@node9/proxy 2.8.5 → 2.9.1

package/dist/dashboard.mjs

@@ -89,10 +89,47 @@ var init_types = __esm({
 
 // packages/policy-engine/dist/index.mjs
 import safeRegex from "safe-regex2";
+import { createHash } from "crypto";
 import mvdanSh from "mvdan-sh";
 import pm from "picomatch";
 import safeRegex2 from "safe-regex2";
 import safeRegex3 from "safe-regex2";
+function validateBase58Check(s) {
+  if (!s) return null;
+  let n = 0n;
+  for (const c of s) {
+    const v = B58_INDEX[c];
+    if (v === void 0) return null;
+    n = n * 58n + BigInt(v);
+  }
+  let hex = n.toString(16);
+  if (hex.length % 2) hex = "0" + hex;
+  let zeros = 0;
+  for (const c of s) {
+    if (c !== "1") break;
+    zeros++;
+  }
+  const bytes = Buffer.concat([
+    Buffer.alloc(zeros),
+    n === 0n ? Buffer.alloc(0) : Buffer.from(hex, "hex")
+  ]);
+  if (bytes.length < 5) return null;
+  const body = bytes.subarray(0, bytes.length - 4);
+  const check = bytes.subarray(bytes.length - 4);
+  const h = createHash("sha256").update(createHash("sha256").update(body).digest()).digest();
+  return h.subarray(0, 4).equals(check) ? body : null;
+}
+function validateWif(s) {
+  const p = validateBase58Check(s);
+  if (!p || p[0] !== 128) return false;
+  return p.length === 33 || p.length === 34 && p[33] === 1;
+}
+function validateXprv(s) {
+  const p = validateBase58Check(s);
+  if (!p || p.length !== 78) return false;
+  const version = p.readUInt32BE(0);
+  return XPRV_VERSIONS.has(version) && p[45] === 0;
+}
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
 }
@@ -133,6 +170,33 @@ function maskSecret(raw, pattern) {
   const stars = "*".repeat(Math.min(secret.length - 8, 12));
   return `${prefix}${stars}${suffix}`;
 }
+function suppressed(pattern, raw) {
+  if (pattern.validate) {
+    let ok;
+    try {
+      ok = pattern.validate(raw);
+    } catch {
+      ok = true;
+    }
+    return !ok;
+  }
+  if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) return true;
+  if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) return true;
+  return false;
+}
+function firstAcceptedMatch(pattern, text) {
+  const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : pattern.regex.flags + "g";
+  const re = new RegExp(pattern.regex.source, flags);
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (m[0].length === 0) {
+      re.lastIndex = m.index + 1;
+      continue;
+    }
+    if (!suppressed(pattern, m[0])) return m[0];
+  }
+  return null;
+}
 function scanArgs(args, depth = 0, fieldPath = "args") {
   if (depth > MAX_DEPTH || args === null || args === void 0) return null;
   if (Array.isArray(args)) {
@@ -157,18 +221,16 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
       if (pattern.keywords && !pattern.keywords.some((kw) => textLower.includes(kw.toLowerCase()))) {
         continue;
       }
-      if (pattern.regex.test(text)) {
-        const raw = text.match(pattern.regex)?.[0] ?? "";
-        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
-        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
-        const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
-        return {
-          patternName: pattern.name,
-          fieldPath,
-          redactedSample: maskSecret(text, pattern.regex),
-          severity
-        };
-      }
+      const raw = firstAcceptedMatch(pattern, text);
+      if (raw === null) continue;
+      const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
+      return {
+        patternName: pattern.name,
+        fieldPath,
+        // Mask the ACCEPTED token, not the first regex hit in the field.
+        redactedSample: maskSecret(raw, pattern.regex),
+        severity
+      };
     }
     if (text.length < MAX_JSON_PARSE_BYTES) {
       const trimmed = text.trim();
@@ -228,13 +290,13 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path13) {
+function getNestedValue(obj, path14) {
   if (!obj || typeof obj !== "object") return null;
-  const segments = path13.split(".");
-  for (const seg of segments) {
+  const segments2 = path14.split(".");
+  for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
-  return segments.reduce((prev, curr) => prev?.[curr], obj);
+  return segments2.reduce((prev, curr) => prev?.[curr], obj);
 }
 function evaluateSmartConditions(args, rule) {
   if (!rule.conditions || rule.conditions.length === 0) return true;
@@ -659,6 +721,162 @@ function analyzeFsOperationImpl(command) {
     return null;
   }
 }
+function parseComponent(s) {
+  if (!s) return null;
+  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
+  if (s === "0") return 0;
+  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
+  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
+  return null;
+}
+function parseIpv4(input) {
+  let s = input;
+  if (s.endsWith(".")) s = s.slice(0, -1);
+  if (!s) return null;
+  const parts = s.split(".");
+  if (parts.length > 4) return null;
+  const vals = [];
+  for (const p of parts) {
+    const v = parseComponent(p);
+    if (v === null || !Number.isFinite(v) || v < 0) return null;
+    vals.push(v);
+  }
+  const n = vals.length;
+  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
+  const last = vals[n - 1];
+  const remainingBytes = 4 - (n - 1);
+  const limit = Math.pow(256, remainingBytes);
+  if (last >= limit) return null;
+  let value = last;
+  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
+  if (value > 4294967295) return null;
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function expandIpv6(input) {
+  const s = input.toLowerCase();
+  if (!/^[0-9a-f:.]+$/.test(s)) return null;
+  if ((s.match(/::/g) ?? []).length > 1) return null;
+  let head = s;
+  let tailV4 = null;
+  const lastColon = s.lastIndexOf(":");
+  const afterLast = s.slice(lastColon + 1);
+  if (afterLast.includes(".")) {
+    const dotted = parseIpv4(afterLast);
+    if (!dotted) return null;
+    const o = dotted.split(".").map(Number);
+    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
+    head = s.slice(0, lastColon + 1) + "0";
+  }
+  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
+  const toGroups = (part) => {
+    if (!part) return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const left = toGroups(lhs);
+  if (left === null) return null;
+  let right = [];
+  if (rhs !== null) {
+    const r = toGroups(rhs);
+    if (r === null) return null;
+    right = r;
+  }
+  if (tailV4) {
+    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
+    else left.splice(left.length - 1, 1, ...tailV4);
+  }
+  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
+  if (rhs === null && groups.length !== 8) return null;
+  if (rhs !== null && left.length + right.length > 8) return null;
+  if (groups.length !== 8) return null;
+  return groups;
+}
+function compressIpv6(g) {
+  let bestStart = -1;
+  let bestLen = 0;
+  let i = 0;
+  while (i < 8) {
+    if (g[i] !== 0) {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && g[j] === 0) j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  const hex = g.map((x) => x.toString(16));
+  if (bestLen < 2) return hex.join(":");
+  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
+}
+function normalizeIpLiteral(host) {
+  try {
+    if (typeof host !== "string") return null;
+    let s = host.trim();
+    if (!s || s.length > SSRF_MAX_HOST) return null;
+    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+    const zone = s.indexOf("%");
+    if (zone >= 0) s = s.slice(0, zone);
+    if (!s) return null;
+    if (s.includes(":")) {
+      const g = expandIpv6(s);
+      if (!g) return null;
+      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
+      if (mapped) {
+        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
+      }
+      return compressIpv6(g);
+    }
+    return parseIpv4(s);
+  } catch {
+    return null;
+  }
+}
+function classifySsrf(host) {
+  try {
+    if (typeof host !== "string" || !host) return null;
+    const lower = host.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host);
+    if (ip === null) {
+      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
+    }
+    const hit = (tier, overridable) => ({
+      tier,
+      overridable,
+      kind: "address",
+      normalized: ip
+    });
+    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
+    const o = v4Octets(ip);
+    if (o) {
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
+      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
+      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
+      if (o[0] === 127) return hit("private", true);
+      if (o[0] === 10) return hit("private", true);
+      if (o[0] === 192 && o[1] === 168) return hit("private", true);
+      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
+      return null;
+    }
+    const g = expandIpv6(ip);
+    if (!g) return null;
+    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if ((g[0] & 65472) === 65152) return hit("link-local", false);
+    if ((g[0] & 65280) === 65280) return hit("multicast", false);
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
+    return null;
+  } catch {
+    return null;
+  }
+}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -712,10 +930,123 @@ function assertBuiltinShieldRegexesAreSafe() {
     }
   }
 }
-var ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LONG_OUTPUT_THRESHOLD_BYTES;
+function percentDecodeOnce(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s.replace(/%([0-9A-Fa-f]{2})/g, (_, h) => String.fromCharCode(parseInt(h, 16)));
+  }
+}
+function segments(s, alphabet) {
+  const out = /* @__PURE__ */ new Set();
+  if (alphabet.test(s)) out.add(s);
+  for (const seg of s.split(/[?&\s"'<>]+/)) {
+    if (seg.length >= MIN_SEGMENT && alphabet.test(seg)) out.add(seg);
+    for (const part of seg.split("=")) {
+      if (part.length >= MIN_SEGMENT && alphabet.test(part)) out.add(part);
+    }
+  }
+  return [...out];
+}
+function lowestOffset(cands, needles, stripped) {
+  let best = null;
+  for (const c of cands) {
+    for (const n of needles) {
+      const off = c.indexOf(stripped ? n.stripped : n.raw);
+      if (off >= 0 && (best === null || off < best.off)) best = { off, v: n.v };
+    }
+  }
+  return best?.v ?? null;
+}
+function prepare(values) {
+  const out = [];
+  for (const v of values) {
+    if (typeof v.value !== "string" || v.value.length < CANARY_MIN_LENGTH) {
+      console.error(
+        `[node9 engine] canary ${v.id}: value shorter than ${CANARY_MIN_LENGTH}, skipped`
+      );
+      continue;
+    }
+    out.push({ v, raw: v.value, stripped: stripSeparators(v.value) });
+  }
+  return out;
+}
+function matchPrepared(text, needles) {
+  if (!text || needles.length === 0) return null;
+  const t = text.length > MAX_TEXT ? text.slice(0, MAX_TEXT) : text;
+  const raw = lowestOffset([t], needles, false);
+  if (raw) return { v: raw, view: "raw" };
+  for (const { view, decoder, stripped } of VIEWS) {
+    let cands;
+    try {
+      cands = CANARY_DECODERS[decoder](t);
+    } catch (e) {
+      console.error(
+        `[node9 engine] canary view ${view} failed, skipped:`,
+        e instanceof Error ? e.message : String(e)
+      );
+      continue;
+    }
+    const hit = lowestOffset(cands, needles, stripped);
+    if (hit) return { v: hit, view };
+  }
+  return null;
+}
+function matchCanaryArgs(args, values) {
+  if (values.length === 0) return null;
+  const needles = prepare(values);
+  if (needles.length === 0) return null;
+  const walk = (v, depth, fieldPath) => {
+    if (depth > MAX_DEPTH2) return null;
+    if (typeof v === "string") {
+      const hit = matchPrepared(v, needles);
+      if (hit) return { id: hit.v.id, view: hit.view, fieldPath, retired: Boolean(hit.v.retired) };
+      if (v.length < MAX_JSON_PARSE) {
+        const trimmed = v.trim();
+        if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+          try {
+            return walk(JSON.parse(v), depth + 1, fieldPath);
+          } catch {
+          }
+        }
+      }
+      return null;
+    }
+    if (typeof v === "number" && Number.isFinite(v)) return walk(String(v), depth, fieldPath);
+    if (Array.isArray(v)) {
+      for (let i = 0; i < v.length; i++) {
+        const h = walk(v[i], depth + 1, `${fieldPath}[${i}]`);
+        if (h) return h;
+      }
+      return null;
+    }
+    if (v && typeof v === "object") {
+      for (const [k, child] of Object.entries(v)) {
+        const h = walk(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
+        if (h) return h;
+      }
+    }
+    return null;
+  };
+  try {
+    return walk(args, 0, "");
+  } catch (e) {
+    console.error(
+      "[node9 engine] canary args walk failed:",
+      e instanceof Error ? e.message : String(e)
+    );
+    return null;
+  }
+}
+var B58, B58_INDEX, XPRV_VERSIONS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
+    B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+    B58_INDEX = Object.fromEntries(
+      [...B58].map((c, i) => [c, i])
+    );
+    XPRV_VERSIONS = /* @__PURE__ */ new Set([76066276, 77428856, 78791436]);
     ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(?:_key|_token)?|credential|private[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*/i;
     DLP_STOPWORDS = [
       "example",
@@ -894,6 +1225,27 @@ var init_dist = __esm({
         severity: "block",
         keywords: ["sg."]
       },
+      // ── Cryptocurrency private keys (base58check-validated) ───────────────────
+      // Both are anchored with \b on each side: unanchored, `[KL][base58]{51}`
+      // matches INSIDE any longer base58 blob (an xprv, a Solana keypair, a
+      // Monero address). Lookbehind fails safe-regex2; \b is the house style
+      // (see the card regexes). Mainnet only, matching validateWif / validateXprv;
+      // testnet (WIF 0xEF, tprv) is deferred. Cost was measured: the WIF regex
+      // runs on every string (first keyword-less pattern) at 0.024 ms per 100 KB
+      // of prose, so no prefilter is warranted.
+      {
+        name: "Bitcoin WIF Private Key",
+        regex: /\b(?:5[1-9A-HJ-NP-Za-km-z]{50}|[KL][1-9A-HJ-NP-Za-km-z]{51})\b/,
+        severity: "block",
+        validate: validateWif
+      },
+      {
+        name: "Extended Private Key",
+        regex: /\b[xyz]prv[1-9A-HJ-NP-Za-km-z]{107}\b/,
+        severity: "block",
+        keywords: ["xprv", "yprv", "zprv"],
+        validate: validateXprv
+      },
       // ── Private keys (PEM) ────────────────────────────────────────────────────
       {
         name: "Private Key (PEM)",
@@ -1399,6 +1751,22 @@ var init_dist = __esm({
       deriveRedirOp("cat <<X\nX"),
       deriveRedirOp("cat <<-X\nX")
     ]);
+    SSRF_MAX_HOST = 253;
+    METADATA_ADDRESSES = /* @__PURE__ */ new Set([
+      "169.254.169.254",
+      // AWS / Azure / DigitalOcean / OpenStack IMDS
+      "169.254.170.2",
+      // AWS ECS task role
+      "168.63.129.16",
+      // Azure WireServer
+      "fd00:ec2::254"
+      // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+    ]);
+    METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+    v4Octets = (a) => {
+      const p = a.split(".");
+      return p.length === 4 ? p.map(Number) : null;
+    };
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -2150,6 +2518,60 @@ var init_dist = __esm({
       [redis_default.name]: redis_default
     };
     assertBuiltinShieldRegexesAreSafe();
+    CANARY_MIN_LENGTH = 16;
+    MAX_TEXT = 1e5;
+    MAX_DEPTH2 = 6;
+    MAX_JSON_PARSE = 1e4;
+    URL_DEPTH = 4;
+    B64_DEPTH = 3;
+    MIN_SEGMENT = 16;
+    SEPARATORS = /[./\\?&= \t\n\r:;,\-_@%+#]/g;
+    stripSeparators = (s) => s.replace(SEPARATORS, "");
+    looksText = (s) => s.length > 0 && !/[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(s);
+    CANARY_DECODERS = {
+      url: (s) => {
+        const out = [];
+        let cur = s;
+        for (let i = 0; i < URL_DEPTH; i++) {
+          const d = percentDecodeOnce(cur);
+          if (d === cur) break;
+          out.push(d);
+          cur = d;
+        }
+        return out;
+      },
+      base64: (s) => {
+        const out = [];
+        let frontier = segments(s, /^[A-Za-z0-9+/\-_=]+$/);
+        for (let depth = 0; depth < B64_DEPTH && frontier.length; depth++) {
+          const next = [];
+          for (const c of frontier) {
+            const d = Buffer.from(c, "base64").toString("utf8");
+            if (!looksText(d) || d.length < CANARY_MIN_LENGTH) continue;
+            out.push(d);
+            next.push(...segments(d, /^[A-Za-z0-9+/\-_=]+$/));
+          }
+          frontier = next;
+        }
+        return out;
+      },
+      hex: (s) => {
+        const out = [];
+        for (const c of segments(s, /^[0-9A-Fa-f]+$/)) {
+          if (c.length % 2 !== 0 || c.length < CANARY_MIN_LENGTH * 2) continue;
+          const d = Buffer.from(c, "hex").toString("utf8");
+          if (looksText(d)) out.push(d);
+        }
+        return out;
+      },
+      separators: (s) => [stripSeparators(s)]
+    };
+    VIEWS = [
+      { view: "url-decoded", decoder: "url", stripped: false },
+      { view: "base64-decoded", decoder: "base64", stripped: false },
+      { view: "hex-decoded", decoder: "hex", stripped: false },
+      { view: "separators-stripped", decoder: "separators", stripped: true }
+    ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
   }
 });
@@ -2332,8 +2754,8 @@ function sanitizeConfig(raw) {
     }
   }
   const lines = result.error.issues.map((issue) => {
-    const path13 = issue.path.length > 0 ? issue.path.join(".") : "root";
-    return `  \u2022 ${path13}: ${issue.message}`;
+    const path14 = issue.path.length > 0 ? issue.path.join(".") : "root";
+    return `  \u2022 ${path14}: ${issue.message}`;
   });
   return {
     sanitized,
@@ -2478,7 +2900,11 @@ var init_config_schema = __esm({
           mode: z.enum(["off", "review", "block"]).optional(),
           allow: z.array(z.string()).optional(),
           deny: z.array(z.string()).optional(),
-          allowPrivate: z.boolean().optional()
+          allowPrivate: z.boolean().optional(),
+          // SSRF floor. `ssrfAllow` exempts OVERRIDABLE tiers only; a tier-1
+          // entry is dropped with a warning at load, never silently honoured.
+          ssrfAllow: z.array(z.string()).optional(),
+          ssrfStrict: z.boolean().optional()
         }).optional(),
         loopDetection: z.object({
           enabled: z.boolean().optional(),
@@ -2636,6 +3062,12 @@ function applyManagedEgress(local, managed, locked, localModeUserSet = true) {
   if (Array.isArray(managed.deny) && managed.deny.length > 0) {
     next.deny = [.../* @__PURE__ */ new Set([...local.deny ?? [], ...managed.deny])];
   }
+  if (typeof managed.ssrfStrict === "boolean") {
+    next.ssrfStrict = managed.ssrfStrict;
+  }
+  if (Array.isArray(managed.ssrfAllow)) {
+    next.ssrfAllow = [...managed.ssrfAllow];
+  }
   if (typeof managed.allowPrivate === "boolean") {
     next.allowPrivate = locked.includes("egressAllowPrivate") ? managed.allowPrivate : (local.allowPrivate ?? true) && managed.allowPrivate;
   }
@@ -2723,9 +3155,9 @@ function slug(s) {
 }
 function pathToRegexFragment(rawPath) {
   const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
-  const segments = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
-  if (segments.length === 0) return "";
-  return `(^|${B})${segments.join(SEP)}(${B}|$)`;
+  const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
+  if (segments2.length === 0) return "";
+  return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
 }
 function pathRules(rawPath, verdict, reason) {
   const value = pathToRegexFragment(rawPath);
@@ -2789,6 +3221,20 @@ var init_trusted_hosts = __esm({
 import fs4 from "fs";
 import path4 from "path";
 import os4 from "os";
+function sanitizeSsrfAllow(entries, source) {
+  const kept = [];
+  for (const entry of entries) {
+    const m = classifySsrf(entry);
+    if (m && !m.overridable) {
+      process.emitWarning(
+        `[node9] ${source} ssrfAllow entry "${entry}" is a protected address (${m.tier}) and cannot be exempted; ignoring it.`
+      );
+      continue;
+    }
+    kept.push(entry);
+  }
+  return kept;
+}
 function getCredentials() {
   const DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
   if (process.env.NODE9_API_KEY) {
@@ -2895,7 +3341,8 @@ function getConfig(cwd) {
     egress: {
       ...DEFAULT_CONFIG.policy.egress,
       allow: [...DEFAULT_CONFIG.policy.egress.allow],
-      deny: [...DEFAULT_CONFIG.policy.egress.deny]
+      deny: [...DEFAULT_CONFIG.policy.egress.deny],
+      ssrfAllow: [...DEFAULT_CONFIG.policy.egress.ssrfAllow ?? []]
     },
     loopDetection: { ...DEFAULT_CONFIG.policy.loopDetection },
     injectionScan: {
@@ -2921,6 +3368,7 @@ function getConfig(cwd) {
   };
   const pr2Creds = getCredentials();
   const keyed = !!pr2Creds?.apiKey && pr2Creds.localOnly !== true;
+  let ssrfStrictSource = "default";
   const applyLayer = (source, isProject = false, isCloud = false) => {
     if (!source) return;
     const s = source.settings || {};
@@ -3003,6 +3451,15 @@ function getConfig(cwd) {
       if (Array.isArray(e.deny)) mergedPolicy.egress.deny.push(...e.deny);
       if (e.allowPrivate !== void 0 && !(isProject && e.allowPrivate === true))
         mergedPolicy.egress.allowPrivate = e.allowPrivate;
+      if (!isProject) {
+        if (Array.isArray(e.ssrfAllow)) {
+          mergedPolicy.egress.ssrfAllow = sanitizeSsrfAllow(e.ssrfAllow, "egress.");
+        }
+        if (e.ssrfStrict !== void 0) {
+          mergedPolicy.egress.ssrfStrict = e.ssrfStrict;
+          ssrfStrictSource = "local";
+        }
+      }
     }
     if (p.loopDetection) {
       const ld = p.loopDetection;
@@ -3109,6 +3566,13 @@ function getConfig(cwd) {
             if (deny) mergedPolicy.egress.deny = deny;
             if (typeof e.allowPrivate === "boolean")
               mergedPolicy.egress.allowPrivate = e.allowPrivate;
+            if (typeof e.ssrfStrict === "boolean") {
+              mergedPolicy.egress.ssrfStrict = e.ssrfStrict;
+              ssrfStrictSource = "workspace";
+            }
+            const ssrfAllow = hosts(e.ssrfAllow);
+            if (ssrfAllow)
+              mergedPolicy.egress.ssrfAllow = sanitizeSsrfAllow(ssrfAllow, "managed egress.");
           } else {
             mergedPolicy.egress = applyManagedEgress(
               mergedPolicy.egress,
@@ -3117,7 +3581,16 @@ function getConfig(cwd) {
                 mode: typeof mc.egress.mode === "string" ? mc.egress.mode : void 0,
                 allow: hosts(mc.egress.allow),
                 deny: hosts(mc.egress.deny),
-                allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0
+                allowPrivate: typeof mc.egress.allowPrivate === "boolean" ? mc.egress.allowPrivate : void 0,
+                ssrfStrict: (() => {
+                  if (typeof mc.egress.ssrfStrict !== "boolean") return void 0;
+                  ssrfStrictSource = "workspace";
+                  return mc.egress.ssrfStrict;
+                })(),
+                ssrfAllow: (() => {
+                  const list = hosts(mc.egress.ssrfAllow);
+                  return list ? sanitizeSsrfAllow(list, "managed egress.") : void 0;
+                })()
               },
               locked,
               egressModeUserSet
@@ -3212,13 +3685,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path13 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path13) continue;
+            const path14 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path14) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path13, verdict, "org-managed jail")) {
+            for (const r of pathRules(path14, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path13, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path14, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -3347,6 +3820,7 @@ function getConfig(cwd) {
   mergedPolicy.dangerousWords = [...new Set(mergedPolicy.dangerousWords)];
   mergedPolicy.ignoredTools = [...new Set(mergedPolicy.ignoredTools)];
   mergedPolicy.skillPinning.roots = [...new Set(mergedPolicy.skillPinning.roots)];
+  const resolvedSsrfStrictSource = keyed && ssrfStrictSource === "local" ? "default" : ssrfStrictSource;
   const result = {
     settings: mergedSettings,
     policy: mergedPolicy,
@@ -3354,7 +3828,10 @@ function getConfig(cwd) {
     // PR-2 — the one truth introspection reads: which of the two working
     // modes this machine is in. 'workspace' = keyed, policy from the cloud;
     // 'local' = the local stack (incl. --local / named-profile keys).
-    policySource: keyed ? "workspace" : "local"
+    policySource: keyed ? "workspace" : "local",
+    // A keyed machine drops the local policy layers wholesale, so a 'local'
+    // provenance recorded before the fork cannot survive into the result.
+    ssrfStrictSource: resolvedSsrfStrictSource
   };
   if (!cwd) cachedConfig = result;
   return result;
@@ -3422,6 +3899,7 @@ var init_config = __esm({
     init_build();
     init_trusted_hosts();
     init_dist();
+    init_dist();
     DANGEROUS_WORDS = [
       "mkfs",
       // formats/wipes a filesystem partition
@@ -3431,6 +3909,7 @@ var init_config = __esm({
     DEFAULT_CONFIG = {
       version: "1.0",
       policySource: "local",
+      ssrfStrictSource: "default",
       settings: {
         mode: "standard",
         autoStartDaemon: true,
@@ -3614,7 +4093,17 @@ var init_config = __esm({
           }
         ],
         dlp: { enabled: true, scanIgnoredTools: true, pii: "off" },
-        egress: { enabled: false, mode: "review", allow: [], deny: [], allowPrivate: true },
+        egress: {
+          enabled: false,
+          mode: "review",
+          allow: [],
+          deny: [],
+          allowPrivate: true,
+          // The SSRF floor is always on and needs no default; these two only
+          // widen or narrow it. See doc/roadmap/active/ssrf-floor-design.md.
+          ssrfAllow: [],
+          ssrfStrict: false
+        },
         loopDetection: { enabled: true, threshold: 5, windowSeconds: 120 },
         injectionScan: { enabled: false, minConfidence: "medium", allow: [] },
         skillPinning: { enabled: false, mode: "warn", roots: [] },
@@ -4050,12 +4539,74 @@ var init_decision = __esm({
   }
 });
 
+// src/shields/jail.ts
+var init_jail = __esm({
+  "src/shields/jail.ts"() {
+    "use strict";
+    init_build();
+    init_dist();
+    init_shields();
+  }
+});
+
+// src/canary/registry.ts
+import fs7 from "fs";
+import os7 from "os";
+import path8 from "path";
+function canaryStorePath() {
+  return path8.join(os7.homedir(), ".node9", "canaries.json");
+}
+function isRecord(x) {
+  if (!x || typeof x !== "object") return false;
+  const r = x;
+  return typeof r.id === "string" && typeof r.value === "string" && typeof r.valueHash === "string";
+}
+function loadCanaries(opts) {
+  const p = canaryStorePath();
+  let raw;
+  try {
+    raw = fs7.readFileSync(p, "utf-8");
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new Error(
+      `[node9] ${p} is not valid JSON; refusing to touch it (${e instanceof Error ? e.message : String(e)})`
+    );
+  }
+  const recs = parsed?.records;
+  if (!Array.isArray(recs)) return [];
+  const out = recs.filter(isRecord);
+  return opts?.includeRetired === false ? out.filter((r) => !r.retiredAt) : out;
+}
+function canaryCtxValues() {
+  return loadCanaries().map((r) => ({
+    id: r.id,
+    value: r.value,
+    retired: Boolean(r.retiredAt),
+    kind: r.kind,
+    path: r.path
+  }));
+}
+var init_registry = __esm({
+  "src/canary/registry.ts"() {
+    "use strict";
+    init_dist();
+    init_jail();
+  }
+});
+
 // src/daemon/scan-watermark.ts
 var MAX_LINE_BYTES;
 var init_scan_watermark = __esm({
   "src/daemon/scan-watermark.ts"() {
     "use strict";
     init_dlp();
+    init_registry();
     init_config();
     init_dist();
     MAX_LINE_BYTES = 2 * 1024 * 1024;
@@ -4063,9 +4614,9 @@ var init_scan_watermark = __esm({
 });
 
 // src/cli/aggregate/report-audit.ts
-import fs7 from "fs";
-import os7 from "os";
-import path8 from "path";
+import fs8 from "fs";
+import os8 from "os";
+import path9 from "path";
 function buildTestTimestamps(allEntries) {
   const testTs = /* @__PURE__ */ new Set();
   for (const e of allEntries) {
@@ -4146,8 +4697,8 @@ function getDateRange(period, now) {
   }
 }
 function parseAuditLog(logPath) {
-  if (!fs7.existsSync(logPath)) return [];
-  const raw = fs7.readFileSync(logPath, "utf-8");
+  if (!fs8.existsSync(logPath)) return [];
+  const raw = fs8.readFileSync(logPath, "utf-8");
   return raw.split("\n").flatMap((line) => {
     if (!line.trim()) return [];
     try {
@@ -4201,10 +4752,10 @@ function freezeClaudeCost(acc) {
   };
 }
 function processClaudeCostProject(proj, projectsDir, start, end, acc) {
-  const projPath = path8.join(projectsDir, proj);
+  const projPath = path9.join(projectsDir, proj);
   let files;
   try {
-    const stat = fs7.statSync(projPath);
+    const stat = fs8.statSync(projPath);
     if (!stat.isDirectory()) return;
     files = listSessionFiles(projPath);
   } catch {
@@ -4212,14 +4763,14 @@ function processClaudeCostProject(proj, projectsDir, start, end, acc) {
   }
   const startMs = start.getTime();
   for (const file of files) {
-    const filePath = path8.join(projPath, file);
+    const filePath = path9.join(projPath, file);
     try {
-      if (fs7.statSync(filePath).mtimeMs < startMs) continue;
+      if (fs8.statSync(filePath).mtimeMs < startMs) continue;
     } catch {
       continue;
     }
     try {
-      const raw = fs7.readFileSync(filePath, "utf-8");
+      const raw = fs8.readFileSync(filePath, "utf-8");
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
         let entry;
@@ -4269,10 +4820,10 @@ function processClaudeCostProject(proj, projectsDir, start, end, acc) {
 }
 function loadClaudeCost(start, end, projectsDir) {
   const acc = emptyClaudeCostAccumulator();
-  if (!fs7.existsSync(projectsDir)) return freezeClaudeCost(acc);
+  if (!fs8.existsSync(projectsDir)) return freezeClaudeCost(acc);
   let dirs;
   try {
-    dirs = fs7.readdirSync(projectsDir);
+    dirs = fs8.readdirSync(projectsDir);
   } catch {
     return freezeClaudeCost(acc);
   }
@@ -4283,10 +4834,10 @@ function loadClaudeCost(start, end, projectsDir) {
 }
 async function loadClaudeCostAsync(start, end, projectsDir) {
   const acc = emptyClaudeCostAccumulator();
-  if (!fs7.existsSync(projectsDir)) return freezeClaudeCost(acc);
+  if (!fs8.existsSync(projectsDir)) return freezeClaudeCost(acc);
   let dirs;
   try {
-    dirs = fs7.readdirSync(projectsDir);
+    dirs = fs8.readdirSync(projectsDir);
   } catch {
     return freezeClaudeCost(acc);
   }
@@ -4299,7 +4850,7 @@ async function loadClaudeCostAsync(start, end, projectsDir) {
 function processCodexCostFile(filePath, start, end, acc) {
   let lines;
   try {
-    lines = fs7.readFileSync(filePath, "utf-8").split("\n");
+    lines = fs8.readFileSync(filePath, "utf-8").split("\n");
   } catch {
     return;
   }
@@ -4354,31 +4905,31 @@ function processCodexCostFile(filePath, start, end, acc) {
 }
 function listCodexSessionFiles(sessionsBase) {
   const jsonlFiles = [];
-  if (!fs7.existsSync(sessionsBase)) return jsonlFiles;
+  if (!fs8.existsSync(sessionsBase)) return jsonlFiles;
   try {
-    for (const year of fs7.readdirSync(sessionsBase)) {
-      const yearPath = path8.join(sessionsBase, year);
+    for (const year of fs8.readdirSync(sessionsBase)) {
+      const yearPath = path9.join(sessionsBase, year);
       try {
-        if (!fs7.statSync(yearPath).isDirectory()) continue;
+        if (!fs8.statSync(yearPath).isDirectory()) continue;
       } catch {
         continue;
       }
-      for (const month of fs7.readdirSync(yearPath)) {
-        const monthPath = path8.join(yearPath, month);
+      for (const month of fs8.readdirSync(yearPath)) {
+        const monthPath = path9.join(yearPath, month);
         try {
-          if (!fs7.statSync(monthPath).isDirectory()) continue;
+          if (!fs8.statSync(monthPath).isDirectory()) continue;
         } catch {
           continue;
         }
-        for (const day of fs7.readdirSync(monthPath)) {
-          const dayPath = path8.join(monthPath, day);
+        for (const day of fs8.readdirSync(monthPath)) {
+          const dayPath = path9.join(monthPath, day);
           try {
-            if (!fs7.statSync(dayPath).isDirectory()) continue;
+            if (!fs8.statSync(dayPath).isDirectory()) continue;
           } catch {
             continue;
           }
-          for (const file of fs7.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(path8.join(dayPath, file));
+          for (const file of fs8.readdirSync(dayPath)) {
+            if (file.endsWith(".jsonl")) jsonlFiles.push(path9.join(dayPath, file));
           }
         }
       }
@@ -4459,13 +5010,13 @@ function freezeGeminiCost(acc) {
 function processGeminiCostFile(filePath, projectKey, start, end, acc) {
   const startMs = start.getTime();
   try {
-    if (fs7.statSync(filePath).mtimeMs < startMs) return;
+    if (fs8.statSync(filePath).mtimeMs < startMs) return;
   } catch {
     return;
   }
   let raw;
   try {
-    raw = fs7.readFileSync(filePath, "utf-8");
+    raw = fs8.readFileSync(filePath, "utf-8");
   } catch {
     return;
   }
@@ -4514,30 +5065,30 @@ function listGeminiSessionFiles(geminiTmpDir) {
   const out = [];
   let dirs;
   try {
-    if (!fs7.statSync(geminiTmpDir).isDirectory()) return out;
-    dirs = fs7.readdirSync(geminiTmpDir);
+    if (!fs8.statSync(geminiTmpDir).isDirectory()) return out;
+    dirs = fs8.readdirSync(geminiTmpDir);
   } catch {
     return out;
   }
   for (const proj of dirs) {
-    const chatsDir = path8.join(geminiTmpDir, proj, "chats");
+    const chatsDir = path9.join(geminiTmpDir, proj, "chats");
     let files;
     try {
-      if (!fs7.statSync(chatsDir).isDirectory()) continue;
-      files = fs7.readdirSync(chatsDir);
+      if (!fs8.statSync(chatsDir).isDirectory()) continue;
+      files = fs8.readdirSync(chatsDir);
     } catch {
       continue;
     }
     for (const f of files) {
       if (!f.endsWith(".jsonl")) continue;
-      out.push({ projectKey: proj, file: path8.join(chatsDir, f) });
+      out.push({ projectKey: proj, file: path9.join(chatsDir, f) });
     }
   }
   return out;
 }
 function loadGeminiCost(start, end, geminiTmpDir) {
   const acc = emptyGeminiAccumulator();
-  if (!fs7.existsSync(geminiTmpDir)) return freezeGeminiCost(acc);
+  if (!fs8.existsSync(geminiTmpDir)) return freezeGeminiCost(acc);
   for (const { projectKey, file } of listGeminiSessionFiles(geminiTmpDir)) {
     processGeminiCostFile(file, projectKey, start, end, acc);
   }
@@ -4545,7 +5096,7 @@ function loadGeminiCost(start, end, geminiTmpDir) {
 }
 async function loadGeminiCostAsync(start, end, geminiTmpDir) {
   const acc = emptyGeminiAccumulator();
-  if (!fs7.existsSync(geminiTmpDir)) return freezeGeminiCost(acc);
+  if (!fs8.existsSync(geminiTmpDir)) return freezeGeminiCost(acc);
   const files = listGeminiSessionFiles(geminiTmpDir);
   const CHUNK_SIZE = 5;
   for (let i = 0; i < files.length; i++) {
@@ -4558,6 +5109,7 @@ async function loadGeminiCostAsync(start, end, geminiTmpDir) {
 }
 function dimensionOfBlock(checkedBy, ruleName) {
   if (checkedBy.includes("egress")) return "network";
+  if (ruleName.startsWith("ssrf:")) return "network";
   if (checkedBy.includes("pii") || checkedBy.includes("dlp")) return "data";
   if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection"))
     return "detection";
@@ -4568,11 +5120,11 @@ function dimensionOfBlock(checkedBy, ruleName) {
 }
 function aggregateReportFromAudit(period, opts = {}) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
-  const auditLogPath2 = opts.auditLogPath ?? path8.join(os7.homedir(), ".node9", "audit.log");
-  const claudeProjectsDir = opts.claudeProjectsDir ?? path8.join(os7.homedir(), ".claude", "projects");
-  const codexSessionsDir = opts.codexSessionsDir ?? path8.join(os7.homedir(), ".codex", "sessions");
-  const geminiTmpDir = opts.geminiTmpDir ?? path8.join(os7.homedir(), ".gemini", "tmp");
-  const hasAuditFile = fs7.existsSync(auditLogPath2);
+  const auditLogPath2 = opts.auditLogPath ?? path9.join(os8.homedir(), ".node9", "audit.log");
+  const claudeProjectsDir = opts.claudeProjectsDir ?? path9.join(os8.homedir(), ".claude", "projects");
+  const codexSessionsDir = opts.codexSessionsDir ?? path9.join(os8.homedir(), ".codex", "sessions");
+  const geminiTmpDir = opts.geminiTmpDir ?? path9.join(os8.homedir(), ".gemini", "tmp");
+  const hasAuditFile = fs8.existsSync(auditLogPath2);
   const allEntries = opts.preloadedAuditEntries ?? parseAuditLog(auditLogPath2);
   const unackedDlp = allEntries.filter((e) => e.source === "response-dlp");
   const { start, end } = getDateRange(period, now);
@@ -4826,18 +5378,18 @@ var init_keyed_guard = __esm({
 });
 
 // src/utils/provenance.ts
-import path9 from "path";
-import os8 from "os";
+import path10 from "path";
+import os9 from "os";
 var USER_PREFIXES;
 var init_provenance = __esm({
   "src/utils/provenance.ts"() {
     "use strict";
     USER_PREFIXES = [
-      path9.join(os8.homedir(), "bin"),
-      path9.join(os8.homedir(), ".local", "bin"),
-      path9.join(os8.homedir(), ".cargo", "bin"),
-      path9.join(os8.homedir(), ".npm-global", "bin"),
-      path9.join(os8.homedir(), ".volta", "bin")
+      path10.join(os9.homedir(), "bin"),
+      path10.join(os9.homedir(), ".local", "bin"),
+      path10.join(os9.homedir(), ".cargo", "bin"),
+      path10.join(os9.homedir(), ".npm-global", "bin"),
+      path10.join(os9.homedir(), ".volta", "bin")
     ];
   }
 });
@@ -4881,14 +5433,14 @@ var init_mcp_pin = __esm({
 });
 
 // src/daemon/hook-baseline.ts
-import path10 from "path";
-import os9 from "os";
+import path11 from "path";
+import os10 from "os";
 var BASELINE_FILE, NOTIFIED_FILE;
 var init_hook_baseline = __esm({
   "src/daemon/hook-baseline.ts"() {
     "use strict";
-    BASELINE_FILE = path10.join(os9.homedir(), ".node9", "hooks-baseline.json");
-    NOTIFIED_FILE = path10.join(os9.homedir(), ".node9", "hook-heal-notified.json");
+    BASELINE_FILE = path11.join(os10.homedir(), ".node9", "hooks-baseline.json");
+    NOTIFIED_FILE = path11.join(os10.homedir(), ".node9", "hook-heal-notified.json");
   }
 });
 
@@ -4947,9 +5499,9 @@ var init_scan_history = __esm({
 
 // src/cli/commands/scan.ts
 import chalk5 from "chalk";
-import fs8 from "fs";
-import path11 from "path";
-import os10 from "os";
+import fs9 from "fs";
+import path12 from "path";
+import os11 from "os";
 import stringWidth2 from "string-width";
 function claudeModelPrice2(model) {
   const t = pricingFor(model);
@@ -4970,12 +5522,6 @@ function isNode9SelfOutput(text) {
   }
   return false;
 }
-function looksLikeFixtureToken(sample) {
-  for (const re of FIXTURE_TOKEN_PATTERNS) {
-    if (re.test(sample)) return true;
-  }
-  return false;
-}
 function stripTerminalEscapes(s) {
   return s.replace(TERMINAL_ESCAPE_RE, "");
 }
@@ -4985,7 +5531,7 @@ function preview(input, max) {
   return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
 }
 function emptyScanDedup() {
-  return { findingsKeys: /* @__PURE__ */ new Set(), dlpKeys: /* @__PURE__ */ new Set() };
+  return { findingsKeys: /* @__PURE__ */ new Set(), dlpKeys: /* @__PURE__ */ new Set(), canaryIndex: /* @__PURE__ */ new Map() };
 }
 function findingKey(ruleName, inputPreview, projLabel) {
   return `${ruleName ?? "<unnamed>"}|${inputPreview}|${projLabel}`;
@@ -4993,6 +5539,73 @@ function findingKey(ruleName, inputPreview, projLabel) {
 function dlpKey(patternName, redactedSample, projLabel) {
   return `${patternName}|${redactedSample}|${projLabel}`;
 }
+function safeCanaryScanValues() {
+  try {
+    return canaryCtxValues();
+  } catch {
+    return [];
+  }
+}
+function recordCanaries(scanned, toolName, timestamp, projLabel, sessionId, agent, result, dedup, values) {
+  if (values.length === 0) return [];
+  let pool = [...values];
+  const matched = [];
+  for (let guard = 0; guard < 8 && pool.length > 0; guard++) {
+    const hit = matchCanaryArgs(scanned, pool);
+    if (!hit) break;
+    const v = pool.find((x) => x.id === hit.id);
+    if (v) matched.push(v.value);
+    pool = pool.filter((x) => x.id !== hit.id);
+    const key = `canary|${hit.id}|${sessionId}|${agent}`;
+    const existing = dedup.canaryIndex.get(key);
+    if (existing) {
+      existing.count++;
+      if (timestamp && (!existing.timestamp || timestamp < existing.timestamp)) {
+        existing.timestamp = timestamp;
+      }
+      continue;
+    }
+    const finding = {
+      canaryId: hit.id,
+      canaryHash: v?.valueHash ?? "",
+      kind: v?.kind ?? "unknown",
+      field: v?.field ?? "",
+      path: v?.path ?? "",
+      view: hit.view,
+      retired: hit.retired,
+      toolName,
+      timestamp,
+      project: projLabel,
+      sessionId,
+      agent,
+      count: 1
+    };
+    dedup.canaryIndex.set(key, finding);
+    result.canaryFindings.push(finding);
+  }
+  return matched;
+}
+function scrubDecoys(subject, values) {
+  if (values.length === 0) return subject;
+  const scrubText = (s) => {
+    let out = s;
+    for (const v of values) if (v) out = out.split(v).join("[node9-decoy]");
+    return out;
+  };
+  const walk = (v, depth) => {
+    if (depth > 6) return v;
+    if (typeof v === "string") return scrubText(v);
+    if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, child] of Object.entries(v))
+        out[k] = walk(child, depth + 1);
+      return out;
+    }
+    return v;
+  };
+  return walk(subject, 0);
+}
 function pushFsOpAstFinding(command, toolName, input, timestamp, projLabel, sessionId, agent, result, dedup) {
   const fsVerdict = analyzeFsOperation(command);
   if (!fsVerdict) return false;
@@ -5091,7 +5704,7 @@ function buildRuleSources() {
   }
   return sources;
 }
-function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, result, dedup, onProgress, onLine) {
+function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, result, dedup, canaryVals, onProgress, onLine) {
   result.filesScanned++;
   result.sessions++;
   onProgress?.(result.filesScanned);
@@ -5099,7 +5712,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   const session = { sessionId, costUSD: 0, toolCalls: 0 };
   let raw;
   try {
-    raw = fs8.readFileSync(path11.join(projPath, file), "utf-8");
+    raw = fs9.readFileSync(path12.join(projPath, file), "utf-8");
   } catch {
     return;
   }
@@ -5130,7 +5743,18 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
       if (Array.isArray(content2)) {
         const text = content2.filter((b) => b.type === "text").map((b) => b["text"] ?? "").join("\n");
         if (text) {
-          const dlpMatch = scanArgs({ text });
+          const decoysHere0 = recordCanaries(
+            { text },
+            "user-prompt",
+            entry.timestamp ?? "",
+            projLabel,
+            sessionId,
+            "claude",
+            result,
+            dedup,
+            canaryVals
+          );
+          const dlpMatch = scanArgs(scrubDecoys({ text }, decoysHere0));
           if (dlpMatch) {
             const k = dlpKey(dlpMatch.patternName, dlpMatch.redactedSample, projLabel);
             if (!dedup.dlpKeys.has(k)) {
@@ -5151,15 +5775,25 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
           if (block.type !== "tool_result") continue;
           const filePath = block.tool_use_id ? toolUseFilePaths.get(block.tool_use_id) : void 0;
           if (filePath) {
-            const ext = path11.extname(filePath).toLowerCase();
+            const ext = path12.extname(filePath).toLowerCase();
             if (CODE_EXTENSIONS.has(ext)) continue;
           }
           const resultText = typeof block.content === "string" ? block.content : Array.isArray(block.content) ? block.content.map((c) => c.text ?? "").join("\n") : null;
           if (!resultText) continue;
           if (isNode9SelfOutput(resultText)) continue;
-          const dlpMatch = scanArgs({ text: resultText });
+          const decoysHere1 = recordCanaries(
+            { text: resultText },
+            "tool-result",
+            entry.timestamp ?? "",
+            projLabel,
+            sessionId,
+            "claude",
+            result,
+            dedup,
+            canaryVals
+          );
+          const dlpMatch = scanArgs(scrubDecoys({ text: resultText }, decoysHere1));
           if (dlpMatch) {
-            if (looksLikeFixtureToken(dlpMatch.redactedSample)) continue;
             if (firstDlpTs === null) firstDlpTs = entry.timestamp ?? null;
             const k = dlpKey(dlpMatch.patternName, dlpMatch.redactedSample, projLabel);
             if (!dedup.dlpKeys.has(k)) {
@@ -5211,9 +5845,20 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
       const rawCmd = String(input.command ?? "").trimStart();
       if (/^node9\s+(scan|explain|report|tail|dlp|status|sessions|audit)\b/.test(rawCmd)) continue;
       const inputFilePath = typeof input.file_path === "string" ? input.file_path : "";
-      const inputFileExt = inputFilePath ? path11.extname(inputFilePath).toLowerCase() : "";
-      if (CODE_EXTENSIONS.has(inputFileExt)) continue;
-      const dlpMatch = scanArgs(input);
+      const inputFileExt = inputFilePath ? path12.extname(inputFilePath).toLowerCase() : "";
+      const canaryInInput = recordCanaries(
+        input,
+        toolName,
+        entry.timestamp ?? "",
+        projLabel,
+        sessionId,
+        "claude",
+        result,
+        dedup,
+        canaryVals
+      );
+      if (canaryInInput.length === 0 && CODE_EXTENSIONS.has(inputFileExt)) continue;
+      const dlpMatch = scanArgs(scrubDecoys(input, canaryInInput));
       if (dlpMatch) {
         if (firstDlpTs === null) firstDlpTs = entry.timestamp ?? null;
         const k = dlpKey(dlpMatch.patternName, dlpMatch.redactedSample, projLabel);
@@ -5308,14 +5953,14 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   }
   result.perSession.push(session);
 }
-async function processClaudeProjectAsync(proj, projectsDir, ruleSources, startDate, result, dedup, onProgress, onLine) {
-  const projPath = path11.join(projectsDir, proj);
+async function processClaudeProjectAsync(proj, projectsDir, ruleSources, startDate, result, dedup, canaryVals, onProgress, onLine) {
+  const projPath = path12.join(projectsDir, proj);
   try {
-    if (!fs8.statSync(projPath).isDirectory()) return;
+    if (!fs9.statSync(projPath).isDirectory()) return;
   } catch {
     return;
   }
-  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os10.homedir(), "~")).slice(
+  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os11.homedir(), "~")).slice(
     0,
     40
   );
@@ -5334,6 +5979,7 @@ async function processClaudeProjectAsync(proj, projectsDir, ruleSources, startDa
       startDate,
       result,
       dedup,
+      canaryVals,
       onProgress,
       onLine
     );
@@ -5351,6 +5997,7 @@ function emptyClaudeScan() {
     bashCalls: 0,
     findings: [],
     dlpFindings: [],
+    canaryFindings: [],
     loopFindings: [],
     totalCostUSD: 0,
     firstDate: null,
@@ -5360,17 +6007,18 @@ function emptyClaudeScan() {
   };
 }
 async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
-  const projectsDir = path11.join(os10.homedir(), ".claude", "projects");
+  const projectsDir = path12.join(os11.homedir(), ".claude", "projects");
   const result = emptyClaudeScan();
-  if (!fs8.existsSync(projectsDir)) return result;
+  if (!fs9.existsSync(projectsDir)) return result;
   let projDirs;
   try {
-    projDirs = fs8.readdirSync(projectsDir);
+    projDirs = fs9.readdirSync(projectsDir);
   } catch {
     return result;
   }
   const ruleSources = buildRuleSources();
   const dedup = emptyScanDedup();
+  const canaryVals = safeCanaryScanValues();
   for (const proj of projDirs) {
     await processClaudeProjectAsync(
       proj,
@@ -5379,6 +6027,7 @@ async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
       startDate,
       result,
       dedup,
+      canaryVals,
       onProgress,
       onLine
     );
@@ -5386,7 +6035,8 @@ async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
   return result;
 }
 function scanGeminiHistory(startDate, onProgress, onLine) {
-  const tmpDir = path11.join(os10.homedir(), ".gemini", "tmp");
+  const canaryVals = safeCanaryScanValues();
+  const tmpDir = path12.join(os11.homedir(), ".gemini", "tmp");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -5394,6 +6044,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     bashCalls: 0,
     findings: [],
     dlpFindings: [],
+    canaryFindings: [],
     loopFindings: [],
     totalCostUSD: 0,
     firstDate: null,
@@ -5402,33 +6053,33 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     perSession: []
   };
   const dedup = emptyScanDedup();
-  if (!fs8.existsSync(tmpDir)) return result;
+  if (!fs9.existsSync(tmpDir)) return result;
   let slugDirs;
   try {
-    slugDirs = fs8.readdirSync(tmpDir);
+    slugDirs = fs9.readdirSync(tmpDir);
   } catch {
     return result;
   }
   const ruleSources = buildRuleSources();
   for (const slug2 of slugDirs) {
-    const slugPath = path11.join(tmpDir, slug2);
+    const slugPath = path12.join(tmpDir, slug2);
     try {
-      if (!fs8.statSync(slugPath).isDirectory()) continue;
+      if (!fs9.statSync(slugPath).isDirectory()) continue;
     } catch {
       continue;
     }
     let projLabel = stripTerminalEscapes(slug2).slice(0, 40);
     try {
       projLabel = stripTerminalEscapes(
-        fs8.readFileSync(path11.join(slugPath, ".project_root"), "utf-8").trim()
-      ).replace(os10.homedir(), "~").slice(0, 40);
+        fs9.readFileSync(path12.join(slugPath, ".project_root"), "utf-8").trim()
+      ).replace(os11.homedir(), "~").slice(0, 40);
     } catch {
     }
-    const chatsDir = path11.join(slugPath, "chats");
-    if (!fs8.existsSync(chatsDir)) continue;
+    const chatsDir = path12.join(slugPath, "chats");
+    if (!fs9.existsSync(chatsDir)) continue;
     let chatFiles;
     try {
-      chatFiles = fs8.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
+      chatFiles = fs9.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
     } catch {
       continue;
     }
@@ -5441,7 +6092,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
       onProgress?.(result.filesScanned);
       let raw;
       try {
-        raw = fs8.readFileSync(path11.join(chatsDir, chatFile), "utf-8");
+        raw = fs9.readFileSync(path12.join(chatsDir, chatFile), "utf-8");
       } catch {
         continue;
       }
@@ -5470,7 +6121,18 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
           const content = msg.content;
           const text = Array.isArray(content) ? content.map((c) => c.text ?? "").join("\n") : typeof content === "string" ? content : "";
           if (text) {
-            const dlpMatch = scanArgs({ text });
+            const decoysHere3 = recordCanaries(
+              { text },
+              "user-prompt",
+              msg.timestamp ?? "",
+              projLabel,
+              sessionId,
+              "gemini",
+              result,
+              dedup,
+              canaryVals
+            );
+            const dlpMatch = scanArgs(scrubDecoys({ text }, decoysHere3));
             if (dlpMatch) {
               const k = dlpKey(dlpMatch.patternName, dlpMatch.redactedSample, projLabel);
               if (!dedup.dlpKeys.has(k)) {
@@ -5517,7 +6179,18 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
           const rawCmd = String(input.command ?? "").trimStart();
           if (/^node9\s+(scan|explain|report|tail|dlp|status|sessions|audit)\b/.test(rawCmd))
             continue;
-          const dlpMatch = scanArgs(input);
+          const decoysHere4 = recordCanaries(
+            input,
+            toolName,
+            msg.timestamp ?? "",
+            projLabel,
+            sessionId,
+            "gemini",
+            result,
+            dedup,
+            canaryVals
+          );
+          const dlpMatch = scanArgs(scrubDecoys(input, decoysHere4));
           if (dlpMatch) {
             const k = dlpKey(dlpMatch.patternName, dlpMatch.redactedSample, projLabel);
             if (!dedup.dlpKeys.has(k)) {
@@ -5614,7 +6287,8 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
   return result;
 }
 function scanCodexHistory(startDate, onProgress, onLine) {
-  const sessionsBase = path11.join(os10.homedir(), ".codex", "sessions");
+  const canaryVals = safeCanaryScanValues();
+  const sessionsBase = path12.join(os11.homedir(), ".codex", "sessions");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -5622,6 +6296,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     bashCalls: 0,
     findings: [],
     dlpFindings: [],
+    canaryFindings: [],
     loopFindings: [],
     totalCostUSD: 0,
     firstDate: null,
@@ -5630,32 +6305,32 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     perSession: []
   };
   const dedup = emptyScanDedup();
-  if (!fs8.existsSync(sessionsBase)) return result;
+  if (!fs9.existsSync(sessionsBase)) return result;
   const jsonlFiles = [];
   try {
-    for (const year of fs8.readdirSync(sessionsBase)) {
-      const yearPath = path11.join(sessionsBase, year);
+    for (const year of fs9.readdirSync(sessionsBase)) {
+      const yearPath = path12.join(sessionsBase, year);
       try {
-        if (!fs8.statSync(yearPath).isDirectory()) continue;
+        if (!fs9.statSync(yearPath).isDirectory()) continue;
       } catch {
         continue;
       }
-      for (const month of fs8.readdirSync(yearPath)) {
-        const monthPath = path11.join(yearPath, month);
+      for (const month of fs9.readdirSync(yearPath)) {
+        const monthPath = path12.join(yearPath, month);
         try {
-          if (!fs8.statSync(monthPath).isDirectory()) continue;
+          if (!fs9.statSync(monthPath).isDirectory()) continue;
         } catch {
           continue;
         }
-        for (const day of fs8.readdirSync(monthPath)) {
-          const dayPath = path11.join(monthPath, day);
+        for (const day of fs9.readdirSync(monthPath)) {
+          const dayPath = path12.join(monthPath, day);
           try {
-            if (!fs8.statSync(dayPath).isDirectory()) continue;
+            if (!fs9.statSync(dayPath).isDirectory()) continue;
           } catch {
             continue;
           }
-          for (const file of fs8.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(path11.join(dayPath, file));
+          for (const file of fs9.readdirSync(dayPath)) {
+            if (file.endsWith(".jsonl")) jsonlFiles.push(path12.join(dayPath, file));
           }
         }
       }
@@ -5669,7 +6344,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     onProgress?.(result.filesScanned);
     let lines;
     try {
-      lines = fs8.readFileSync(filePath, "utf-8").split("\n");
+      lines = fs9.readFileSync(filePath, "utf-8").split("\n");
     } catch {
       continue;
     }
@@ -5696,7 +6371,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         sessionId = String(payload["id"] ?? filePath);
         startTime = String(payload["timestamp"] ?? "");
         const cwd = String(payload["cwd"] ?? "");
-        projLabel = stripTerminalEscapes(cwd.replace(os10.homedir(), "~")).slice(0, 40);
+        projLabel = stripTerminalEscapes(cwd.replace(os11.homedir(), "~")).slice(0, 40);
         continue;
       }
       if (entry.type === "turn_context" && typeof payload["model"] === "string") {
@@ -5714,7 +6389,18 @@ function scanCodexHistory(startDate, onProgress, onLine) {
       if (entry.type === "event_msg" && payload["type"] === "user_message") {
         const text = String(payload["message"] ?? "");
         if (text) {
-          const dlpMatch2 = scanArgs({ text });
+          const decoysHere9 = recordCanaries(
+            { text },
+            "user-prompt",
+            entry.timestamp ?? startTime,
+            projLabel,
+            sessionId,
+            "codex",
+            result,
+            dedup,
+            canaryVals
+          );
+          const dlpMatch2 = scanArgs(scrubDecoys({ text }, decoysHere9));
           if (dlpMatch2) {
             const k = dlpKey(dlpMatch2.patternName, dlpMatch2.redactedSample, projLabel);
             if (!dedup.dlpKeys.has(k)) {
@@ -5758,7 +6444,18 @@ function scanCodexHistory(startDate, onProgress, onLine) {
       }
       const rawCmd = String(input["command"] ?? "").trimStart();
       if (/^node9\s+(scan|explain|report|tail|dlp|status|sessions|audit)\b/.test(rawCmd)) continue;
-      const dlpMatch = scanArgs(input);
+      const decoysHere10 = recordCanaries(
+        input,
+        toolName,
+        ts,
+        projLabel,
+        sessionId,
+        "codex",
+        result,
+        dedup,
+        canaryVals
+      );
+      const dlpMatch = scanArgs(scrubDecoys(input, decoysHere10));
       if (dlpMatch) {
         const k = dlpKey(dlpMatch.patternName, dlpMatch.redactedSample, projLabel);
         if (!dedup.dlpKeys.has(k)) {
@@ -5857,7 +6554,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
   }
   return result;
 }
-var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, FIXTURE_TOKEN_PATTERNS, TERMINAL_ESCAPE_RE, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
+var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, TERMINAL_ESCAPE_RE, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
@@ -5867,6 +6564,8 @@ var init_scan = __esm({
     init_policy();
     init_dist();
     init_dlp();
+    init_dlp();
+    init_registry();
     init_litellm();
     init_cost_gemini();
     init_cost_codex();
@@ -5915,16 +6614,6 @@ var init_scan = __esm({
       /\bseverity:\s*['"](?:block|review|allow)['"]/,
       /NODE9 SECURITY ALERT/
     ];
-    FIXTURE_TOKEN_PATTERNS = [
-      /(.)\1{5,}/,
-      // 6+ repeated characters (aaaaaa, 000000)
-      /(?:EXAMPLE|FAKE|DUMMY|PLACEHOLDER|XXXXX)/i,
-      /abcdefghijklmn/i,
-      // long alpha sequence — fixture, not entropy
-      /1234567890/,
-      // long digit sequence — fixture, not entropy
-      /qwerty/i
-    ];
     TERMINAL_ESCAPE_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
     LOOP_TOOLS = /* @__PURE__ */ new Set([
       "bash",
@@ -5944,23 +6633,23 @@ var init_scan = __esm({
 });
 
 // src/tui/dashboard/data.ts
-import fs9 from "fs";
-import os11 from "os";
-import path12 from "path";
+import fs10 from "fs";
+import os12 from "os";
+import path13 from "path";
 import http from "http";
 function auditLogPath() {
-  return path12.join(os11.homedir(), ".node9", "audit.log");
+  return path13.join(os12.homedir(), ".node9", "audit.log");
 }
 function readAuditEntriesAsync(chunkSize = 1e3, customPath) {
   return new Promise((resolve) => {
     const p = customPath ?? auditLogPath();
-    if (!fs9.existsSync(p)) {
+    if (!fs10.existsSync(p)) {
       resolve([]);
       return;
     }
     let raw;
     try {
-      raw = fs9.readFileSync(p, "utf8");
+      raw = fs10.readFileSync(p, "utf8");
     } catch {
       resolve([]);
       return;
@@ -6092,13 +6781,13 @@ function loadBlast() {
   }
 }
 function shortenPath(p) {
-  const home = os11.homedir();
+  const home = os12.homedir();
   return p.startsWith(home) ? p.replace(home, "~") : p;
 }
 async function loadReportAuditAsync(period) {
-  const claudeProjectsDir = path12.join(os11.homedir(), ".claude", "projects");
-  const codexSessionsDir = path12.join(os11.homedir(), ".codex", "sessions");
-  const geminiTmpDir = path12.join(os11.homedir(), ".gemini", "tmp");
+  const claudeProjectsDir = path13.join(os12.homedir(), ".claude", "projects");
+  const codexSessionsDir = path13.join(os12.homedir(), ".codex", "sessions");
+  const geminiTmpDir = path13.join(os12.homedir(), ".gemini", "tmp");
   const { start, end } = getDateRange(period, /* @__PURE__ */ new Date());
   const entries = await readAuditEntriesAsync();
   void ensurePricingLoaded();
@@ -7197,8 +7886,8 @@ import { Fragment as Fragment3, jsx as jsx4, jsxs as jsxs4 } from "react/jsx-run
 function TopToolsProjects({ audit }) {
   const data = audit?.data;
   const tools = data ? [...data.toolMap.entries()].sort(([, a], [, b]) => b.calls - a.calls).slice(0, ROW_LIMIT) : [];
-  const projects = data ? [...data.cost.byProject.entries()].map(([path13, r]) => ({
-    name: basenameOf(path13),
+  const projects = data ? [...data.cost.byProject.entries()].map(([path14, r]) => ({
+    name: basenameOf(path14),
     cost: r.cost,
     tokens: r.inputTokens + r.outputTokens
   })).sort((a, b) => b.cost - a.cost).slice(0, ROW_LIMIT) : [];
@@ -7635,8 +8324,8 @@ function pickTopLoopFile(loops) {
     map.set(k, (map.get(k) ?? 0) + (l.count ?? 0));
   }
   if (map.size === 0) return void 0;
-  const [path13, count] = [...map.entries()].sort((a, b) => b[1] - a[1])[0];
-  return { path: path13, count };
+  const [path14, count] = [...map.entries()].sort((a, b) => b[1] - a[1])[0];
+  return { path: path14, count };
 }
 var EMPTY_FILTERED_SCAN;
 var init_derive = __esm({