
@@ -24458,17 +24848,17 @@ async function resolveSessionScript(toolName, args, cwd, layers, deps, home = im
     return null;
   }
 }
-function sessionWriteTargets(toolName, args, fileAccess, cwd, home = import_os15.default.homedir()) {
-  const base2 = cwd ?? process.cwd();
+function sessionWriteTargets(toolName, args, fileAccess, cwd, home = import_os16.default.homedir()) {
+  const base3 = cwd ?? process.cwd();
   const out = /* @__PURE__ */ new Set();
   const argsObj = args && typeof args === "object" ? args : {};
   const named = argsObj.file_path ?? argsObj.path ?? argsObj.filename;
   if (typeof named === "string" && named && /write|edit|create|save|append/i.test(toolName))
-    out.add(absolute(named, base2, home));
+    out.add(absolute(named, base3, home));
   for (const a of fileAccess?.accesses ?? []) {
     if (a.operation !== "write" && a.operation !== "create") continue;
     if (a.glob || a.recursive) continue;
-    out.add(absolute(a.path, a.cwd ?? base2, home));
+    out.add(absolute(a.path, a.cwd ?? base3, home));
     if (out.size >= MAX_RECORDED_WRITES) break;
   }
   return [...out];
@@ -24489,27 +24879,27 @@ init_dist();
 
 // src/exposure/known-hosts.ts
 init_cjs_shims();
-var import_fs23 = __toESM(require("fs"));
+var import_fs24 = __toESM(require("fs"));
 var import_path25 = __toESM(require("path"));
 
 // src/utils/git-remotes.ts
 init_cjs_shims();
-var import_fs22 = __toESM(require("fs"));
+var import_fs23 = __toESM(require("fs"));
 var import_path24 = __toESM(require("path"));
 init_dist();
-function readSmallFile(p, max) {
+function readSmallFile2(p, max) {
   let fd;
   try {
-    fd = import_fs22.default.openSync(p, import_fs22.default.constants.O_RDONLY | (import_fs22.default.constants.O_NOFOLLOW ?? 0));
-    const st = import_fs22.default.fstatSync(fd);
+    fd = import_fs23.default.openSync(p, import_fs23.default.constants.O_RDONLY | (import_fs23.default.constants.O_NOFOLLOW ?? 0));
+    const st = import_fs23.default.fstatSync(fd);
     if (!st.isFile() || st.size > max) return null;
     const buf = Buffer.alloc(st.size);
-    const n = import_fs22.default.readSync(fd, buf, 0, st.size, 0);
+    const n = import_fs23.default.readSync(fd, buf, 0, st.size, 0);
     return buf.subarray(0, n).toString("utf8");
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) import_fs22.default.closeSync(fd);
+    if (fd !== void 0) import_fs23.default.closeSync(fd);
   }
 }
 function gitRemoteHost(url) {
@@ -24531,15 +24921,15 @@ function findGitConfig(dir2, walkUp = true) {
   let cur = import_path24.default.resolve(dir2);
   for (let i = 0; i < (walkUp ? 64 : 1); i++) {
     const dotGit = import_path24.default.join(cur, ".git");
-    const direct = readSmallFile(import_path24.default.join(dotGit, "config"), 1e6);
+    const direct = readSmallFile2(import_path24.default.join(dotGit, "config"), 1e6);
     if (direct !== null) return direct;
-    const pointer = readSmallFile(dotGit, 4096);
+    const pointer = readSmallFile2(dotGit, 4096);
     const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
     if (m) {
       let gitDir = import_path24.default.resolve(cur, m[1]);
-      const common = readSmallFile(import_path24.default.join(gitDir, "commondir"), 4096);
+      const common = readSmallFile2(import_path24.default.join(gitDir, "commondir"), 4096);
       if (common !== null) gitDir = import_path24.default.resolve(gitDir, common.trim());
-      return readSmallFile(import_path24.default.join(gitDir, "config"), 1e6);
+      return readSmallFile2(import_path24.default.join(gitDir, "config"), 1e6);
     }
     const parent = import_path24.default.dirname(cur);
     if (parent === cur) return null;
@@ -24596,7 +24986,7 @@ function manifestRoot(dir2) {
   for (let i = 0; i < 64; i++) {
     for (const [m] of ECOSYSTEMS) {
       try {
-        if (import_fs23.default.existsSync(import_path25.default.join(cur, m))) return cur;
+        if (import_fs24.default.existsSync(import_path25.default.join(cur, m))) return cur;
       } catch {
       }
     }
@@ -24622,10 +25012,10 @@ function knownProjectHosts(dir2) {
     const root = manifestRoot(key);
     if (root !== null) {
       for (const [m, registry] of ECOSYSTEMS) {
-        if (import_fs23.default.existsSync(import_path25.default.join(root, m))) out.hosts.add(registry);
+        if (import_fs24.default.existsSync(import_path25.default.join(root, m))) out.hosts.add(registry);
       }
       try {
-        if (import_fs23.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
+        if (import_fs24.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
           out.hosts.add("host:rubygems.org");
       } catch {
       }
@@ -24638,8 +25028,8 @@ function knownProjectHosts(dir2) {
 
 // src/exposure/writes.ts
 init_cjs_shims();
-var import_fs24 = __toESM(require("fs"));
-var import_os16 = __toESM(require("os"));
+var import_fs25 = __toESM(require("fs"));
+var import_os17 = __toESM(require("os"));
 var import_path26 = __toESM(require("path"));
 init_dist();
 var WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "remove"]);
@@ -24670,7 +25060,7 @@ function packageScriptsTouched(args, absPath, shellCommand) {
   if (typeof a.content === "string") {
     try {
       const next = JSON.parse(a.content);
-      const prev = JSON.parse(import_fs24.default.readFileSync(absPath, "utf8"));
+      const prev = JSON.parse(import_fs25.default.readFileSync(absPath, "utf8"));
       return JSON.stringify(next.scripts ?? null) !== JSON.stringify(prev.scripts ?? null);
     } catch {
       return LIFECYCLE_RE.test(a.content);
@@ -24680,8 +25070,8 @@ function packageScriptsTouched(args, absPath, shellCommand) {
 }
 function judgeWritesAfterExposure(opts) {
   const holds = [];
-  const home = opts.home ?? import_os16.default.homedir();
-  const tmp = normalizeFilePath(import_os16.default.tmpdir());
+  const home = opts.home ?? import_os17.default.homedir();
+  const tmp = normalizeFilePath(import_os17.default.tmpdir());
   const root = opts.cwd ? normalizeFilePath(opts.cwd, "", home) : null;
   const seen = /* @__PURE__ */ new Set();
   for (const access of opts.accesses) {
@@ -24714,8 +25104,8 @@ function judgeWritesAfterExposure(opts) {
 // src/exposure/marker.ts
 init_cjs_shims();
 var import_crypto9 = __toESM(require("crypto"));
-var import_fs25 = __toESM(require("fs"));
-var import_os17 = __toESM(require("os"));
+var import_fs26 = __toESM(require("fs"));
+var import_os18 = __toESM(require("os"));
 var import_path27 = __toESM(require("path"));
 
 // src/daemon/exposure-store.ts
@@ -24725,7 +25115,7 @@ var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
 // src/exposure/marker.ts
 init_forecast_context();
 function dir() {
-  return import_path27.default.join(import_os17.default.homedir(), ".node9", "exposure-sessions");
+  return import_path27.default.join(import_os18.default.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = import_crypto9.default.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
@@ -24736,7 +25126,7 @@ function maybeSessionExposed(sessionId) {
   const forecast = forecastRun();
   if (forecast) return forecast.session.checkExposure(forecast.now) !== null;
   try {
-    const st = import_fs25.default.statSync(file(sessionId));
+    const st = import_fs26.default.statSync(file(sessionId));
     return Date.now() - st.mtimeMs < SESSION_EXPOSURE_TTL_MS;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -24745,7 +25135,7 @@ function maybeSessionExposed(sessionId) {
 
 // src/exposure/roles.ts
 init_cjs_shims();
-var import_fs26 = __toESM(require("fs"));
+var import_fs27 = __toESM(require("fs"));
 var EXPOSURE_LABEL = "\u{1F6E1}\uFE0F Node9 Exposure";
 var AGENT_INTERNAL_PREFIXES = ["ccd_", "visualize"];
 function foldServerName(name) {
@@ -24755,7 +25145,7 @@ var inventoryCache = null;
 var inventoryStamp = null;
 function inventoryFileStamp() {
   try {
-    const st = import_fs26.default.statSync(getMcpToolsFile());
+    const st = import_fs27.default.statSync(getMcpToolsFile());
     return `${st.mtimeMs}:${st.size}`;
   } catch {
     return "";
@@ -24840,16 +25230,16 @@ function sourceWord(toolName) {
 
 // src/auth/trusted-recipients.ts
 init_cjs_shims();
-var import_fs27 = __toESM(require("fs"));
+var import_fs28 = __toESM(require("fs"));
 var import_path28 = __toESM(require("path"));
-var import_os18 = __toESM(require("os"));
+var import_os19 = __toESM(require("os"));
 init_dist();
 function getTrustedRecipientsPath() {
-  return import_path28.default.join(import_os18.default.homedir(), ".node9", "trusted-recipients.json");
+  return import_path28.default.join(import_os19.default.homedir(), ".node9", "trusted-recipients.json");
 }
 function readTrustedRecipients() {
   try {
-    const raw = import_fs27.default.readFileSync(getTrustedRecipientsPath(), "utf8");
+    const raw = import_fs28.default.readFileSync(getTrustedRecipientsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.entries) ? parsed.entries.filter((e) => e && typeof e.value === "string") : [];
   } catch {
@@ -24858,10 +25248,10 @@ function readTrustedRecipients() {
 }
 function writeTrustedRecipients(entries) {
   const filePath = getTrustedRecipientsPath();
-  import_fs27.default.mkdirSync(import_path28.default.dirname(filePath), { recursive: true });
+  import_fs28.default.mkdirSync(import_path28.default.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
-  import_fs27.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
-  import_fs27.default.renameSync(tmp, filePath);
+  import_fs28.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
+  import_fs28.default.renameSync(tmp, filePath);
 }
 function addTrustedRecipient(raw, addedBy = "user") {
   const value = normalizeRecipient(raw);
@@ -24876,7 +25266,7 @@ function addTrustedRecipient(raw, addedBy = "user") {
 var cache6 = null;
 function mtimeOf() {
   try {
-    return import_fs27.default.statSync(getTrustedRecipientsPath()).mtimeMs;
+    return import_fs28.default.statSync(getTrustedRecipientsPath()).mtimeMs;
   } catch {
     return 0;
   }
@@ -24894,8 +25284,8 @@ init_forecast_context();
 
 // src/auth/cloud.ts
 init_cjs_shims();
-var import_fs28 = __toESM(require("fs"));
-var import_os19 = __toESM(require("os"));
+var import_fs29 = __toESM(require("fs"));
+var import_os20 = __toESM(require("os"));
 var import_path29 = __toESM(require("path"));
 init_audit();
 init_dist();
@@ -24932,7 +25322,7 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = import_path29.default.join(import_os19.default.homedir(), ".node9", "ci-context.json");
+      const ciContextPath = import_path29.default.join(import_os20.default.homedir(), ".node9", "ci-context.json");
       const ci = readCappedText(ciContextPath, 1e4);
       if (!ci) throw new Error("ci-context.json unreadable");
       if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
@@ -24974,9 +25364,9 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
         context: {
           agent: meta?.agent,
           mcpServer: meta?.mcpServer,
-          hostname: import_os19.default.hostname(),
+          hostname: import_os20.default.hostname(),
           cwd: process.cwd(),
-          platform: import_os19.default.platform()
+          platform: import_os20.default.platform()
         },
         // The SaaS validates riskMetadata strictly and would drop it whole on
         // an unknown key, so only fields its schema declares go on the wire.
@@ -25050,14 +25440,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      import_fs28.default.appendFileSync(
+      import_fs29.default.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    import_fs28.default.appendFileSync(
+    import_fs29.default.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err)}
 `
@@ -25067,19 +25457,19 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 
 // src/loop-detector.ts
 init_cjs_shims();
-var import_fs29 = __toESM(require("fs"));
+var import_fs30 = __toESM(require("fs"));
 var import_path30 = __toESM(require("path"));
-var import_os20 = __toESM(require("os"));
+var import_os21 = __toESM(require("os"));
 init_dist();
 init_forecast_context();
 init_dist();
 function loopStateFile() {
-  return import_path30.default.join(import_os20.default.homedir(), ".node9", "loop-state.json");
+  return import_path30.default.join(import_os21.default.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
-    if (!import_fs29.default.existsSync(loopStateFile())) return [];
-    const raw = import_fs29.default.readFileSync(loopStateFile(), "utf-8");
+    if (!import_fs30.default.existsSync(loopStateFile())) return [];
+    const raw = import_fs30.default.readFileSync(loopStateFile(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return [];
     return parsed;
@@ -25089,10 +25479,10 @@ function readState() {
 }
 function writeState(records) {
   const dir2 = import_path30.default.dirname(loopStateFile());
-  if (!import_fs29.default.existsSync(dir2)) import_fs29.default.mkdirSync(dir2, { recursive: true });
-  const tmpPath = `${loopStateFile()}.${import_os20.default.hostname()}.${process.pid}.tmp`;
-  import_fs29.default.writeFileSync(tmpPath, JSON.stringify(records));
-  import_fs29.default.renameSync(tmpPath, loopStateFile());
+  if (!import_fs30.default.existsSync(dir2)) import_fs30.default.mkdirSync(dir2, { recursive: true });
+  const tmpPath = `${loopStateFile()}.${import_os21.default.hostname()}.${process.pid}.tmp`;
+  import_fs30.default.writeFileSync(tmpPath, JSON.stringify(records));
+  import_fs30.default.renameSync(tmpPath, loopStateFile());
 }
 function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   try {
@@ -25291,7 +25681,7 @@ function isMcpToolName(toolName) {
   return /^mcp__[^_](?:[^_]|_(?!_))*?__/i.test(toolName);
 }
 function absoluteUploadPath(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path31.default.join(import_os21.default.homedir(), spelled.slice(1)) : spelled;
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path31.default.join(import_os22.default.homedir(), spelled.slice(1)) : spelled;
   if (import_path31.default.isAbsolute(expanded)) return expanded;
   return cwd && import_path31.default.isAbsolute(cwd) ? import_path31.default.resolve(cwd, expanded) : expanded;
 }
@@ -25617,8 +26007,17 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
     const judged = sendsSomething || (!!shellExp?.fetches || writes.length > 0) && mayBeExposed;
     if (judged) {
       const exposure = await checkSessionExposure(meta.sessionId);
-      if (exposure.exposed && exposure.record) {
-        const rec = exposure.record;
+      const unknownRead = exposure.daemonUnavailable === true && holdsSendsWithoutDaemon(config.settings.mode);
+      const rec = exposure.exposed && exposure.record ? exposure.record : unknownRead ? {
+        sessionId: meta.sessionId,
+        sources: [],
+        destinations: [],
+        userMentioned: [],
+        approved: [],
+        createdAt: 0,
+        expiresAt: 0
+      } : null;
+      if (rec) {
         const dests = new Set(
           acts && !shellExp && !mcpFileWrite ? extractArgDestinations(args) : []
         );
@@ -25677,7 +26076,7 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
         if (dests.size === 0 && acts && !mcpFileWrite && (role.destructive === true || isDestructiveToolName(bare))) {
           held.push({ dest: "", why: "destructive" });
         }
-        const writeHolds = writes.length > 0 ? judgeWritesAfterExposure({
+        const writeHolds = writes.length > 0 && !(unknownRead && !exposure.exposed) ? judgeWritesAfterExposure({
           accesses: writes,
           args,
           shellCommand: shellInput.kind === "shell" ? shellInput.command : null,
@@ -25704,14 +26103,14 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
           const parts = held.map(
             (h) => h.dest ? `sends to ${destinationValue(h.dest)}, ${h.why === "appeared in what was read" ? `${noun(h.dest)} that appeared in that ${last ? readWord : "content"}` : `${noun(h.dest)} this session did not know`}` : h.why === "repository" ? h.repo.endsWith("/*") ? `sends to a repository on ${h.repo.slice(0, -2)} it does not name (a gist, a new repository or an API call)` : `sends to ${h.repo}, a repository that is not one of this project's remotes` : h.why === "unresolved" ? "sends to a destination this session cannot see (built at run time, or a remote of another repository)" : `is ${bare}, a destructive call, with no known destination`
           );
-          const home = import_os21.default.homedir();
+          const home = import_os22.default.homedir();
           const short = (p) => p.startsWith(home + "/") ? "~" + p.slice(home.length) : p;
           for (const w of writeHolds) {
             parts.push(
               w.why === "outside-project" ? `writes outside the project, to ${short(w.path)}` : w.why === "agent-instruction" ? `writes to ${short(w.path)}, a file that runs code or instructs the agent` : `writes content carrying ${destinationValue(w.destination ?? "")}, ${noun(w.destination ?? "host:x")} that appeared in that ${readWord}`
             );
           }
-          exposureReview = `\u{1F6E1}\uFE0F Node9: this session read ${read2}. This call ${parts.join("; and ")}.`;
+          exposureReview = unknownRead && !exposure.exposed ? `\u{1F6E1}\uFE0F Node9: the node9 daemon is not running, so node9 cannot tell what this session read. This call ${parts.join("; and ")}. Start it with: node9 daemon start.` : `\u{1F6E1}\uFE0F Node9: this session read ${read2}. This call ${parts.join("; and ")}.`;
           exposureFromEid = last?.eid;
           if (exposureFromEid) exposureMeta = { exposureFromEid };
           exposureKeys = [