@profullstack/threatcrush 0.11.1 → 0.11.2

package/dist/daemon.js

@@ -2022,8 +2022,8 @@ var require_toml = __commonJS({
 });
 
 // src/daemon/index.ts
-var import_node_fs15 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path12 = require("path");
 
 // src/daemon/paths.ts
 var import_node_fs = require("fs");
@@ -2107,7 +2107,28 @@ function findRunningDaemon() {
 
 // src/daemon/ipc-server.ts
 var import_node_net = require("net");
+var import_node_fs4 = require("fs");
+
+// src/daemon/control-token.ts
+var import_node_crypto = require("crypto");
 var import_node_fs3 = require("fs");
+var import_node_path2 = require("path");
+var CONTROL_TOKEN_FILE = (0, import_node_path2.join)(PATHS.runDir, "control.token");
+function issueControlToken() {
+  const token = (0, import_node_crypto.randomBytes)(32).toString("hex");
+  (0, import_node_fs3.writeFileSync)(CONTROL_TOKEN_FILE, token, { mode: 384 });
+  try {
+    (0, import_node_fs3.chmodSync)(CONTROL_TOKEN_FILE, 384);
+  } catch {
+  }
+  return token;
+}
+function tokensMatch(expected, provided) {
+  if (typeof provided !== "string" || !provided) return false;
+  const a = Buffer.from(expected);
+  const b = Buffer.from(provided);
+  return a.length === b.length && (0, import_node_crypto.timingSafeEqual)(a, b);
+}
 
 // src/daemon/event-bus.ts
 var import_node_events = require("events");
@@ -2303,10 +2324,12 @@ var IpcServer = class {
   nextClientId = 1;
   startedAt = /* @__PURE__ */ new Date();
   counters = { events: 0, threats: 0, alerts: 0 };
+  controlToken = "";
   async start() {
-    if ((0, import_node_fs3.existsSync)(PATHS.socket)) {
+    this.controlToken = issueControlToken();
+    if ((0, import_node_fs4.existsSync)(PATHS.socket)) {
       try {
-        (0, import_node_fs3.unlinkSync)(PATHS.socket);
+        (0, import_node_fs4.unlinkSync)(PATHS.socket);
       } catch {
       }
     }
@@ -2342,14 +2365,14 @@ var IpcServer = class {
     return new Promise((resolve3) => {
       if (!this.server) {
         try {
-          if ((0, import_node_fs3.existsSync)(PATHS.socket)) (0, import_node_fs3.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs4.existsSync)(PATHS.socket)) (0, import_node_fs4.unlinkSync)(PATHS.socket);
         } catch {
         }
         return resolve3();
       }
       this.server.close(() => {
         try {
-          if ((0, import_node_fs3.existsSync)(PATHS.socket)) (0, import_node_fs3.unlinkSync)(PATHS.socket);
+          if ((0, import_node_fs4.existsSync)(PATHS.socket)) (0, import_node_fs4.unlinkSync)(PATHS.socket);
         } catch {
         }
         resolve3();
@@ -2435,6 +2458,13 @@ var IpcServer = class {
         for (const ch of req.params.channels) client.subscriptions.add(ch);
         return this.send(client, { id: req.id, ok: true, result: { subscribed: [...client.subscriptions] } });
       case "shutdown":
+        if (!tokensMatch(this.controlToken, req.params?.token)) {
+          return this.send(client, {
+            id: req.id,
+            ok: false,
+            error: "shutdown requires the daemon control token (run as root, or use systemctl)"
+          });
+        }
         this.send(client, { id: req.id, ok: true, result: "shutting down" });
         setTimeout(() => process.emit("SIGTERM"), 50);
         return;
@@ -2455,13 +2485,134 @@ var IpcServer = class {
 };
 
 // src/daemon/module-host.ts
-var import_node_fs8 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path5 = require("path");
 var import_node_url = require("url");
 var import_toml2 = __toESM(require_toml());
 
+// src/daemon/module-trust.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs5 = require("fs");
+var import_node_path3 = require("path");
+var TRUST_FILE = (0, import_node_path3.join)(PATHS.configDir, "trusted-modules.json");
+var PUBLISHER_KEYS_FILE = (0, import_node_path3.join)(PATHS.configDir, "publisher-keys.json");
+var DIGEST_EXCLUDED_DIRS = /* @__PURE__ */ new Set([".git"]);
+function collectFiles(root, dir = root, out = []) {
+  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true }).sort(
+    (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
+  )) {
+    const full = (0, import_node_path3.join)(dir, entry.name);
+    if (entry.isSymbolicLink()) {
+      out.push({ path: full, isSymlink: true });
+    } else if (entry.isDirectory()) {
+      if (DIGEST_EXCLUDED_DIRS.has(entry.name)) continue;
+      collectFiles(root, full, out);
+    } else if (entry.isFile()) {
+      out.push({ path: full, isSymlink: false });
+    }
+  }
+  return out;
+}
+function computeModuleDigest(modulePath) {
+  const hash = (0, import_node_crypto2.createHash)("sha256");
+  for (const entry of collectFiles(modulePath)) {
+    const relPath = (0, import_node_path3.relative)(modulePath, entry.path).split(import_node_path3.sep).join("/");
+    hash.update(relPath);
+    hash.update("\0");
+    if (entry.isSymlink) {
+      hash.update("symlink:");
+      hash.update((0, import_node_fs5.readlinkSync)(entry.path));
+    } else {
+      hash.update("file:");
+      hash.update((0, import_node_fs5.readFileSync)(entry.path));
+    }
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function readTrustFile() {
+  if (!(0, import_node_fs5.existsSync)(TRUST_FILE)) return { version: 1, modules: {} };
+  try {
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(TRUST_FILE, "utf-8"));
+    if (parsed.version !== 1 || typeof parsed.modules !== "object" || !parsed.modules) {
+      return { version: 1, modules: {} };
+    }
+    return { version: 1, modules: parsed.modules };
+  } catch {
+    return { version: 1, modules: {} };
+  }
+}
+function readPublisherKeys() {
+  if (!(0, import_node_fs5.existsSync)(PUBLISHER_KEYS_FILE)) return {};
+  try {
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(PUBLISHER_KEYS_FILE, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function verifyModuleSignature(modulePath, digest) {
+  const keys = readPublisherKeys();
+  const pinnedKeyIds = Object.keys(keys);
+  const sigPath = (0, import_node_path3.join)(modulePath, "mod.sig");
+  if (pinnedKeyIds.length === 0) {
+    return { ok: true };
+  }
+  if (!(0, import_node_fs5.existsSync)(sigPath)) {
+    return { ok: false, reason: "publisher keys are pinned but the module ships no mod.sig" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs5.readFileSync)(sigPath, "utf-8"));
+  } catch {
+    return { ok: false, reason: "mod.sig is not valid JSON" };
+  }
+  if (!parsed.keyId || !parsed.signature) {
+    return { ok: false, reason: "mod.sig is missing keyId or signature" };
+  }
+  const publicKey = keys[parsed.keyId];
+  if (!publicKey) {
+    return { ok: false, reason: `mod.sig references unpinned key "${parsed.keyId}"` };
+  }
+  try {
+    const valid = (0, import_node_crypto2.verify)(
+      null,
+      Buffer.from(digest, "hex"),
+      publicKey,
+      Buffer.from(parsed.signature, "base64")
+    );
+    return valid ? { ok: true } : { ok: false, reason: "mod.sig signature does not match" };
+  } catch (err) {
+    return { ok: false, reason: `signature check failed: ${String(err.message || err)}` };
+  }
+}
+function verifyModuleTrust(name, modulePath) {
+  let digest;
+  try {
+    digest = computeModuleDigest(modulePath);
+  } catch (err) {
+    return { ok: false, reason: `could not hash module: ${String(err.message || err)}` };
+  }
+  const signature = verifyModuleSignature(modulePath, digest);
+  if (!signature.ok) return signature;
+  const record = readTrustFile().modules[name];
+  if (!record) {
+    return {
+      ok: false,
+      reason: `not trusted \u2014 review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  if (record.digest !== digest) {
+    return {
+      ok: false,
+      reason: `contents changed since it was trusted on ${record.trustedAt} \u2014 re-review it, then run: threatcrush modules trust ${name}`
+    };
+  }
+  return { ok: true };
+}
+
 // src/daemon/watchers/log-watcher.ts
-var import_node_fs4 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_readline = require("readline");
 
 // src/core/log-parser.ts
@@ -2618,9 +2769,9 @@ var LogWatcher = class {
   start() {
     const started = [];
     for (const src of this.sources) {
-      if (!(0, import_node_fs4.existsSync)(src.path)) continue;
+      if (!(0, import_node_fs6.existsSync)(src.path)) continue;
       try {
-        (0, import_node_fs4.accessSync)(src.path, import_node_fs4.constants.R_OK);
+        (0, import_node_fs6.accessSync)(src.path, import_node_fs6.constants.R_OK);
       } catch {
         continue;
       }
@@ -2640,7 +2791,7 @@ var LogWatcher = class {
   }
   tail(src) {
     try {
-      this.positions.set(src.path, (0, import_node_fs4.statSync)(src.path).size);
+      this.positions.set(src.path, (0, import_node_fs6.statSync)(src.path).size);
     } catch {
       this.positions.set(src.path, 0);
     }
@@ -2651,7 +2802,7 @@ var LogWatcher = class {
   poll(src) {
     let stat;
     try {
-      stat = (0, import_node_fs4.statSync)(src.path);
+      stat = (0, import_node_fs6.statSync)(src.path);
     } catch {
       return;
     }
@@ -2661,7 +2812,7 @@ var LogWatcher = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs4.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs6.createReadStream)(src.path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(src.path, stat.size));
     const rl = (0, import_node_readline.createInterface)({ input: stream });
     rl.on("error", () => {
@@ -2853,7 +3004,7 @@ function realtimeToDate(rt) {
 
 // src/modules/network-monitor/index.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs5 = require("fs");
+var import_node_fs7 = require("fs");
 var NetworkMonitor = class {
   constructor(bus2) {
     this.bus = bus2;
@@ -2891,7 +3042,7 @@ var NetworkMonitor = class {
   hasConntrackOrSs() {
     const ss = (0, import_node_child_process2.spawnSync)("ss", ["--version"], { stdio: "pipe" });
     if (ss.status === 0) return true;
-    return (0, import_node_fs5.existsSync)("/proc/net/tcp");
+    return (0, import_node_fs7.existsSync)("/proc/net/tcp");
   }
   poll() {
     try {
@@ -3030,7 +3181,7 @@ var NetworkMonitor = class {
 };
 
 // src/modules/dns-monitor/index.ts
-var import_node_fs6 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_readline2 = require("readline");
 var DNS_LOG_SOURCES = [
   "/var/log/syslog",
@@ -3064,9 +3215,9 @@ var DnsMonitor = class {
   entropyThreshold = 3.5;
   start() {
     const sources = DNS_LOG_SOURCES.filter((p) => {
-      if (!(0, import_node_fs6.existsSync)(p)) return false;
+      if (!(0, import_node_fs8.existsSync)(p)) return false;
       try {
-        (0, import_node_fs6.accessSync)(p, import_node_fs6.constants.R_OK);
+        (0, import_node_fs8.accessSync)(p, import_node_fs8.constants.R_OK);
         return true;
       } catch {
         return false;
@@ -3090,7 +3241,7 @@ var DnsMonitor = class {
   }
   tailLog(path) {
     try {
-      this.positions.set(path, (0, import_node_fs6.statSync)(path).size);
+      this.positions.set(path, (0, import_node_fs8.statSync)(path).size);
     } catch {
       this.positions.set(path, 0);
     }
@@ -3100,7 +3251,7 @@ var DnsMonitor = class {
   pollLog(path) {
     let stat;
     try {
-      stat = (0, import_node_fs6.statSync)(path);
+      stat = (0, import_node_fs8.statSync)(path);
     } catch {
       return;
     }
@@ -3110,7 +3261,7 @@ var DnsMonitor = class {
       return;
     }
     if (stat.size === prev) return;
-    const stream = (0, import_node_fs6.createReadStream)(path, { start: prev, encoding: "utf-8" });
+    const stream = (0, import_node_fs8.createReadStream)(path, { start: prev, encoding: "utf-8" });
     stream.on("error", () => this.positions.set(path, stat.size));
     const rl = (0, import_node_readline2.createInterface)({ input: stream });
     rl.on("line", (line) => this.parseDnsLine(line));
@@ -3239,8 +3390,8 @@ var DnsMonitor = class {
 };
 
 // src/core/config.ts
-var import_node_fs7 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path4 = require("path");
 var import_toml = __toESM(require_toml());
 var DEFAULT_CONFIG_PATH = "/etc/threatcrush/threatcrushd.conf";
 var DEFAULT_CONFDIR = "/etc/threatcrush/threatcrushd.conf.d";
@@ -3266,11 +3417,11 @@ var DEFAULT_CONFIG = {
 };
 function loadConfig(configPath) {
   const path = configPath || DEFAULT_CONFIG_PATH;
-  if (!(0, import_node_fs7.existsSync)(path)) {
+  if (!(0, import_node_fs9.existsSync)(path)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const raw = (0, import_node_fs7.readFileSync)(path, "utf-8");
+    const raw = (0, import_node_fs9.readFileSync)(path, "utf-8");
     const parsed = import_toml.default.parse(raw);
     return {
       daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },
@@ -3286,13 +3437,13 @@ function loadConfig(configPath) {
 function loadModuleConfigs(confDir) {
   const dir = confDir || DEFAULT_CONFDIR;
   const configs = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs7.existsSync)(dir)) {
+  if (!(0, import_node_fs9.existsSync)(dir)) {
     return configs;
   }
-  const files = (0, import_node_fs7.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
+  const files = (0, import_node_fs9.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
   for (const file of files) {
     try {
-      const raw = (0, import_node_fs7.readFileSync)((0, import_node_path2.join)(dir, file), "utf-8");
+      const raw = (0, import_node_fs9.readFileSync)((0, import_node_path4.join)(dir, file), "utf-8");
       const parsed = import_toml.default.parse(raw);
       for (const [name, config] of Object.entries(parsed)) {
         configs.set(name, config);
@@ -3406,15 +3557,15 @@ var ModuleHost = class {
     for (const m of builtins) this.modules.set(m.name, m);
   }
   async discoverAndStartInstalled() {
-    if (!(0, import_node_fs8.existsSync)(PATHS.moduleDir)) return;
+    if (!(0, import_node_fs10.existsSync)(PATHS.moduleDir)) return;
     const configs = loadModuleConfigs(PATHS.confD);
-    const entries = (0, import_node_fs8.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
+    const entries = (0, import_node_fs10.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = (0, import_node_path3.join)(PATHS.moduleDir, entry.name, "mod.toml");
-      if (!(0, import_node_fs8.existsSync)(manifestPath)) continue;
+      const manifestPath = (0, import_node_path5.join)(PATHS.moduleDir, entry.name, "mod.toml");
+      if (!(0, import_node_fs10.existsSync)(manifestPath)) continue;
       try {
-        const manifest = import_toml2.default.parse((0, import_node_fs8.readFileSync)(manifestPath, "utf-8"));
+        const manifest = import_toml2.default.parse((0, import_node_fs10.readFileSync)(manifestPath, "utf-8"));
         const name = manifest.module?.name || entry.name;
         const defaults = manifest.module?.config?.defaults || {};
         const config = {
@@ -3428,7 +3579,7 @@ var ModuleHost = class {
           source: "installed",
           status: config.enabled === false ? "disabled" : "loaded",
           events: 0,
-          path: (0, import_node_path3.join)(PATHS.moduleDir, entry.name),
+          path: (0, import_node_path5.join)(PATHS.moduleDir, entry.name),
           config
         };
         this.modules.set(name, hosted);
@@ -3443,7 +3594,7 @@ var ModuleHost = class {
           status: "error",
           events: 0,
           detail: `manifest load failed: ${String(err.message || err)}`,
-          path: (0, import_node_path3.join)(PATHS.moduleDir, entry.name)
+          path: (0, import_node_path5.join)(PATHS.moduleDir, entry.name)
         });
       }
     }
@@ -3455,6 +3606,13 @@ var ModuleHost = class {
       hosted.detail = "no built entrypoint found; run npm install && npm run build in the module directory";
       return;
     }
+    const trust = verifyModuleTrust(hosted.name, hosted.path);
+    if (!trust.ok) {
+      hosted.status = "error";
+      hosted.detail = `refusing to load: ${trust.reason}`;
+      this.bus.announceModule(hosted.name, "error", hosted.detail);
+      return;
+    }
     try {
       const imported = await import((0, import_node_url.pathToFileURL)(entrypoint).href);
       const exported = imported.default || imported.module || imported;
@@ -3475,17 +3633,17 @@ var ModuleHost = class {
     }
   }
   installedEntrypoint(modulePath) {
-    const packageJson = (0, import_node_path3.join)(modulePath, "package.json");
+    const packageJson = (0, import_node_path5.join)(modulePath, "package.json");
     const candidates = [];
-    if ((0, import_node_fs8.existsSync)(packageJson)) {
+    if ((0, import_node_fs10.existsSync)(packageJson)) {
       try {
-        const pkg = JSON.parse((0, import_node_fs8.readFileSync)(packageJson, "utf-8"));
-        if (pkg.main) candidates.push((0, import_node_path3.join)(modulePath, pkg.main));
+        const pkg = JSON.parse((0, import_node_fs10.readFileSync)(packageJson, "utf-8"));
+        if (pkg.main) candidates.push((0, import_node_path5.join)(modulePath, pkg.main));
       } catch {
       }
     }
-    candidates.push((0, import_node_path3.join)(modulePath, "dist", "index.js"), (0, import_node_path3.join)(modulePath, "index.js"));
-    return candidates.find((candidate) => (0, import_node_fs8.existsSync)(candidate)) || null;
+    candidates.push((0, import_node_path5.join)(modulePath, "dist", "index.js"), (0, import_node_path5.join)(modulePath, "index.js"));
+    return candidates.find((candidate) => (0, import_node_fs10.existsSync)(candidate)) || null;
   }
   isThreatCrushModule(value) {
     return Boolean(
@@ -3757,14 +3915,14 @@ function slackChannel(webhookUrl) {
 }
 
 // src/core/cli-config.ts
-var import_node_fs9 = require("fs");
-var import_node_path4 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path6 = require("path");
 var import_node_os2 = require("os");
-var CLI_CONFIG_DIR = (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".threatcrush");
-var CLI_CONFIG_PATH = (0, import_node_path4.join)(CLI_CONFIG_DIR, "config.json");
+var CLI_CONFIG_DIR = (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".threatcrush");
+var CLI_CONFIG_PATH = (0, import_node_path6.join)(CLI_CONFIG_DIR, "config.json");
 function readCliConfig() {
   try {
-    return JSON.parse((0, import_node_fs9.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs11.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -3783,8 +3941,8 @@ function authHeaders() {
 }
 
 // src/commands/scan.ts
-var import_node_fs12 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path10 = require("path");
 
 // ../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -4527,7 +4685,17 @@ var NODE_RULES = [
     // arrangement of nearby lines that makes an echoed origin safe — except a
     // membership test on the value, which is what the guard looks for.
     inherent: true,
-    guard: ORIGIN_ALLOWLIST_GUARD
+    guard: ORIGIN_ALLOWLIST_GUARD,
+    /**
+     * Logging the origin is not reflecting it.
+     *
+     * `origin: request.headers.origin` is the CORS mistake *and* the ordinary
+     * way to record who called — the two are character-for-character
+     * identical, and only what encloses them differs. A response header goes
+     * out to the browser; a log line goes to stdout, where it grants nobody
+     * anything.
+     */
+    enclosingCallGuard: /(?:^|\.)(?:log|debug|info|warn|error|trace|verbose|fatal)$/
   },
   // ── Server-side request forgery ──────────────────────────────────────────
   {
@@ -4776,7 +4944,8 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["javascript", "typescript"],
-    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/
+    pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/,
+    constantInterpolationGuard: true
   },
   {
     id: "py-shell-command-string",
@@ -5675,7 +5844,26 @@ var CODE_RULES = [
     cwe: "CWE-346",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/
+    pattern: /\$\{[^}\n]*\breq(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname|host)\b|['"`]\s*\+\s*req(?:uest)?\s*\.\s*(?:headers\s*\.\s*host|hostname)\b/,
+    /**
+     * Parsing the request's own URL is not building a link from the Host
+     * header, even though it is spelled with one.
+     *
+     *     const url = new URL(request.url, `http://${request.headers.host}`);
+     *     const token = url.searchParams.get('token');
+     *
+     * `request.url` on a Node server is a path — `/ws?token=…` — and `new URL`
+     * refuses a relative input without a base. The base exists to satisfy the
+     * parser and is thrown away; only the path and query are ever read. Every
+     * Node HTTP handler that wants a query parameter is written this way, so
+     * the rule fired on the framework idiom rather than on the defect.
+     *
+     * Narrow on purpose: the first argument must be `req.url` itself. The
+     * dangerous shape passes a *path* the application chose —
+     * `new URL('/reset?t=…', `https://${req.headers.host}`)` — and that is what
+     * produces an attacker-controlled link. It does not match this guard.
+     */
+    lineGuard: /\bnew\s+URL\s*\(\s*(?:req|request|ctx)(?:uest)?\s*\.\s*url\b\s*,/
   },
   // A recursive-merge prototype-pollution rule (`target[key] = source[key]`
   // with no `__proto__` guard) was built and dropped. The bare copy-by-key is
@@ -5743,6 +5931,55 @@ function fileTextOf(lines) {
 function withoutSingleQuoted(text) {
   return text.replace(/'[^'\n]*'/g, "''");
 }
+function calleeEndingAt(text, open) {
+  let end = open;
+  while (end > 0 && (text[end - 1] === " " || text[end - 1] === "	")) end -= 1;
+  let start = end;
+  while (start > 0 && /[\w$.]/.test(text[start - 1])) start -= 1;
+  return text.slice(start, end);
+}
+function enclosingCallees(lines, index, back) {
+  const before = lines.slice(Math.max(0, index - back), index).join("\n");
+  const stack = [];
+  let quote = null;
+  for (let i = 0; i < before.length; i += 1) {
+    const ch = before[i];
+    if (quote) {
+      if (ch === "\\") i += 1;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "(") stack.push(calleeEndingAt(before, i));
+    else if (ch === ")") stack.pop();
+  }
+  return stack;
+}
+function interpolations(line) {
+  const found = [];
+  for (let i = 0; ; ) {
+    const start = line.indexOf("${", i);
+    if (start === -1) break;
+    const end = line.indexOf("}", start + 2);
+    if (end === -1) return null;
+    found.push(line.slice(start + 2, end).trim());
+    i = end + 1;
+  }
+  return found.length > 0 ? found : null;
+}
+function isConstantString(name, fileText) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `\\bconst\\s+${escaped}\\s*(?::[^=\\n]+)?=\\s*(?:'[^'\\n]*'|"[^"\\n]*"|\`[^\`$\\n]*\`)`
+  ).test(fileText);
+}
+function interpolationsAreConstant(line, fileText) {
+  const found = interpolations(line);
+  if (!found) return false;
+  return found.every(
+    (expr) => /^[A-Za-z_$][\w$]*$/.test(expr) && isConstantString(expr, fileText)
+  );
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -5754,6 +5991,13 @@ function evaluateRule(rule, ctx) {
   const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);
   if (rule.requires && !rule.requires.test(context)) return null;
   if (rule.lineGuard?.test(line)) return null;
+  if (rule.enclosingCallGuard) {
+    const callees = enclosingCallees(ctx.lines, ctx.index, back);
+    if (callees.some((callee) => rule.enclosingCallGuard.test(callee))) return null;
+  }
+  if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
@@ -6336,7 +6580,8 @@ var SECRET_RULES = [
     pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_.+/=-]*/,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived."
+    consequence: "Session or service identity until it expires \u2014 and committed tokens are usually long-lived.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-api-key",
@@ -6347,7 +6592,8 @@ var SECRET_RULES = [
     pattern: /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9\-_.]{20,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid."
+    consequence: "Whatever the third-party service lets the key do, for as long as it stays valid.",
+    keywordShaped: true
   },
   {
     id: "secret-generic-credential",
@@ -6355,7 +6601,8 @@ var SECRET_RULES = [
     pattern: /(?:secret|password|passwd|pwd|token)\s*[=:]\s*['"]([^'"\s]{8,})['"]/i,
     severity: "high",
     cwe: "CWE-798",
-    consequence: "A password in source is a password in every clone, fork and CI cache of that source."
+    consequence: "A password in source is a password in every clone, fork and CI cache of that source.",
+    keywordShaped: true
   },
   {
     id: "secret-hex-token",
@@ -6363,7 +6610,8 @@ var SECRET_RULES = [
     pattern: /(?:token|key|secret|auth|signing)\w*\s*[=:]\s*['"]?([0-9a-f]{32,})['"]?/i,
     severity: "medium",
     cwe: "CWE-798",
-    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign."
+    consequence: "Signing secrets and session keys are usually hex; a leaked one forges anything they sign.",
+    keywordShaped: true
   }
 ];
 var KNOWN_PLACEHOLDERS = [
@@ -6394,6 +6642,54 @@ var KNOWN_PLACEHOLDERS = [
 function isKnownPlaceholder(text) {
   return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
 }
+function isVariableReference(value) {
+  const trimmed = value.trim();
+  const braced = /^\$\{\s*([A-Za-z_][\w.]*)\s*(?::?[-=+?]([\s\S]*))?\}$/.exec(trimmed);
+  if (braced) {
+    const fallback = braced[2];
+    if (fallback === void 0 || fallback.trim() === "") return true;
+    return /^\$\{?[A-Za-z_][\w.]*\}?$/.test(fallback.trim());
+  }
+  return /^\$[A-Za-z_]\w*$/.test(trimmed) || // $VAR
+  /^\$\([\s\S]*\)$/.test(trimmed) || // $(command substitution)
+  /^%[A-Za-z_]\w*%$/.test(trimmed) || // %VAR% on Windows
+  /^\{\{[\s\S]*\}\}$/.test(trimmed) || // {{ template }}
+  /^#\{[\s\S]*\}$/.test(trimmed) || // #{ruby}
+  /^<%=?[\s\S]*%>$/.test(trimmed);
+}
+var FIXTURE_STEMS = [
+  "test",
+  "mock",
+  "fake",
+  "dummy",
+  "stub",
+  "sample",
+  "example",
+  "placeholder",
+  "fixture",
+  "invalid",
+  "expired",
+  "forged",
+  "bogus",
+  "notreal",
+  "nonexistent",
+  "changeme",
+  "foobar",
+  "lorem"
+];
+var KEY_NOISE = /* @__PURE__ */ new Set(["const", "this", "return", "await", "async", "expect", "value"]);
+function words(text) {
+  return text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[^A-Za-z]+/g, " ").toLowerCase().split(" ").filter(Boolean);
+}
+function isTestFixtureValue(line, value) {
+  const valueWords = words(value);
+  if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;
+  if (value.length > 48) return false;
+  const valueAt = line.lastIndexOf(value);
+  const key = valueAt === -1 ? line : line.slice(0, valueAt);
+  const flattened = valueWords.join("");
+  return words(key).filter((word) => word.length >= 4 && !KEY_NOISE.has(word)).some((word) => flattened.includes(word));
+}
 function redactSecret(line) {
   return line.replace(/([A-Za-z0-9+/=_.-]{12,})/g, (match) => {
     if (match.length <= 12) return match;
@@ -6612,6 +6908,9 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       if (!match) continue;
       if (isKnownPlaceholder(match[0])) continue;
       if (isSuppressed(suppressions, index, rule.id)) continue;
+      const value = match[1] ?? match[0];
+      if (isVariableReference(value)) continue;
+      if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;
       const marked = foreignCredentialMark(line);
       findings.push({
         ruleId: rule.id,
@@ -6690,8 +6989,8 @@ function scanManifest(relativePath, filename, text) {
 }
 
 // ../../packages/scan/src/node/walk.ts
-var import_node_fs10 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path7 = require("path");
 function compileExcludes(patterns) {
   const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
   if (matchers.length === 0) return () => false;
@@ -6762,7 +7061,7 @@ function matchPrefix(parts, segs) {
 }
 function readIgnoreFile(root) {
   try {
-    return (0, import_node_fs10.readFileSync)((0, import_node_path5.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+    return (0, import_node_fs12.readFileSync)((0, import_node_path7.join)(root, ".threatcrushignore"), "utf-8").split("\n");
   } catch {
     return [];
   }
@@ -6778,16 +7077,16 @@ function scanPath(targetPath, options = {}) {
   let excluded = 0;
   const rootIsDirectory = (() => {
     try {
-      return (0, import_node_fs10.statSync)(targetPath).isDirectory();
+      return (0, import_node_fs12.statSync)(targetPath).isDirectory();
     } catch {
       return true;
     }
   })();
-  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path5.dirname)(targetPath);
+  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path7.dirname)(targetPath);
   const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
-    const extension = (0, import_node_path5.extname)(filename).toLowerCase();
+    const extension = (0, import_node_path7.extname)(filename).toLowerCase();
     const isManifest = filename === "package.json" || filename === "requirements.txt";
     const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith(".env");
     const mayDeclareInterpreter = !scannable && !isManifest && extension === "";
@@ -6799,26 +7098,26 @@ function scanPath(targetPath, options = {}) {
     let handle;
     let declared = null;
     try {
-      handle = (0, import_node_fs10.openSync)(fullPath, "r");
+      handle = (0, import_node_fs12.openSync)(fullPath, "r");
     } catch {
       unreadable.push(relativePath);
       return;
     }
     try {
-      if ((0, import_node_fs10.fstatSync)(handle).size > maxFileBytes) return;
+      if ((0, import_node_fs12.fstatSync)(handle).size > maxFileBytes) return;
       if (mayDeclareInterpreter) {
         const prefix = Buffer.alloc(128);
-        const read = (0, import_node_fs10.readSync)(handle, prefix, 0, prefix.length, 0);
+        const read = (0, import_node_fs12.readSync)(handle, prefix, 0, prefix.length, 0);
         declared = languageOfShebang(prefix.subarray(0, read).toString("utf-8").split("\n", 1)[0] ?? "");
         if (!declared) return;
       }
-      text = (0, import_node_fs10.readFileSync)(handle, "utf-8");
+      text = (0, import_node_fs12.readFileSync)(handle, "utf-8");
     } catch {
       unreadable.push(relativePath);
       return;
     } finally {
       try {
-        (0, import_node_fs10.closeSync)(handle);
+        (0, import_node_fs12.closeSync)(handle);
       } catch {
       }
     }
@@ -6836,13 +7135,13 @@ function scanPath(targetPath, options = {}) {
   const walk = (currentPath) => {
     let entries;
     try {
-      entries = (0, import_node_fs10.readdirSync)(currentPath, { withFileTypes: true });
+      entries = (0, import_node_fs12.readdirSync)(currentPath, { withFileTypes: true });
     } catch {
       unreadable.push(toRelative(walkRoot, currentPath));
       return;
     }
     for (const entry of entries) {
-      const fullPath = (0, import_node_path5.join)(currentPath, entry.name);
+      const fullPath = (0, import_node_path7.join)(currentPath, entry.name);
       const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
@@ -6866,7 +7165,7 @@ function scanPath(targetPath, options = {}) {
   } else if (isExcluded(toRelative(walkRoot, targetPath))) {
     excluded += 1;
   } else {
-    scanFile(targetPath, (0, import_node_path5.basename)(targetPath));
+    scanFile(targetPath, (0, import_node_path7.basename)(targetPath));
   }
   if (options.missingControls) findings.push(...controls.findings());
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
@@ -6898,32 +7197,37 @@ function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   }
 }
 function toRelative(base, target) {
-  const rel = (0, import_node_path5.relative)(base, target);
-  return (rel === "" ? target : rel).split(import_node_path5.sep).join("/");
+  const rel = (0, import_node_path7.relative)(base, target);
+  return (rel === "" ? target : rel).split(import_node_path7.sep).join("/");
 }
 
 // ../../packages/scan/src/node/dependencies.ts
-var import_node_fs11 = require("fs");
-var import_node_path6 = require("path");
-var LOCKFILES = [
-  { file: "package-lock.json", ecosystem: "npm" },
-  { file: "pnpm-lock.yaml", ecosystem: "npm" },
-  { file: "yarn.lock", ecosystem: "npm" },
-  { file: "requirements.txt", ecosystem: "PyPI" },
-  { file: "Pipfile.lock", ecosystem: "PyPI" }
-];
+var import_node_fs13 = require("fs");
+var import_node_path8 = require("path");
 var MAX_DEPS_PER_LOCKFILE = 50;
 async function scanDependencies(targetPath) {
   const findings = [];
-  for (const { file, ecosystem } of LOCKFILES) {
-    const lockPath = (0, import_node_path6.join)(targetPath, file);
-    if (!(0, import_node_fs11.existsSync)(lockPath)) continue;
+  for (const { file, ecosystem, parse } of LOCKFILES) {
+    const lockPath = (0, import_node_path8.join)(targetPath, file);
+    if (!(0, import_node_fs13.existsSync)(lockPath)) continue;
     let deps;
     try {
-      deps = parseDependencies(lockPath, file);
+      deps = dedupe(parse((0, import_node_fs13.readFileSync)(lockPath, "utf-8")));
     } catch {
       continue;
     }
+    if (deps.length === 0) {
+      findings.push(incompleteFinding(file, "No dependencies could be read from this lockfile."));
+      continue;
+    }
+    if (deps.length > MAX_DEPS_PER_LOCKFILE) {
+      findings.push(
+        incompleteFinding(
+          file,
+          `Only the first ${MAX_DEPS_PER_LOCKFILE} of ${deps.length} locked packages were checked against OSV.`
+        )
+      );
+    }
     for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
       let vulns;
       try {
@@ -6950,6 +7254,20 @@ async function scanDependencies(targetPath) {
   }
   return findings;
 }
+function incompleteFinding(file, message) {
+  return {
+    ruleId: "dependency-scan-incomplete",
+    title: "Dependency scan incomplete",
+    file,
+    line: 1,
+    severity: "low",
+    confidence: "evidence",
+    message,
+    consequence: "Advisories affecting the unchecked packages would not appear in this report.",
+    excerpt: file,
+    category: "dependency"
+  };
+}
 function severityFromCvss(score) {
   if (!score) return "medium";
   const value = Number.parseFloat(score);
@@ -6959,26 +7277,131 @@ function severityFromCvss(score) {
   if (value >= 4) return "medium";
   return "low";
 }
-function parseDependencies(lockPath, filename) {
+function dedupe(deps) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const dep of deps) {
+    const key = `${dep.name}@${dep.version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(dep);
+  }
+  return unique;
+}
+function splitNameVersion(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return null;
+  const name = spec.slice(0, at);
+  const version = spec.slice(at + 1);
+  if (!name || !version) return null;
+  return { name, version };
+}
+function exactVersion(raw) {
+  const version = raw.trim().replace(/^[=v]+/, "");
+  return /^[0-9][0-9a-zA-Z.+-]*$/.test(version) ? version : null;
+}
+function parsePackageLock(content) {
+  const lock = JSON.parse(content);
+  const packages = lock.packages ?? lock.dependencies ?? {};
+  const deps = [];
+  for (const [key, value] of Object.entries(packages)) {
+    const name = key.replace(/^.*node_modules\//, "");
+    const version = value?.version;
+    if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  }
+  return deps;
+}
+function parsePnpmLock(content) {
   const deps = [];
-  if (filename === "package-lock.json") {
-    const lock = JSON.parse((0, import_node_fs11.readFileSync)(lockPath, "utf-8"));
-    const packages = lock.packages ?? lock.dependencies ?? {};
-    for (const [key, value] of Object.entries(packages)) {
-      const name = key.replace(/^node_modules\//, "");
-      const version = value?.version;
-      if (name && version && !name.startsWith(".")) deps.push({ name, version });
+  let inPackages = false;
+  for (const line of content.split("\n")) {
+    if (/^[a-zA-Z]/.test(line)) {
+      inPackages = line.startsWith("packages:");
+      continue;
+    }
+    if (!inPackages) continue;
+    const match = /^ {2}(?! )(.+):\s*$/.exec(line);
+    if (!match?.[1]) continue;
+    let key = match[1].trim().replace(/^['"]|['"]$/g, "");
+    key = key.replace(/^\//, "");
+    key = key.replace(/\(.*$/, "");
+    let name;
+    let rawVersion;
+    const slashed = /^(@?[^@]+)\/([0-9][^/]*)$/.exec(key);
+    if (slashed?.[1] && slashed[2]) {
+      name = slashed[1];
+      rawVersion = slashed[2];
+    } else {
+      const dep = splitNameVersion(key);
+      if (!dep) continue;
+      name = dep.name;
+      rawVersion = dep.version;
     }
-    return deps;
+    const version = exactVersion(rawVersion.replace(/_.*$/, ""));
+    if (version) deps.push({ name, version });
   }
-  if (filename === "requirements.txt") {
-    for (const line of (0, import_node_fs11.readFileSync)(lockPath, "utf-8").split("\n")) {
-      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
-      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
+  return deps;
+}
+function parseYarnLock(content) {
+  const deps = [];
+  let pendingName = null;
+  for (const line of content.split("\n")) {
+    if (line.startsWith("#") || line.trim() === "") continue;
+    if (!/^\s/.test(line)) {
+      pendingName = null;
+      const header = line.replace(/:\s*$/, "");
+      const first = header.split(",")[0]?.trim().replace(/^['"]|['"]$/g, "");
+      if (!first) continue;
+      if (!first.includes("@") || first === "__metadata") continue;
+      if (/@(?:workspace|file|link|portal|exec|patch):/.test(first)) continue;
+      const dep = splitNameVersion(first.replace(/@npm:/, "@"));
+      if (dep) pendingName = dep.name;
+      continue;
     }
+    if (!pendingName) continue;
+    const version = /^\s+version:?\s+["']?([^"'\s]+)["']?\s*$/.exec(line);
+    if (!version?.[1]) continue;
+    const exact = exactVersion(version[1]);
+    if (exact) deps.push({ name: pendingName, version: exact });
+    pendingName = null;
   }
   return deps;
 }
+function parsePipfileLock(content) {
+  const lock = JSON.parse(content);
+  const deps = [];
+  for (const section of ["default", "develop"]) {
+    const packages = lock[section];
+    if (!packages || typeof packages !== "object") continue;
+    for (const [name, value] of Object.entries(packages)) {
+      const version = exactVersion(String(value?.version ?? "").replace(/^==/, ""));
+      if (name && version) deps.push({ name, version });
+    }
+  }
+  return deps;
+}
+function parseRequirementsTxt(content) {
+  const deps = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.split("#")[0]?.split(";")[0]?.trim();
+    if (!line || line.startsWith("-")) continue;
+    const match = /^([a-zA-Z0-9._-]+)\s*(?:\[[^\]]*\])?\s*==\s*([^\s,]+)/.exec(line);
+    if (!match?.[1] || !match[2]) continue;
+    const version = exactVersion(match[2]);
+    if (version) deps.push({ name: match[1], version });
+  }
+  return deps;
+}
+var LOCKFILES = [
+  { file: "package-lock.json", ecosystem: "npm", parse: parsePackageLock },
+  { file: "pnpm-lock.yaml", ecosystem: "npm", parse: parsePnpmLock },
+  { file: "yarn.lock", ecosystem: "npm", parse: parseYarnLock },
+  { file: "requirements.txt", ecosystem: "PyPI", parse: parseRequirementsTxt },
+  { file: "Pipfile.lock", ecosystem: "PyPI", parse: parsePipfileLock }
+];
+var LOCKFILE_PARSERS = Object.fromEntries(
+  LOCKFILES.map((entry) => [entry.file, entry.parse])
+);
 function isValidPackageName(name) {
   return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
 }
@@ -7003,17 +7426,17 @@ async function queryOsv(name, version, ecosystem) {
 }
 
 // ../../packages/scan/src/node/sarif.ts
-var import_node_crypto = require("crypto");
-var import_node_path7 = require("path");
+var import_node_crypto3 = require("crypto");
+var import_node_path9 = require("path");
 
 // src/commands/scan.ts
 function readVersion() {
   for (const candidate of [
-    (0, import_node_path8.join)(__dirname, "..", "package.json"),
-    (0, import_node_path8.join)(__dirname, "..", "..", "package.json")
+    (0, import_node_path10.join)(__dirname, "..", "package.json"),
+    (0, import_node_path10.join)(__dirname, "..", "..", "package.json")
   ]) {
     try {
-      return JSON.parse((0, import_node_fs12.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
+      return JSON.parse((0, import_node_fs14.readFileSync)(candidate, "utf-8")).version ?? "0.0.0";
     } catch {
     }
   }
@@ -7474,8 +7897,8 @@ var RuleEngine = class {
 };
 
 // src/daemon/rules/loader.ts
-var import_node_fs13 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path11 = require("path");
 
 // src/daemon/rules/default-rules.ts
 var DEFAULT_RULES = [
@@ -7759,11 +8182,11 @@ var RULES_DIR = "/etc/threatcrush/rules.d";
 function loadAllRules(customDir) {
   const rules = [...DEFAULT_RULES];
   const dir = customDir || RULES_DIR;
-  if ((0, import_node_fs13.existsSync)(dir)) {
-    const files = (0, import_node_fs13.readdirSync)(dir).filter((f) => f.endsWith(".json"));
+  if ((0, import_node_fs15.existsSync)(dir)) {
+    const files = (0, import_node_fs15.readdirSync)(dir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
       try {
-        const raw = (0, import_node_fs13.readFileSync)((0, import_node_path9.join)(dir, file), "utf-8");
+        const raw = (0, import_node_fs15.readFileSync)((0, import_node_path11.join)(dir, file), "utf-8");
         const parsed = JSON.parse(raw);
         const customRules = Array.isArray(parsed) ? parsed : [parsed];
         for (const rule of customRules) {
@@ -7926,7 +8349,7 @@ function detectFirewallAdapter() {
 }
 
 // src/daemon/firewall/remediation.ts
-var import_node_fs14 = require("fs");
+var import_node_fs16 = require("fs");
 var DEFAULT_CONFIG2 = {
   enabled: true,
   dry_run: true,
@@ -8081,7 +8504,7 @@ var RemediationManager = class {
   }
   logLine(line) {
     try {
-      (0, import_node_fs14.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      (0, import_node_fs16.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     } catch {
     }
@@ -8137,7 +8560,7 @@ async function flushTelemetry(timeoutMs = 2e3) {
 // src/daemon/index.ts
 function readVersion2() {
   try {
-    const pkg = JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path10.join)(__dirname, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path12.join)(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -8145,7 +8568,7 @@ function readVersion2() {
 }
 function logLine(line) {
   try {
-    (0, import_node_fs15.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+    (0, import_node_fs17.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
   } catch {
   }
@@ -8173,7 +8596,7 @@ async function runDaemon() {
   } catch (err) {
     logLine(`[daemon] state db unavailable: ${err.message}`);
   }
-  const config = loadConfig((0, import_node_fs15.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
+  const config = loadConfig((0, import_node_fs17.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
   bus.on("event", (event) => {
     logLine(`[event] ${event.severity} ${event.module} ${event.message}`);
   });